Skip to content

Commit 86d4f4a

Browse files
author
Usingthefork
committed
chore: add CI, OIDC release workflow, community files
- .github/workflows/ci.yml pytest matrix (3.10/3.11/3.12) + twine check - .github/workflows/release.yml tag-triggered PyPI publish via trusted publishing (OIDC) - CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md (Contributor Covenant 2.1) - Issue templates: bug, feature, regulatory-update (+ disable blank issues) - PR template - Dependabot weekly for pip + github-actions
1 parent 12ab4ae commit 86d4f4a

11 files changed

Lines changed: 483 additions & 0 deletions

File tree

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: Bug report
2+
description: Something isn't working
3+
labels: ["bug", "triage"]
4+
body:
5+
- type: markdown
6+
attributes:
7+
value: |
8+
Thanks for filing a bug. Please fill in the fields below — issues
9+
without a reproducer will be closed.
10+
- type: input
11+
id: version
12+
attributes:
13+
label: cra-scope version
14+
description: Output of `cra-scope --version`
15+
placeholder: "0.1.2"
16+
validations:
17+
required: true
18+
- type: input
19+
id: python
20+
attributes:
21+
label: Python version
22+
description: Output of `python --version`
23+
placeholder: "3.12.3"
24+
validations:
25+
required: true
26+
- type: input
27+
id: os
28+
attributes:
29+
label: Operating system
30+
placeholder: "Ubuntu 24.04 / macOS 14 / Windows 11"
31+
validations:
32+
required: true
33+
- type: textarea
34+
id: what-happened
35+
attributes:
36+
label: What happened?
37+
description: A clear and concise description of the bug.
38+
validations:
39+
required: true
40+
- type: textarea
41+
id: reproducer
42+
attributes:
43+
label: Minimal reproducer
44+
description: Exact command(s) or Python snippet. Redact any secrets.
45+
render: shell
46+
validations:
47+
required: true
48+
- type: textarea
49+
id: expected
50+
attributes:
51+
label: Expected behaviour
52+
validations:
53+
required: true
54+
- type: textarea
55+
id: logs
56+
attributes:
57+
label: Full output / traceback
58+
render: shell

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: Security vulnerability
4+
url: https://github.com/Usingthefork/cra-scope-cli/security/policy
5+
about: Please report security issues privately via SECURITY.md, not as a public issue.
6+
- name: Managed SaaS questions
7+
url: https://crascope.com
8+
about: For multi-product clocks, dashboards, alerting and audit archive, see CRA Scope SaaS.

‎.github/ISSUE_TEMPLATE/feature_request.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Feature request
2+
description: Suggest an enhancement
3+
labels: ["enhancement", "triage"]
4+
body:
5+
- type: textarea
6+
id: problem
7+
attributes:
8+
label: What problem are you trying to solve?
9+
description: Describe the user-facing problem, not the implementation.
10+
validations:
11+
required: true
12+
- type: textarea
13+
id: proposal
14+
attributes:
15+
label: Proposed solution
16+
validations:
17+
required: true
18+
- type: textarea
19+
id: cra-reference
20+
attributes:
21+
label: CRA / ENISA reference (if applicable)
22+
description: |
23+
Link to the relevant article in Regulation (EU) 2024/2847 or
24+
official ENISA / EC guidance. Features tied to regulation are
25+
prioritised over generic enhancements.
26+
- type: textarea
27+
id: alternatives
28+
attributes:
29+
label: Alternatives considered

‎.github/ISSUE_TEMPLATE/regulatory_update.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: Regulatory update
2+
description: ENISA, EC or CRA-text change that affects this tool
3+
labels: ["regulatory", "triage"]
4+
body:
5+
- type: markdown
6+
attributes:
7+
value: |
8+
Use this template when ENISA, the European Commission, or another
9+
official body publishes guidance, a schema, an FAQ update, or an
10+
implementing act that changes what this tool must produce.
11+
- type: input
12+
id: source
13+
attributes:
14+
label: Source URL
15+
description: Link to the official publication.
16+
placeholder: "https://digital-strategy.ec.europa.eu/..."
17+
validations:
18+
required: true
19+
- type: input
20+
id: published-date
21+
attributes:
22+
label: Publication date
23+
placeholder: "2026-09-11"
24+
validations:
25+
required: true
26+
- type: textarea
27+
id: change
28+
attributes:
29+
label: What changed?
30+
description: Summarise the regulatory change in plain English.
31+
validations:
32+
required: true
33+
- type: textarea
34+
id: impact
35+
attributes:
36+
label: Impact on cra-scope
37+
description: Which payload builders, schemas, or CSIRT entries are affected?
38+
validations:
39+
required: true

