From 952ac381c1daf5e169d81a9663a1ad6a756634e9 Mon Sep 17 00:00:00 2001 From: semrel-sync-bot Date: Wed, 21 Oct 2026 13:59:51 +0000 Subject: [PATCH] chore: sync from plugin-template@9810af7 -- .golangci.yml CODE_OF_CONDUCT.md Dockerfile GOVERNANCE.md MAINTAINERS.md SECURITY.md --- .editorconfig | 21 ++++++ .golangci.yml | 7 +- .pre-commit-config.yaml | 18 +++++ CODE_OF_CONDUCT.md | 2 +- Dockerfile | 50 +++++++++----- GOVERNANCE.md | 5 +- MAINTAINERS.md | 4 +- SECURITY.md | 12 ++-- Taskfile.yaml | 143 ++++++++++++++++++++++++++++++++++++++++ commitlint.config.js | 34 ++++++++++ 10 files changed, 266 insertions(+), 30 deletions(-) create mode 100644 .editorconfig create mode 100644 .pre-commit-config.yaml create mode 100644 Taskfile.yaml create mode 100644 commitlint.config.js diff --git a/.editorconfig b/.editorconfig new file mode 100644 index 0000000..8c744f0 --- /dev/null +++ b/.editorconfig @@ -0,0 +1,21 @@ +# SPDX-License-Identifier: Apache-2.0 +# SPDX-FileCopyrightText: 2026 The semrel Authors + +root = true + +[*] +charset = utf-8 +insert_final_newline = true +trim_trailing_whitespace = true + +[*.{html,tmpl,py,go}] +indent_style = tab +indent_size = 4 + +[*.{yml,yaml,toml,json,css,less,js,vue,rb,nix}] +indent_style = space +indent_size = 2 + +[*.sh] +indent_style = space +indent_size = 4 diff --git a/.golangci.yml b/.golangci.yml index 9c9ae7e..b2321fc 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -1,6 +1,7 @@ +--- # SPDX-License-Identifier: Apache-2.0 -# SPDX-FileCopyrightText: 2026 The plugin-template Authors - +# SPDX-FileCopyrightText: 2026 The semrel Authors +# yaml-language-server: $schema=https://golangci-lint.run/jsonschema/golangci.jsonschema.json version: "2" run: @@ -13,3 +14,5 @@ linters: - ineffassign - staticcheck - unused + +... diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000..a7547cc --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,18 @@ +--- +# SPDX-License-Identifier: Apache-2.0 +# SPDX-FileCopyrightText: 2026 The semrel Authors +# yaml-language-server: $schema=https://www.schemastore.org/pre-commit-config.json +default_stages: + - pre-commit + +repos: + - repo: https://github.com/alessandrojcm/commitlint-pre-commit-hook + rev: v9.26.0 + hooks: + - id: commitlint + stages: + - commit-msg + additional_dependencies: + - "@commitlint/config-conventional" + +... diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md index 36a2d98..3ff477f 100644 --- a/CODE_OF_CONDUCT.md +++ b/CODE_OF_CONDUCT.md @@ -1,6 +1,6 @@ # Code of Conduct -hook-gitplugin is committed to providing a welcoming and harassment-free community. +`hook-gitplugin` is committed to providing a welcoming and harassment-free community. ## Our Pledge diff --git a/Dockerfile b/Dockerfile index 5d02657..36f2af4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,31 +1,45 @@ # SPDX-License-Identifier: Apache-2.0 -# SPDX-FileCopyrightText: 2026 The hook-gitplugin Authors +# SPDX-FileCopyrightText: 2026 The semrel Authors # ── build stage ──────────────────────────────────────────────────────────────── -FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS build +FROM --platform=$BUILDPLATFORM debian:13-slim@sha256:62bd423aeee912639ca8ee681c2b762cb3e25137e0a92b20be455898a9f034ad AS build + +RUN