From e70aec534d9d8a2c45990165d383a9af5c053945 Mon Sep 17 00:00:00 2001 From: Igor Beylin <31744795+cryptoxdog@users.noreply.github.com> Date: Sat, 22 Aug 2026 14:10:53 -0400 Subject: [PATCH] chore(governance): auto-seed 34 org template file(s) --- .biomeignore | 6 + .editorconfig | 18 ++ .github/CODEOWNERS | 18 ++ .github/FUNDING.yml | 11 + .github/ISSUE_TEMPLATE/1-bug.yml | 66 ++++++ .github/ISSUE_TEMPLATE/2-feature.yml | 58 +++++ .github/ISSUE_TEMPLATE/3-task.yml | 36 ++++ .github/ISSUE_TEMPLATE/4-incident.yml | 90 ++++++++ .github/ISSUE_TEMPLATE/bug_report.yml | 99 +++++++++ .github/ISSUE_TEMPLATE/ci-failure.yml | 86 ++++++++ .github/ISSUE_TEMPLATE/config.yml | 15 ++ .github/ISSUE_TEMPLATE/feature_request.yml | 69 ++++++ .github/ISSUE_TEMPLATE/gov-violation.yml | 84 ++++++++ .github/dependabot.yml | 35 +++ .github/governance/execution-profiles.yaml | 45 ++++ .github/governance/promotion-policy.yaml | 16 ++ .github/governance/provider-requiredness.yaml | 20 ++ .github/governance/quality-thresholds.yaml | 21 ++ .github/governance/rule-modes.yaml | 19 ++ .github/governance/waivers.yaml | 4 + .github/labels.yml | 35 +++ .github/pull_request_template.md | 81 +++++++ .github/workflows/governance.yml | 33 +++ .github/workflows/l9-analysis.yml | 200 ++++++++++++++++++ .github/workflows/l9-lint-test-node.yml | 150 +++++++++++++ .github/workflows/l9-lint-test.yml | 126 +++++++++++ .github/workflows/on-org-update.yml | 65 ++++++ .vscode/extensions.json | 3 + CODE_OF_CONDUCT.md | 54 +++++ CONTRIBUTING.md | 101 +++++++++ LICENSE | 102 +++++++++ SECURITY.md | 63 ++++++ SUPPORT.md | 36 ++++ biome.json | 169 +++++++++++++++ 34 files changed, 2034 insertions(+) create mode 100644 .biomeignore create mode 100644 .editorconfig create mode 100644 .github/CODEOWNERS create mode 100644 .github/FUNDING.yml create mode 100644 .github/ISSUE_TEMPLATE/1-bug.yml create mode 100644 .github/ISSUE_TEMPLATE/2-feature.yml create mode 100644 .github/ISSUE_TEMPLATE/3-task.yml create mode 100644 .github/ISSUE_TEMPLATE/4-incident.yml create mode 100644 .github/ISSUE_TEMPLATE/bug_report.yml create mode 100644 .github/ISSUE_TEMPLATE/ci-failure.yml create mode 100644 .github/ISSUE_TEMPLATE/config.yml create mode 100644 .github/ISSUE_TEMPLATE/feature_request.yml create mode 100644 .github/ISSUE_TEMPLATE/gov-violation.yml create mode 100644 .github/dependabot.yml create mode 100644 .github/governance/execution-profiles.yaml create mode 100644 .github/governance/promotion-policy.yaml create mode 100644 .github/governance/provider-requiredness.yaml create mode 100644 .github/governance/quality-thresholds.yaml create mode 100644 .github/governance/rule-modes.yaml create mode 100644 .github/governance/waivers.yaml create mode 100644 .github/labels.yml create mode 100644 .github/pull_request_template.md create mode 100644 .github/workflows/governance.yml create mode 100644 .github/workflows/l9-analysis.yml create mode 100644 .github/workflows/l9-lint-test-node.yml create mode 100644 .github/workflows/l9-lint-test.yml create mode 100644 .github/workflows/on-org-update.yml create mode 100644 .vscode/extensions.json create mode 100644 CODE_OF_CONDUCT.md create mode 100644 CONTRIBUTING.md create mode 100644 LICENSE create mode 100644 SECURITY.md create mode 100644 SUPPORT.md create mode 100644 biome.json diff --git a/.biomeignore b/.biomeignore new file mode 100644 index 0000000..bddc75c --- /dev/null +++ b/.biomeignore @@ -0,0 +1,6 @@ +# Biome path exclusions (gitignore syntax). +# Biome 2.5 reads files.includes in biome.json, not this file โ€” keep generated trees in both. + +coverage/ +dist/ +.l9/ diff --git a/.editorconfig b/.editorconfig new file mode 100644 index 0000000..585946c --- /dev/null +++ b/.editorconfig @@ -0,0 +1,18 @@ +root = true + +[*] +charset = utf-8 +end_of_line = lf +insert_final_newline = true +trim_trailing_whitespace = true +indent_style = space +indent_size = 2 + +[*.py] +indent_size = 4 + +[*.md] +trim_trailing_whitespace = false + +[Makefile] +indent_style = tab diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..f62a6a3 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,18 @@ +# Managed by Quantum-L9/.github โ€” do not edit here. +# Edit templates/CODEOWNERS.repo in the .github repo; changes are re-seeded by PR. +# CODEOWNERS is not inheritable, so this file is physically copied per repo. +# +# Team slugs verified against the live org (gh api orgs/Quantum-L9/teams): +# only `platform` exists. The pack's placeholder slugs (maintainers, governance, +# infra, ci-cd, security) were replaced โ€” an unresolvable owner makes the whole +# rule silently inert. If new teams are created later, add rules here and re-seed. + +* @Quantum-L9/platform + +# Blast-radius paths require cryptoxdog as additional reviewer. +/.github/ @Quantum-L9/platform @cryptoxdog +/.github/workflows/ @Quantum-L9/platform @cryptoxdog +/infra/ @Quantum-L9/platform @cryptoxdog +/terraform/ @Quantum-L9/platform @cryptoxdog +SECURITY.md @Quantum-L9/platform @cryptoxdog +CODEOWNERS @Quantum-L9/platform @cryptoxdog diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml new file mode 100644 index 0000000..7e1d6ce --- /dev/null +++ b/.github/FUNDING.yml @@ -0,0 +1,11 @@ +# Quantum-L9 org-wide funding configuration. +# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository +# +# No public sponsor links are configured. This is an internal engineering org; +# entries are intentionally left blank rather than omitting the file, so any +# future decision to enable a sponsor button is a one-line change, not a new +# file requiring CODEOWNERS/governance re-review. +# +# github: [] +# open_collective: # '' +# custom: # [''] diff --git a/.github/ISSUE_TEMPLATE/1-bug.yml b/.github/ISSUE_TEMPLATE/1-bug.yml new file mode 100644 index 0000000..2539204 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/1-bug.yml @@ -0,0 +1,66 @@ +name: ๐Ÿ› Bug +description: Something behaves incorrectly and you can show it. +title: "bug: " +labels: ["type:bug", "needs:triage"] +body: + - type: markdown + attributes: + value: | + CI pipeline failures go to + [l9-ci-debt-resolver](https://github.com/Quantum-L9/l9-ci-debt-resolver/issues/new) + instead โ€” that component owns failure diagnosis. + + - type: textarea + id: problem + attributes: + label: Problem + description: The symptom you observed, in one or two sentences. Not your theory. + validations: + required: true + + - type: textarea + id: evidence + attributes: + label: Error output + description: Traceback, failing assertion, or log line. Redact secrets. + render: shell + validations: + required: true + + - type: textarea + id: reproduce + attributes: + label: Reproduction + description: Steps from a clean checkout. Best effort is fine. + render: shell + + - type: input + id: version + attributes: + label: Version / commit + description: Release tag or SHA if you have it. + + - type: dropdown + id: severity + attributes: + label: Severity + description: Routes triage. Advisory only โ€” nothing is blocked by this. + options: + - S4 โ€” cosmetic + - S3 โ€” degraded, workaround exists + - S2 โ€” major function broken, no workaround + - S1 โ€” production down, data loss, or security exposure + validations: + required: true + + - type: input + id: regression + attributes: + label: Last known good version + description: If set, implies a bisect range. Leave blank if unknown. + + - type: textarea + id: context + attributes: + label: Anything else + description: Suspected cause, related issues, workaround in use. diff --git a/.github/ISSUE_TEMPLATE/2-feature.yml b/.github/ISSUE_TEMPLATE/2-feature.yml new file mode 100644 index 0000000..41df311 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/2-feature.yml @@ -0,0 +1,58 @@ +name: โœจ Feature +description: Propose a capability that does not exist yet. +title: "feat: " +labels: ["type:feature", "needs:triage"] +body: + - type: textarea + id: problem + attributes: + label: Problem + description: The pain, not the solution. Who is blocked, and on what? + validations: + required: true + + - type: textarea + id: today + attributes: + label: What you do today + description: Current workaround and its cost. + + - type: textarea + id: proposal + attributes: + label: Proposed behavior + description: What should exist. Include the interface if you know it. + validations: + required: true + + - type: dropdown + id: owner + attributes: + label: Which component should own this? + description: Prevents governance from absorbing CI concerns. + options: + - this repo (org governance / community health) + - l9-ci-sdk or l9-ci-core (test, lint, build execution) + - l9-ci-debt-resolver (CI failure diagnosis or remediation) + - l9-ci-debt-intelligence (CI debt measurement) + - unsure + validations: + required: true + + - type: textarea + id: alternatives + attributes: + label: Alternatives considered + description: Options you rejected and why. + + - type: dropdown + id: scope + attributes: + label: Scope + options: + - S โ€” under a day + - M โ€” a few days, one repo + - L โ€” multi-repo or migration + - XL