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
## Summary
2+
3+
<!-- One sentence: what does this PR change? -->
4+
5+
## Motivation
6+
7+
<!-- Why is this change needed? Link any issues with "Fixes #N". -->
8+
9+
## Checklist
10+
11+
- [ ] Tests added or updated
12+
- [ ] `pytest` passes locally on Python 3.10 / 3.11 / 3.12
13+
- [ ] `CHANGELOG.md` updated under `## [Unreleased]`
14+
- [ ] No version bump in `pyproject.toml` (maintainers handle releases)
15+
- [ ] If the change affects payload structure, a regulatory reference is cited
16+
17+
## Regulatory reference (if applicable)
18+
19+
<!-- Link to Regulation (EU) 2024/2847 article, ENISA guidance, or EC FAQ. -->

‎.github/dependabot.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: pip
4+
directory: "/"
5+
schedule:
6+
interval: weekly
7+
day: monday
8+
open-pull-requests-limit: 5
9+
labels:
10+
- dependencies
11+
commit-message:
12+
prefix: "deps"
13+
include: scope
14+
15+
- package-ecosystem: github-actions
16+
directory: "/"
17+
schedule:
18+
interval: weekly
19+
day: monday
20+
open-pull-requests-limit: 5
21+
labels:
22+
- dependencies
23+
- ci
24+
commit-message:
25+
prefix: "ci"
26+
include: scope

‎.github/workflows/ci.yml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
workflow_dispatch:
9+
10+
permissions:
11+
contents: read
12+
13+
jobs:
14+
test:
15+
name: pytest (py${{ matrix.python-version }})
16+
runs-on: ubuntu-latest
17+
strategy:
18+
fail-fast: false
19+
matrix:
20+
python-version: ["3.10", "3.11", "3.12"]
21+
steps:
22+
- uses: actions/checkout@v4
23+
24+
- name: Set up Python
25+
uses: actions/setup-python@v5
26+
with:
27+
python-version: ${{ matrix.python-version }}
28+
cache: pip
29+
30+
- name: Install package + dev deps
31+
run: |
32+
python -m pip install --upgrade pip
33+
pip install -e ".[dev]"
34+
35+
- name: Run tests
36+
run: pytest -q --cov=cra_scope_core --cov=cra_scope_cli --cov-report=term
37+
38+
build:
39+
name: build + twine check
40+
runs-on: ubuntu-latest
41+
needs: test
42+
steps:
43+
- uses: actions/checkout@v4
44+
45+
- name: Set up Python
46+
uses: actions/setup-python@v5
47+
with:
48+
python-version: "3.12"
49+
cache: pip
50+
51+
- name: Install build tooling
52+
run: |
53+
python -m pip install --upgrade pip
54+
pip install build twine
55+
56+
- name: Build distributions
57+
run: python -m build
58+
59+
- name: Verify distributions
60+
run: python -m twine check dist/*
61+
62+
- name: Upload dist artefacts
63+
uses: actions/upload-artifact@v4
64+
with:
65+
name: dist
66+
path: dist/
67+
retention-days: 7

