From 3f0957831e989c25f38609f9c9edf3bccb9cff4e Mon Sep 17 00:00:00 2001 From: Mariano Aguero Date: Thu, 17 Sep 2026 17:06:03 -0300 Subject: [PATCH 1/7] chore(repo): add issue forms, pr template and codeowners --- .github/CODEOWNERS | 7 +++ .github/ISSUE_TEMPLATE/01-divergence.yml | 80 ++++++++++++++++++++++++ .github/ISSUE_TEMPLATE/02-bug.yml | 69 ++++++++++++++++++++ .github/ISSUE_TEMPLATE/03-feature.yml | 45 +++++++++++++ .github/ISSUE_TEMPLATE/config.yml | 11 ++++ .github/PULL_REQUEST_TEMPLATE.md | 50 +++++++++++++++ 6 files changed, 262 insertions(+) create mode 100644 .github/CODEOWNERS create mode 100644 .github/ISSUE_TEMPLATE/01-divergence.yml create mode 100644 .github/ISSUE_TEMPLATE/02-bug.yml create mode 100644 .github/ISSUE_TEMPLATE/03-feature.yml create mode 100644 .github/ISSUE_TEMPLATE/config.yml create mode 100644 .github/PULL_REQUEST_TEMPLATE.md diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..b3bfb6e --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,7 @@ +# Review is requested automatically from these accounts. +* @mariano-aguero @Ghadi8 + +# The oracles and the published gas figures are what the library exists for, +# so a change to either always gets a second pair of eyes. +/src/gas.ts @mariano-aguero +/test/fixtures/ @mariano-aguero diff --git a/.github/ISSUE_TEMPLATE/01-divergence.yml b/.github/ISSUE_TEMPLATE/01-divergence.yml new file mode 100644 index 0000000..a4ec83a --- /dev/null +++ b/.github/ISSUE_TEMPLATE/01-divergence.yml @@ -0,0 +1,80 @@ +name: Divergence from ethrex +description: This library and the reference client disagree about bytes, a hash, a price or a receipt. +title: 'divergence: ' +labels: [divergence] +body: + - type: markdown + attributes: + value: | + This is the report the project most wants. A second implementation exists to disagree usefully, so a confirmed disagreement is a result, not a nuisance. + + If the disagreement is in signing or hashing and could let someone produce a transaction that a signer did not intend, stop and file a private advisory instead. + - type: dropdown + id: subject + attributes: + label: What disagrees + options: + - Encoded bytes or transaction hash + - Sig-hash or recovered signer + - Gas, intrinsic or a limit-derived term + - maxCost + - Receipt decoding, including frame status + - Something else + validations: + required: true + - type: input + id: evidence + attributes: + label: Transaction hash or raw bytes + description: A hash on hegota-testnet, or the hex the two implementations were fed. Without one of these the report cannot be reproduced. + placeholder: '0x…' + validations: + required: true + - type: textarea + id: expected + attributes: + label: What ethrex produces + description: The value, and where it came from. A node response, a published figure, or a path and line in the ethrex repository on its `hegota-testnet` branch. + validations: + required: true + - type: textarea + id: actual + attributes: + label: What frametx-kit produces + description: The value, plus the call that produced it. + render: text + validations: + required: true + - type: input + id: ethrex-version + attributes: + label: ethrex version + description: The commit the node reports, or the endpoint you queried. The gas rule sets are pinned per binary, so this decides which of them applies. + placeholder: 31b532266, or rpc1.privacy.ethrex.xyz + validations: + required: true + - type: dropdown + id: ruleset + attributes: + label: Rule set + description: Which rule set you priced under, if this is a gas report. + options: + - chain + - pins + - head + - Not a gas report + validations: + required: true + - type: input + id: version + attributes: + label: frametx-kit version + placeholder: 0.1.1 + validations: + required: true + - type: input + id: genesis + attributes: + label: Genesis hash + description: The chain has already been re-genesised twice, and fixtures record the genesis they were captured against. Leave blank if you do not have it. + placeholder: '0x…' diff --git a/.github/ISSUE_TEMPLATE/02-bug.yml b/.github/ISSUE_TEMPLATE/02-bug.yml new file mode 100644 index 0000000..2d51236 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/02-bug.yml @@ -0,0 +1,69 @@ +name: Bug report +description: The library behaves differently from its documentation, throws where it should not, or fails to type-check. +labels: [bug] +body: + - type: markdown + attributes: + value: | + If the disagreement is with