headlesslab/.github: SECURITY.md and the satellites' reusable workflow #37

Activity

1. Fly-Playgroud

   added

   ready-for-agentFully specified, ready for an AFK agentFully specified, ready for an AFK agent

   on Sep 5, 2026
2. Fly-Playgroud

   added a parent issue on Sep 5, 2026

   • Spec: Baseline release #33
3. Fly-Playgroud

   marked this as blocking 2 issues on Sep 5, 2026

   • Four snapshot satellites: eventbus, lazyjson, seqdiff, leakcheck #38
   • fetch satellite: generic archive fetcher with its own suite #39
4. Fly-Playgroud commented on Sep 5, 2026

   

   Fly-Playgroud

   on Sep 5, 2026

   ContributorAuthor

   More actions

   Resolution. Repository headlesslab/.github exists (public, main at 0b6cd15, five commits), and the smoke run is green: https://github.com/headlesslab/.github/actions/runs/33978217343.

   Acceptance criteria

   • SECURITY.md: supported = the latest Milestone release and its release candidate (stated for wand; for the other modules, their latest release), fixes as patch releases, reports through GitHub private vulnerability reporting, advisories as GHSA with a CVE requested, acknowledgement within 7 days, no bounty. Verified as the default policy: https://github.com/headlesslab/wand/security/policy renders it although wand has no SECURITY.md.
   • Reusable workflow .github/workflows/go.yml (workflow_call): test on ubuntu-latest at the module's Go floor (read from go.mod via setup-go's go-version-file, so go 1.21 ran on go1.21.13) and at stable (go1.27.1); input cross-platform: true adds windows-latest and macos-latest at stable; go build, go vet, go test -race -count=1 -covermode=atomic; lint with golangci-lint v2.13.2 through its official action, using the module's own .golangci.* when present and otherwise the default configuration checked out from this repository at the caller's pinned commit (job.workflow_repository / job.workflow_sha, guarded so an empty value fails the job); govulncheck ./... with x/vuln v1.7.0 on the stable job; coverage ratchet on the ubuntu/stable cell, input coverage-threshold (required number), fails below it; GOTOOLCHAIN=local workflow-wide; permissions: contents: read; persist-credentials: false; every action pinned to a full commit SHA with a version comment (checkout v7.0.1, setup-go v7.0.0, golangci-lint-action v9.3.0).
   • Dependabot template: documented in the README (github-actions weekly; gomod with open-pull-requests-limit: 0, i.e. security updates only; the security-update switch itself is a repository setting for Repository settings script applied to wand and the satellites #57's script). The repository's own .github/dependabot.yml is the same file pointed at /smoke.
   • Smoke test: smoke/ (one function, 100 % coverage) calls the workflow on every push and pull request with working-directory: smoke, coverage-threshold: 100, cross-platform: true; all six jobs green (ubuntu floor/stable, windows stable, macos stable, lint, govulncheck).

   Decisions worth knowing

   • golangci-lint v2, not v1. Upstream's .golangci.yml is v1-schema and v1 is unmaintained and does not read Go 1.25+ export data. The default .golangci.yml is upstream's file run through golangci-lint migrate at v2.13.2 with three commented hand edits (run.relative-path-mode: wd to keep v1 path semantics; wsl/wsl_v5 both disabled as upstream disabled wsl; deprecated gomodguard disabled in favour of gomodguard_v2). default: all means linters added since upstream froze are on; a satellite that needs relief commits its own .golangci.yml. wand's own .golangci.yml is still v1 and is wand's CI ticket's concern.
   • Windows and macOS run stable only, matching wand's Tier 1 layout (spec §13); the floor is exercised on ubuntu-latest.
   • Callers pin uses: headlesslab/.github/.github/workflows/go.yml@<sha> # main; Dependabot's github-actions updater moves a SHA pinned to a branch commit to that branch's head (dependabot-core latest_commit_for_pinned_ref). Resulting check names for rulesets: go / test (ubuntu-latest, floor), go / test (ubuntu-latest, stable), go / lint, go / govulncheck (+ the two stable cells with cross-platform).
   • Not done here, by design: the .github repository's own settings (rulesets, Dependabot security updates, SHA-pin policy) wait for Repository settings script applied to wand and the satellites #57's script; the satellites' callers are written by Four snapshot satellites: eventbus, lazyjson, seqdiff, leakcheck #38 and fetch satellite: generic archive fetcher with its own suite #39.
5. Fly-Playgroud commented on Sep 5, 2026

   

   Fly-Playgroud

   on Sep 5, 2026

   ContributorAuthor

   More actions

   Resolved above; repository, workflow, template and green smoke run are linked in the resolution comment.
6. Fly-Playgroud

   closed this as completedon Sep 5, 2026