โ€” needs a design doc first + validations: + required: true diff --git a/.github/ISSUE_TEMPLATE/3-task.yml b/.github/ISSUE_TEMPLATE/3-task.yml new file mode 100644 index 0000000..b7705f9 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/3-task.yml @@ -0,0 +1,36 @@ +name: ๐Ÿ”ง Task +description: Known work with a known solution โ€” chore, refactor, infra, docs. +title: "chore: " +labels: ["type:task"] +body: + - type: textarea + id: problem + attributes: + label: Problem + description: Why this work exists. What degrades if it is never done? + validations: + required: true + + - type: textarea + id: work + attributes: + label: Work + value: | + - [ ] + - [ ] + validations: + required: true + + - type: dropdown + id: kind + attributes: + label: Kind + options: [chore, refactor, infra / IaC, governance, docs, dependency bump] + validations: + required: true + + - type: input + id: blocks + attributes: + label: Blocks / blocked by + placeholder: "blocked by #12, blocks #34" diff --git a/.github/ISSUE_TEMPLATE/4-incident.yml b/.github/ISSUE_TEMPLATE/4-incident.yml new file mode 100644 index 0000000..bf7247d --- /dev/null +++ b/.github/ISSUE_TEMPLATE/4-incident.yml @@ -0,0 +1,90 @@ +name: ๐Ÿšจ Incident +description: Production is degraded or down. File first, investigate second. +title: "incident: " +labels: ["type:incident", "sev:untriaged", "priority:P0"] +assignees: [] +body: + - type: markdown + attributes: + value: | + **Page first, file second.** If customers are affected and nobody is paged, + stop and page on-call. This issue is the written record, not the alarm. + If this is a security compromise, use a private advisory instead โ€” not this form. + + - type: input + id: started + attributes: + label: Detected at (UTC) + placeholder: "2026-07-28T15:04:00Z" + validations: + required: true + + - type: textarea + id: problem + attributes: + label: Problem + description: Customer-visible symptom. What is broken, for whom, since when? + validations: + required: true + + - type: dropdown + id: severity + attributes: + label: Severity + options: + - S1 โ€” full outage, data loss, or security exposure + - S2 โ€” major degradation, no workaround + - S3 โ€” partial degradation, workaround in place + validations: + required: true + + - type: textarea + id: evidence + attributes: + label: Signal + description: Alert name, dashboard link, error rate, sample traceback. + render: shell + validations: + required: true + + - type: textarea + id: impact + attributes: + label: Blast radius + description: Services, regions, tenants, and estimated request or user count. + validations: + required: true + + - type: textarea + id: mitigation + attributes: + label: Mitigation in progress + description: What is being done right now. Update this field as it evolves. + validations: + required: true + + - type: input + id: suspect + attributes: + label: Suspected trigger + description: Deploy, PR, config change, or upstream provider. Link it. + placeholder: "#1184, deployed 14:52Z" + + - type: input + id: commander + attributes: + label: Incident commander + placeholder: "@handle" + validations: + required: true + + - type: checkboxes + id: gates + attributes: + label: Response checklist + options: + - label: On-call paged. + required: true + - label: Status page or stakeholder comms updated, or explicitly not needed. + - label: Timeline is being kept in the comments below. + - label: Postmortem issue will be opened within 48h of resolution. diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml new file mode 100644 index 0000000..b551343 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -0,0 +1,99 @@ +name: Bug Report +description: Report a reproducible bug in any Quantum-L9 repository +title: "[Bug]: " +labels: ["bug", "triage"] +assignees: [] +body: + - type: markdown + attributes: + value: | + Thank you for taking the time to file a bug report. Please fill out all fields completely. + Incomplete reports may be closed without investigation. + + - type: textarea + id: description + attributes: + label: Bug Description + description: A clear and concise description of what the bug is. + placeholder: "Describe the bug..." + validations: + required: true + + - type: textarea + id: reproduction + attributes: + label: Steps to Reproduce + description: Exact steps to reproduce the behavior. + placeholder: | + 1. Go to '...' + 2. Run command '...' + 3. See error + validations: + required: true + + - type: textarea + id: expected + attributes: + label: Expected Behavior + description: What did you expect to happen? + validations: + required: true + + - type: textarea + id: actual + attributes: + label: Actual Behavior + description: What actually happened? + validations: + required: true + + - type: dropdown + id: repo + attributes: + label: Affected Repository + options: + - l9-ci-core + - Cursor-Governance + - l9-assurance + - .github (org backbone) + - Other (specify in description) + validations: + required: true + + - type: input + id: workflow-name + attributes: + label: Workflow Name (if CI-related) + description: "e.g. pr-pipeline.yml, security.yml" + placeholder: "pr-pipeline.yml" + + - type: input + id: python-version + attributes: + label: Python Version + placeholder: "3.12" + + - type: input + id: node-version + attributes: + label: Node Version (if applicable) + placeholder: "20" + + - type: input + id: os + attributes: + label: Operating System + placeholder: "ubuntu-latest / macOS 14 / Windows 11" + + - type: textarea + id: logs + attributes: + label: Logs / Screenshots + description: Paste relevant log output or attach screenshots. + render: shell + + - type: input + id: related-issues + attributes: + label: Related Issues / PRs + placeholder: "#123, #456" diff --git a/.github/ISSUE_TEMPLATE/ci-failure.yml b/.github/ISSUE_TEMPLATE/ci-failure.yml new file mode 100644 index 0000000..bc3a892 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/ci-failure.yml @@ -0,0 +1,86 @@ +name: CI Pipeline Failure +description: Report a CI pipeline failure for triage by the platform team +title: "[CI Failure]: " +labels: ["ci-failure", "triage"] +assignees: [] +body: + - type: markdown + attributes: + value: | + Use this template for CI pipeline failures that are not explained by a code bug. + For code bugs that cause test failures, use the Bug Report template instead. + + - type: input + id: workflow-run-url + attributes: + label: Workflow Run URL + description: Paste the full URL of the failed GitHub Actions run. + placeholder: "https://github.com/Quantum-L9/l9-ci-core/actions/runs/XXXXXXXXX" + validations: + required: true + + - type: input + id: failed-job + attributes: + label: Failed Job Name + placeholder: "pr-pipeline / security-scan / scorecard" + validations: + required: true + + - type: dropdown + id: trigger + attributes: + label: Triggered By + options: + - Pull Request + - Push to main + - Scheduled (cron) + - Workflow Dispatch + - Tag push + validations: + required: true + + - type: textarea + id: error-output + attributes: + label: Error Output + description: Paste the relevant error section from the failed step. + render: shell + validations: + required: true + + - type: dropdown + id: bisect-attempted + attributes: + label: Bisect Attempted? + options: + - "No โ€” first occurrence" + - "No โ€” intermittent failure" + - "Yes โ€” narrowed to specific commit (paste SHA below)" + - "Yes โ€” cannot reproduce locally" + validations: + required: true + + - type: input + id: bisect-sha + attributes: + label: Bisect SHA (if applicable) + placeholder: "2b330a5aab90cd7781bef08f14c5e7904b61bc56" + + - type: dropdown + id: affected-kernel + attributes: + label: Affected Kernel + options: + - pr-pipeline.yml + - release-publish.yml + - nightly.yml + - pre-commit-ci.yml + - trio-governance.yml + - security.yml + - scorecard.yml + - sbom.yml + - l9-self-ci.yml (inline only) + - Not a kernel call (repo-local workflow) + validations: + required: true diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..ca75bf6 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,15 @@ +# Quantum-L9 org-wide issue template chooser config. +# https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/configuring-issue-templates-for-your-repository + +blank_issues_enabled: false + +contact_links: + - name: Security Vulnerability Report + url: https://github.com/Quantum-L9/.github/security/policy + about: Do not open a public issue for security vulnerabilities. Follow SECURITY.md instead. + - name: Governance / CANONICAL_LAW Question + url: https://github.com/Quantum-L9/Cursor-Governance/blob/main/CANONICAL_LAW.md + about: For questions about governance policy, symlink contracts, or CANONICAL_LAW.md, read the policy source of truth first. + - name: CI Kernel API Contract + url: https://github.com/Quantum-L9/.github/blob/main/workflow-interface-registry.yml + about: For questions about kernel inputs/outputs/versioning, check the machine-readable registry before filing an issue. diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml new file mode 100644 