apt-get update && \ + apt-get -y --no-install-recommends install ca-certificates curl git build-essential && \ + rm -rf /var/lib/apt/lists/* + +SHELL ["/bin/bash", "-o", "pipefail", "-c"] +ENV PATH="/root/.local/bin:/mise/shims:$PATH" \ + MISE_DATA_DIR="/mise" \ + MISE_CONFIG_DIR="/mise" \ + MISE_CACHE_DIR="/mise/cache" \ + MISE_INSTALL_PATH="/usr/local/bin/mise" + +RUN curl --proto '=https' --proto-redir '=https' \ + --fail --show-error --silent --location https://mise.run | sh + +COPY mise.toml ./ +RUN --mount=type=cache,target=/mise/cache \ + mise trust && mise install + +WORKDIR /src + +COPY go.mod go.sum* ./ +RUN --mount=type=cache,target=/root/go/pkg \ + go mod download -x + +COPY . . ARG TARGETOS ARG TARGETARCH ARG VERSION=dev -WORKDIR /src -RUN apk add --no-cache ca-certificates git -COPY go.mod go.sum ./ -RUN go mod download -COPY . . -RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \ - go build -trimpath -ldflags="-s -w" -o /out/plugin ./cmd/plugin +RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} \ + task build # ── distroless release image ─────────────────────────────────────────────────── -FROM gcr.io/distroless/static-debian12:nonroot - -# NOTE: intentionally no repo-specific `org.opencontainers.image.*` LABEL block -# here. sync-template.yml only substitutes the "hook-gitplugin Authors" line -# in this file when propagating it to plugin repos (see `sed` step) — it does -# NOT rewrite LABEL title/description/source values. Adding those here would -# get copied verbatim (and wrongly) into every plugin's Dockerfile. Add labels -# in each plugin's own Dockerfile after copying this template, not here. +FROM gcr.io/distroless/static-debian13:nonroot@sha256:516757106de35205efb70b91ba03f6f1298424a0678c603255cf2852a7000087 -COPY --from=build /out/plugin /usr/local/bin/plugin +COPY --from=build /src/bin/plugin /usr/local/bin/plugin USER nonroot ENTRYPOINT ["/usr/local/bin/plugin"] diff --git a/GOVERNANCE.md b/GOVERNANCE.md index e11f666..5b94619 100644 --- a/GOVERNANCE.md +++ b/GOVERNANCE.md @@ -2,17 +2,20 @@ ## Overview -{{PROJECT_NAME}} is an open source project governed by its maintainers and community contributors. This document describes how decisions are made and how to participate. +`hook-gitplugin` is an open source project governed by its maintainers and community contributors. This document describes how decisions are made and how to participate. ## Project Roles ### Contributor + Anyone who opens an issue, submits a PR, improves documentation, or participates in discussions. No formal process is required beyond following [CONTRIBUTING.md](CONTRIBUTING.md) and the [Code of Conduct](CODE_OF_CONDUCT.md). ### Reviewer + An experienced contributor trusted to review changes in a specific area. Reviewers can approve changes but should not merge without maintainer approval unless the repo explicitly grants that permission. ### Maintainer + Maintainers have merge rights and are responsible for the overall health of the repository. The current list of maintainers is in [MAINTAINERS.md](MAINTAINERS.md). **To become a Maintainer:** diff --git a/MAINTAINERS.md b/MAINTAINERS.md index 94dc0c4..b0ace2b 100644 --- a/MAINTAINERS.md +++ b/MAINTAINERS.md @@ -4,8 +4,8 @@ | Name | GitHub | Affiliation | Areas | | --- | --- | --- | --- | -| {{MAINTAINER_NAME_1}} | [@{{MAINTAINER_GITHUB_1}}](https://github.com/{{MAINTAINER_GITHUB_1}}) | {{AFFILIATION_1}} | {{AREAS_1}} | -| {{MAINTAINER_NAME_2}} | [@{{MAINTAINER_GITHUB_2}}](https://github.com/{{MAINTAINER_GITHUB_2}}) | {{AFFILIATION_2}} | {{AREAS_2}} | +| Markus Waldheim | [@mwaldheim](https://github.com/mwaldheim) | Independent | Core, Plugin Architecture, CI | +| Thomas Boerger | [@tboerger](https://github.com/tboerger) | Independent | Core, Plugin Architecture, Gitea Integration | ## Responsibilities diff --git a/SECURITY.md b/SECURITY.md index 4632a3c..14cca71 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,17 +4,17 @@ | Version | Supported | | --- | --- | -| `main` / `{{DEFAULT_BRANCH}}` | ? | +| `main` (pre-release) | ✅ | -Update this table once stable releases exist. +Once stable releases are published this table will list supported version ranges. ## Reporting a Vulnerability -**Do not open a public issue for security vulnerabilities.** +**Please do not open a public GitHub Issue for security vulnerabilities.** -Please report vulnerabilities through **[GitHub Security Advisories]({{SECURITY_ADVISORY_URL}})**. +Report security issues privately via **[GitHub Security Advisories](https://github.com/SemRels/hook-gitplugin/security/advisories/new)**. -Alternative contact: {{SECURITY_CONTACT}} +You can also reach the maintainers at the addresses listed in [MAINTAINERS.md](MAINTAINERS.md). ## What To Include @@ -23,7 +23,7 @@ Alternative contact: {{SECURITY_CONTACT}} - Affected versions, tags, or commits - Proposed mitigations or workarounds, if known -## Response Targets +## Response SLA | Action | Target | | --- | --- | diff --git a/Taskfile.yaml b/Taskfile.yaml new file mode 100644 index 0000000..8672c69 --- /dev/null +++ b/Taskfile.yaml @@ -0,0 +1,143 @@ +--- +# SPDX-License-Identifier: Apache-2.0 +# SPDX-FileCopyrightText: 2026 The semrel Authors +# yaml-language-server: $schema=https://taskfile.dev/schema.json +version: "3.40" + +tasks: + clean: + desc: Remove all temporary build artifacts + cmds: + - go clean -i ./... + - rm -rf dist/ bin/ coverage.out + + fmt: + desc: Run standard formatter + vars: + SOURCES: + sh: find . -name "*.go" -type f | xargs echo + cmds: + - gofmt -s -w {{ .SOURCES }} + + vet: + desc: Run vet linting + cmds: + - go vet ./... + + lint: + desc: Run golangci linter + cmds: + - golangci-lint run + + test: + desc: Run unit tests + vars: + PACKAGES: + sh: go list ./... | xargs echo + cmds: + - go test -v -coverprofile=coverage.out ./... + + e2e: + desc: Run end-to-end tests + cmds: + - go test -tags e2e -v ./cmd/plugin/... + + build: + desc: Build the plugin for the current platform + cmds: + - go build -v -trimpath -ldflags="-s -w" -o bin/plugin{{if eq .GOOS "windows"}}.exe{{end}} ./cmd/plugin + env: + CGO_ENABLED: "0" + GOOS: "{{ .GOOS }}" + GOARCH: "{{ .GOARCH }}" + vars: + GOOS: + sh: go env GOOS + GOARCH: + sh: go env GOARCH + + build:dist: + desc: Build the plugin for the current platform + cmds: + - go build -v -trimpath -ldflags="-s -w" -o dist/plugin{{if eq .GOOS "windows"}}.exe{{end}} ./cmd/plugin + - sha256sum "dist/plugin{{if eq .GOOS "windows"}}.exe{{end}}" > "dist/plugin{{if eq .GOOS "windows"}}.exe{{end}}.sha256" + env: + CGO_ENABLED: "0" + GOOS: "{{ .GOOS }}" + GOARCH: "{{ .GOARCH }}" + vars: + GOOS: + sh: go env GOOS + GOARCH: + sh: go env GOARCH + + build:all: + desc: Build the plugin for all release platforms + cmds: + - for: + - linux/amd64 + - linux/arm64 + - darwin/amd64 + - darwin/arm64 + - windows/amd64 + - windows/arm64 + cmd: >- + GOOS={{ index (splitList "/" .ITEM) 0 }} + GOARCH={{ index (splitList "/" .ITEM) 1 }} + go build -o dist/plugin-{{ index (splitList "/" .ITEM) 0 }}-{{ index (splitList "/" .ITEM) 1 }}{{if eq (index (splitList "/" .ITEM) 0) "windows"}}.exe{{end}} + ./cmd/plugin + - for: + - linux/amd64 + - linux/arm64 + - darwin/amd64 + - darwin/arm64 + - windows/amd64 + - windows/arm64 + cmd: >- + cd dist && + sha256sum plugin-{{ index (splitList "/" .ITEM) 0 }}-{{ index (splitList "/" .ITEM) 1 }}{{if eq (index (splitList "/" .ITEM) 0) "windows"}}.exe{{end}} + > plugin-{{ index (splitList "/" .ITEM) 0 }}-{{ index (splitList "/" .ITEM) 1 }}{{if eq (index (splitList "/" .ITEM) 0) "windows"}}.exe{{end}}.sha256 + env: + CGO_ENABLED: "0" + + checksums: + desc: Generate checksums for all release artifacts + cmds: + - | + cd dist && find . -maxdepth 1 -type f ! -name '*.sha256' ! -name checksums.txt | sed 's|^\./||' | sort | while read -r file; do + sha256sum "${file}" + done > checksums.txt + + sync:registry: + desc: Trigger a plugin sync in the semrel registry for a release tag + silent: true + vars: + PLUGIN_OWNER: SemRels + PLUGIN_REPO: SemRels/hook-gitplugin + PLUGIN_TAG: + sh: if [ -n "{{ .PLUGIN_TAG }}" ]; then echo "{{ .PLUGIN_TAG }}"; else git describe --tags --abbrev=0; fi + env: + PLUGIN_TAG: "{{ .PLUGIN_TAG }}" + cmds: + - | + if [ -n "${REGISTRY_SYNC_TOKEN:-}" ]; then + payload=$(printf '{"event_type":"sync-plugins","client_payload":{"source_owner":"{{ .PLUGIN_OWNER }}","source_repo":"{{ .PLUGIN_REPO }}","tag":"%s"}}' "${PLUGIN_TAG}") + curl --fail --silent --show-error \ + -X POST \ + -H "Accept: application/vnd.github+json" \ + -H "Authorization: Bearer ${REGISTRY_SYNC_TOKEN}" \ + -H "X-GitHub-Api-Version: 2022-11-28" \ + https://api.github.com/repos/SemRels/semrel-registry/dispatches \ + -d "${payload}" + elif [ -n "${REGISTRY_SYNC_WEBHOOK:-}" ]; then + payload=$(printf '{"repository":"{{ .PLUGIN_REPO }}","owner":"{{ .PLUGIN_OWNER }}","tag":"%s"}' "${PLUGIN_TAG}") + curl --fail --silent --show-error \ + -X POST \ + -H "Content-Type: application/json" \ + "${REGISTRY_SYNC_WEBHOOK}" \ + -d "${payload}" + else + echo "No registry sync secret configured; skipping dispatch." + fi + +... diff --git a/commitlint.config.js b/commitlint.config.js new file mode 100644 index 0000000..afd2f32 --- /dev/null +++ b/commitlint.config.js @@ -0,0 +1,34 @@ +// SPDX-License-Identifier: Apache-2.0 +// SPDX-FileCopyrightText: 2026 The semrel Authors +// yaml-language-server: $schema=https://json.schemastore.org/commitlintrc.json +module.exports = { + extends: ["@commitlint/config-conventional"], + rules: { + "signed-off-by": [ + 2, + "always", + "Signed-off-by:", + ], + "type-enum": [ + 2, + "always", + [ + "feat", + "fix", + "docs", + "style", + "refactor", + "perf", + "test", + "build", + "ci", + "chore", + "revert", + "major", + "minor", + "patch", + "deps", + ], + ], + }, +};