Activity

1. VijitSingh97

   added

   documentationImprovements or additions to documentationImprovements or additions to documentation

   infraDeployment, packaging, releasesDeployment, packaging, releases

   on Jul 8, 2026
2. VijitSingh97 commented on Jul 8, 2026

   

   VijitSingh97

   on Jul 8, 2026

   ContributorAuthor

   More actions

   Implementation notes for whoever picks this up (human or agent). Drafted against develop @ 76e4c6b; decisions are proposals — veto by replying here.

   Implementation notes — #136 (repo hygiene: branch protection, release flags, licensing note, settings)

   Repo: p2pool-starter-stack/rigforge. State below was re-verified live via the GitHub API on
   2026-07-08 — one finding in the issue body is STALE (item 1). Items 3 and 4 are file edits that go
   through the normal develop PR flow; everything else is gh commands or Settings UI. "Needs admin"
   means repo/org admin rights; plain write access is enough otherwise.

   Per-item instructions

   1. Protect main — ALREADY DONE (stale finding); verify and optionally tighten

   Correction to the issue body: main IS protected, by an active repository RULESET named
   "Main Branch" (id 17200112, created 2026-06-02): requires a PR with 1 approving review,
   code-owner review, last-push approval; blocks deletion and force-pushes. The audit's "API reports
   no protection" came from the LEGACY branch-protection endpoint
   (/branches/main/protection → 404 "Branch not protected"), which does not see rulesets. So
   RELEASING.md:55's claim is already true.

   Verify (needs only read access):

   gh api repos/p2pool-starter-stack/rigforge/branches/main --jq '.protected'   # -> true
   gh api repos/p2pool-starter-stack/rigforge/rulesets/17200112 --jq '{enforcement, rules: [.rules[].type]}'
   # -> {"enforcement":"active","rules":["deletion","non_fast_forward","pull_request"]}

   Action: tick the box and drop a one-line comment on #136 noting the ruleset id and that the legacy
   API is why it looked unprotected.

   Optional tightening (needs admin; do NOT do without the maintainer's say-so — two real gaps vs
   develop's protection):

   • No required status checks on main (develop requires 9). Add a required_status_checks rule to
     ruleset 17200112 via Settings → Rules → Rulesets → "Main Branch" (maintainer manual step; the
     PUT payload for rulesets is fiddly and a wrong body replaces ALL rules).
   • bypass_actors grants OrganizationAdmin bypass_mode: always; switching it to
     "pull requests only" is the same Settings screen.

   2. Unflag v1.0.0 as a pre-release — one gh command (needs write)

   Confirmed live: isPrerelease: true on v1.0.0 (v1.0.1 and v1.1.0 are correct; release.yml:70-72
   only marks 0.* tags as pre-releases, so this was a manual mis-tick).

   gh release edit v1.0.0 --repo p2pool-starter-stack/rigforge --prerelease=false

   Verify:

   gh release view v1.0.0 --repo p2pool-starter-stack/rigforge --json isPrerelease --jq '.isPrerelease'  # -> false

   3. XMRig licensing note — README.md edit (normal PR to develop)

   File: README.md, License section (lines 207-209).

   Before:

   ## 📝 License
   
   Provided "as-is" under the [MIT License](./LICENSE).

   After:

   ## 📝 License
   
   Provided "as-is" under the [MIT License](./LICENSE).
   
   RigForge itself is MIT; [XMRig](https://github.com/xmrig/xmrig) is GPLv3. RigForge clones and
   compiles upstream XMRig source on your own machine and redistributes no XMRig binaries.

   Verify: make lint-md (markdownlint via npx) and make lint-links if lychee is installed (the new
   xmrig link is external).

   4. Donation-address ownership — README.md edit (+ optional FUNDING.yml)

   File: README.md, Donate section (line 199).

