From 54d12db2974f9be986686eb96fc9580cbd3123f1 Mon Sep 17 00:00:00 2001 From: Igor Beylin <31744795+cryptoxdog@users.noreply.github.com> Date: Sat, 22 Aug 2026 20:01:10 -0400 Subject: [PATCH] chore(governance): auto-seed 17 org template file(s) --- .biomeignore | 6 + .editorconfig | 18 +++ .github/FUNDING.yml | 11 ++ .github/ISSUE_TEMPLATE/1-bug.yml | 66 +++++++++ .github/ISSUE_TEMPLATE/2-feature.yml | 58 ++++++++ .github/ISSUE_TEMPLATE/3-task.yml | 36 +++++ .github/ISSUE_TEMPLATE/4-incident.yml | 90 +++++++++++++ .github/ISSUE_TEMPLATE/config.yml | 15 +++ .github/labels.yml | 35 +++++ .github/pull_request_template.md | 81 ++++++++++++ .github/workflows/governance.yml | 33 +++++ .github/workflows/l9-lint-test-node.yml | 150 +++++++++++++++++++++ .github/workflows/l9-lint-test.yml | 126 ++++++++++++++++++ .github/workflows/on-org-update.yml | 65 +++++++++ .vscode/extensions.json | 3 + LICENSE | 102 ++++++++++++++ biome.json | 169 ++++++++++++++++++++++++ 17 files changed, 1064 insertions(+) create mode 100644 .biomeignore create mode 100644 .editorconfig create mode 100644 .github/FUNDING.yml create mode 100644 .github/ISSUE_TEMPLATE/1-bug.yml create mode 100644 .github/ISSUE_TEMPLATE/2-feature.yml create mode 100644 .github/ISSUE_TEMPLATE/3-task.yml create mode 100644 .github/ISSUE_TEMPLATE/4-incident.yml create mode 100644 .github/ISSUE_TEMPLATE/config.yml create mode 100644 .github/labels.yml create mode 100644 .github/pull_request_template.md create mode 100644 .github/workflows/governance.yml create mode 100644 .github/workflows/l9-lint-test-node.yml create mode 100644 .github/workflows/l9-lint-test.yml create mode 100644 .github/workflows/on-org-update.yml create mode 100644 .vscode/extensions.json create mode 100644 LICENSE create mode 100644 biome.json diff --git a/.biomeignore b/.biomeignore new file mode 100644 index 0000000..bddc75c --- /dev/null +++ b/.biomeignore @@ -0,0 +1,6 @@ +# Biome path exclusions (gitignore syntax). +# Biome 2.5 reads files.includes in biome.json, not this file — keep generated trees in both. + +coverage/ +dist/ +.l9/ diff --git a/.editorconfig b/.editorconfig new file mode 100644 index 0000000..585946c --- /dev/null +++ b/.editorconfig @@ -0,0 +1,18 @@ +root = true + +[*] +charset = utf-8 +end_of_line = lf +insert_final_newline = true +trim_trailing_whitespace = true +indent_style = space +indent_size = 2 + +[*.py] +indent_size = 4 + +[*.md] +trim_trailing_whitespace = false + +[Makefile] +indent_style = tab diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml new file mode 100644 index 0000000..7e1d6ce --- /dev/null +++ b/.github/FUNDING.yml @@ -0,0 +1,11 @@ +# Quantum-L9 org-wide funding configuration. +# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository +# +# No public sponsor links are configured. This is an internal engineering org; +# entries are intentionally left blank rather than omitting the file, so any +# future decision to enable a sponsor button is a one-line change, not a new +# file requiring CODEOWNERS/governance re-review. +# +# github: [] +# open_collective: # '' +# custom: # [''] diff --git a/.github/ISSUE_TEMPLATE/1-bug.yml b/.github/ISSUE_TEMPLATE/1-bug.yml new file mode 100644 index 0000000..2539204 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/1-bug.yml @@ -0,0 +1,66 @@ +name: 🐛 Bug +description: Something behaves incorrectly and you can show it. +title: "bug: " +labels: ["type:bug", "needs:triage"] +body: + - type: markdown + attributes: + value: | + CI pipeline failures go to + [l9-ci-debt-resolver](https://github.com/Quantum-L9/l9-ci-debt-resolver/issues/new) + instead — that component owns failure diagnosis. + + - type: textarea + id: problem + attributes: + label: Problem + description: The symptom you observed, in one or two sentences. Not your theory. + validations: + required: true + + - type: textarea + id: evidence + attributes: + label: Error output + description: Traceback, failing assertion, or log line. Redact secrets. + render: shell + validations: + required: true + + - type: textarea + id: reproduce + attributes: + label: Reproduction + description: Steps from a clean checkout. Best effort is fine. + render: shell + + - type: input + id: version + attributes: + label: Version / commit + description: Release tag or SHA if you have it. + + - type: dropdown + id: severity + attributes: + label: Severity + description: Routes triage. Advisory only — nothing is blocked by this. + options: + - S4 — cosmetic + - S3 — degraded, workaround exists + - S2 — major