Skip to content

Commit 3586d84

Browse files
coaxkclaude
coaxk
and
claude
committed
ci: add security scanning, release automation, and repo hygiene workflows
Security: - Trivy: Docker image CVE scanning (push + weekly) - Bandit: Python security linter with SARIF upload - Dependency Review: block PRs adding vulnerable deps Automation: - Release Drafter: auto-generate release notes from PR labels - Label Sync: declarative label management from .github/labels.yml - Stale: auto-close inactive issues (60d) and PRs (30d) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 3ee0b04 commit 3586d84

8 files changed

Lines changed: 307 additions & 0 deletions

File tree

‎.github/labels.yml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# Core
2+
- name: bug
3+
color: "d73a4a"
4+
description: "Something isn't working"
5+
- name: enhancement
6+
color: "a2eeef"
7+
description: "New feature or request"
8+
- name: documentation
9+
color: "0075ca"
10+
description: "Improvements or additions to documentation"
11+
- name: security
12+
color: "e11d48"
13+
description: "Security hardening"
14+
- name: dependencies
15+
color: "0366d6"
16+
description: "Dependency updates"
17+
18+
# Areas
19+
- name: backend
20+
color: "3b82f6"
21+
description: "FastAPI / Python backend"
22+
- name: frontend
23+
color: "8b5cf6"
24+
description: "JavaScript frontend / UI"
25+
- name: analysis-engine
26+
color: "f59e0b"
27+
description: "Conflict detection & fix generation"
28+
- name: apply-fix
29+
color: "34d399"
30+
description: "Fix generation & application"
31+
- name: paste-flow
32+
color: "a78bfa"
33+
description: "Error paste pathway"
34+
- name: UX
35+
color: "ec4899"
36+
description: "User experience improvements"
37+
- name: infrastructure
38+
color: "6b7280"
39+
description: "CI/CD, Docker, deployment"
40+
- name: tech-debt
41+
color: "f97316"
42+
description: "Code restructuring & cleanup"
43+
44+
# Process
45+
- name: beta-testing
46+
color: "10b981"
47+
description: "Beta test reports & feedback"
48+
- name: elder-council
49+
color: "fbbf24"
50+
description: "Originated from Elder Council review"
51+
- name: good first issue
52+
color: "7057ff"
53+
description: "Good for newcomers"
54+
- name: help wanted
55+
color: "008672"
56+
description: "Extra attention is needed"
57+
58+
# Stages
59+
- name: stage-1
60+
color: "dc2626"
61+
description: "Pre-beta priority"
62+
- name: stage-2
63+
color: "ea580c"
64+
description: "First patch"
65+
- name: stage-3
66+
color: "ca8a04"
67+
description: "Code health + UX"
68+
- name: stage-4
69+
color: "16a34a"
70+
description: "Strategic / v2.0"
71+
72+
# Lifecycle
73+
- name: stale
74+
color: "ededed"
75+
description: "No recent activity"
76+
- name: pinned
77+
color: "006b75"
78+
description: "Exempt from stale bot"
79+
- name: skip-changelog
80+
color: "ededed"
81+
description: "Exclude from release notes"
82+
83+
# Triage
84+
- name: duplicate
85+
color: "cfd3d7"
86+
description: "This issue or pull request already exists"
87+
- name: invalid
88+
color: "e4e669"
89+
description: "This doesn't seem right"
90+
- name: wontfix
91+
color: "ffffff"
92+
description: "This will not be worked on"
93+
- name: question
94+
color: "d876e3"
95+
description: "Further information is requested"

‎.github/release-drafter.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name-template: "v$RESOLVED_VERSION"
2+
tag-template: "v$RESOLVED_VERSION"
3+
template: |
4+
## What's Changed
5+
6+
$CHANGES
7+
8+
**Full Changelog**: https://github.com/$OWNER/$REPOSITORY/compare/$PREVIOUS_TAG...v$RESOLVED_VERSION
9+
categories:
10+
- title: "Security"
11+
labels:
12+
- "security"
13+
- title: "Features"
14+
labels:
15+
- "enhancement"
16+
- "feature"
17+
- title: "Bug Fixes"
18+
labels:
19+
- "bug"
20+
- "fix"
21+
- title: "Infrastructure"
22+
labels:
23+
- "ci/cd"
24+
- "infrastructure"
25+
- title: "Documentation"
26+
labels:
27+
- "documentation"
28+
- title: "Dependencies"
29+
labels:
30+
- "dependencies"
31+
change-template: "- $TITLE @$AUTHOR (#$NUMBER)"
32+
change-title-escapes: '\<*_&'
33+
version-resolver:
34+
major:
35+
labels:
36+
- "major"
37+
minor:
38+
labels:
39+
- "minor"
40+
- "enhancement"
41+
- "feature"
42+
patch:
43+
labels:
44+
- "bug"
45+
- "fix"
46+
- "dependencies"
47+
default: patch
48+
exclude-labels:
49+
- "skip-changelog"

