Add open-source readiness infrastructure and documentation - #143
Merged
Conversation
The pre-resolve and post-resolve hook subsystem had no production implementations, was never registered in the builder, exposed no plugin kind, and was not surfaced in the CLI, MCP, config, or docs. Only test doubles exercised it, so it executed as a no-op on every run. Remove the internal/engine/hooks package, the registry registration and accessor methods, the pipeline runPre/runPost stages and context helpers, the diff and explain call sites, and the hook tests. Update the pipeline-order descriptions and package trees in CLAUDE.md, AGENTS.md, and docs/ARCHITECTURE.md accordingly. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Scrub "currently private" caveats from docs/CI.md and the release workflow now that the repository is public. Add community health files (issue templates, pull request template, CODEOWNERS), a Bomly CLI SVG wordmark, and a README badge row (CI, release, license, Go Reference, Go Report Card). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Now that the repository is public, enable the security and quality automation that was previously unavailable: - CodeQL static analysis for Go (PR, push to main, weekly). - OpenSSF Scorecard supply-chain checks with published results, plus a Scorecard badge in the README. - GitHub dependency-review on PRs, failing on high-severity additions. - CodeRabbit configuration that skips generated docs, schemas, and golden fixtures. Document the new workflows in docs/CI.md alongside the existing Bomly Review workflow. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Generate per-auditor reference pages (vulnerability, license, package) by extending the component-docs generator with an auditors writer and hand-written prose, mirroring the existing matcher pages. Link them from the auditors overview and the docs index. Add docs/USE_CASES.md with task-oriented recipes (PR gate, SBOM, reachability triage, license policy, typosquats, offline scan, release diff). Foreground Bomly's extensibility in the README and docs/ARCHITECTURE.md with a plug-in pipeline diagram and the four typed extension points, and reference the Bomly review action from the README and docs/CI_INTEGRATION.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Replace the off-brand cyan cube wordmark with a lockup built from the Bomly favicon: the amber (#E89B5C) terminal-prompt tile plus "Bomly CLI" set in JetBrains Mono, the landing page's mono typeface. The wordmark ink adapts to light/dark via prefers-color-scheme so it reads on both GitHub themes. Adjust the README logo width for the new aspect ratio. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
Bomly Diff SummaryCompared Overview
Dependency ChangesSummary: 11 added, 0 changed, 0 removed. Added Dependencies
Vulnerabilities✅ No vulnerability changes. License Changes✅ No license changes. Project Posture✅ No project posture changes (or Policy FindingsSummary: 9 introduced, 0 persisted, 0 resolved. Introduced Findings
|
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Contributor
📝 WalkthroughWalkthroughThis PR consolidates engine infrastructure cleanup, auditor documentation generation, and repository governance into a single delivery. The resolve-stage hook lifecycle is removed from the pipeline and registry; auditor reference pages are generated from prose sources and integrated into docs; and governance policies, CI workflows, and community documentation are established across the repository. ChangesEngine hook lifecycle removal
Auditor documentation generation and publication
Repository governance, CI workflows, and documentation
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Collaborator
Author
|
@coderabbitai review |
Contributor
✅ Action performedReview finished.
|
Add CODE_OF_CONDUCT.md (Contributor Covenant 3.0, verbatim) with the reporting channel set to contact@bomly.dev, and link the Code of Conduct and Security Policy from CONTRIBUTING.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
.github/workflows/dependency-review.yml (1)
20-21: ⚡ Quick winConsider disabling credential persistence for defense-in-depth.
The checkout action does not set
persist-credentials: false. Explicitly disabling credential persistence prevents theGITHUB_TOKENfrom being available to subsequent steps, reducing the attack surface.🔒 Proposed fix
- name: Check out repository uses: actions/checkout@v5 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/dependency-review.yml around lines 20 - 21, The checkout step currently uses actions/checkout@v5 without disabling credential persistence; update the "Check out repository" step (uses: actions/checkout@v5) to include persist-credentials: false so the GITHUB_TOKEN is not carried to later steps — add the persist-credentials: false property under that step to explicitly disable credential persistence..github/workflows/codeql.yml (1)
29-30: ⚡ Quick winConsider disabling credential persistence for defense-in-depth.
