Skip to content

Commit ed8b96e

Browse files
amondnetamondnet
authored
chore: add OSS community health files and pin actions to commit SHAs (#34)
* chore: add OSS community health files and worktree setup - Add CONTRIBUTING.md (bun-based workflow, lint/typecheck/build checks, optional ref/ submodules note) - Add CODE_OF_CONDUCT.md (Contributor Covenant) - Add SECURITY.md (private vulnerability reporting, contact gon.yun@pleaseai.dev) - Add .github/PULL_REQUEST_TEMPLATE.md and .github/ISSUE_TEMPLATE/ (bug_report.md, feature_request.md, config.yml) - Add orca.yaml (worktree setup: worktreeinclude copy -> git submodule update --init --recursive -> bun install) and .worktreeinclude * ci: pin GitHub Actions to commit SHAs in release-please workflow Pin actions/create-github-app-token, googleapis/release-please-action, actions/checkout, oven-sh/setup-bun, and actions/setup-node to their current major-version commit SHAs for supply-chain hardening. No version upgrades, comments retain the original tag for readability. * ci: add dependabot config for bun and github actions Enable weekly grouped dependency updates for bun (root, apps/docs, packages/layer, minor/patch grouped) and github-actions (grouped), keeping the newly SHA-pinned actions fresh. * docs: use team security alias as contact address * ci: group dependabot updates by dependency name across directories * ci: use single root directory for bun workspace dependabot updates * ci: disable credential persistence on checkout in publish job * chore: run dev:prepare in orca worktree setup * ci: add explicit patterns to dependabot minor-and-patch group * ci: exclude community health docs from codacy analysis * chore: skip optional ref submodules in orca worktree setup
1 parent 7074801 commit ed8b96e

12 files changed

Lines changed: 373 additions & 5 deletions

‎.codacy.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Community health files intentionally publish a contact email address;
2+
# Codacy's PII rule flags any email, so exclude these docs from analysis.
3+
---
4+
exclude_paths:
5+
- "SECURITY.md"
6+
- "CODE_OF_CONDUCT.md"

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
name: Bug report
3+
about: Report a problem to help us improve
4+
title: ""
5+
labels: ["bug"]
6+
---
7+
8+
## Describe the bug
9+
10+
A clear and concise description of what the bug is.
11+
12+
## To reproduce
13+
14+
Steps to reproduce the behavior:
15+
16+
1. ...
17+
2. ...
18+
3. See error
19+
20+
## Expected behavior
21+
22+
What you expected to happen.
23+
24+
## Environment
25+
26+
- Package version:
27+
- Runtime/OS:
28+
29+
## Additional context
30+
31+
Logs, screenshots, or anything else that helps.

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: Question or discussion
4+
url: https://github.com/pleaseai/docs/discussions
5+
about: Ask questions and discuss ideas here instead of opening an issue.
6+
- name: Security vulnerability
7+
url: https://github.com/pleaseai/docs/security/advisories/new
8+
about: Report security issues privately — do not open a public issue.

‎.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
name: Feature request
3+
about: Suggest an idea or improvement
4+
title: ""
5+
labels: ["enhancement"]
6+
---
7+
8+
## Problem
9+
10+
What problem does this feature solve? What is the use case?
11+
12+
## Proposed solution
13+
14+
A clear and concise description of what you want to happen.
15+
16+
## Alternatives considered
17+
18+
Other approaches you've thought about, and why this one is preferable.
19+
20+
## Additional context
21+
22+
Anything else that helps explain the request.

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<!-- PR title should follow Conventional Commits, e.g. "feat(layer): add toc component" -->
2+
3+
## Summary
4+
5+
<!-- What does this PR change, and why? -->
6+
7+
## Related issue
8+
9+
<!-- e.g. Closes #123 -->
10+
11+
## Checklist
12+
13+
- [ ] PR title follows Conventional Commits
14+
- [ ] Lint passes (`bun run lint`)
15+
- [ ] Type check passes (`bun run typecheck`)
16+
- [ ] Documentation updated if behavior changed
17+
- [ ] No breaking change, or a `BREAKING CHANGE:` note is included

‎.github/dependabot.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
version: 2
2+
updates:
3+
# Bun workspaces: the root entry covers workspace member package.json
4+
# files too (apps/*, packages/*) — no per-directory entries needed.
5+
- package-ecosystem: bun
6+
directory: "/"
7+
schedule:
8+
interval: weekly
9+
commit-message:
10+
prefix: "chore(deps)"
11+
groups:
12+
minor-and-patch:
13+
patterns:
14+
- "*"
15+
update-types:
16+
- minor
17+
- patch
18+
19+
- package-ecosystem: github-actions
20+
directory: "/"
21+
schedule:
22+
interval: weekly
23+
commit-message:
24+
prefix: "ci(deps)"
25+
groups:
26+
actions:
27+
patterns:
28+
- "*"