function broken, no workaround + - S1 — production down, data loss, or security exposure + validations: + required: true + + - type: input + id: regression + attributes: + label: Last known good version + description: If set, implies a bisect range. Leave blank if unknown. + + - type: textarea + id: context + attributes: + label: Anything else + description: Suspected cause, related issues, workaround in use. diff --git a/.github/ISSUE_TEMPLATE/2-feature.yml b/.github/ISSUE_TEMPLATE/2-feature.yml new file mode 100644 index 0000000..41df311 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/2-feature.yml @@ -0,0 +1,58 @@ +name: ✨ Feature +description: Propose a capability that does not exist yet. +title: "feat: " +labels: ["type:feature", "needs:triage"] +body: + - type: textarea + id: problem + attributes: + label: Problem + description: The pain, not the solution. Who is blocked, and on what? + validations: + required: true + + - type: textarea + id: today + attributes: + label: What you do today + description: Current workaround and its cost. + + - type: textarea + id: proposal + attributes: + label: Proposed behavior + description: What should exist. Include the interface if you know it. + validations: + required: true + + - type: dropdown + id: owner + attributes: + label: Which component should own this? + description: Prevents governance from absorbing CI concerns. + options: + - this repo (org governance / community health) + - l9-ci-sdk or l9-ci-core (test, lint, build execution) + - l9-ci-debt-resolver (CI failure diagnosis or remediation) + - l9-ci-debt-intelligence (CI debt measurement) + - unsure + validations: + required: true + + - type: textarea + id: alternatives + attributes: + label: Alternatives considered + description: Options you rejected and why. + + - type: dropdown + id: scope + attributes: + label: Scope + options: + - S — under a day + - M — a few days, one repo + - L — multi-repo or migration + - XL — needs a design doc first + validations: + required: true diff --git a/.github/ISSUE_TEMPLATE/3-task.yml b/.github/ISSUE_TEMPLATE/3-task.yml new file mode 100644 index 0000000..b7705f9 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/3-task.yml @@ -0,0 +1,36 @@ +name: 🔧 Task +description: Known work with a known solution — chore, refactor, infra, docs. +title: "chore: " +labels: ["type:task"] +body: + - type: textarea + id: problem + attributes: + label: Problem + description: Why this work exists. What degrades if it is never done? + validations: + required: true + + - type: textarea + id: work + attributes: + label: Work + value: | + - [ ] + - [ ] + validations: + required: true + + - type: dropdown + id: kind + attributes: + label: Kind + options: [chore, refactor, infra / IaC, governance, docs, dependency bump] + validations: + required: true + + - type: input + id: blocks + attributes: + label: Blocks / blocked by + placeholder: "blocked by #12, blocks #34" diff --git a/.github/ISSUE_TEMPLATE/4-incident.yml b/.github/ISSUE_TEMPLATE/4-incident.yml new file mode 100644 index 0000000..bf7247d --- /dev/null +++ b/.github/ISSUE_TEMPLATE/4-incident.yml @@ -0,0 +1,90 @@ +name: 🚨 Incident +description: Production is degraded or down. File first, investigate second. +title: "incident: " +labels: ["type:incident", "sev:untriaged", "priority:P0"] +assignees: [] +body: + - type: markdown + attributes: + value: | + **Page first, file second.** If customers are affected and nobody is paged, + stop and page on-call. This issue is the written record, not the alarm. + If this is a security compromise, use a private advisory instead — not this form. + + - type: input + id: started + attributes: + label: Detected at (UTC) + placeholder: "2026-07-28T15:04:00Z" + validations: + required: true + + - type: textarea + id: problem + attributes: + label: Problem + description: Customer-visible symptom. What is broken, for whom, since when? + validations: + required: true + + - type: dropdown + id: severity + attributes: + label: Severity + options: + - S1 — full outage, data loss, or security exposure + - S2 — major degradation, no workaround + - S3 — partial degradation, workaround in place + validations: + required: true + + - type: textarea + id: evidence + attributes: + label: Signal + description: Alert name, dashboard link, error rate, sample traceback. + render: shell + validations: + required: true + + - type: textarea + id: impact + attributes: + label: Blast radius + description: Services, regions, tenants, and estimated request