The checkout action does not set
persist-credentials: false. While not critical for this read-only analysis workflow, explicitly disabling credential persistence prevents theGITHUB_TOKENfrom being available to subsequent steps, reducing the attack surface if a compromised action or script runs later in the job.🔒 Proposed fix
- name: Check out repository uses: actions/checkout@v5 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/codeql.yml around lines 29 - 30, Update the GitHub Actions checkout step (the step that uses actions/checkout@v5) to explicitly disable credential persistence by adding persist-credentials: false to that step; locate the checkout step in .github/workflows/codeql.yml and add the persist-credentials: false key under the step that has "name: Check out repository" / "uses: actions/checkout@v5" so the GITHUB_TOKEN is not persisted to later steps.internal/support/generate_test.go (1)
105-106: ⚡ Quick winConsider checking all built-in auditor docs for completeness.
The test currently verifies
auditors/README.mdandauditors/vulnerability.md, but the component docs generator defines three built-in auditors: vulnerability, license, and package. Since there are only three auditors total, consider addingauditors/license.mdandauditors/package.mdto the test expectations to ensure all generated documentation is present and the prose files are correctly embedded.📋 Suggested test expectations
filepath.Join(tmp, "auditors", "README.md"), filepath.Join(tmp, "auditors", "vulnerability.md"), + filepath.Join(tmp, "auditors", "license.md"), + filepath.Join(tmp, "auditors", "package.md"), } {🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/support/generate_test.go` around lines 105 - 106, The test in generate_test.go currently expects auditors/README.md and auditors/vulnerability.md only; update the expected files slice (the filepath.Join(tmp, "auditors", "...") entries) to also include "auditors/license.md" and "auditors/package.md" so all three built-in auditors (vulnerability, license, package) are asserted; ensure any length or existence checks (e.g., len(expected) assertions) are updated to match the new entries.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@AGENTS.md`:
- Line 56: Update the documented scan pipeline string so it includes the
optional analyze stage between match and audit: change the sequence
"runtimePreparation → subprojectDiscovery → detect (per-package-manager chains)
→ scopeFilter → consolidate → match (license enrichment on the consolidated
graph) → audit → format" to insert "analyze (optional, when enabled)" after
"match" to match the actual engine pipeline in internal/engine/pipeline.go and
the behavior described in CLAUDE.md; ensure the exact pipeline text containing
"match (license enrichment on the consolidated graph)" is edited to include the
"analyze" stage so contributors see the correct ordering.
---
Nitpick comments:
In @.github/workflows/codeql.yml:
- Around line 29-30: Update the GitHub Actions checkout step (the step that uses
actions/checkout@v5) to explicitly disable credential persistence by adding
persist-credentials: false to that step; locate the checkout step in
.github/workflows/codeql.yml and add the persist-credentials: false key under
the step that has "name: Check out repository" / "uses: actions/checkout@v5" so
the GITHUB_TOKEN is not persisted to later steps.
In @.github/workflows/dependency-review.yml:
- Around line 20-21: The checkout step currently uses actions/checkout@v5
without disabling credential persistence; update the "Check out repository" step
(uses: actions/checkout@v5) to include persist-credentials: false so the
GITHUB_TOKEN is not carried to later steps — add the persist-credentials: false
property under that step to explicitly disable credential persistence.
In `@internal/support/generate_test.go`:
- Around line 105-106: The test in generate_test.go currently expects
auditors/README.md and auditors/vulnerability.md only; update the expected files
slice (the filepath.Join(tmp, "auditors", "...") entries) to also include
"auditors/license.md" and "auditors/package.md" so all three built-in auditors
(vulnerability, license, package) are asserted; ensure any length or existence
checks (e.g., len(expected) assertions) are updated to match the new entries.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 21928cab-ff95-411e-be5e-c660f75f297e
⛔ Files ignored due to path filters (1)
assets/bomly-cli-wordmark.svgis excluded by!**/*.svg
📒 Files selected for processing (39)
.coderabbit.yaml.github/CODEOWNERS.github/ISSUE_TEMPLATE/bug_report.yml.github/ISSUE_TEMPLATE/config.yml.github/ISSUE_TEMPLATE/feature_request.yml.github/PULL_REQUEST_TEMPLATE.md.github/workflows/codeql.yml.github/workflows/dependency-review.yml.github/workflows/release.yml.github/workflows/scorecard.yml.gitignoreAGENTS.mdCLAUDE.mdCODE_OF_CONDUCT.mdCONTRIBUTING.mdREADME.mdSECURITY.mddocs/ARCHITECTURE.mddocs/AUDITORS.mddocs/CI.mddocs/CI_INTEGRATION.mddocs/README.mddocs/USE_CASES.mddocs/auditors/README.mddocs/auditors/license.mddocs/auditors/package.mddocs/auditors/vulnerability.mdinternal/engine/diff/diff.gointernal/engine/hooks/hooks.gointernal/engine/pipeline.gointernal/engine/pipeline_explain.gointernal/engine/pipeline_test.gointernal/engine/registry.gointernal/engine/types.gointernal/support/component_docs.gointernal/support/generate_test.gointernal/support/prose/auditors/license.mdinternal/support/prose/auditors/package.mdinternal/support/prose/auditors/vulnerability.md
💤 Files with no reviewable changes (5)
- internal/engine/hooks/hooks.go
- internal/engine/diff/diff.go
- internal/engine/pipeline_explain.go
- internal/engine/types.go
- internal/engine/pipeline_test.go
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
bomly-guy
changed the title
bomly-guy
changed the title
The LICENSE was a reworded paraphrase of Apache-2.0 (the definitions of
"Work", "Contribution", and "Contributor" and the patent-termination
clause were all altered). GitHub's licensee therefore classified it as
NOASSERTION ("Other") and pkg.go.dev withheld documentation under
"license restrictions".