‎.github/workflows/release-please.yml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,13 +24,13 @@ jobs:
2424
layer_tag_name: ${{ steps.release.outputs['packages/layer--tag_name'] }}
2525
layer_version: ${{ steps.release.outputs['packages/layer--version'] }}
2626
steps:
27-
- uses: actions/create-github-app-token@v2
27+
- uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
2828
id: app-token
2929
with:
3030
app-id: ${{ secrets.APP_ID }}
3131
private-key: ${{ secrets.PRIVATE_KEY }}
3232

33-
- uses: googleapis/release-please-action@v4
33+
- uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4
3434
id: release
3535
with:
3636
token: ${{ steps.app-token.outputs.token }}
@@ -42,13 +42,15 @@ jobs:
4242
if: ${{ needs.release-please.outputs.releases_created == 'true' }}
4343
runs-on: ubuntu-latest
4444
steps:
45-
- uses: actions/checkout@v4
45+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
46+
with:
47+
persist-credentials: false
4648

47-
- uses: oven-sh/setup-bun@v2
49+
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
4850
with:
4951
bun-version: latest
5052

51-
- uses: actions/setup-node@v4
53+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
5254
with:
5355
node-version: '24'
5456
registry-url: 'https://registry.npmjs.org'

‎.worktreeinclude‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# .worktreeinclude — gitignored files to copy into new worktrees
2+
# Uses .gitignore syntax. Only files matching a pattern AND ignored by git
3+
# are copied. Claude Code --worktree handles this automatically; external
4+
# tools (orca/conductor) run `bunx @pleaseai/worktreeinclude <src> <dst>`
5+
# from their setup hook (see orca.yaml).
6+
7+
# Root environment variables (dotenvx)
8+
.env
9+
.env.local
10+
.env.*.local
11+
.env.keys
12+
13+
# Per-workspace environment variables
14+
apps/*/.env
15+
apps/*/.env.local
16+
packages/*/.env
17+
18+
# Claude Code local settings (permissions, env, plugin overrides)
19+
.claude/settings.local.json

‎CODE_OF_CONDUCT.md‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
# Contributor Covenant Code of Conduct
2+
3+
## Our Pledge
4+
5+
We as members, contributors, and leaders pledge to make participation in our
6+
community a harassment-free experience for everyone, regardless of age, body
7+
size, visible or invisible disability, ethnicity, sex characteristics, gender
8+
identity and expression, level of experience, education, socio-economic status,
9+
nationality, personal appearance, race, caste, color, religion, or sexual
10+
identity and orientation.
11+
12+
We pledge to act and interact in ways that contribute to an open, welcoming,
13+
diverse, inclusive, and healthy community.
14+
15+
## Our Standards
16+
17+
Examples of behavior that contributes to a positive environment for our
18+
community include:
19+
20+
- Demonstrating empathy and kindness toward other people
21+
- Being respectful of differing opinions, viewpoints, and experiences
22+
- Giving and gracefully accepting constructive feedback
23+
- Accepting responsibility and apologizing to those affected by our mistakes,
24+
and learning from the experience
25+
- Focusing on what is best not just for us as individuals, but for the overall
26+
community
27+
28+
Examples of unacceptable behavior include:
29+
30+
- The use of sexualized language or imagery, and sexual attention or advances of
31+
any kind
32+
- Trolling, insulting or derogatory comments, and personal or political attacks
33+
- Public or private harassment
34+
- Publishing others' private information, such as a physical or email address,
35+
without their explicit permission
36+
- Other conduct which could reasonably be considered inappropriate in a
37+
professional setting
38+
39+
## Enforcement Responsibilities
40+
41+
Community leaders are responsible for clarifying and enforcing our standards of
42+
acceptable behavior and will take appropriate and fair corrective action in
43+
response to any behavior that they deem inappropriate, threatening, offensive,
44+
or harmful.
45+
46+
Community leaders have the right and responsibility to remove, edit, or reject
47+
comments, commits, code, wiki edits, issues, and other contributions that are
48+
not aligned to this Code of Conduct, and will communicate reasons for moderation
49+
decisions when appropriate.
50+
51+
## Scope
52+
53+
This Code of Conduct applies within all community spaces, and also applies when
54+
an individual is officially representing the community in public spaces.
55+
Examples of representing our community include using an official email address,
56+
posting via an official social media account, or acting as an appointed
57+
representative at an online or offline event.
58+
59+
## Enforcement
60+
61+
Instances of abusive, harassing, or otherwise unacceptable behavior may be
62+
reported to the community leaders responsible for enforcement at
63+
**security@pleaseai.dev**.
64+
All complaints will be reviewed and investigated promptly and fairly.
65+
66+
All community leaders are obligated to respect the privacy and security of the
67+
reporter of any incident.
68+
69+
## Enforcement Guidelines
70+
71+
Community leaders will follow these Community Impact Guidelines in determining
72+
the consequences for any action they deem in violation of this Code of Conduct:
73+
74+
### 1. Correction
75+
76+
**Community Impact**: Use of inappropriate language or other behavior deemed
77+
unprofessional or unwelcome in the community.
78+
79+
**Consequence**: A private, written warning from community leaders, providing
80+
clarity around the nature of the violation and an explanation of why the
81+
behavior was inappropriate. A public apology may be requested.
82+
83+
### 2. Warning
84+
85+
**Community Impact**: A violation through a single incident or series of
86+
actions.
87+
88+
**Consequence**: A warning with consequences for continued behavior. No
89+
interaction with the people involved, including unsolicited interaction with
90+
those enforcing the Code of Conduct, for a specified period of time. This
91+
includes avoiding interactions in community spaces as well as external channels
92+
like social media. Violating these terms may lead to a temporary or permanent
93+
ban.
94+
95+
### 3. Temporary Ban
96+
97+
**Community Impact**: A serious violation of community standards, including
98+
sustained inappropriate behavior.
99+
100+
**Consequence**: A temporary ban from any sort of interaction or public
101+
communication with the community for a specified period of time. No public or
102+
private interaction with the people involved, including unsolicited interaction
103+
with those enforcing the Code of Conduct, is allowed during this period.
104+
Violating these terms may lead to a permanent ban.
105+
106+
### 4. Permanent Ban
107+
108+
**Community Impact**: Demonstrating a pattern of violation of community
109+
standards, including sustained inappropriate behavior, harassment of an
110+
individual, or aggression toward or disparagement of classes of individuals.
111+
112+
**Consequence**: A permanent ban from any sort of public interaction within the
113+
community.
114+
115+
## Attribution
116+
117+
This Code of Conduct is adapted from the [Contributor Covenant][homepage],
118+
version 2.1, available at
119+
[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
120+
121+
Community Impact Guidelines were inspired by
122+
[Mozilla's code of conduct enforcement ladder][mozilla coc].
123+
124+
For answers to common questions about this code of conduct, see the FAQ at
125+
[https://www.contributor-covenant.org/faq][faq]. Translations are available at
126+
[https://www.contributor-covenant.org/translations][translations].
127+
128+
[homepage]: https://www.contributor-covenant.org
129+
[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
130+
[mozilla coc]: https://github.com/mozilla/diversity
131+
[faq]: https://www.contributor-covenant.org/faq
132+
[translations]: https://www.contributor-covenant.org/translations