   Before:

   If RigForge saved you time and you'd like to support it, donations to this XMR wallet are appreciated:

   After:

   If RigForge saved you time and you'd like to support it, donations to this XMR wallet (the
   maintainer's wallet, separate from XMRig's own dev donation) are appreciated:

   Optional Sponsor button: create .github/FUNDING.yml (does not exist today) with exactly:

   # Points the Sponsor button at the Donate section (an XMR address is not a URL GitHub can render).
   custom: ["https://github.com/p2pool-starter-stack/rigforge#-donate"]

   .yamllint disables document-start, so no leading --- is needed. The file is picked up by
   make lint-yaml only after git add (YAML_FILES comes from git ls-files).

   Verify: make lint-md and, if FUNDING.yml was added, git add .github/FUNDING.yml && make lint-yaml.
   The Sponsor button itself must also be enabled: Settings → General → Features → Sponsorships
   (maintainer manual step).

   5. Enable secret scanning + push protection — gh command (needs admin)

   Confirmed live: both secret_scanning and secret_scanning_push_protection report disabled; the
   repo is public so both are free.

   gh api -X PATCH repos/p2pool-starter-stack/rigforge \
     -f 'security_and_analysis[secret_scanning][status]=enabled' \
     -f 'security_and_analysis[secret_scanning_push_protection][status]=enabled'

   Verify:

   gh api repos/p2pool-starter-stack/rigforge \
     --jq '.security_and_analysis | {ss: .secret_scanning.status, pp: .secret_scanning_push_protection.status}'
   # -> {"ss":"enabled","pp":"enabled"}

   If the PATCH 403s (org policy owns the toggle), fall back to Settings → Advanced Security →
   Secret Protection (maintainer manual step).

   6. Auto-delete head branches + delete the stale branch — gh commands (needs admin for the toggle)

   Confirmed live: delete_branch_on_merge: false; branch claude/silly-liskov-95e9de still exists
   and its PR #129 is MERGED (2026-07-01).

   gh repo edit p2pool-starter-stack/rigforge --delete-branch-on-merge
   git push origin --delete claude/silly-liskov-95e9de

   (The git push --delete needs write access, not admin. Ruleset 17200112 only guards main, so the
   delete goes through.)

   Verify:

   gh api repos/p2pool-starter-stack/rigforge --jq '.delete_branch_on_merge'  # -> true
   git ls-remote --heads origin claude/silly-liskov-95e9de                    # -> no output

   7. Prune or bless the Pithead-only labels — maintainer decision first, then gh commands

   Confirmed usage (issues + PRs, all states): monero 0, p2pool 0, tari 0, notifications 0,
   dashboard 1 (open issue #99, "Sister HTTP API..."). The issue-template config
   (.github/ISSUE_TEMPLATE/config.yml) redirects those topics to the Pithead repo.

   MAINTAINER DECISION REQUIRED before running anything: RigForge deliberately mirrors Pithead's UX,
   so a shared label taxonomy may be intentional. If the maintainer says "bless", tick the box and
   stop. If "prune":

   gh label delete monero        --repo p2pool-starter-stack/rigforge --yes
   gh label delete p2pool        --repo p2pool-starter-stack/rigforge --yes
   gh label delete tari          --repo p2pool-starter-stack/rigforge --yes
   gh label delete notifications --repo p2pool-starter-stack/rigforge --yes
   # dashboard is in use on #99 — swap it for an in-taxonomy label BEFORE deleting:
   gh issue edit 99 --repo p2pool-starter-stack/rigforge --add-label enhancement --remove-label dashboard
   gh label delete dashboard     --repo p2pool-starter-stack/rigforge --yes

   Verify: gh label list --repo p2pool-starter-stack/rigforge no longer shows the five, and
   gh issue view 99 --json labels shows enhancement.