index 0000000..a04534e --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -0,0 +1,69 @@ +name: Feature Request +description: Propose a new feature or enhancement for Quantum-L9 infrastructure +title: "[Feature]: " +labels: ["enhancement", "triage"] +assignees: [] +body: + - type: markdown + attributes: + value: | + Before submitting, check existing issues and discussions to avoid duplicates. + + - type: textarea + id: problem + attributes: + label: Problem Statement + description: What problem does this feature solve? What gap does it address? + placeholder: "Currently, when I do X, I have to manually Y because..." + validations: + required: true + + - type: textarea + id: solution + attributes: + label: Proposed Solution + description: Describe the feature you'd like to see implemented. + validations: + required: true + + - type: textarea + id: alternatives + attributes: + label: Alternatives Considered + description: What other approaches did you consider? Why did you reject them? + + - type: textarea + id: acceptance-criteria + attributes: + label: Acceptance Criteria + description: Define what "done" looks like. Use checkboxes. + placeholder: | + - [ ] CI gate added to pr-pipeline kernel + - [ ] CONTRIBUTING.md updated + - [ ] TRACEABILITY_MAP.yaml entry added + validations: + required: true + + - type: dropdown + id: affected-repos + attributes: + label: Primarily Affected Repository + multiple: true + options: + - l9-ci-core + - Cursor-Governance + - l9-assurance + - .github (org backbone) + - Multiple repos (org-wide change) + validations: + required: true + + - type: dropdown + id: priority + attributes: + label: Suggested Priority + options: + - Critical (blocks current work) + - High (significant improvement) + - Medium (nice to have) + - Low (future consideration) diff --git a/.github/ISSUE_TEMPLATE/gov-violation.yml b/.github/ISSUE_TEMPLATE/gov-violation.yml new file mode 100644 index 0000000..5765ba3 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/gov-violation.yml @@ -0,0 +1,84 @@ +name: Governance Violation +description: Report a violation of CANONICAL_LAW.md policy +title: "[Gov Violation]: " +labels: ["governance", "violation", "triage"] +assignees: [] +body: + - type: markdown + attributes: + value: | + Use this template to report a detected violation of [CANONICAL_LAW.md](https://github.com/Quantum-L9/Cursor-Governance/blob/main/CANONICAL_LAW.md). + The platform team will triage and enforce. Do NOT use this for general bugs โ€” use the Bug Report template. + + - type: dropdown + id: violation-type + attributes: + label: Violation Type + options: + - Symlink drift (ยง2 โ€” symlinks missing or broken) + - Anti-pattern detected (ยง7 โ€” forbidden patterns present) + - Trio separation breach (ยง3 โ€” model/service/interface cross-import) + - Policy gate failure (CI gate not enforcing policy) + - Workspace wiring failure (ยง8 โ€” workspace config broken) + - Kernel ref violation (@main used instead of @v1) + - Other (describe below) + validations: + required: true + + - type: dropdown + id: canonical-law-section + attributes: + label: CANONICAL_LAW.md Section Violated + options: + - "ยง1 โ€” Unknown/General" + - "ยง2 โ€” Symlink Contract" + - "ยง3 โ€” Trio Separation" + - "ยง4 โ€” Unknown" + - "ยง5 โ€” Unknown" + - "ยง6 โ€” Unknown" + - "ยง7 โ€” Anti-Patterns" + - "ยง8 โ€” Workspace Wiring" + - "ยง9 โ€” Unknown" + validations: + required: true + + - type: textarea + id: evidence + attributes: + label: Evidence + description: Paste command output, diff, or log that demonstrates the violation. + render: shell + validations: + required: true + + - type: dropdown + id: affected-repos + attributes: + label: Affected Repository + multiple: true + options: + - l9-ci-core + - Cursor-Governance + - l9-assurance + - .github (org backbone) + - Multiple repos + validations: + required: true + + - type: dropdown + id: severity + attributes: + label: Severity + options: + - Critical (active governance bypass / security impact) + - High (CI not enforcing policy) + - Medium (drift detected but not exploited) + - Low (documentation only) + validations: + required: true + + - type: textarea + id: proposed-fix + attributes: + label: Proposed Fix (optional) + description: If you know how to fix this, describe the resolution. diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..7f7af9d --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,35 @@ +# Managed by Quantum-L9/.github. dependabot.yml is NOT inheritable โ€” it is seeded +# per repo and must live at .github/dependabot.yml on the default branch. +# +# ADVISORY POSTURE: this opens PRs only. No auto-merge, no forced schedules. +# It exists because our PR gate requires SHA-pinned actions, and a pin without an +# update mechanism is a frozen, silently ageing dependency. +version: 2 +updates: + - package-ecosystem: github-actions + directory: "/" + schedule: + interval: weekly + day: monday + open-pull-requests-limit: 5 + labels: ["type:task", "deps"] + commit-message: + prefix: "chore(deps)" + groups: + actions-minor-patch: + patterns: ["*"] + update-types: ["minor", "patch"] + + - package-ecosystem: pip + directory: "/" + schedule: + interval: weekly + day: monday + open-pull-requests-limit: 5 + labels: ["type:task", "deps"] + commit-message: + prefix: "chore(deps)" + groups: + python-minor-patch: + patterns: ["*"] + update-types: ["minor", "patch"] diff --git a/.github/governance/execution-profiles.yaml b/.github/governance/execution-profiles.yaml new file mode 100644 index 0000000..2d58873 --- /dev/null +++ b/.github/governance/execution-profiles.yaml @@ -0,0 +1,45 @@ +{ + "schema": "l9.execution-profiles/v1", + "profiles": { + "pr_fast": { + "sdk_profile": "ci_fast", + "strict": true, + "default_mode": "blocking", + "providers": ["semgrep"], + "policy": "", + "allowed_events": ["pull_request", "workflow_dispatch"] + }, + "merge": { + "sdk_profile": "ci_fast", + "strict": true, + "default_mode": "blocking", + "providers": ["semgrep"], + "policy": "", + "allowed_events": ["push", "workflow_dispatch"] + }, + "nightly": { + "sdk_profile": "ci_deep", + "strict": true, + "default_mode": "advisory", + "providers": ["semgrep"], + "policy": "", + "allowed_events": ["schedule", "workflow_dispatch"] + }, + "release": { + "sdk_profile": "ci_deep", + "strict": true, + "default_mode": "blocking", + "providers": ["semgrep"], + "policy": "", + "allowed_events": ["push", "workflow_dispatch"] + }, + "supply_chain": { + "sdk_profile": "ci_deep", + "strict": true, + "default_mode": "blocking", + "providers": ["semgrep"], + "policy": "", + "allowed_events": ["schedule", "workflow_dispatch"] + } + } +} diff --git a/.github/governance/promotion-policy.yaml b/.github/governance/promotion-policy.yaml new file mode 100644 index 0000000..69b5470 --- /dev/null +++ b/.github/governance/promotion-policy.yaml @@ -0,0 +1,16 @@ +{ + "schema": "l9.promotion-policy/v1", + "transitions": { + "disabled": ["shadow"], + "shadow": ["advisory", "disabled"], + "advisory": ["blocking", "shadow"], + "blocking": ["advisory"] + }, + "requirements": { + "minimum_observation_runs": 20, + "minimum_observation_days": 7, + "maximum_contract_failures": 0, + "maximum_artifact_validation_failures": 0, + "approval_required": true + } +} diff --git a/.github/governance/provider-requiredness.yaml b/.github/governance/provider-requiredness.yaml new file mode 100644 index 0000000..a8194e4 --- /dev/null +++ b/.github/governance/provider-requiredness.yaml @@ -0,0 +1,20 @@ +{ + "schema": "l9.provider-requiredness/v1", + "profiles": { + "pr_fast": { + "semgrep": true + }, + "merge": { + "semgrep": true + }, + "nightly": { + "semgrep": false + }, + "release": { + "semgrep": true + }, + "supply_chain": { + "semgrep": true + } + } +} diff --git a/.github/governance/quality-thresholds.yaml b/.github/governance/quality-thresholds.yaml new file mode 100644 index 0000000..d33cbd6 --- /dev/null +++ b/.github/governance/quality-thresholds.yaml @@ -0,0 +1,21 @@ +{ + "schema": "l9.quality-threshold-selection/v1", + "profiles": { + "pr_fast": { + "sdk_policy": "" + }, + "merge": { + "sdk_policy": "" + }, + "nightly": { + "sdk_policy": "" + }, + "release": { + "sdk_policy": "" + }, + "supply_chain": { + "sdk_policy": "" + } + }, + "note": "Core selects an SDK policy file but never evaluates finding thresholds itself. Point sdk_policy at a policy file the pinned SDK understands to raise/lower gates." +} diff --git a/.github/governance/rule-modes.yaml b/.github/governance/rule-modes.yaml new file mode 100644 index 0000000..443e424 --- /dev/null +++ b/.github/governance/rule-modes.yaml @@ -0,0 +1,19 @@ +{ + "schema": "l9.rule-modes/v1", + "defaults": { + "pr_fast": "blocking", + "merge": "blocking", + "nightly": "advisory", + "release": "blocking", + "supply_chain": "blocking" + }, + "provider_overrides": { + "semgrep": {} + }, + "allowed_modes": [ + "blocking", + "advisory", + "shadow", + "disabled" + ] +} diff --git a/.github/governance/waivers.yaml b/.github/governance/waivers.yaml new file mode 100644 index 0000000..dce98fa --- /dev/null +++ b/.github/governance/waivers.yaml @@ -0,0 +1,4 @@ +{ + "schema": "l9.waivers/v1", + "waivers": [] +} diff --git a/.github/labels.yml b/.github/labels.yml new file mode 100644 index 0000000..f828515 --- /dev/null +++ b/.github/labels.yml @@ -0,0 +1,35 @@ +# Apply with: gh label create --file (or github-label-sync). Names are load-bearing: +# workflows in .github/workflows/issue-triage.yml write sev:*, priority:*, scope:*. +- { name: "type:bug", color: "d73a4a", description: "Incorrect behavior with evidence" } +- { name: "type:feature", color: "0e8a16", description: "New capability" } +- { name: "type:task", color: "c5def5", description: "Known work, known solution" } +- { name: "type:incident", color: "b60205", description: "Production degraded or down" } +- { name: "sev:S1", color: "b60205", description: "Outage, data loss, or security exposure" } +- { name: "sev:S2", color: "d93f0b", description: "Major function broken, no workaround" } +- { name: "sev:S3", color: "fbca04", description: "Degraded, workaround exists" } +- { name: "sev:S4", color: "fef2c0", description: "Cosmetic" } +- { name: "sev:untriaged", color: "ededed", description: "Severity not yet assessed" } +- { name: "priority:P0", color: "b60205", description: "Drop everything" } +- { name: "priority:P1", color: "d93f0b", description: "This sprint" } +- { name: "priority:P2", color: "fbca04", description: "Backlog, scheduled" } +- { name: "priority:P3", color: "fef2c0", description: "Someday" } +- { name: "scope:S", color: "e4e669", description: "Under a day" } +- { name: "scope:M", color: "e4e669", description: "A few days, one repo" } +- { name: "scope:L", color: "e4e669", description: "Multi-repo or migration" } +- { name: "scope:XL", color: "e4e669", description: "Needs a design doc first" } +- { name: "needs:triage", color: "ededed", description: "Awaiting maintainer review" } +- { name: "needs:info", color: "ededed", description: "Blocked on the reporter; eligible for stale" } +- { name: "regression", color: "5319e7", description: "Worked in an earlier version" } +- { name: "breaking", color: "5319e7", description: "Requires a major version bump" } +- { name: "env:prod", color: "1d76db", description: "Observed in production" } +- { name: "area:ci", color: "1d76db", description: "CI/CD pipelines" } +- { name: "area:ci-templates", color: "1d76db", description: "workflow-templates/ starter gallery" } +- { name: "area:ci-pack", color: "1d76db", description: "l9-ci-pack/ v2 instantiation kit" } +- { name: "area:governance", color: "5319e7", description: "registry, ADR template, governance docs" } +- { name: "area:ops", color: "1d76db", description: "ops/ scripts" } +- { name: "area:issue-templates", color: "c5def5", description: ".github/ISSUE_TEMPLATE/" } +- { name: "area:community-health", color: "0e8a16", description: "CONTRIBUTING/SECURITY/SUPPORT/etc" } +- { name: "area:org-profile", color: "7057ff", description: "profile/ org landing page" } +- { name: "area:ci-self", color: "1d76db", description: ".github/workflows/ self-CI" } +- { name: "security:possible-leak", color: "b60205", description: "May contain a credential โ€” rotate" } +- { name: "good first issue",color: "7057ff", description: "Scoped, documented, low context" } diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 0000000..302ac5c --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,81 @@ + + +## Problem + + + +``` +paste the error / failing output here, or delete this block and describe the gap +``` + +Closes # + +## Fix + + + +## Risk + + + +- [ ] Low โ€” additive, reversible, no data or contract change +- [ ] Medium โ€” touches shared code, config, or a public interface +- [ ] High โ€” breaking change, migration, IAM/network, or irreversible + +Blast radius: +Rollback: + +## Evidence + + + +``` +$ pytest -q +$ ruff check . && pyright +``` + +## Gates + + + +- [ ] Regression test added that fails without this fix +- [ ] No secrets, tokens, or customer data in code, tests, fixtures, or logs +- [ ] `semgrep` clean, or findings triaged below +- [ ] New IAM / workflow permissions are least privilege and enumerated +- [ ] Third-party actions pinned to a full commit SHA +- [ ] Public interface change is documented and versioned +- [ ] Observability exists for the new path (metric, log, trace, or alert) + +## Reviewer focus + + + +## Changes by intent + + + +**Added** +- `path/to/new_file.py` โ€” why this file needs to exist + +**Modified** +- `path/to/existing.py` โ€” what changed in it and why + +**Deleted** +- `path/to/dead.py` โ€” why it is safe to remove + +## Files touched + + + + +_pending โ€” the bot fills this in on push_ + diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml new file mode 100644 index 0000000..070aae5 --- /dev/null +++ b/.github/workflows/governance.yml @@ -0,0 +1,33 @@ +# Managed by Quantum-L9/.github. Pinned to a tag so main can move safely. +# +# This file should never need editing again. Governance logic lives in +# Quantum-L9/.github/.github/workflows/governance-*.yml; shipping a change means +# force-moving the v1 tag there, not touching this file. +# +# SECRETS: a called workflow does NOT inherit caller secrets automatically. Today +# both callees use only the automatic GITHUB_TOKEN, so nothing is passed. If a +# governance job later needs a real secret, add `secrets:` to the job below โ€” +# `inherit` for all, or named entries (preferred, least privilege). +# See docs/DISTRIBUTION.md Appendix A. +# +# ACCESS: if this caller fails before any step runs, check the Actions policy on +# THIS repo โ€” see Appendix B. `gh api repos/OWNER/REPO/actions/permissions` + +name: Governance + +on: + pull_request: + types: [opened, edited, synchronize, reopened, ready_for_review] + issues: + types: [opened, edited, reopened] + +jobs: + pr: + if: github.event_name == 'pull_request' + uses: Quantum-L9/.github/.github/workflows/governance-pr.yml@v1 + # secrets: inherit + + issue: + if: github.event_name == 'issues' + uses: Quantum-L9/.github/.github/workflows/governance-issue.yml@v1 + # secrets: inherit diff --git a/.github/workflows/l9-analysis.yml b/.github/workflows/l9-analysis.yml new file mode 100644 index 0000000..29f51c9 --- /dev/null +++ b/.github/workflows/l9-analysis.yml @@ -0,0 +1,200 @@ +# L9 analysis caller (TEMPLATE โ€” copy into your repo at .github/workflows/l9-analysis.yml) +# +# Works for Python AND Node.js repos: semgrep is the single, language-agnostic +# provider the pinned SDK normalizes. The ONLY per-language difference is the +# semgrep --config rulesets in the "Run semgrep" step below. +# +# Topology (this is the wiring that actually works): +# job analyze -> generates the semgrep report and runs the SDK pipeline in ONE +# job so the freshly-generated report is on the same filesystem +# (the reusable normalize workflow re-checks-out github.sha and +# would NOT see an uncommitted report). +# job publish -> calls Core's publish-analysis.yml, which DOWNLOADS the +# uploaded artifact (no report-in-tree needed) and publishes the +# GitHub check per the resolved governance mode. +# +# Prerequisite: copy docs/templates/governance/*.yaml into THIS repo at +# .github/governance/ (that is the CI instantiation pack the resolver reads). + +name: L9 Analysis + +on: + pull_request: + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: l9-analysis-${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +env: + # Core pin is the literal SHA/tag on every uses: Quantum-L9/l9-ci-core/...@... + # line below. GitHub Actions does NOT expand env/expressions in uses: refs โ€” + # do not add an L9_CORE_REF env expecting it to repin; edit each uses: line + # (or run ops/sync-v2-starters.sh) instead. Current pin: + # f88116503430aa18992b70d8d31063e34ff97ef1 + # Match the event: pr_fast for pull_request, merge for push, nightly/release/ + # supply_chain as appropriate. Must be allowed_events in execution-profiles.yaml. + L9_PROFILE: "pr_fast" + L9_MATRIX_ID: "pr-semgrep" + +jobs: + analyze: + name: Analyze (semgrep -> SDK) + runs-on: ubuntu-latest + timeout-minutes: 20 + permissions: + contents: read + outputs: + mode: ${{ steps.gov.outputs.mode }} + enabled: ${{ steps.gov.outputs.enabled }} + artifact-name: ${{ steps.names.outputs.artifact-name }} + governance-digest: ${{ steps.gov.outputs.governance-digest }} + steps: + - name: Checkout immutable event revision + env: + REPOSITORY: ${{ github.repository }} + REVISION: ${{ github.sha }} + TOKEN: ${{ github.token }} + run: | + set -euo pipefail + git init . + git remote add origin \ + "https://x-access-token:${TOKEN}@github.com/${REPOSITORY}.git" + git -c protocol.version=2 fetch --depth=1 origin "${REVISION}" + git checkout --detach FETCH_HEAD + git remote set-url origin "https://github.com/${REPOSITORY}.git" + + - id: gov + name: Resolve governance (Core) + uses: Quantum-L9/l9-ci-core/.github/actions/resolve-governance@f88116503430aa18992b70d8d31063e34ff97ef1 + with: + profile: ${{ env.L9_PROFILE }} + provider: semgrep + event-name: ${{ github.event_name }} + repository: ${{ github.repository }} + ref: ${{ github.ref }} + governance-root: .github/governance + + - id: names + name: Resolve artifact name + env: + MATRIX_ID: ${{ env.L9_MATRIX_ID }} + run: | + set -euo pipefail + echo "artifact-name=l9-semgrep-${MATRIX_ID}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_OUTPUT" + + - name: Run semgrep (produce raw report) + if: steps.gov.outputs.enabled == 'true' + run: | + set -euo pipefail + python -m pip install --upgrade pip semgrep + mkdir -p "artifacts/raw/semgrep/${L9_MATRIX_ID}" + # โ”€โ”€ PER-LANGUAGE RULESETS โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ + # Python repo: --config p/python + # Node.js repo: --config p/javascript --config p/typescript + # Polyglot / either: keep all three (semgrep skips rules that do not + # match any files) or use --config auto. + semgrep scan \ + --config p/python \ + --config p/javascript \ + --config p/typescript \ + --json \ + --output "artifacts/raw/semgrep/${L9_MATRIX_ID}/report.json" \ + --error --quiet || true + env: + L9_MATRIX_ID: ${{ env.L9_MATRIX_ID }} + + - id: sdk + name: Provision immutable SDK + if: steps.gov.outputs.enabled == 'true' + uses: Quantum-L9/l9-ci-core/.github/actions/provision-sdk@f88116503430aa18992b70d8d31063e34ff97ef1 + + - name: Normalize provider report + if: steps.gov.outputs.enabled == 'true' + uses: Quantum-L9/l9-ci-core/.github/actions/invoke-sdk@f88116503430aa18992b70d8d31063e34ff97ef1 + with: + executable: ${{ steps.sdk.outputs.executable }} + operation: semgrep-normalize + input: artifacts/raw/semgrep/${{ env.L9_MATRIX_ID }}/report.json + output: .l9/runtime/${{ env.L9_MATRIX_ID }}/finding-bundle.json + root: . + snapshot-id: ${{ github.sha }} + revision: ${{ github.sha }} + strict: ${{ steps.gov.outputs.strict }} + required: ${{ steps.gov.outputs.required-provider }} + policy: ${{ steps.gov.outputs.sdk-policy }} + + - name: Validate canonical bundle + if: steps.gov.outputs.enabled == 'true' + uses: Quantum-L9/l9-ci-core/.github/actions/validate-bundle@f88116503430aa18992b70d8d31063e34ff97ef1 + with: + executable: ${{ steps.sdk.outputs.executable }} + bundle: .l9/runtime/${{ env.L9_MATRIX_ID }}/finding-bundle.json + + - name: Project agent-review payload + if: steps.gov.outputs.enabled == 'true' + uses: Quantum-L9/l9-ci-core/.github/actions/invoke-sdk@f88116503430aa18992b70d8d31063e34ff97ef1 + with: + executable: ${{ steps.sdk.outputs.executable }} + operation: bundle-project-agent-payload + input: .l9/runtime/${{ env.L9_MATRIX_ID }}/finding-bundle.json + output: .l9/runtime/${{ env.L9_MATRIX_ID }}/agent-review-payload.json + strict: ${{ steps.gov.outputs.strict }} + + - id: route + name: Route artifacts + if: steps.gov.outputs.enabled == 'true' + uses: Quantum-L9/l9-ci-core/.github/actions/route-artifacts@f88116503430aa18992b70d8d31063e34ff97ef1 + with: + provider: semgrep + matrix-id: ${{ env.L9_MATRIX_ID }} + raw-report: artifacts/raw/semgrep/${{ env.L9_MATRIX_ID }}/report.json + bundle: .l9/runtime/${{ env.L9_MATRIX_ID }}/finding-bundle.json + agent-payload: .l9/runtime/${{ env.L9_MATRIX_ID }}/agent-review-payload.json + destination-root: artifacts + + - name: Build artifact manifest + if: steps.gov.outputs.enabled == 'true' + uses: Quantum-L9/l9-ci-core/.github/actions/build-artifact-manifest@f88116503430aa18992b70d8d31063e34ff97ef1 + with: + provider: semgrep + matrix-id: ${{ env.L9_MATRIX_ID }} + sdk-revision: ${{ steps.sdk.outputs.sdk-revision }} + bundle: ${{ steps.route.outputs.bundle }} + agent-payload: ${{ steps.route.outputs.agent-payload }} + raw-directory: ${{ steps.route.outputs.raw-directory }} + output: artifacts/metadata/${{ env.L9_MATRIX_ID }}/artifact-manifest.json + + - name: Upload analysis artifact set + if: steps.gov.outputs.enabled == 'true' + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: ${{ steps.names.outputs.artifact-name }} + path: | + artifacts/raw/semgrep/${{ env.L9_MATRIX_ID }}/ + artifacts/l9/${{ env.L9_MATRIX_ID }}/ + artifacts/metadata/${{ env.L9_MATRIX_ID }}/ + if-no-files-found: error + retention-days: 14 + + publish: + name: Publish analysis (Core) + needs: analyze + if: needs.analyze.outputs.enabled == 'true' + uses: Quantum-L9/l9-ci-core/.github/workflows/publish-analysis.yml@f88116503430aa18992b70d8d31063e34ff97ef1 + permissions: + actions: read + checks: write + contents: read + with: + artifact-name: ${{ needs.analyze.outputs.artifact-name }} + profile: pr_fast + mode: ${{ needs.analyze.outputs.mode }} + provider: semgrep + matrix-id: pr-semgrep + governance-digest: ${{ needs.analyze.outputs.governance-digest }} + repository-revision: ${{ github.sha }} + workflow-result: ${{ needs.analyze.result }} diff --git a/.github/workflows/l9-lint-test-node.yml b/.github/workflows/l9-lint-test-node.yml new file mode 100644 index 0000000..1903d29 --- /dev/null +++ b/.github/workflows/l9-lint-test-node.yml @@ -0,0 +1,150 @@ +# L9 consumer lint + test workflow for Node.js / TypeScript +# +# Copy into the CONSUMER repo at `.github/workflows/l9-lint-test-node.yml`. +# Org-distributed copy of Quantum-L9/l9-ci-core presets/typescript +# `.github/workflows/l9-lint-test.yml`. Do not invent a second lint owner. +# +# Formatter/linter ownership: Biome owns JS/TS/JSON (format + lint) via the +# SDK-owned reusable workflow below. ESLint is NOT a second formatter owner +# here. Type checking (tsc) and the repository test suite stay in this repo. +# +# Conventions: +# - Immutable event-revision checkout (no floating action ref) +# - SDK reusable workflow pinned to a full 40-char commit SHA +# - Least privilege (contents: read only) +name: L9 Lint and Test (Node) +on: + pull_request: + push: + branches: [main] + workflow_dispatch: + +# โ”€โ”€ CONFIGURABLE: agent sets these during activation โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ +env: + NODE_VERSION: "20" + PACKAGE_MANAGER: "npm" + SOURCE_DIR: "." + HAS_TYPESCRIPT: "true" + +permissions: + contents: read + +concurrency: + group: l9-lint-test-node-${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + # Biome (format + lint + import organization) is owned by the SDK reusable + # workflow โ€” a single read-only gate with a checksum-verified biome binary + # and zero external actions. Reusable-workflow inputs cannot read `env:`, so + # scan-path and the rollout flag are set literally here. + biome: + name: Biome (format + lint) โ€” SDK-owned + permissions: + contents: read + uses: Quantum-L9/l9-ci-sdk/.github/workflows/l9-biome-scan.yml@f546f122d33601ea5a4b2592e3482c5c39eddd82 + with: + scan-path: "." + # Advisory-to-blocking rollout: false = full scan + annotate + exit 0. + # Flip to true to make Biome findings blocking once the repo is clean. + enforce-biome: false + + typecheck: + name: Type Check (tsc --noEmit) + runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + contents: read + steps: + - name: Checkout immutable event revision + env: + REPOSITORY: ${{ github.repository }} + REVISION: ${{ github.sha }} + TOKEN: ${{ github.token }} + run: | + set -euo pipefail + git init . + git remote add origin "https://github.com/${REPOSITORY}.git" + # Authenticate with a per-fetch Authorization header instead of + # embedding the token in the remote URL, so the credential is never + # written to the remote URL or .git/config (mirrors actions/checkout). + auth_header="Authorization: Basic $(printf 'x-access-token:%s' "${TOKEN}" | base64 | tr -d '\n')" + git -c protocol.version=2 \ + -c "http.https://github.com/.extraheader=${auth_header}" \ + fetch --depth=1 origin "${REVISION}" + git checkout --detach FETCH_HEAD + + - name: Set up Node + uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 + with: + node-version: ${{ env.NODE_VERSION }} + cache: ${{ env.PACKAGE_MANAGER }} + + - name: Install dependencies + run: | + set -euo pipefail + case "${PACKAGE_MANAGER}" in + npm) if [ -f package-lock.json ]; then npm ci; else npm install; fi ;; + pnpm) corepack enable && (if [ -f pnpm-lock.yaml ]; then pnpm install --frozen-lockfile; else pnpm install; fi) ;; + yarn) corepack enable && (if [ -f yarn.lock ]; then yarn install --frozen-lockfile; else yarn install; fi) ;; + *) echo "::error::unknown PACKAGE_MANAGER ${PACKAGE_MANAGER}" && exit 1 ;; + esac + + - name: tsc --noEmit + if: env.HAS_TYPESCRIPT == 'true' + run: | + set -euo pipefail + if [ -f tsconfig.json ]; then + npx --yes tsc --noEmit -p tsconfig.json + else + echo "::notice::no tsconfig.json found, skipping type check" + fi + + test: + name: Test Suite + runs-on: ubuntu-latest + timeout-minutes: 30 + permissions: + contents: read + steps: + - name: Checkout immutable event revision + env: + REPOSITORY: ${{ github.repository }} + REVISION: ${{ github.sha }} + TOKEN: ${{ github.token }} + run: | + set -euo pipefail + git init . + git remote add origin "https://github.com/${REPOSITORY}.git" + auth_header="Authorization: Basic $(printf 'x-access-token:%s' "${TOKEN}" | base64 | tr -d '\n')" + git -c protocol.version=2 \ + -c "http.https://github.com/.extraheader=${auth_header}" \ + fetch --depth=1 origin "${REVISION}" + git checkout --detach FETCH_HEAD + + - name: Set up Node + uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 + with: + node-version: ${{ env.NODE_VERSION }} + cache: ${{ env.PACKAGE_MANAGER }} + + - name: Install dependencies + run: | + set -euo pipefail + case "${PACKAGE_MANAGER}" in + npm) if [ -f package-lock.json ]; then npm ci; else npm install; fi ;; + pnpm) corepack enable && (if [ -f pnpm-lock.yaml ]; then pnpm install --frozen-lockfile; else pnpm install; fi) ;; + yarn) corepack enable && (if [ -f yarn.lock ]; then yarn install --frozen-lockfile; else yarn install; fi) ;; + *) echo "::error::unknown PACKAGE_MANAGER ${PACKAGE_MANAGER}" && exit 1 ;; + esac + + - name: Run test suite + env: + CI: "true" + run: | + set -euo pipefail + if [ -f package.json ] && node -e "process.exit(require('./package.json').scripts && require('./package.json').scripts.test ? 