‎.github/workflows/bandit.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: Bandit Security Lint
2+
3+
on:
4+
push:
5+
branches: [main, "feature/**"]
6+
pull_request:
7+
branches: [main]
8+
9+
jobs:
10+
bandit:
11+
name: Python security lint
12+
runs-on: ubuntu-latest
13+
permissions:
14+
security-events: write
15+
contents: read
16+
steps:
17+
- uses: actions/checkout@v4
18+
19+
- uses: actions/setup-python@v5
20+
with:
21+
python-version: "3.12"
22+
23+
- name: Install Bandit
24+
run: pip install bandit[sarif]
25+
26+
- name: Run Bandit
27+
run: bandit -r backend/ -f sarif -o bandit-results.sarif --severity-level medium || true
28+
29+
- name: Upload Bandit results
30+
uses: github/codeql-action/upload-sarif@v3
31+
if: always()
32+
with:
33+
sarif_file: "bandit-results.sarif"

‎.github/workflows/dependency-review.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Dependency Review
2+
3+
on:
4+
pull_request:
5+
branches: [main]
6+
7+
permissions:
8+
contents: read
9+
10+
jobs:
11+
dependency-review:
12+
name: Check for vulnerable dependencies
13+
runs-on: ubuntu-latest
14+
steps:
15+
- uses: actions/checkout@v4
16+
- uses: actions/dependency-review-action@v4
17+
with:
18+
fail-on-severity: high

‎.github/workflows/label-sync.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: Label Sync
2+
3+
on:
4+
push:
5+
branches: [main]
6+
paths:
7+
- ".github/labels.yml"
8+
workflow_dispatch:
9+
10+
jobs:
11+
sync:
12+
runs-on: ubuntu-latest
13+
permissions:
14+
issues: write
15+
steps:
16+
- uses: actions/checkout@v4
17+
- uses: EndBug/label-sync@v2
18+
with:
19+
config-file: .github/labels.yml
20+
delete-other-labels: false

‎.github/workflows/release-drafter.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: Release Drafter
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
types: [opened, reopened, synchronize]
8+
9+
permissions:
10+
contents: read
11+
pull-requests: write
12+
13+
jobs:
14+
update_release_draft:
15+
runs-on: ubuntu-latest
16+
permissions:
17+
contents: write
18+
pull-requests: write
19+
steps:
20+
- uses: release-drafter/release-drafter@v6
21+
env:
22+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/stale.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: Stale Issues
2+
3+
on:
4+
schedule:
5+
- cron: "0 9 * * 1" # Weekly Monday 9am UTC
6+
7+
permissions:
8+
issues: write
9+
pull-requests: write
10+
11+
jobs:
12+
stale:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- uses: actions/stale@v9
16+
with:
17+
stale-issue-message: >
18+
This issue has been automatically marked as stale because it has not had
19+
activity in the last 60 days. It will be closed in 14 days if no further
20+
activity occurs. If this is still relevant, please comment to keep it open.
21+
stale-pr-message: >
22+
This PR has been automatically marked as stale because it has not had
23+
activity in the last 30 days. It will be closed in 14 days if no further
24+
activity occurs.
25+
days-before-issue-stale: 60
26+
days-before-pr-stale: 30
27+
days-before-issue-close: 14
28+
days-before-pr-close: 14
29+
stale-issue-label: "stale"
30+
stale-pr-label: "stale"
31+
exempt-issue-labels: "pinned,security,beta-testing"
32+
exempt-pr-labels: "pinned,security"

‎.github/workflows/trivy.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: Trivy Container Scan
2+
3+
on:
4+
push:
5+
branches: [main]
6+
paths:
7+
- "Dockerfile"
8+
- "requirements.txt"
9+
schedule:
10+
- cron: "0 6 * * 3" # Weekly Wednesday 6am UTC
11+
workflow_dispatch:
12+
13+
jobs:
14+
scan:
15+
name: Scan Docker image
16+
runs-on: ubuntu-latest
17+
permissions:
18+
security-events: write
19+
contents: read
20+
steps:
21+
- uses: actions/checkout@v4
22+
23+
- name: Build image for scanning
24+
run: docker build -t maparr:scan .
25+
26+
- name: Run Trivy vulnerability scanner
27+
uses: aquasecurity/trivy-action@0.28.0
28+
with:
29+
image-ref: "maparr:scan"
30+
format: "sarif"
31+
output: "trivy-results.sarif"
32+
severity: "CRITICAL,HIGH"
33+
34+
- name: Upload Trivy scan results
35+
uses: github/codeql-action/upload-sarif@v3
36+
if: always()
37+
with:
38+
sarif_file: "trivy-results.sarif"

0 commit comments

Comments
 (0)