or user count. + validations: + required: true + + - type: textarea + id: mitigation + attributes: + label: Mitigation in progress + description: What is being done right now. Update this field as it evolves. + validations: + required: true + + - type: input + id: suspect + attributes: + label: Suspected trigger + description: Deploy, PR, config change, or upstream provider. Link it. + placeholder: "#1184, deployed 14:52Z" + + - type: input + id: commander + attributes: + label: Incident commander + placeholder: "@handle" + validations: + required: true + + - type: checkboxes + id: gates + attributes: + label: Response checklist + options: + - label: On-call paged. + required: true + - label: Status page or stakeholder comms updated, or explicitly not needed. + - label: Timeline is being kept in the comments below. + - label: Postmortem issue will be opened within 48h of resolution. diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..ca75bf6 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,15 @@ +# Quantum-L9 org-wide issue template chooser config. +# https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/configuring-issue-templates-for-your-repository + +blank_issues_enabled: false + +contact_links: + - name: Security Vulnerability Report + url: https://github.com/Quantum-L9/.github/security/policy + about: Do not open a public issue for security vulnerabilities. Follow SECURITY.md instead. + - name: Governance / CANONICAL_LAW Question + url: https://github.com/Quantum-L9/Cursor-Governance/blob/main/CANONICAL_LAW.md + about: For questions about governance policy, symlink contracts, or CANONICAL_LAW.md, read the policy source of truth first. + - name: CI Kernel API Contract + url: https://github.com/Quantum-L9/.github/blob/main/workflow-interface-registry.yml + about: For questions about kernel inputs/outputs/versioning, check the machine-readable registry before filing an issue. diff --git a/.github/labels.yml b/.github/labels.yml new file mode 100644 index 0000000..f828515 --- /dev/null +++ b/.github/labels.yml @@ -0,0 +1,35 @@ +# Apply with: gh label create --file (or github-label-sync). Names are load-bearing: +# workflows in .github/workflows/issue-triage.yml write sev:*, priority:*, scope:*. +- { name: "type:bug", color: "d73a4a", description: "Incorrect behavior with evidence" } +- { name: "type:feature", color: "0e8a16", description: "New capability" } +- { name: "type:task", color: "c5def5", description: "Known work, known solution" } +- { name: "type:incident", color: "b60205", description: "Production degraded or down" } +- { name: "sev:S1", color: "b60205", description: "Outage, data loss, or security exposure" } +- { name: "sev:S2", color: "d93f0b", description: "Major function broken, no workaround" } +- { name: "sev:S3", color: "fbca04", description: "Degraded, workaround exists" } +- { name: "sev:S4", color: "fef2c0", description: "Cosmetic" } +- { name: "sev:untriaged", color: "ededed", description: "Severity not yet assessed" } +- { name: "priority:P0", color: "b60205", description: "Drop everything" } +- { name: "priority:P1", color: "d93f0b", description: "This sprint" } +- { name: "priority:P2", color: "fbca04", description: "Backlog, scheduled" } +- { name: "priority:P3", color: "fef2c0", description: "Someday" } +- { name: "scope:S", color: "e4e669", description: "Under a day" } +- { name: "scope:M", color: "e4e669", description: "A few days, one repo" } +- { name: "scope:L", color: "e4e669", description: "Multi-repo or migration" } +- { name: "scope:XL", color: "e4e669", description: "Needs a design doc first" } +- { name: "needs:triage", color: "ededed", description: "Awaiting maintainer review" } +- { name: "needs:info", color: "ededed", description: "Blocked on the reporter; eligible for stale" } +- { name: "regression", color: "5319e7", description: "Worked in an earlier version" } +- { name: "breaking", color: "5319e7", description: "Requires a major version bump" } +- { name: "env:prod", color: "1d76db", description: "Observed in production" } +- { name: "area:ci", color: "1d76db", description: "CI/CD pipelines" } +- { name: "area:ci-templates", color: "1d76db", description: "workflow-templates/ starter gallery" } +- { name: "area:ci-pack", color: "1d76db", description: "l9-ci-pack/ v2 instantiation kit" } +- { name: "area:governance", color: "5319e7", description: "registry, ADR template, governance docs" } +- { name: "area:ops", color: "1d76db", description: "ops/ scripts" } +- { name: "area:issue-templates", color: "c5def5", description: ".github/ISSUE_TEMPLATE/" } +- { name: "area:community-health", color: "0e8a16", description: "CONTRIBUTING/SECURITY/SUPPORT/etc" } +- { name: "area:org-profile", color: "7057ff", description: "profile/ org landing page" } +- { name: "area:ci-self", color: "1d76db", description: ".github/workflows/ self-CI" } +- { name: "security:possible-leak", color: "b60205", description: "May contain a credential — rotate" } +- { name: "good first issue",color: "7057ff", description: "Scoped, documented, low context" } diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 0000000..302ac5c --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,81 @@ + + +## Problem + + + +``` +paste the error / failing output here, or delete this block and describe the gap +``` + +Closes # + +## Fix + + + +## Risk + + + +- [ ] Low — additive, reversible, no data or contract change +- [ ] Medium — touches shared code, config, or a public interface +- [ ] High — breaking change, migration, IAM/network, or irreversible + +Blast radius: +Rollback: + +## Evidence + + + +``` +$ pytest -q +$ ruff check . && pyright +``` + +## Gates + + + +- [ ] Regression test added that fails without this fix +- [ ] No secrets, tokens, or customer data in code, tests, fixtures, or logs +- [ ] `semgrep` clean, or findings triaged below +- [ ] New IAM / workflow permissions are least privilege and enumerated +- [ ] Third-party actions pinned to a full commit SHA +- [ ] Public interface change is documented and versioned +- [ ] Observability exists for the new path (metric, log, trace, or alert) + +## Reviewer focus + + + +## Changes by intent + + + +**Added** +- `path/to/new_file.py` — why this file needs to exist + +**Modified** +- `path/to/existing.py` — what changed in it and why + +**Deleted** +- `path/to/dead.py` — why it is safe to remove + +## Files touched + + + + +_pending — the bot fills this in on push_ + diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml new file mode 100644 index 0000000..070aae5 --- /dev/null +++ b/.github/workflows/governance.yml @@ -0,0 +1,33 @@ +# Managed by Quantum-L9/.github. Pinned to a tag so main can move safely. +# +# This file should never need editing again. Governance logic lives in +# Quantum-L9/.github/.github/workflows/governance-*.yml; shipping a change means +# force-moving the v1 tag there, not touching this file. +# +# SECRETS: a called workflow does NOT inherit caller secrets automatically. Today +# both callees use only the automatic GITHUB_TOKEN, so nothing is passed. If a +# governance job later needs a real secret, add `secrets:` to the job below — +# `inherit` for all, or named entries (preferred, least privilege). +# See docs/DISTRIBUTION.md Appendix A. +# +# ACCESS: if this caller fails before any step runs, check the Actions policy on +# THIS repo — see Appendix B. `gh api repos/OWNER/REPO/actions/permissions` + +name: Governance + +on: + pull_request: + types: [opened, edited, synchronize, reopened, ready_for_review] + issues: + types: [opened, edited, reopened] + +jobs: + pr: + if: github.event_name == 'pull_request' + uses: Quantum-L9/.github/.github/workflows/governance-pr.yml@v1 + # secrets: inherit + + issue: + if: github.event_name == 'issues' + uses: Quantum-L9/.github/.github/workflows/governance-issue.yml@v1 + # secrets: inherit diff --git a/.github/workflows/l9-lint-test-node.yml b/.github/workflows/l9-lint-test-node.yml new file mode 100644 index 0000000..1903d29 --- /dev/null +++ b/.github/workflows/l9-lint-test-node.yml @@ -0,0 +1,150 @@ +# L9 consumer lint + test workflow for Node.js / TypeScript +# +# Copy into the CONSUMER repo at `.github/workflows/l9-lint-test-node.yml`. +# Org-distributed copy of Quantum-L9/l9-ci-core presets/typescript +# `.github/workflows/l9-lint-test.yml`. Do not invent a second lint owner. +# +# Formatter/linter ownership: Biome owns JS/TS/JSON (format + lint) via the +# SDK-owned reusable workflow below. ESLint is NOT a second formatter owner +# here. Type checking (tsc) and the repository test suite stay in this repo. +# +# Conventions: +# - Immutable event-revision checkout (no floating action ref) +# - SDK reusable workflow pinned to a full 40-char commit SHA +# - Least privilege (contents: read only) +name: L9 Lint and Test (Node) +on: + pull_request: + push: + branches: [main] + workflow_dispatch: + +# ── CONFIGURABLE: agent sets these during activation ─────────────────────────── +env: + NODE_VERSION: "20" + PACKAGE_MANAGER: "npm" + SOURCE_DIR: "." + HAS_TYPESCRIPT: "true" + +permissions: + contents: read + +concurrency: + group: l9-lint-test-node-${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + # Biome (format + lint + import organization) is owned by the SDK reusable + # workflow — a single read-only gate with a checksum-verified biome binary + # and zero external actions. Reusable-workflow inputs cannot read `env:`, so + # scan-path and the rollout flag are set literally here. + biome: + name: Biome (format + lint) — SDK-owned + permissions: + contents: read + uses: Quantum-L9/l9-ci-sdk/.github/workflows/l9-biome-scan.yml@f546f122d33601ea5a4b2592e3482c5c39eddd82 + with: + scan-path: "." + # Advisory-to-blocking rollout: false = full scan + annotate + exit 0. + # Flip to true to make Biome findings blocking once the repo is clean. + enforce-biome: false + + typecheck: + name: Type Check (tsc --noEmit) + runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + contents: read + steps: + - name: Checkout immutable event revision + env: + REPOSITORY: ${{ github.repository }} + REVISION: ${{ github.sha }} + TOKEN: ${{ github.token }} + run: | + set -euo pipefail + git init . + git remote add origin "https://github.com/${REPOSITORY}.git" + # Authenticate with a per-fetch Authorization header instead of + # embedding the token in the remote URL, so the credential is never + # written to the remote URL or .git/config (mirrors actions/checkout). + auth_header="Authorization: Basic $(printf 'x-access-token:%s' "${TOKEN}" | base64 | tr -d '\n')" + git -c protocol.version=2 \ + -c "http.https://github.com/.extraheader=${auth_header}" \ + fetch --depth=1 origin "${REVISION}" + git checkout --detach FETCH_HEAD + + - name: Set up Node + uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 + with: + node-version: ${{ env.NODE_VERSION }} + cache: ${{ env.PACKAGE_MANAGER }} + + - name: Install dependencies + run: | + set -euo pipefail + case "${PACKAGE_MANAGER}" in + npm) if [ -f package-lock.json ]; then npm ci; else npm install; fi ;; + pnpm) corepack enable && (if [ -f pnpm-lock.yaml ]; then pnpm install --frozen-lockfile; else pnpm install; fi) ;; + yarn) corepack enable && (if [ -f yarn.lock ]; then yarn install --frozen-lockfile; else yarn install; fi) ;; + *) echo "::error::unknown PACKAGE_MANAGER ${PACKAGE_MANAGER}" && exit 1 ;; + esac + + - name: tsc --noEmit + if: env.HAS_TYPESCRIPT == 'true' + run: | + set -euo pipefail + if [ -f tsconfig.json ]; then + npx --yes tsc --noEmit -p tsconfig.json + else + echo "::notice::no tsconfig.json found, skipping type check" + fi + + test: + name: Test Suite + runs-on: ubuntu-latest + timeout-minutes: 30 + permissions: + contents: read + steps: + - name: Checkout immutable event revision + env: + REPOSITORY: ${{ github.repository }} + REVISION: ${{ github.sha }} + TOKEN: ${{ github.token }} + run: | + set -euo pipefail + git init . + git remote add origin "https://github.com/${REPOSITORY}.git" + auth_header="Authorization: Basic $(printf 'x-access-token:%s' "${TOKEN}" | base64 | tr -d '\n')" + git -c protocol.version=2 \ + -c "http.https://github.com/.extraheader=${auth_header}" \ + fetch --depth=1 origin "${REVISION}" + git checkout --detach FETCH_HEAD + + - name: Set up Node + uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 + with: + node-version: ${{ env.NODE_VERSION }} + cache: ${{ env.PACKAGE_MANAGER }} + + - name: Install dependencies + run: | + set -euo pipefail + case "${PACKAGE_MANAGER}" in + npm) if [ -f package-lock.json ]; then npm ci; else npm install; fi ;; + pnpm) corepack enable && (if [ -f pnpm-lock.yaml ]; then pnpm install --frozen-lockfile; else pnpm install; fi) ;; + yarn) corepack enable && (if [ -f yarn.lock ]; then yarn install --frozen-lockfile; else yarn install; fi) ;; + *) echo "::error::unknown PACKAGE_MANAGER ${PACKAGE_MANAGER}" && exit 1 ;; + esac + + - name: Run test suite + env: + CI: "true" + run: | + set -euo pipefail + if [ -f package.json ] && node -e "process.exit(require('./package.json').scripts && require('./package.json').scripts.test ? 