Replace it with the verbatim Apache License 2.0 text, with only the
appendix copyright filled in (Copyright 2026 bomly.dev), so the license
is correctly detected as Apache-2.0.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Consolidation is the tail of detection, not a separate pipeline stage: it merges the per-subproject graphs the detectors produced into the single graph and package registry the rest of the pipeline consumes, and it has no progress stage of its own. Introduce runDetect (= runResolve + runConsolidate) and call it from the scan and explain pipelines instead of invoking the two steps separately. Update the pipeline-order descriptions in CLAUDE.md and AGENTS.md and the Scan Pipeline diagram/stage list in docs/ARCHITECTURE.md to present detection as resolve + consolidate. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Document --typosquat-mode values (warn default, fail) and the 0.90 threshold default in the package auditor, correcting the earlier "comparison mode" description, and add a Diff & baselines section explaining how the base graph seeds the protected-name set. - Add a "Configure with a YAML file" section to the auditors overview showing the policy.* block, file locations, and load-order precedence, and add the YAML key beside each flag in every per-auditor page. - Link the public plugin example repos from the matcher and auditor overviews (eol, clearlydefined, meme). Regenerated docs/AUDITORS.md, docs/MATCHERS.md, and docs/auditors/*. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Use the single slogan "Analyze Your Software DNA." in the README, matching the CLI startup logo. - Correct the extensibility story: detector, matcher, and auditor are pluggable today; analyzers are built-in only and external analyzer plugins are planned. Update the README "Extensible by design" section and docs/ARCHITECTURE.md, reusing one extensibility diagram (now including configure-runtime and index-subprojects nodes, with consolidation folded into detect). - Expand docs/USE_CASES.md container coverage: scan/audit an image, generate an SBOM from an image, a CI base-image gate, and diffing two image tags. - Move docs/CI.md to docs/development/CI.md (contributor docs) and update all inbound links. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Split the single validate job into independent, parallel jobs (lint, test, build, format, modules, generated-docs) so checks run concurrently and report separately, and rename the workflow from "CI" to "Build & Test". Update docs/development/CI.md to match. Note: the required status-check names change from a single "CI" to the per-job names, so branch protection on main must be updated accordingly. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (5)
internal/support/prose/auditors/package.md (1)
45-46: 💤 Low valueOptional: Consider rephrasing "Outside of" to "Outside".