   8. Set the repo homepage URL — gh command (needs admin); URL choice is the maintainer's

   Confirmed live: homepage is null. There is no docs site; the natural candidate is the org page.
   Ask the maintainer which URL, then:

   gh repo edit p2pool-starter-stack/rigforge --homepage "https://github.com/p2pool-starter-stack"

   Verify: gh api repos/p2pool-starter-stack/rigforge --jq '.homepage'

   (Note item) Private vulnerability reporting

   The issue body says this was already enabled; no action. Optional sanity check:

   gh api repos/p2pool-starter-stack/rigforge/private-vulnerability-reporting --jq '.enabled'  # -> true

   Verification

   • File edits (items 3, 4): make lint-md (+ make lint-yaml if FUNDING.yml added,
     make lint-links if lychee installed); ship via a normal PR to develop.
   • Settings (items 1, 2, 5, 6, 7, 8): each item's inline gh ... --jq check above is the
     acceptance test; run them all once at the end.
   • Admin-gated: items 5, 6 (toggle), 8, and the optional tightening in 1. UI-only
     (maintainer manual steps): ruleset edits in item 1, Sponsor-button toggle in item 4, and the
     Settings fallback in item 5.
   • Decisions to get from the maintainer before executing: item 7 (prune vs bless) and item 8 (URL).
3. VijitSingh97

   added this to the v1.2 — audit fixes milestone on Jul 9, 2026
4. VijitSingh97 commented on Jul 9, 2026

   

   VijitSingh97

   on Jul 9, 2026

   ContributorAuthor

   More actions

   Progress (2026-07-09):

   • Protect main — stale finding, verified protected by ruleset "Main Branch" (see body).
   • v1.0.0 unflagged as pre-release (isPrerelease: false confirmed).
   • XMRig GPLv3 note + donation-address ownership clause + .github/FUNDING.yml — in PR v1.2 audit fixes: config permissions, SERVICE_NAME, GRUB escaping, robustness sweep, doc corrections #150.
   • Secret scanning + push protection enabled (both report enabled).
   • "Automatically delete head branches" on; stale claude/silly-liskov-95e9de deleted.

   Left for the maintainer (decisions, per the notes above):

   • Labels: prune vs bless the Pithead-taxonomy labels (dashboard is in use on Sister HTTP API: serve a superset of XMRig's stats, enriched with RigForge-captured data #99 — relabel first if pruning).
   • Homepage URL choice.
   • Sponsor button toggle in Settings → General → Features (makes FUNDING.yml visible).
   • Optional: required status checks on the main ruleset.
5. VijitSingh97

   added a commit that references this issue on Jul 9, 2026

   v1.2 audit fixes: config permissions, SERVICE_NAME, GRUB escaping, ro…

   ...

   e940c64
6. VijitSingh97

   removed this from the v1.2 — audit fixes milestone on Jul 10, 2026
7. VijitSingh97

   added 3 commits that reference this issue on Jul 10, 2026

   release: v1.2.0 (#159)

   ...

   4b2935a

   release: v1.2.1 (#163)

   ...

   8deddac

   release: v1.3.0 (#175)

   ...

   a8e172f
8. VijitSingh97 commented on Jul 10, 2026

   

   VijitSingh97

   on Jul 10, 2026

   ContributorAuthor

   More actions

   All items done as of v1.4.0 ship day (2026-07-10):

   • Protect main — stale finding, already covered by the Main Branch ruleset.
   • v1.0.0 un-flagged as pre-release (gh release edit v1.0.0 --prerelease=false).
   • XMRig GPLv3 licensing note — already in README › License (MIT for RigForge, GPLv3 for XMRig, no binaries redistributed).
   • Donation ownership clause — already in README › Donate, and .github/FUNDING.yml exists.
   • Secret-scanning push protection: enabled (blocks secrets before they land; CI gitleaks remains the full-history audit).
   • Auto-delete head branches: enabled; the stale claude/silly-liskov-95e9de branch was already gone.
   • Pithead-only labels pruned: dashboard, monero, notifications, p2pool, tari (issue templates redirect those topics to Pithead).
   • Homepage URL set.

   Also swept today: v1.3 + v1.4 milestones closed (all issues shipped), no stale remote branches, no orphaned open PRs.
9. VijitSingh97

   closed this as completedon Jul 10, 2026
10. VijitSingh97

    added this to the v1.2 — audit fixes milestone on Sep 20, 2026