the ethrex node rather than with this library's own documentation, use the divergence report instead. + + If it lets someone produce a transaction a signer did not intend, file a private advisory instead. + - type: textarea + id: what + attributes: + label: What happened + validations: + required: true + - type: textarea + id: expected + attributes: + label: What you expected + description: Point at the README, `docs/DESIGN.md` or `CONTRIBUTING.md` line if one of them promises the other behaviour. + validations: + required: true + - type: textarea + id: repro + attributes: + label: Reproduction + description: The smallest snippet that shows it. A transaction hash or a hex blob is worth more than a description. + render: ts + validations: + required: true + - type: textarea + id: output + attributes: + label: Error or output + render: text + - type: input + id: version + attributes: + label: frametx-kit version + placeholder: 0.1.1 + validations: + required: true + - type: input + id: viem + attributes: + label: viem version + description: viem is a peer dependency, and a duplicated copy of it is a common cause of type errors around `client.extend`. + placeholder: 2.21.0 + validations: + required: true + - type: input + id: runtime + attributes: + label: Runtime and package manager + placeholder: bun 1.3.2, or node 22.8 with pnpm 10.16 + validations: + required: true + - type: dropdown + id: entry + attributes: + label: Which entry point + options: + - '@jaw.id/frametx-kit' + - '@jaw.id/frametx-kit/viem' + - Both + - Not relevant + validations: + required: true diff --git a/.github/ISSUE_TEMPLATE/03-feature.yml b/.github/ISSUE_TEMPLATE/03-feature.yml new file mode 100644 index 0000000..8be36be --- /dev/null +++ b/.github/ISSUE_TEMPLATE/03-feature.yml @@ -0,0 +1,45 @@ +name: Feature or coverage request +description: Something the wire format does that this library cannot do yet. +labels: [enhancement] +body: + - type: markdown + attributes: + value: | + Check `docs/OPEN-ITEMS.md` first. Known gaps are already recorded there, and a comment on the matching item is more useful than a new issue. + - type: textarea + id: need + attributes: + label: What you are trying to do + description: The task, not the API. A concrete transaction you cannot build or survey is the strongest case. + validations: + required: true + - type: textarea + id: shape + attributes: + label: The API you have in mind + description: Optional, and a sketch is fine. + render: ts + - type: dropdown + id: area + attributes: + label: Area + options: + - envelope + - sighash + - signatures + - gas + - divergence + - rlp + - rpc + - viem + - fixtures + - docs + validations: + required: true + - type: textarea + id: spec + attributes: + label: Where the behaviour is specified + description: The EIP section, the ethrex path on its `hegota-testnet` branch, or the node response that defines what correct means. Anything added here needs an oracle that is not the code's own output. + validations: + required: true diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..24ae929 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,11 @@ +blank_issues_enabled: false +contact_links: + - name: Report a security vulnerability + url: https://github.com/JustaName-id/frametx-kit/security/advisories/new + about: Signature layout, sig-hash, encoder or gas-accounting flaws go through a private advisory, not a public issue. See SECURITY.md. + - name: A bug in the ethrex node itself + url: https://github.com/lambdaclass/ethrex/issues + about: If the reference client is the side that is wrong, it belongs upstream. Open a divergence report here too so we record it. + - name: How do I use this + url: https://github.com/JustaName-id/frametx-kit#readme + about: The README covers the API and the two behaviours that surprise people most. CONTRIBUTING.md covers the wire-format traps. diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..498c069 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,50 @@ +## What this changes + + + +## Why + + + +## How the new behaviour is pinned + +Which oracle covers this change, and why it could actually fail: + +- [ ] A published figure, transcribed rather than derived +- [ ] The golden byte vector or sig-hash from ethrex's `frame_tx_wire_tests.rs` +- [ ] Re-encoding captured chain data and reproducing the transaction hash +- [ ] A live receipt (recovered signer, `maxCost`, or the `gasUsed` decomposition) +- [ ] N/A, this change has no wire-format or gas behaviour + + + +## Load-bearing rules + +Did this touch anything under "Rules that are not style preferences" in `CONTRIBUTING.md`, such as a derived gas constant, a golden vector, a captured fixture, the module import order, or `encodeFrameTx` validating? + +- [ ] No +- [ ] Yes, and the argument for it is below + +## Checks + +Only tick what you ran. + +- [ ] `bun run test` +- [ ] `bun run typecheck` +- [ ] `bun run build && bunx @arethetypeswrong/cli --pack .