‎CONTRIBUTING.md‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# Contributing
2+
3+
Thanks for your interest in contributing! This guide covers how to get from a clone to a merged pull request.
4+
5+
By participating, you agree to abide by our [Code of Conduct](./CODE_OF_CONDUCT.md). All documentation, code, comments, and commit messages in this repository are written in **English**.
6+
7+
## Getting started
8+
9+
```bash
10+
git clone https://github.com/pleaseai/docs.git
11+
cd docs
12+
bun install # install dependencies
13+
bun run dev:prepare # generate Nuxt type stubs
14+
```
15+
16+
The `ref/` directory contains git submodules with reference projects (docus, shadcn-vue, fumadocs, …). They are not required for development, but if you want them:
17+
18+
```bash
19+
git submodule update --init --recursive
20+
```
21+
22+
## Development workflow
23+
24+
1. Create a branch from `main` (e.g. `feat/short-description` or `fix/issue-123`).
25+
2. Make focused changes — keep each pull request to one logical change.
26+
3. Run the checks below and make sure they pass.
27+
4. Open a pull request and fill out the template.
28+
29+
```bash
30+
bun run lint # lint and format
31+
bun run typecheck # type-check the layer package
32+
bun run build # ensure the docs site builds
33+
```
34+
35+
## Commit messages
36+
37+
We follow [Conventional Commits](https://www.conventionalcommits.org/): `type(scope): subject`, where `type` is one of `feat`, `fix`, `docs`, `refactor`, `test`, `chore`, etc. Breaking changes include a `BREAKING CHANGE:` footer. Versioning and the changelog are generated automatically from these messages, so accurate types matter.
38+
39+
## Pull requests
40+
41+
- Reference the issue your PR addresses (e.g. `Closes #123`).
42+
- Use a Conventional-Commit-style PR title — it becomes the squash-merge commit.
43+
- Make sure CI is green before requesting review.
44+
45+
## Reporting bugs and requesting features
46+
47+
Open an issue using the bug report or feature request template. For security
48+
vulnerabilities, **do not** open a public issue — follow [SECURITY.md](./SECURITY.md).

0 commit comments

Comments
 (0)