0 : 1)" 2>/dev/null; then + ${PACKAGE_MANAGER} test + else + echo "::notice::no test script defined in package.json, skipping" + fi diff --git a/.github/workflows/l9-lint-test.yml b/.github/workflows/l9-lint-test.yml new file mode 100644 index 0000000..8822dc4 --- /dev/null +++ b/.github/workflows/l9-lint-test.yml @@ -0,0 +1,126 @@ +# L9 consumer lint + test workflow (TEMPLATE โ€” copy into your repo) +# +# This file is NOT executed from l9-ci-core. Copy it into the CONSUMER +# repository at `.github/workflows/l9-lint-test.yml`. It replaces the +# lint / type-check / test half of the retired v1 `pr-pipeline.yml`. +# +# It deliberately lives consumer-side: l9-ci-core v2 is a thin control plane +# whose workflow set is fixed by `tests/workflows/test_phase_scope.py`. Generic +# ruff / mypy / pytest *config* is owned by the consuming repository; *versions* +# come from install-consumer-ci@v2. Do not write version literals here. +# +# v2 conventions preserved here: +# - immutable event-revision checkout (no floating action ref) +# - external actions pinned to full commit SHAs +# - explicit least-privilege permissions (contents: read, no write scopes) +name: L9 Lint and Test + +on: + pull_request: + push: + branches: + - main + workflow_dispatch: + +# โ”€โ”€ Consumer config: edit these values for your repo โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ +env: + PYTHON_VERSION: "3.12" + SOURCE_DIR: "." + TEST_DIR: "tests/" + # Fail the build below this line coverage percentage. 0 = advisory (no gate). + COVERAGE_THRESHOLD: "0" + +permissions: + contents: read + +concurrency: + group: l9-lint-test-${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + lint: + name: Lint and Type Check + runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + contents: read + steps: + - name: Checkout immutable event revision + env: + REPOSITORY: ${{ github.repository }} + REVISION: ${{ github.sha }} + TOKEN: ${{ github.token }} + run: | + set -euo pipefail + git init . + git remote add origin \ + "https://x-access-token:${TOKEN}@github.com/${REPOSITORY}.git" + git -c protocol.version=2 fetch --depth=1 origin "${REVISION}" + git checkout --detach FETCH_HEAD + git remote set-url origin "https://github.com/${REPOSITORY}.git" + - name: Set up Python + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + with: + python-version: ${{ env.PYTHON_VERSION }} + - name: Install consumer CI toolchain + uses: Quantum-L9/l9-ci-core/.github/actions/install-consumer-ci@v2 + - name: Install extra CI requirements + run: | + set -euo pipefail + if [ -f requirements-ci.txt ]; then pip install -r requirements-ci.txt; fi + - name: ruff check + run: ruff check . --output-format=github + - name: ruff format --check + run: ruff format --check . + - name: mypy + run: | + mypy "${SOURCE_DIR}" \ + --show-error-codes --pretty \ + --install-types --non-interactive --ignore-missing-imports + + test: + name: Test Suite + runs-on: ubuntu-latest + timeout-minutes: 30 + permissions: + contents: read + steps: + - name: Checkout immutable event revision + env: + REPOSITORY: ${{ github.repository }} + REVISION: ${{ github.sha }} + TOKEN: ${{ github.token }} + run: | + set -euo pipefail + git init . + git remote add origin \ + "https://x-access-token:${TOKEN}@github.com/${REPOSITORY}.git" + git -c protocol.version=2 fetch --depth=1 origin "${REVISION}" + git checkout --detach FETCH_HEAD + git remote set-url origin "https://github.com/${REPOSITORY}.git" + - name: Set up Python + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + with: + python-version: ${{ env.PYTHON_VERSION }} + - name: Install consumer CI toolchain + uses: Quantum-L9/l9-ci-core/.github/actions/install-consumer-ci@v2 + - name: Install test tools + run: | + set -euo pipefail + if [ -f requirements-ci.txt ]; then pip install -r requirements-ci.txt; fi + pip install -e ".[dev]" || pip install -e . || \ + echo "::notice::no local editable package to install" + python -c "import pytest_cov" 2>/dev/null || pip install pytest-cov + python -c "import xdist" 2>/dev/null || pip install pytest-xdist + python -c "import pytest_timeout" 2>/dev/null || pip install pytest-timeout + - name: pytest with coverage + env: + TESTING: "true" + run: | + set -euo pipefail + PYTHONPATH=. pytest "${TEST_DIR}" \ + -n auto \ + --cov="${SOURCE_DIR}" \ + --cov-report=xml --cov-report=term-missing \ + --cov-fail-under="${COVERAGE_THRESHOLD}" \ + --timeout=300 --tb=short -v diff --git a/.github/workflows/on-org-update.yml b/.github/workflows/on-org-update.yml new file mode 100644 index 0000000..33cad87 --- /dev/null +++ b/.github/workflows/on-org-update.yml @@ -0,0 +1,65 @@ +# Receiver for org template updates. Place at .github/workflows/on-org-update.yml. +# When Quantum-L9/.github pushes a template change, this workflow auto-syncs. +name: Sync on org update + +on: + repository_dispatch: + types: [org_template_updated] + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + sync: + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + + - name: Set up Python + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + with: + python-version: "3.12" + + - name: Run sync-ci + run: | + set -euo pipefail + if [ -f scripts/sync_ci_from_pack.py ]; then + python scripts/sync_ci_from_pack.py + else + echo "::notice::No sync_ci_from_pack.py found โ€” skipping" + exit 0 + fi + + - name: Check for changes + id: diff + run: | + if git diff --quiet; then + echo "changed=false" >> "$GITHUB_OUTPUT" + else + echo "changed=true" >> "$GITHUB_OUTPUT" + fi + + - name: Create sync PR + if: steps.diff.outputs.changed == 'true' + run: | + set -euo pipefail + BRANCH="chore/auto-sync-org-templates" + git checkout -b "$BRANCH" + git add -A + git -c user.name="l9-governance[bot]" -c user.email="governance@quantum-l9.dev" \ + commit -m "chore: auto-sync org templates from Quantum-L9/.github" + git push -f origin "$BRANCH" + + # Create PR if none exists + EXISTING=$(gh pr list --head "$BRANCH" --state open --json number --jq '.[0].number' 2>/dev/null || true) + if [ -z "$EXISTING" ]; then + gh pr create \ + --title "chore: auto-sync org templates" \ + --body "Org templates changed in Quantum-L9/.github. This PR syncs the updates. Merge at your convenience." \ + --base "$(git remote show origin | grep 'HEAD branch' | awk '{print $NF}')" + fi + env: + GH_TOKEN: ${{ github.token }} diff --git a/.vscode/extensions.json b/.vscode/extensions.json new file mode 100644 index 0000000..699ed73 --- /dev/null +++ b/.vscode/extensions.json @@ -0,0 +1,3 @@ +{ + "recommendations": ["biomejs.biome"] +} diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..3f22d01 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,54 @@ +# Code of Conduct + +## Our Pledge + +We as members, contributors, and leaders pledge to make participation in the Quantum-L9 community +a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, +ethnicity, sex characteristics, gender identity and expression, level of experience, education, +socioeconomic status, nationality, personal appearance, race, caste, color, religion, or sexual identity and orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community. + +## Our Standards + +Examples of behavior that contributes to a positive environment: +- Demonstrating empathy and kindness toward other people +- Being respectful of differing opinions, viewpoints, and experiences +- Giving and gracefully accepting constructive feedback +- Accepting responsibility and apologizing to those affected by our mistakes +- Focusing on what is best not just for us as individuals, but for the overall community + +Examples of unacceptable behavior: +- The use of sexualized language or imagery, and sexual attention or advances of any kind +- Trolling, insulting or derogatory comments, and personal or political attacks +- Public or private harassment +- Publishing others' private information without their explicit permission +- Other conduct which could reasonably be considered inappropriate in a professional setting + +## Enforcement Responsibilities + +The Quantum-L9 platform team (`@Quantum-L9/platform`) is responsible for clarifying and enforcing this Code of Conduct. +They will take appropriate and fair corrective action in response to any behavior deemed inappropriate, threatening, offensive, or harmful. + +## Scope + +This Code of Conduct applies within all community spaces and also applies when an individual is officially +representing the community in public spaces. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the platform team +via GitHub Security Advisories (for confidential reports) or by contacting `@Quantum-L9/platform` directly. + +All complaints will be reviewed and investigated promptly and fairly. + +## Enforcement Guidelines + +**1. Correction** โ€” Private written warning, clarity on violation, request for public apology. +**2. Warning** โ€” Warning with consequences for continued behavior; no interaction with involved parties for a specified period. +**3. Temporary Ban** โ€” Temporary ban from community interaction. +**4. Permanent Ban** โ€” Permanent ban for sustained, severe, or repeated violations. + +## Attribution + +This Code of Conduct is adapted from the [Contributor Covenant v2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/). diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..7267777 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,101 @@ +# Contributing to Quantum-L9 + +## Governance Setup Checklist {#governance-setup} + +Before opening any pull request, verify each item: + +- [ ] Cloned `Cursor-Governance` into your local workspace root +- [ ] Ran `setup_workspace_symlinks.sh` (see [ยง2 symlink contract](https://github.com/Quantum-L9/Cursor-Governance/blob/main/CANONICAL_LAW.md#2-symlink-contract)) +- [ ] Validated symlinks resolve correctly: `ls -la .cursor/rules .cursor/skills .cursor/commands` +- [ ] Read [CANONICAL_LAW.md ยง8](https://github.com/Quantum-L9/Cursor-Governance/blob/main/CANONICAL_LAW.md#8) for workspace wiring requirements +- [ ] Reviewed [CANONICAL_LAW.md ยง7 Anti-Patterns](https://github.com/Quantum-L9/Cursor-Governance/blob/main/CANONICAL_LAW.md#7-anti-patterns) โ€” never violate these +- [ ] All CI gates green (no bypassing required status checks) +- [ ] CODEOWNERS notified for blast-radius files + +--- + +## Quick Setup (3 Steps) + +```bash +# Step 1: Clone Cursor-Governance alongside your target repo +git clone https://github.com/Quantum-L9/Cursor-Governance.git + +# Step 2: Run workspace symlink wiring +cd Cursor-Governance +bash scripts/setup_workspace_symlinks.sh + +# Step 3: Validate symlinks +ls -la .cursor/rules .cursor/skills .cursor/commands +# Expected: all three resolve without error +``` + +Per [CANONICAL_LAW.md ยง2](https://github.com/Quantum-L9/Cursor-Governance/blob/main/CANONICAL_LAW.md#2-symlink-contract): +the workspace root must have `.cursor/` symlinks resolving to `Cursor-Governance/rules/`, `skills/`, and `commands/`. + +--- + +## CI Gate Requirements + +All pull requests must pass: + +| Gate | Tool | Kernel | +|---|---|---| +| Lint + type-check | ruff, mypy (Python) / tsc (TypeScript) | `pr-pipeline.yml@v1` | +| Unit tests | pytest (Python) / Jest (TypeScript) | `pr-pipeline.yml@v1` | +| Secret scan | gitleaks | `security.yml@v1` | +| SAST | Bandit + Semgrep (Python) | `security.yml@v1` | +| Dependency audit | pip-audit / npm audit | `security.yml@v1` | +| Pre-commit hooks | pre-commit framework | `pre-commit-ci.yml@v1` | +| Governance trio | Three-tier separation | `trio-governance.yml@v1` | + +> **Anti-patterns** ([ยง7](https://github.com/Quantum-L9/Cursor-Governance/blob/main/CANONICAL_LAW.md#7-anti-patterns)): +> Never duplicate logic across kernels. Never add business logic to thin callers. +> Never reference `@main` from thin callers โ€” always use `@v1`. + +--- + +## Branch Naming & Commit Conventions + +- Branches: `feat/`, `fix/`, `chore/`, `docs/` +- Commits: Conventional Commits format โ€” `feat(scope): message` +- PRs targeting `main` require 2 CODEOWNERS approvals for blast-radius paths + +--- + +## This Repo's Own CI + +`Quantum-L9/.github` validates itself on every PR/push to `main` โ€” note that +none of the 12 files under `workflow-templates/` ever run as CI *in this +repo*; they only appear as starter-workflow choices in other repos' Actions +tab. What actually executes here: + +- **`validate-starters.sh`** โ€” workflow-templates + `l9-ci-pack/` completeness + and `@main`-ref check (existing). +- **`actionlint`** โ€” lints every file in `workflow-templates/` and + `l9-ci-pack/workflows/` for YAML/expression/shellcheck errors + ([`.github/workflows/actionlint.yml`](.github/workflows/actionlint.yml)). +- **`SHA-pin audit`** โ€” repo-wide: every `uses:` ref in `workflow-templates/`, + `l9-ci-pack/workflows/`, and `.github/workflows/` must be pinned by full + 40-char commit SHA, except the documented frozen `Quantum-L9/l9-ci-core` + tags (`@v1` legacy, `@v2`/`@v2.0.0` current) + ([`ops/audit-sha-pins.sh`](ops/audit-sha-pins.sh)). +- **`properties.json schema validation`** โ€” every + `workflow-templates/*.properties.json` against + [`ops/schemas/workflow-template-properties.schema.json`](ops/schemas/workflow-template-properties.schema.json). + This is a structural schema only โ€” `categories` is deliberately + unconstrained by an enum. GitHub's real category vocabulary is an open + union (11 fixed buckets + any [linguist](https://github.com/github/linguist/blob/main/lib/linguist/languages.yml) + language + tech-stack names) with no single closed list; the community + SchemaStore schema for this file type encodes only the linguist-language + list and would false-flag legitimate buckets like `Automation` or + `continuous-integration`. +- **SonarCloud** โ€” external GitHub App, not a workflow file, always runs. + +--- + +## Kernel Authoring (l9-ci-core contributors only) + +- Kernels must use `on: workflow_call` only +- `l9-self-ci.yml` must remain `on: pull_request/push` โ€” **never convert to workflow_call** (circular dependency) +- `@v1` moving tag discipline: force-update `v1` for backward-compatible changes; cut `v2` for breaking changes +- See [workflow-interface-registry.yml](https://github.com/Quantum-L9/.github/blob/main/workflow-interface-registry.yml) for the full kernel API contract diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..47f4524 --- /dev/null +++ b/LICENSE @@ -0,0 +1,102 @@ +QUANTUM AI PARTNERS โ€” L9 PROPRIETARY SOFTWARE LICENSE +Version 1.0 โ€” 2026 + +Copyright (c) 2026 Quantum AI Partners ("Licensor"). All rights reserved. + +This software and associated documentation files (the "Software") are the +proprietary property of Quantum AI Partners. The Software is made +source-available on this repository for transparency, audit, and evaluation +purposes only, under the terms below. NO OPEN-SOURCE LICENSE IS GRANTED. No +prior license grant by Licensor (if any) shall be construed as a waiver of +these terms. + +1. DEFINITIONS + + "Software" means the source code, object code, documentation, domain + specs, configuration, and all other files contained in this repository, + and any modifications or derivative works thereof. + + "Commercial Use" means any use of the Software, in whole or in part, + directly or indirectly, from which any person or entity derives revenue, + profit, cost savings, competitive advantage, or other commercial benefit. + This includes, without limitation: selling, sublicensing, or hosting the + Software or a derivative work; incorporating the Software into a product + or service offered to third parties (including as part of a SaaS, + managed service, or consulting engagement); and internal use by a + for-profit entity in its business operations beyond internal evaluation. + + "You" / "Licensee" means any individual or entity that accesses, clones, + copies, or otherwise makes use of the Software. + +2. LIMITED GRANT + + Subject to Your compliance with this License, Licensor grants You a + limited, non-exclusive, non-transferable, revocable license to view, + clone, and use the Software solely for personal, academic, or internal + evaluation purposes that do NOT constitute Commercial Use. + +3. COMMERCIAL USE REQUIRES A PAID LICENSE + + Any Commercial Use of the Software requires a separate written commercial + license agreement with Quantum AI Partners, negotiated in advance, which + may include license fees, royalties, or a revenue/profit share. Engaging + in Commercial Use without such an agreement is a material breach of this + License and constitutes copyright infringement. + + To request a commercial license, contact: eng@l9.dev + +4. RESTRICTIONS + + Except as expressly permitted under Section 2, You may NOT, without prior + written consent from Licensor: + + a. Copy, reproduce, or redistribute the Software, in source or object + form, to any third party; + b. Modify, create derivative works of, reverse-engineer, or decompile + the Software, except as necessary for permitted evaluation; + c. Sublicense, sell, rent, lease, or otherwise transfer any rights in + the Software; + d. Host, deploy, or offer the Software (or a derivative work) as a + hosted or managed service to any third party; + e. Remove, obscure, or alter any copyright, trademark, or proprietary + notice contained in the Software; + f. Use the Software to