` (required if `exports`, `files`, `typesVersions` or `tsup.config.ts` changed; otherwise N/A) +- [ ] `bun run test:live` (optional, hits the public endpoint, not a gate) + +## Release impact + +The commit history sets the version, so say which this is: + +- [ ] No release (`docs`, `chore`, `test`, `ci`, `refactor`, `style`, `perf`, `build`) +- [ ] Patch (`fix`) +- [ ] Minor (`feat`) +- [ ] Major (`feat!` or a `BREAKING CHANGE:` footer) + +A wire-format or gas change is almost always at least a `fix:`, because someone downstream is encoding bytes with this. + +## AI assistance + +- [ ] This change was written or reviewed with an assistant, and I have read every line of it From 1edafd07fe733aa26631654ccc15e82ae439c13b Mon Sep 17 00:00:00 2001 From: Mariano Aguero Date: Thu, 17 Sep 2026 17:06:03 -0300 Subject: [PATCH 2/7] docs: add security policy and code of conduct --- CODE_OF_CONDUCT.md | 77 ++++++++++++++++++++++++++++++++++++++++++++++ SECURITY.md | 37 ++++++++++++++++++++++ 2 files changed, 114 insertions(+) create mode 100644 CODE_OF_CONDUCT.md create mode 100644 SECURITY.md diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..a1eba8f --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,77 @@ +# Contributor Covenant Code of Conduct + +## Our Pledge + +We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, color, religion, or sexual identity and orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community. + +## Our Standards + +Examples of behavior that contributes to a positive environment for our community include: + +* Demonstrating empathy and kindness toward other people +* Being respectful of differing opinions, viewpoints, and experiences +* Giving and gracefully accepting constructive feedback +* Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience +* Focusing on what is best not just for us as individuals, but for the overall community + +Examples of unacceptable behavior include: + +* The use of sexualized language or imagery, and sexual attention or advances of any kind +* Trolling, insulting or derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or email address, without their explicit permission +* Other conduct which could reasonably be considered inappropriate in a professional setting + +## Enforcement Responsibilities + +Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful. + +Community leaders have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, and will communicate reasons for moderation decisions when appropriate. + +## Scope + +This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public spaces. Examples of representing our community include using an official email address, posting via an official social media account, or acting as an appointed representative at an online or offline event. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at ghadimhawej@outlook.com. All complaints will be reviewed and investigated promptly and fairly. + +All community leaders are obligated to respect the privacy and security of the reporter of any incident. + +## Enforcement Guidelines + +Community leaders will follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct: + +### 1. Correction + +**Community Impact**: Use of inappropriate language or other behavior deemed unprofessional or unwelcome in the community. + +**Consequence**: A private, written warning from community leaders, providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested. + +### 2. Warning + +**Community Impact**: A violation through a single incident or series of actions. + +**Consequence**: A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period of time. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban. + +### 3. Temporary Ban + +**Community Impact**: A serious violation of community standards, including sustained inappropriate behavior. + +**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period of time. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban. + +### 4. Permanent Ban + +**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behavior, harassment of an individual, or aggression toward or disparagement of classes of individuals. + +**Consequence**: A permanent ban from any sort of public interaction within the community. + +## Attribution + +This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.1, available at https://www.contributor-covenant.org/version/2/1/code_of_conduct.html. + +Community Impact Guidelines were inspired by [Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/inclusion). + +For answers to common questions about this code of conduct, see the FAQ at https://www.contributor-covenant.org/faq. Translations are available at https://www.contributor-covenant.org/translations. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..ee1e931 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,37 @@ +# Security policy + +## Reporting + +Report privately through [GitHub's advisory form](https://github.com/JustaName-id/frametx-kit/security/advisories/new). Do not open a public issue for anything listed as in scope below. + +Include the transaction hash, the raw bytes, or the smallest snippet that shows the problem, plus the library version and the ethrex commit or endpoint you were talking to. The reports that get fixed fastest are the ones that come with bytes. + +You will get an acknowledgement within three working days. If a fix is warranted we will agree a disclosure date with you before publishing, and credit you in the advisory and the changelog unless you would rather not be named. + +## Scope + +hegota-testnet is a testnet and the assets on it are not real. The interesting risk here is not the coins, it is that this library produces bytes a signer is asked to authorise, and that consumers will carry the same code onto a chain where the assets are real. Treat the following as in scope: + +- A signature or sig-hash flaw that lets a transaction be authorised for something other than what it appears to say, including the `v || r || s` byte order, the recovery id encoding, and signer resolution. +- An encoder or decoder flaw where the bytes on the wire do not match the transaction the caller handed in, or where `getFrameTransaction` returns something whose re-encoding does not reproduce its hash. +- `assertValidFrameTx` accepting an envelope that consensus rejects, or accepting a signature it should refuse. +- Gas accounting that understates `maxCost`, so a caller budgets less than the chain will charge. +- Any path where node-supplied data reaches a caller as trusted, without the hash check that is meant to pin it. +- A dependency in the published tarball that runs code at install time or reaches the network. + +Out of scope, and better reported elsewhere: + +- Bugs in the ethrex node, which belong in [its issue tracker](https://github.com/lambdaclass/ethrex/issues). Open a divergence report here as well so the disagreement is recorded. +- The availability or the data served by the public endpoint at `rpc1.privacy.ethrex.xyz`, which this project does not operate. +- Anything that requires a caller to pass their own private key to code they chose to run. +- A missing validation in `encodeFrameTx`, which does not validate by design. The strict path is `assertValidFrameTx(tx)` and then `encodeFrameTx(tx)`, and the reasoning is in `CONTRIBUTING.md`. + +## Supported versions + +Pre-1.0, only the latest published version receives fixes. Upgrade before reporting, and say which version you tested. + +Releases are published to npm with [provenance](https://docs.npmjs.com/generating-provenance-statements) from the tagged commit in this repository, so you can verify that a tarball was built from the source you are reading. + +## Dependencies + +Installs are held to a seven day minimum release age, transitive dependencies included, so a hijacked release is likely to be found before it reaches anyone's `node_modules`. The value lives in `bunfig.toml` and applies to contributors and to CI. It does nothing against a package that was malicious from its first version, so a new dependency still gets its repository and its install scripts read before it is added. From d08917398415d604197de59c70405b37410594ef Mon Sep 17 00:00:00 2001 From: Mariano Aguero Date: Thu, 17 Sep 2026 17:06:03 -0300 Subject: [PATCH 3/7] ci: add codeql, scorecard and dependabot with cooldown --- .github/dependabot.yml | 26 +++++++++++++++++++++ .github/workflows/codeql.yml | 30 +++++++++++++++++++++++++ .github/workflows/scorecard.yml | 40 +++++++++++++++++++++++++++++++++ 3 files changed, 96 insertions(+) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/codeql.yml create mode 100644 .github/workflows/scorecard.