The static analysis tool suggests "Outside of
diff" could be simplified to "Outsidediff", though "Outside of" is grammatically correct and commonly used. This is purely stylistic.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/support/prose/auditors/package.md` around lines 45 - 46, Change the phrasing "Outside of `diff`" to "Outside `diff`" in the package documentation to follow the suggested stylistic simplification; update the sentence in the auditors package markdown where the bullet reads "**Protected lists are explicit.** Outside of `diff`, Bomly only checks..." so it instead reads "**Protected lists are explicit.** Outside `diff`, Bomly only checks..." leaving the rest of the sentence and the `--protected-package` reference unchanged..github/workflows/ci.yml (2)
21-22: ⚡ Quick winConsider setting
persist-credentials: falsefor security hardening.The
actions/checkoutaction defaults to persisting credentials, which could enable credential exposure through artifacts or subsequent steps. Settingpersist-credentials: falseprevents the GITHUB_TOKEN from being accessible to later workflow steps.🔒 Proposed fix
Apply to all six checkout steps:
- name: Check out repository uses: actions/checkout@v5 + with: + persist-credentials: falseAlso applies to: 38-39, 53-54, 70-71, 85-86, 104-105
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 21 - 22, Update each checkout step that uses "actions/checkout@v5" (the steps named "Check out repository") to add the persist-credentials: false input so the GITHUB_TOKEN is not persisted to subsequent steps; locate every occurrence of the step (the ones around the uses: actions/checkout@v5 lines noted in the comment) and add the single-line input persist-credentials: false under that step for all listed occurrences.Source: Linters/SAST tools
28-28: 💤 Low valueRemove redundant
cache-dependency-pathparameter.When
go-version-file: go.modis specified, theactions/setup-goaction already infersgo.sumas the cache dependency path. Explicitly settingcache-dependency-path: go.sumis redundant.♻️ Simplify setup-go configuration
Apply to all six jobs:
- name: Set up Go uses: actions/setup-go@v6 with: go-version-file: go.mod cache: true - cache-dependency-path: go.sumAlso applies to: 45-45, 60-60, 77-77, 92-92, 111-111
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml at line 28, Remove the redundant cache-dependency-path: go.sum entries from the actions/setup-go steps: when go-version-file: go.mod is already set, actions/setup-go infers go.sum automatically, so delete the cache-dependency-path: go.sum parameter (remove that key/value from each setup-go step where go-version-file: go.mod is present) to simplify the workflow without changing behavior.docs/ARCHITECTURE.md (2)
76-102: ⚡ Quick winConsider adding a decision-log entry for the extensibility model.
The new "Extensibility" section introduces significant architectural choices about plugin contracts, runtime integration, and the typed extension point model. As per coding guidelines, "add a decision-log entry for non-obvious design choices" in
docs/ARCHITECTURE.md.Consider adding a decision-log entry documenting:
- Why every built-in implements the same contract as external plugins
- Why plugins are disabled until explicitly enabled
- Why analyzers are planned rather than available as plugins today
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ARCHITECTURE.md` around lines 76 - 102, Add a new decision-log entry describing the extensibility model referenced in the Extensibility section: explain the rationale for treating every built-in as implementing the same contract as external plugins (referencing sdk.Detector, sdk.Matcher, sdk.Auditor and planned sdk.Analyzer), document the security/operational choice to disable plugins until explicitly enabled, and capture why analyzers are currently "planned" rather than pluggable (runtime/plugin-kind limitation and migration plan). Link or reference the existing PLUGINS.md trust/authoring details and include intended future work and decision timestamp/owner metadata.Source: Coding guidelines
197-197: Docs: CI link is valid; plugin status wording matches Extensibility; consider adding a decision-log entry for the plugin model
docs/ARCHITECTURE.mdline 197 correctly links todocs/development/CI.md, and that file contains the expected “CI and Release Pipeline” workflow documentation.- “Extensibility” plugin statuses are consistent with the table (Detector/Matcher/Auditor: Available; Analyzer: Planned) and the stated analyzer load limitation.
- Add a
### Decision:/ decision-log entry for the extensibility/plugin model (none appears tied specifically to that new section), if it’s intended as a non-obvious architectural choice.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ARCHITECTURE.md` at line 197, Add a decision-log entry to the ARCHITECTURE.md "Extensibility"/plugin model section by inserting a "### Decision:" subsection that documents the architectural choice for the plugin model, the supported plugin types (Detector, Matcher, Auditor marked as Available; Analyzer marked as Planned), and the analyzer load limitation (single analyzer per run) along with a brief rationale and intended future work; update the section that mentions CI/linking only by referencing this new decision entry so readers can find the rationale and status of the plugin model.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 21-22: Update each checkout step that uses "actions/checkout@v5"
(the steps named "Check out repository") to add the persist-credentials: false
input so the GITHUB_TOKEN is not persisted to subsequent steps; locate every
occurrence of the step (the ones around the uses: actions/checkout@v5 lines
noted in the comment) and add the single-line input persist-credentials: false
under that step for all listed occurrences.
- Line 28: Remove the redundant cache-dependency-path: go.sum entries from the
actions/setup-go steps: when go-version-file: go.mod is already set,
actions/setup-go infers go.sum automatically, so delete the
cache-dependency-path: go.sum parameter (remove that key/value from each
setup-go step where go-version-file: go.mod is present) to simplify the workflow
without changing behavior.