‎.github/workflows/release.yml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
name: Release to PyPI
2+
3+
# Publishes to PyPI when a tag like v1.2.3 is pushed.
4+
# Uses PyPI Trusted Publishing (OIDC) — no long-lived API token required.
5+
#
6+
# One-time setup on PyPI:
7+
# 1. Go to https://pypi.org/manage/account/publishing/
8+
# 2. Add a pending trusted publisher with:
9+
# PyPI Project Name: cra-scope
10+
# Owner: Usingthefork
11+
# Repository name: cra-scope-cli
12+
# Workflow filename: release.yml
13+
# Environment name: pypi
14+
15+
on:
16+
push:
17+
tags:
18+
- "v*"
19+
20+
permissions:
21+
contents: read
22+
23+
jobs:
24+
build:
25+
name: Build distributions
26+
runs-on: ubuntu-latest
27+
steps:
28+
- uses: actions/checkout@v4
29+
30+
- name: Set up Python
31+
uses: actions/setup-python@v5
32+
with:
33+
python-version: "3.12"
34+
cache: pip
35+
36+
- name: Install build tooling
37+
run: |
38+
python -m pip install --upgrade pip
39+
pip install build twine
40+
41+
- name: Verify tag matches pyproject version
42+
run: |
43+
TAG="${GITHUB_REF_NAME#v}"
44+
PYPROJECT_VERSION=$(python -c "import tomllib,pathlib; print(tomllib.loads(pathlib.Path('pyproject.toml').read_text())['project']['version'])")
45+
echo "Tag version: $TAG"
46+
echo "pyproject version: $PYPROJECT_VERSION"
47+
if [ "$TAG" != "$PYPROJECT_VERSION" ]; then
48+
echo "::error::Tag $TAG does not match pyproject.toml version $PYPROJECT_VERSION"
49+
exit 1
50+
fi
51+
52+
- name: Build sdist + wheel
53+
run: python -m build
54+
55+
- name: Verify distributions
56+
run: python -m twine check dist/*
57+
58+
- name: Upload dist artefacts
59+
uses: actions/upload-artifact@v4
60+
with:
61+
name: dist
62+
path: dist/
63+
64+
publish:
65+
name: Publish to PyPI (OIDC)
66+
needs: build
67+
runs-on: ubuntu-latest
68+
environment:
69+
name: pypi
70+
url: https://pypi.org/project/cra-scope/
71+
permissions:
72+
id-token: write # required for trusted publishing
73+
steps:
74+
- name: Download dist artefacts
75+
uses: actions/download-artifact@v4
76+
with:
77+
name: dist
78+
path: dist/
79+
80+
- name: Publish to PyPI
81+
uses: pypa/gh-action-pypi-publish@release/v1

‎CODE_OF_CONDUCT.md‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# Contributor Covenant Code of Conduct
2+
3+
## Our Pledge
4+
5+
We as members, contributors, and leaders pledge to make participation in our
6+
community a harassment-free experience for everyone, regardless of age, body
7+
size, visible or invisible disability, ethnicity, sex characteristics, gender
8+
identity and expression, level of experience, education, socio-economic status,
9+
nationality, personal appearance, race, caste, colour, religion, or sexual
10+
identity and orientation.
11+
12+
We pledge to act and interact in ways that contribute to an open, welcoming,
13+
diverse, inclusive, and healthy community.
14+
15+
## Our Standards
16+
17+
Examples of behaviour that contributes to a positive environment:
18+
19+
- Demonstrating empathy and kindness toward other people
20+
- Being respectful of differing opinions, viewpoints, and experiences
21+
- Giving and gracefully accepting constructive feedback
22+
- Accepting responsibility and apologising to those affected by our mistakes
23+
- Focusing on what is best not just for us as individuals, but for the
24+
overall community
25+
26+
Examples of unacceptable behaviour:
27+
28+
- The use of sexualised language or imagery, and sexual attention or advances
29+
- Trolling, insulting or derogatory comments, and personal or political attacks
30+
- Public or private harassment
31+
- Publishing others' private information, such as a physical or email address,
32+
without their explicit permission
33+
- Other conduct which could reasonably be considered inappropriate in a
34+
professional setting
35+
36+
## Enforcement Responsibilities
37+
38+
Project maintainers are responsible for clarifying and enforcing our standards
39+
and will take appropriate and fair corrective action in response to any
40+
behaviour they deem inappropriate, threatening, offensive, or harmful.
41+
42+
## Scope
43+
44+
This Code of Conduct applies within all community spaces, and also applies when
45+
an individual is officially representing the community in public spaces.
46+
47+
## Enforcement
48+
49+
Instances of abusive, harassing, or otherwise unacceptable behaviour may be
50+
reported to the maintainers at **conduct@crascope.com**. All complaints will
51+
be reviewed and investigated promptly and fairly.
52+
53+
All maintainers are obligated to respect the privacy and security of the
54+
reporter of any incident.
55+
56+
## Attribution
57+
58+
This Code of Conduct is adapted from the
59+
[Contributor Covenant](https://www.contributor-covenant.org), version 2.1,
60+
available at
61+
<https://www.contributor-covenant.org/version/2/1/code_of_conduct.html>.

0 commit comments

Comments
 (0)