0 : 1)" 2>/dev/null; then + ${PACKAGE_MANAGER} test + else + echo "::notice::no test script defined in package.json, skipping" + fi diff --git a/.github/workflows/l9-lint-test.yml b/.github/workflows/l9-lint-test.yml new file mode 100644 index 0000000..8822dc4 --- /dev/null +++ b/.github/workflows/l9-lint-test.yml @@ -0,0 +1,126 @@ +# L9 consumer lint + test workflow (TEMPLATE — copy into your repo) +# +# This file is NOT executed from l9-ci-core. Copy it into the CONSUMER +# repository at `.github/workflows/l9-lint-test.yml`. It replaces the +# lint / type-check / test half of the retired v1 `pr-pipeline.yml`. +# +# It deliberately lives consumer-side: l9-ci-core v2 is a thin control plane +# whose workflow set is fixed by `tests/workflows/test_phase_scope.py`. Generic +# ruff / mypy / pytest *config* is owned by the consuming repository; *versions* +# come from install-consumer-ci@v2. Do not write version literals here. +# +# v2 conventions preserved here: +# - immutable event-revision checkout (no floating action ref) +# - external actions pinned to full commit SHAs +# - explicit least-privilege permissions (contents: read, no write scopes) +name: L9 Lint and Test + +on: + pull_request: + push: + branches: + - main + workflow_dispatch: + +# ── Consumer config: edit these values for your repo ─────────────────────────── +env: + PYTHON_VERSION: "3.12" + SOURCE_DIR: "." + TEST_DIR: "tests/" + # Fail the build below this line coverage percentage. 0 = advisory (no gate). + COVERAGE_THRESHOLD: "0" + +permissions: + contents: read + +concurrency: + group: l9-lint-test-${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + lint: + name: Lint and Type Check + runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + contents: read + steps: + - name: Checkout immutable event revision + env: + REPOSITORY: ${{ github.repository }} + REVISION: ${{ github.sha }} + TOKEN: ${{ github.token }} + run: | + set -euo pipefail + git init . + git remote add origin \ + "https://x-access-token:${TOKEN}@github.com/${REPOSITORY}.git" + git -c protocol.version=2 fetch --depth=1 origin "${REVISION}" + git checkout --detach FETCH_HEAD + git remote set-url origin "https://github.com/${REPOSITORY}.git" + - name: Set up Python + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + with: + python-version: ${{ env.PYTHON_VERSION }} + - name: Install consumer CI toolchain + uses: Quantum-L9/l9-ci-core/.github/actions/install-consumer-ci@v2 + - name: Install extra CI requirements + run: | + set -euo pipefail + if [ -f requirements-ci.txt ]; then pip install -r requirements-ci.txt; fi + - name: ruff check + run: ruff check . --output-format=github + - name: ruff format --check + run: ruff format --check . + - name: mypy + run: | + mypy "${SOURCE_DIR}" \ + --show-error-codes --pretty \ + --install-types --non-interactive --ignore-missing-imports + + test: + name: Test Suite + runs-on: ubuntu-latest + timeout-minutes: 30 + permissions: + contents: read + steps: + - name: Checkout immutable event revision + env: + REPOSITORY: ${{ github.repository }} + REVISION: ${{ github.sha }} + TOKEN: ${{ github.token }} + run: | + set -euo pipefail + git init . + git remote add origin \ + "https://x-access-token:${TOKEN}@github.com/${REPOSITORY}.git" + git -c protocol.version=2 fetch --depth=1 origin "${REVISION}" + git checkout --detach FETCH_HEAD + git remote set-url origin "https://github.com/${REPOSITORY}.git" + - name: Set up Python + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + with: + python-version: ${{ env.PYTHON_VERSION }} + - name: Install consumer CI toolchain + uses: Quantum-L9/l9-ci-core/.github/actions/install-consumer-ci@v2 + - name: Install test tools + run: | + set -euo pipefail + if [ -f requirements-ci.txt ]; then pip install -r requirements-ci.txt; fi + pip install -e ".[dev]" || pip install -e . || \ + echo "::notice::no local editable package to install" + python -c "import pytest_cov" 2>/dev/null || pip install pytest-cov + python -c "import xdist" 2>/dev/null || pip install pytest-xdist + python -c "import pytest_timeout" 2>/dev/null || pip install pytest-timeout + - name: pytest with coverage + env: + TESTING: "true" + run: | + set -euo pipefail + PYTHONPATH=. pytest "${TEST_DIR}" \ + -n auto \ + --cov="${SOURCE_DIR}" \ + --cov-report=xml --cov-report=term-missing \ + --cov-fail-under="${COVERAGE_THRESHOLD}" \ + --timeout=300 --tb=short -v diff --git a/.github/workflows/on-org-update.yml b/.github/workflows/on-org-update.yml new file mode 100644 index 0000000..33cad87 --- /dev/null +++ b/.github/workflows/on-org-update.yml @@ -0,0 +1,65 @@ +# Receiver for org template updates. Place at .github/workflows/on-org-update.yml. +# When Quantum-L9/.github pushes a template change, this workflow auto-syncs. +name: Sync on org update + +on: + repository_dispatch: + types: [org_template_updated] + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + sync: + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + + - name: Set up Python + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + with: + python-version: "3.12" + + - name: Run sync-ci + run: | + set -euo pipefail + if [ -f scripts/sync_ci_from_pack.py ]; then + python scripts/sync_ci_from_pack.py + else + echo "::notice::No sync_ci_from_pack.py found — skipping" + exit 0 + fi + + - name: Check for changes + id: diff + run: | + if git diff --quiet; then + echo "changed=false" >> "$GITHUB_OUTPUT" + else + echo "changed=true" >> "$GITHUB_OUTPUT" + fi + + - name: Create sync PR + if: steps.diff.outputs.changed == 'true' + run: | + set -euo pipefail + BRANCH="chore/auto-sync-org-templates" + git checkout -b "$BRANCH" + git add -A + git -c user.name="l9-governance[bot]" -c user.email="governance@quantum-l9.dev" \ + commit -m "chore: auto-sync org templates from Quantum-L9/.github" + git push -f origin "$BRANCH" + + # Create PR if none exists + EXISTING=$(gh pr list --head "$BRANCH" --state open --json number --jq '.[0].number' 2>/dev/null || true) + if [ -z "$EXISTING" ]; then + gh pr create \ + --title "chore: auto-sync org templates" \ + --body "Org templates changed in Quantum-L9/.github. This PR syncs the updates. Merge at your convenience." \ + --base "$(git remote show origin | grep 'HEAD branch' | awk '{print $NF}')" + fi + env: + GH_TOKEN: ${{ github.token }} diff --git a/.vscode/extensions.json b/.vscode/extensions.json new file mode 100644 index 0000000..699ed73 --- /dev/null +++ b/.vscode/extensions.json @@ -0,0 +1,3 @@ +{ + "recommendations": ["biomejs.biome"] +} diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..47f4524 --- /dev/null +++ b/LICENSE @@ -0,0 +1,102 @@ +QUANTUM AI PARTNERS — L9 PROPRIETARY SOFTWARE LICENSE +Version 1.0 — 2026 + +Copyright (c) 2026 Quantum AI Partners ("Licensor"). All rights reserved. + +This software and associated documentation files (the "Software") are the +proprietary property of Quantum AI Partners. The Software is made +source-available on this repository for transparency, audit, and evaluation +purposes only, under the terms below. NO OPEN-SOURCE LICENSE IS GRANTED. No +prior license grant by Licensor (if any) shall be construed as a waiver of +these terms. + +1. DEFINITIONS + + "Software" means the source code, object code, documentation, domain + specs, configuration, and all other files contained in this repository, + and any modifications or derivative works thereof. + + "Commercial Use" means any use of the Software, in whole or in part, + directly or indirectly, from which any person or entity derives revenue, + profit, cost savings, competitive advantage, or other commercial benefit. + This includes, without limitation: selling, sublicensing, or hosting the + Software or a derivative work; incorporating the Software into a product + or service offered to third parties (including as part of a SaaS, + managed service, or consulting engagement); and internal use by a + for-profit entity in its business operations beyond internal evaluation. + + "You" / "Licensee" means any individual or entity that accesses, clones, + copies, or otherwise makes use of the Software. + +2. LIMITED GRANT + + Subject to Your compliance with this License, Licensor grants You a + limited, non-exclusive, non-transferable, revocable license to view, + clone, and use the Software solely for personal, academic, or internal + evaluation purposes that do NOT constitute Commercial Use. + +3. COMMERCIAL USE REQUIRES A PAID LICENSE + + Any Commercial Use of the Software requires a separate written commercial + license agreement with Quantum AI Partners, negotiated in advance, which + may include license fees, royalties, or a revenue/profit share. Engaging + in Commercial Use without such an agreement is a material breach of this + License and constitutes copyright infringement. + + To request a commercial license, contact: eng@l9.dev + +4. RESTRICTIONS + + Except as expressly permitted under Section 2, You may NOT, without prior + written consent from Licensor: + + a. Copy, reproduce, or redistribute the Software, in source or object + form, to any third party; + b. Modify, create derivative works of, reverse-engineer, or decompile + the Software, except as necessary for permitted evaluation; + c. Sublicense, sell, rent, lease, or otherwise transfer any rights in + the Software; + d. Host, deploy, or offer the Software (or a derivative work) as a + hosted or managed service to any third party; + e. Remove, obscure, or alter any copyright, trademark, or proprietary + notice contained in the Software; + f. Use