In `@docs/ARCHITECTURE.md`:
- Around line 76-102: Add a new decision-log entry describing the extensibility
model referenced in the Extensibility section: explain the rationale for
treating every built-in as implementing the same contract as external plugins
(referencing sdk.Detector, sdk.Matcher, sdk.Auditor and planned sdk.Analyzer),
document the security/operational choice to disable plugins until explicitly
enabled, and capture why analyzers are currently "planned" rather than pluggable
(runtime/plugin-kind limitation and migration plan). Link or reference the
existing PLUGINS.md trust/authoring details and include intended future work and
decision timestamp/owner metadata.
- Line 197: Add a decision-log entry to the ARCHITECTURE.md
"Extensibility"/plugin model section by inserting a "### Decision:" subsection
that documents the architectural choice for the plugin model, the supported
plugin types (Detector, Matcher, Auditor marked as Available; Analyzer marked as
Planned), and the analyzer load limitation (single analyzer per run) along with
a brief rationale and intended future work; update the section that mentions
CI/linking only by referencing this new decision entry so readers can find the
rationale and status of the plugin model.
In `@internal/support/prose/auditors/package.md`:
- Around line 45-46: Change the phrasing "Outside of `diff`" to "Outside `diff`"
in the package documentation to follow the suggested stylistic simplification;
update the sentence in the auditors package markdown where the bullet reads
"**Protected lists are explicit.** Outside of `diff`, Bomly only checks..." so
it instead reads "**Protected lists are explicit.** Outside `diff`, Bomly only
checks..." leaving the rest of the sentence and the `--protected-package`
reference unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 984a6e3b-df5b-4103-a476-3fd1f32fdc3d
📒 Files selected for processing (22)
.github/workflows/ci.ymlAGENTS.mdCLAUDE.mdCONTRIBUTING.mdLICENSEREADME.mddocs/ARCHITECTURE.mddocs/AUDITORS.mddocs/CI_INTEGRATION.mddocs/MATCHERS.mddocs/README.mddocs/USE_CASES.mddocs/auditors/license.mddocs/auditors/package.mddocs/auditors/vulnerability.mddocs/development/CI.mdinternal/engine/pipeline.gointernal/engine/pipeline_explain.gointernal/support/component_docs.gointernal/support/prose/auditors/license.mdinternal/support/prose/auditors/package.mdinternal/support/prose/auditors/vulnerability.md
✅ Files skipped from review due to trivial changes (11)
- internal/support/prose/auditors/license.md
- AGENTS.md
- internal/support/prose/auditors/vulnerability.md
- docs/MATCHERS.md
- docs/auditors/vulnerability.md
- docs/development/CI.md
- docs/CI_INTEGRATION.md
- docs/auditors/license.md
- CLAUDE.md
- README.md
- docs/USE_CASES.md
🚧 Files skipped from review as they are similar to previous changes (3)
- docs/README.md
- internal/engine/pipeline_explain.go
- internal/engine/pipeline.go
bomly-guy
enabled auto-merge (squash)
June 11, 2026 08:30
bomly-guy
disabled auto-merge
June 11, 2026 08:30
This was referenced Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces a comprehensive set of repository hygiene and community standards files, along with several documentation improvements and workflow enhancements. The changes establish clear contribution guidelines, issue and pull request templates, code ownership, security policy, and automated review/security workflows. These updates are foundational for open source best practices and help streamline contributions, improve security posture, and clarify project processes.
Repository standards and community guidelines:
.github/ISSUE_TEMPLATE/bug_report.yml,.github/ISSUE_TEMPLATE/feature_request.yml,.github/PULL_REQUEST_TEMPLATE.md,.github/ISSUE_TEMPLATE/config.yml). [1] [2] [3] [4]CODEOWNERSfile to define repository ownership and streamline code review assignment (.github/CODEOWNERS).SECURITY.mdpolicy detailing how to report vulnerabilities, expected response timelines, and scope of security issues (SECURITY.md).Automation and CI/CD enhancements:
.github/workflows/codeql.yml,.github/workflows/dependency-review.yml,.github/workflows/scorecard.yml). [1] [2] [3].coderabbit.yamlconfiguration for automated code reviews and chat responses (.coderabbit.yaml).Documentation and onboarding improvements:
README.md). [1] [2] [3]AGENTS.mdandCLAUDE.mdto clarify component boundaries and remove outdated references to hooks (AGENTS.md,CLAUDE.md). [1] [2] [3] [4] [5]Minor improvements:
.github/workflows/release.yml).These changes lay the groundwork for a more maintainable, secure, and contributor-friendly project.
Summary by CodeRabbit
New Features
Documentation
Chores