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..baa97d1 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,26 @@ +version: 2 +updates: + - package-ecosystem: bun + directory: / + schedule: + interval: weekly + # Matches the seven day minimum release age in bunfig.toml. Without this, + # Dependabot proposes versions that a local `bun install` refuses to resolve. + cooldown: + default-days: 7 + open-pull-requests-limit: 5 + groups: + dev-dependencies: + dependency-type: development + update-types: [minor, patch] + commit-message: + prefix: 'chore(deps)' + + - package-ecosystem: github-actions + directory: / + schedule: + interval: monthly + cooldown: + default-days: 7 + commit-message: + prefix: 'ci(deps)' diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..7c030c9 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,30 @@ +name: CodeQL + +on: + push: + branches: [main] + pull_request: + branches: [main] + schedule: + # Monday morning, so a newly published query catches this code without a push. + - cron: '0 6 * * 1' + +permissions: + contents: read + +jobs: + analyze: + runs-on: ubuntu-latest + permissions: + security-events: write + actions: read + contents: read + steps: + - uses: actions/checkout@v7 + + - uses: github/codeql-action/init@v4 + with: + languages: javascript-typescript + queries: security-extended + + - uses: github/codeql-action/analyze@v4 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 0000000..04de421 --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,40 @@ +name: Scorecard + +on: + branch_protection_rule: + push: + branches: [main] + schedule: + - cron: '30 6 * * 1' + +permissions: read-all + +jobs: + analysis: + runs-on: ubuntu-latest + permissions: + security-events: write + # Signs the results so the public badge and the API can serve them. + id-token: write + contents: read + actions: read + steps: + - uses: actions/checkout@v7 + with: + persist-credentials: false + + - uses: ossf/scorecard-action@v2.4.4 + with: + results_file: results.sarif + results_format: sarif + publish_results: true + + - uses: actions/upload-artifact@v7 + with: + name: scorecard-results + path: results.sarif + retention-days: 5 + + - uses: github/codeql-action/upload-sarif@v4 + with: + sarif_file: results.sarif From 3ee5df191af6c2d71f0921e5411d34180a178364 Mon Sep 17 00:00:00 2001 From: Mariano Aguero Date: Thu, 17 Sep 2026 17:06:03 -0300 Subject: [PATCH 4/7] docs: link the new community and security files --- CONTRIBUTING.md | 7 +++++++ README.md | 16 ++++++++++++++++ 2 files changed, 23 insertions(+) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 6a50320..88bf295 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -195,3 +195,10 @@ someone downstream is encoding bytes with this. where the code and the spec disagree, that is a bug in one of them, so say which. - `docs/OPEN-ITEMS.md` — known gaps and unfinished work. - `README.md` — user-facing API. +- `SECURITY.md` — what counts as a vulnerability here, and why a report goes private. +- `CODE_OF_CONDUCT.md` — expected conduct in issues and pull requests. + +Opening a pull request loads `.github/PULL_REQUEST_TEMPLATE.md`, which asks which oracle +pins the change and whether it touched anything in **Rules that are not style +preferences**. Issues are forms: a disagreement with ethrex goes to the divergence report, +which asks for the transaction hash, the ethrex commit and the rule set you priced under. diff --git a/README.md b/README.md index caccbf9..04cc000 100644 --- a/README.md +++ b/README.md @@ -2,6 +2,8 @@ [![npm](https://img.shields.io/npm/v/%40jaw.id%2Fframetx-kit)](https://www.npmjs.com/package/@jaw.id/frametx-kit) [![CI](https://github.com/JustaName-id/frametx-kit/actions/workflows/ci.yml/badge.svg)](https://github.com/JustaName-id/frametx-kit/actions/workflows/ci.yml) +[![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE) +[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/JustaName-id/frametx-kit/badge)](https://scorecard.dev/viewer/?uri=github.com/JustaName-id/frametx-kit) TypeScript for **EIP-8141 frame transactions** as hegota-testnet (chain ID `8141`) actually accepts them: the composed envelope that also carries EIP-8250 keyed nonces @@ -156,12 +158,26 @@ genesis hash it was taken against, so a re-genesis fails loudly rather than sile Contributions welcome. Read [`CONTRIBUTING.md`](CONTRIBUTING.md) first — this wire format has traps, and several things in `src/` that look like code smells are load-bearing. +The most valuable report is a disagreement with the reference client. If this library and +ethrex produce different bytes, a different hash, a different price or a different receipt, +open a [divergence report](https://github.com/JustaName-id/frametx-kit/issues/new?template=01-divergence.yml) +with the transaction hash or the byte vector. That is what a second implementation is for. + +Anything that could let a transaction be authorised for something other than what it says +goes to [`SECURITY.md`](SECURITY.md) and a private advisory instead of a public issue. + +Looking for somewhere to start? The issues labelled +[good first issue](https://github.com/JustaName-id/frametx-kit/issues?q=is%3Aopen+label%3A%22good+first+issue%22) +are the coverage gaps that need a captured transaction rather than a design decision. + ## Docs - [`CONTRIBUTING.md`](CONTRIBUTING.md) — architecture, invariants, wire-format traps, how the verification oracles work - [`docs/DESIGN.md`](docs/DESIGN.md) — the binding design spec - [`docs/OPEN-ITEMS.md`](docs/OPEN-ITEMS.md) — known gaps and unfinished work +- [`SECURITY.md`](SECURITY.md) — what counts as a vulnerability here, and how to report it +- [`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md) — expected conduct in issues and pull requests ## License From 3440690cffff173e59ef782b61453bea8d3c64b1 Mon Sep 17 00:00:00 2001 From: Mariano Aguero Date: Thu, 17 Sep 2026 17:10:08 -0300 Subject: [PATCH 5/7] ci: pin new workflow actions to commit shas --- .github/workflows/codeql.yml | 6 +++--- .github/workflows/scorecard.yml | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 7c030c9..ea3d65d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -20,11 +20,11 @@ jobs: actions: read contents: read steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: github/codeql-action/init@v4 + - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: languages: javascript-typescript queries: security-extended - - uses: github/codeql-action/analyze@v4 + - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 04de421..e6ab8b8 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -19,22 +19,22 @@ jobs: contents: read actions: read steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: ossf/scorecard-action@v2.4.4 + - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 with: results_file: results.sarif results_format: sarif publish_results: true - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: scorecard-results path: results.sarif retention-days: 5 - - uses: github/codeql-action/upload-sarif@v4 + - uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: sarif_file: results.sarif From 4861ca480487dd1dd88d7d3913b4a69d69036c20 Mon Sep 17 00:00:00 2001 From: Mariano Aguero Date: Thu, 17 Sep 2026 17:10:08 -0300 Subject: [PATCH 6/7] ci: bump pr title action off deprecated node 20 --- .github/workflows/pr-title.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml index cc46bbf..ccaf878 100644 --- a/.github/workflows/pr-title.yml +++ b/.github/workflows/pr-title.yml @@ -11,7 +11,7 @@ jobs: validate: runs-on: ubuntu-latest steps: - - uses: amannn/action-semantic-pull-request@v5 + - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: From 509d799dc355379f9c0c684c3ecc423c851df268 Mon Sep 17 00:00:00 2001 From: Ghadi Mhawej Date: Fri, 18 Sep 2026 10:28:45 +0300 Subject: [PATCH 7/7] docs: point code of conduct enforcement at a team address --- CODE_OF_CONDUCT.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md index a1eba8f..374b61d 100644 --- a/CODE_OF_CONDUCT.md +++ b/CODE_OF_CONDUCT.md @@ -36,7 +36,7 @@ This Code of Conduct applies within all community spaces, and also applies when ## Enforcement -Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at ghadimhawej@outlook.com. All complaints will be reviewed and investigated promptly and fairly. +Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at dev@justalab.co. All complaints will be reviewed and investigated promptly and fairly. All community leaders are obligated to respect the privacy and security of the reporter of any incident.