build, train, or benchmark a directly competing + product or service. + +5. OWNERSHIP + + The Software is licensed, not sold. Licensor retains all right, title, + and interest in and to the Software, including all intellectual property + rights therein. No rights are granted to You other than as expressly set + forth in this License. + +6. TERMINATION + + This License terminates automatically, without notice, if You breach any + term of this License. Upon termination, You must cease all use of the + Software and destroy all copies in Your possession or control. Sections + 3, 5, 7, and 8 survive termination. + +7. NO WARRANTY + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS + OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. + +8. LIMITATION OF LIABILITY + + IN NO EVENT SHALL LICENSOR BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING + FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER + DEALINGS IN THE SOFTWARE. + +9. GOVERNING LAW + + This License shall be governed by the laws of the State of Delaware, + United States of America, without regard to conflict-of-law principles. + +--- +REPOSITORY NOTICE: This LICENSE applies only to the Quantum-L9/.github +repository. GitHub does not propagate LICENSE files via org community-health +fallbacks. Other Quantum-L9 repositories should include their own LICENSE +file (this text may be used as the org template). diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..3e8c28b --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,63 @@ +# Security Policy + +## Scope + +This policy applies to all repositories in the **Quantum-L9** GitHub organization, +including internal tooling (`l9-*` cartridges), infrastructure-as-code, and CI/CD +workflows. This file is the **single canonical source**, inherited org-wide from +`Quantum-L9/.github` โ€” individual repos MUST NOT maintain a competing `SECURITY.md`; +link here instead. (One local copy makes that repo ignore this file entirely; there +is no merging.) + +## Out of Scope + +Vulnerabilities requiring physical access, social engineering of maintainers, or +issues in third-party dependencies without a demonstrated exploit path against +Quantum-L9 systems specifically โ€” report those upstream instead. + +## Reporting a Vulnerability + +**Do NOT open a public GitHub issue for security vulnerabilities.** + +Report vulnerabilities privately via [GitHub Security Advisories](https://github.com/Quantum-L9/.github/security/advisories/new). + +Include: +- Affected repository and version/SHA +- Vulnerability type and CVSS score estimate (see guidance below) +- Reproduction steps (minimal reproducer preferred) +- Potential impact assessment +- Any proposed mitigations + +## Response SLA + +| Severity | Acknowledge | Patch Target | +|---|---|---| +| Critical (CVSS 9.0โ€“10.0) | 24 hours | 7 days | +| High (CVSS 7.0โ€“8.9) | 48 hours | 14 days | +| Medium (CVSS 4.0โ€“6.9) | 48 hours | 30 days | +| Low (CVSS 0.1โ€“3.9) | 5 business days | Next release cycle | + +## CVSS Scoring Guidance for Reporters + +Use [CVSS v3.1 Calculator](https://www.first.org/cvss/calculator/3.1) to estimate severity. +Key vectors: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, CIA Impact. + +## Security Packages + +The [`l9-assurance`](https://github.com/Quantum-L9/l9-assurance) monorepo provides: +- [`l9-agent-security-testkit`](https://github.com/Quantum-L9/l9-assurance/tree/main/packages/l9-agent-security-testkit) โ€” agent-layer security test utilities +- [`l9-security-testkit`](https://github.com/Quantum-L9/l9-assurance/tree/main/packages/l9-security-testkit) โ€” general security testing framework + +## Automated Security Controls + +All repositories use: +- **gitleaks** โ€” secret scanning on every commit +- **Bandit + Semgrep** โ€” Python SAST +- **pip-audit / npm audit** โ€” dependency vulnerability scanning +- **Dependabot** โ€” automated dependency updates with SHA pinning via `ratchet` +- **OpenSSF Scorecard** โ€” supply-chain security posture scoring + +## Disclosure Policy + +Quantum-L9 follows coordinated disclosure. We request 90 days to remediate before public disclosure. +After the patch is released, we will publish a GitHub Security Advisory crediting the reporter (unless anonymity is requested). diff --git a/SUPPORT.md b/SUPPORT.md new file mode 100644 index 0000000..aa6e613 --- /dev/null +++ b/SUPPORT.md @@ -0,0 +1,36 @@ +# Support + +## Getting Help + +### Primary: GitHub Issues + +Open a GitHub Issue in the relevant repository using the appropriate template: + +| Issue Type | Template | +|---|---| +| Bug report | [Bug Report](https://github.com/Quantum-L9/.github/issues/new?template=bug_report.yml) | +| Feature request | [Feature Request](https://github.com/Quantum-L9/.github/issues/new?template=feature_request.yml) | +| Governance violation | [Gov Violation](https://github.com/Quantum-L9/.github/issues/new?template=gov-violation.yml) | +| CI pipeline failure | [CI Failure](https://github.com/Quantum-L9/.github/issues/new?template=ci-failure.yml) | + +### Secondary: GitHub Discussions + +For questions, architectural discussions, and community input: +[github.com/Quantum-L9/.github/discussions](https://github.com/Quantum-L9/.github/discussions) + +## Out of Scope + +The following are **not supported** through Quantum-L9 channels: +- General AI/ML questions unrelated to Quantum-L9 infrastructure +- Debugging third-party tools (GitHub Actions runners, PyPI, npm registry) +- Questions already answered in [CANONICAL_LAW.md](https://github.com/Quantum-L9/Cursor-Governance/blob/main/CANONICAL_LAW.md) +- Requests to bypass CI gates or CODEOWNERS requirements + +## Response Expectations + +| Channel | Expected Response Time | +|---|---| +| GitHub Issues (bugs, governance) | 2 business days | +| GitHub Issues (features) | 1 week | +| GitHub Discussions | Best effort | +| Security vulnerabilities | See [SECURITY.md](https://github.com/Quantum-L9/.github/blob/main/SECURITY.md) | diff --git a/biome.json b/biome.json new file mode 100644 index 0000000..b1fe395 --- /dev/null +++ b/biome.json @@ -0,0 +1,169 @@ +{ + "$schema": "https://biomejs.dev/schemas/2.5.8/schema.json", + "root": true, + "vcs": { + "enabled": true, + "clientKind": "git", + "useIgnoreFile": true, + "defaultBranch": "main" + }, + "files": { + "ignoreUnknown": true, + "maxSize": 1048576, + "includes": [ + "**", + "!**/*.jsonc", + "!**/node_modules", + "!**/.venv", + "!**/venv", + "!**/__pycache__", + "!**/.git", + "!**/.ruff_cache", + "!**/.l9", + "!**/dist", + "!**/coverage", + "!**/package-lock.json", + "!**/npm-shrinkwrap.json" + ] + }, + "formatter": { + "enabled": true, + "formatWithErrors": false, + "useEditorconfig": true, + "indentStyle": "space", + "indentWidth": 2, + "lineEnding": "lf", + "lineWidth": 100, + "trailingNewline": true, + "bracketSpacing": true, + "bracketSameLine": false, + "attributePosition": "auto", + "expand": "auto", + "delimiterSpacing": false + }, + "linter": { + "enabled": true, + "rules": { + "preset": "recommended" + } + }, + "assist": { + "enabled": true, + "actions": { + "preset": "recommended", + "source": { + "organizeImports": "on", + "useSortedKeys": "off", + "useSortedAttributes": "off", + "useSortedInterfaceMembers": "off", + "useSortedEnumMembers": "on", + "useSortedPackageJson": "on", + "noDuplicateClasses": "on" + } + } + }, + "json": { + "parser": { + "allowComments": false, + "allowTrailingCommas": false + }, + "formatter": { + "enabled": true, + "indentStyle": "space", + "indentWidth": 2, + "lineEnding": "lf", + "lineWidth": 100, + "trailingNewline": true, + "trailingCommas": "none", + "bracketSpacing": true, + "expand": "auto", + "delimiterSpacing": false + }, + "linter": { + "enabled": true + }, + "assist": { + "enabled": false + } + }, + "javascript": { + "jsxRuntime": "transparent", + "formatter": { + "enabled": true, + "indentStyle": "space", + "indentWidth": 2, + "lineEnding": "lf", + "lineWidth": 100, + "trailingNewline": true, + "quoteStyle": "double", + "jsxQuoteStyle": "double", + "quoteProperties": "asNeeded", + "trailingCommas": "all", + "semicolons": "always", + "arrowParentheses": "always", + "bracketSpacing": true, + "bracketSameLine": false, + "attributePosition": "auto", + "operatorLinebreak": "after", + "expand": "auto", + "delimiterSpacing": false + }, + "linter": { + "enabled": true + }, + "assist": { + "enabled": true + } + }, + "css": { + "formatter": { + "enabled": false + }, + "linter": { + "enabled": false + }, + "assist": { + "enabled": false + } + }, + "graphql": { + "formatter": { + "enabled": false + }, + "linter": { + "enabled": false + }, + "assist": { + "enabled": false + } + }, + "html": { + "experimentalFullSupportEnabled": false, + "formatter": { + "enabled": false + }, + "linter": { + "enabled": false + }, + "assist": { + "enabled": false + } + }, + "overrides": [ + { + "includes": ["**/*.jsonc", "**/.vscode"], + "json": { + "parser": { + "allowComments": true, + "allowTrailingCommas": true + }, + "formatter": { + "enabled": false + }, + "linter": { + "enabled": false + } + } + } + ] +}