the Software to build, train, or benchmark a directly competing + product or service. + +5. OWNERSHIP + + The Software is licensed, not sold. Licensor retains all right, title, + and interest in and to the Software, including all intellectual property + rights therein. No rights are granted to You other than as expressly set + forth in this License. + +6. TERMINATION + + This License terminates automatically, without notice, if You breach any + term of this License. Upon termination, You must cease all use of the + Software and destroy all copies in Your possession or control. Sections + 3, 5, 7, and 8 survive termination. + +7. NO WARRANTY + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS + OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. + +8. LIMITATION OF LIABILITY + + IN NO EVENT SHALL LICENSOR BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING + FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER + DEALINGS IN THE SOFTWARE. + +9. GOVERNING LAW + + This License shall be governed by the laws of the State of Delaware, + United States of America, without regard to conflict-of-law principles. + +--- +REPOSITORY NOTICE: This LICENSE applies only to the Quantum-L9/.github +repository. GitHub does not propagate LICENSE files via org community-health +fallbacks. Other Quantum-L9 repositories should include their own LICENSE +file (this text may be used as the org template). diff --git a/biome.json b/biome.json new file mode 100644 index 0000000..b1fe395 --- /dev/null +++ b/biome.json @@ -0,0 +1,169 @@ +{ + "$schema": "https://biomejs.dev/schemas/2.5.8/schema.json", + "root": true, + "vcs": { + "enabled": true, + "clientKind": "git", + "useIgnoreFile": true, + "defaultBranch": "main" + }, + "files": { + "ignoreUnknown": true, + "maxSize": 1048576, + "includes": [ + "**", + "!**/*.jsonc", + "!**/node_modules", + "!**/.venv", + "!**/venv", + "!**/__pycache__", + "!**/.git", + "!**/.ruff_cache", + "!**/.l9", + "!**/dist", + "!**/coverage", + "!**/package-lock.json", + "!**/npm-shrinkwrap.json" + ] + }, + "formatter": { + "enabled": true, + "formatWithErrors": false, + "useEditorconfig": true, + "indentStyle": "space", + "indentWidth": 2, + "lineEnding": "lf", + "lineWidth": 100, + "trailingNewline": true, + "bracketSpacing": true, + "bracketSameLine": false, + "attributePosition": "auto", + "expand": "auto", + "delimiterSpacing": false + }, + "linter": { + "enabled": true, + "rules": { + "preset": "recommended" + } + }, + "assist": { + "enabled": true, + "actions": { + "preset": "recommended", + "source": { + "organizeImports": "on", + "useSortedKeys": "off", + "useSortedAttributes": "off", + "useSortedInterfaceMembers": "off", + "useSortedEnumMembers": "on", + "useSortedPackageJson": "on", + "noDuplicateClasses": "on" + } + } + }, + "json": { + "parser": { + "allowComments": false, + "allowTrailingCommas": false + }, + "formatter": { + "enabled": true, + "indentStyle": "space", + "indentWidth": 2, + "lineEnding": "lf", + "lineWidth": 100, + "trailingNewline": true, + "trailingCommas": "none", + "bracketSpacing": true, + "expand": "auto", + "delimiterSpacing": false + }, + "linter": { + "enabled": true + }, + "assist": { + "enabled": false + } + }, + "javascript": { + "jsxRuntime": "transparent", + "formatter": { + "enabled": true, + "indentStyle": "space", + "indentWidth": 2, + "lineEnding": "lf", + "lineWidth": 100, + "trailingNewline": true, + "quoteStyle": "double", + "jsxQuoteStyle": "double", + "quoteProperties": "asNeeded", + "trailingCommas": "all", + "semicolons": "always", + "arrowParentheses": "always", + "bracketSpacing": true, + "bracketSameLine": false, + "attributePosition": "auto", + "operatorLinebreak": "after", + "expand": "auto", + "delimiterSpacing": false + }, + "linter": { + "enabled": true + }, + "assist": { + "enabled": true + } + }, + "css": { + "formatter": { + "enabled": false + }, + "linter": { + "enabled": false + }, + "assist": { + "enabled": false + } + }, + "graphql": { + "formatter": { + "enabled": false + }, + "linter": { + "enabled": false + }, + "assist": { + "enabled": false + } + }, + "html": { + "experimentalFullSupportEnabled": false, + "formatter": { + "enabled": false + }, + "linter": { + "enabled": false + }, + "assist": { + "enabled": false + } + }, + "overrides": [ + { + "includes": ["**/*.jsonc", "**/.vscode"], + "json": { + "parser": { + "allowComments": true, + "allowTrailingCommas": true + }, + "formatter": { + "enabled": false + }, + "linter": { + "enabled": false + } + } + } + ] +}