feat: public-repo hygiene baseline (goal 0028) - #15
Merged
Conversation
README/SECURITY/CONTRIBUTING/issue-template/Scorecard workflow +
golangci-lint strengthening (gosec/bodyclose/noctx/revive/unparam,
fully triaged) + dependency-review deny-licenses + elkjs EPL-2.0
verdict, closing the real community-profile/security gaps a public
repo needs without ceremony (research delivered prior session:
community-profile score 28%, exposure sweep clean, LICENSE already
correct).
- README: full rewrite from the Wails scaffold -- what Mill actually
is (SPEC §1's thesis, no vendor names), honest pre-1.0 status, and
an install story that actually works for a stranger (adds the
Go/Node/Task/Wails3-CLI prerequisites CLAUDE.md's own commands
assume but never state). CI + new Scorecard badges.
- SECURITY.md: GitHub private vulnerability reporting enabled live
(verified `{"enabled":true}`) as the report channel, an honest
scope paragraph (guardrailed command execution, keychain secrets,
the loopback-only unauthenticated MCP listener), pre-1.0
rolling-main support note.
- CONTRIBUTING.md + one bug-report issue template (reuses the
build-identity badge value as the version field). .ls-lint.yml's
root allowlist extended for SECURITY/CONTRIBUTING with a comment.
- .github/workflows/scorecard.yml from the official ossf/scorecard
template, action SHAs verified live against upstream tags (not
assumed), matching this repo's existing pinning style.
- .golangci.yml: gosec/bodyclose/noctx/revive/unparam enabled and
triaged to zero findings on both the `server` and desktop build-tag
variants. One real bug found and fixed along the way:
mcpserving.Serve's http.Server had no ReadHeaderTimeout, a genuine
Slowloris exposure even on a loopback listener. Every gosec
suppression carries an inline justification, never blanket #nosec.
revive's exported/package-comments rules disabled with a recorded
reason (this repo has never doc-commented every exported symbol;
enforcing it retroactively is ceremony, not a real finding). Second
pass (gocritic/prealloc/contextcheck/sqlclosecheck) explicitly named
as future work in the goal file, not attempted here.
- ci.yml: dependency-review-action gains deny-licenses for the
GPL/AGPL family (Apache-2.0, Mill's own license, is incompatible
with copyleft terms).
- docs/SPEC.md §3: elkjs's EPL-2.0-vs-Apache-2.0 verdict recorded
where SPEC already flagged it -- unmodified dependency, its own
dynamic-import bundle chunk, no conflict.
- De-literalized the two /Users/ali paths (test-investigator.md,
launchatlogin_desktop_test.go).
Full local suite green (lint/vet/build/test, both build-tag variants,
frontend static, e2e) -- 4 known-flaky e2e specs (canvas-click/
resizable-table/live-run-state/activity-row timing) reproduced as
pass-on-retry in isolation, unrelated to any file this goal touched.
Goal 0028 delivered and archived; BACKLOG updated.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FYwojT8GdUbYSoggbvEFft
alicoding
enabled auto-merge (squash)
August 12, 2026 06:23
alicoding
added a commit
that referenced
this pull request
Aug 15, 2026
README/SECURITY/CONTRIBUTING/issue-template/Scorecard workflow +
golangci-lint strengthening (gosec/bodyclose/noctx/revive/unparam,
fully triaged) + dependency-review deny-licenses + elkjs EPL-2.0
verdict, closing the real community-profile/security gaps a public
repo needs without ceremony (research delivered prior session:
community-profile score 28%, exposure sweep clean, LICENSE already
correct).
- README: full rewrite from the Wails scaffold -- what Mill actually
is (SPEC §1's thesis, no vendor names), honest pre-1.0 status, and
an install story that actually works for a stranger (adds the
Go/Node/Task/Wails3-CLI prerequisites CLAUDE.md's own commands
assume but never state). CI + new Scorecard badges.
- SECURITY.md: GitHub private vulnerability reporting enabled live
(verified `{"enabled":true}`) as the report channel, an honest
scope paragraph (guardrailed command execution, keychain secrets,
the loopback-only unauthenticated MCP listener), pre-1.0
rolling-main support note.
- CONTRIBUTING.md + one bug-report issue template (reuses the
build-identity badge value as the version field). .ls-lint.yml's
root allowlist extended for SECURITY/CONTRIBUTING with a comment.
- .github/workflows/scorecard.yml from the official ossf/scorecard
template, action SHAs verified live against upstream tags (not
assumed), matching this repo's existing pinning style.
- .golangci.yml: gosec/bodyclose/noctx/revive/unparam enabled and
triaged to zero findings on both the `server` and desktop build-tag
variants. One real bug found and fixed along the way:
mcpserving.Serve's http.Server had no ReadHeaderTimeout, a genuine
Slowloris exposure even on a loopback listener. Every gosec
suppression carries an inline justification, never blanket #nosec.
revive's exported/package-comments rules disabled with a recorded
reason (this repo has never doc-commented every exported symbol;
enforcing it retroactively is ceremony, not a real finding). Second
pass (gocritic/prealloc/contextcheck/sqlclosecheck) explicitly named
as future work in the goal file, not attempted here.
- ci.yml: dependency-review-action gains deny-licenses for the
GPL/AGPL family (Apache-2.0, Mill's own license, is incompatible
with copyleft terms).
- docs/SPEC.md §3: elkjs's EPL-2.0-vs-Apache-2.0 verdict recorded
where SPEC already flagged it -- unmodified dependency, its own
dynamic-import bundle chunk, no conflict.
- De-literalized the two /Users/ali paths (test-investigator.md,
launchatlogin_desktop_test.go).
Full local suite green (lint/vet/build/test, both build-tag variants,
frontend static, e2e) -- 4 known-flaky e2e specs (canvas-click/
resizable-table/live-run-state/activity-row timing) reproduced as
pass-on-retry in isolation, unrelated to any file this goal touched.
Goal 0028 delivered and archived; BACKLOG updated.
Claude-Session: https://claude.ai/code/session_01FYwojT8GdUbYSoggbvEFft
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mcpserving.Serve'shttp.Serverhad noReadHeaderTimeout, a genuine Slowloris exposure). Every gosec suppression carries an inline justification, never a blanket#nosec.ci.yml's dependency-review step now denies GPL/AGPL-family licenses.docs/SPEC.md§3 records the elkjs EPL-2.0-vs-Apache-2.0 verdict it previously only flagged./Users/alipaths de-literalized.See
docs/goals/archive/0028-public-repo-hygiene.mdfor the full per-item breakdown and acceptance check.Test plan
CGO_ENABLED=0 go test -tags server -count=1 -timeout 600s ./internal/... .— all passgolangci-lint run— 0 issues on both--build-tags=serverand desktop build-tag variantstsc --noEmit,npm run lint,npm run boundaries) — clean{"enabled":true}Co-Authored-By: Claude Fable 5 noreply@anthropic.com
https://claude.ai/code/session_01FYwojT8GdUbYSoggbvEFft