Skip to content

Commit 02296ce

Browse files
HetCreepclaude
HetCreep
and
claude
committed
chore: seed from TheColliery/.github templates/published-code/
Generated skeleton — edit the source (TheColliery/.github), never this repo directly. Re-synced by the .github deputy on every skeleton change. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
1 parent 2b0dc2d commit 02296ce

21 files changed

Lines changed: 787 additions & 2 deletions

‎.gitattributes‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Normalize line endings: LF everywhere except Windows-only scripts.
2+
* text=auto eol=lf
3+
# Redundant under the rule above, but stated explicitly: a CRLF checkout of a
4+
# /bin/sh hook is `bad interpreter` on POSIX, i.e. a silently absent gate.
5+
/.githooks/** text eol=lf
6+
*.ps1 text eol=crlf
7+
*.cmd text eol=crlf
8+
*.bat text eol=crlf

‎.githooks/pre-commit‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#!/bin/sh
2+
# Repo gate — wired as BOTH pre-commit and pre-push (identical bytes).
3+
# Runs the same fail-loud pair CI runs (.github/workflows/ci.yml).
4+
#
5+
# Enable once per clone — git deliberately refuses to let a repo configure its
6+
# own hooks, so the files travel with the clone but the pointer does not:
7+
# git config core.hooksPath .githooks
8+
#
9+
# Fails CLOSED on purpose: a missing node or a missing script blocks the commit
10+
# instead of passing quietly (hooks-safety.md 1.0 — a git pre-* hook MUST be
11+
# able to abort; scripts-quality.md 1 — CLI scripts fail loud).
12+
#
13+
# ponytail: lives in .githooks/, not hooks/ — hooks/ is the SHIPPED plugin-hook
14+
# source dir, so a dev-only gate there would depend on this repo's build filter
15+
# to keep it out of plugin/. CoalMine keeps its twins at hooks/pre-commit.sh and
16+
# its build does filter them; .githooks/ needs no filter to be safe. Named
17+
# divergence, one reason: the shipped dir stays shipped-only.
18+
node scripts/verify.mjs || exit 1
19+
node scripts/test.mjs

‎.githooks/pre-push‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#!/bin/sh
2+
# Repo gate — wired as BOTH pre-commit and pre-push (identical bytes).
3+
# Runs the same fail-loud pair CI runs (.github/workflows/ci.yml).
4+
#
5+
# Enable once per clone — git deliberately refuses to let a repo configure its
6+
# own hooks, so the files travel with the clone but the pointer does not:
7+
# git config core.hooksPath .githooks
8+
#
9+
# Fails CLOSED on purpose: a missing node or a missing script blocks the commit
10+
# instead of passing quietly (hooks-safety.md 1.0 — a git pre-* hook MUST be
11+
# able to abort; scripts-quality.md 1 — CLI scripts fail loud).
12+
#
13+
# ponytail: lives in .githooks/, not hooks/ — hooks/ is the SHIPPED plugin-hook
14+
# source dir, so a dev-only gate there would depend on this repo's build filter
15+
# to keep it out of plugin/. CoalMine keeps its twins at hooks/pre-commit.sh and
16+
# its build does filter them; .githooks/ needs no filter to be safe. Named
17+
# divergence, one reason: the shipped dir stays shipped-only.
18+
node scripts/verify.mjs || exit 1
19+
node scripts/test.mjs

‎.github/ISSUE_TEMPLATE/bug-report.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: "Bug report"
2+
description: "{{REPO_NAME}} misbehaves"
3+
title: "[bug] <component>: <one-line summary>"
4+
labels: ["bug"]
5+
body:
6+
- type: dropdown
7+
id: component
8+
attributes:
9+
label: Component
10+
options:
11+
- "{{COMPONENT_1}}"
12+
- "{{COMPONENT_2}}"
13+
- conductor hook
14+
- installer
15+
- configurator
16+
- verify gate
17+
- plugin / packaging
18+
- docs
19+
validations:
20+
required: true
21+
- type: input
22+
id: version
23+
attributes:
24+
label: "{{REPO_NAME}} version + platform"
25+
placeholder: "vX.Y.Z · Claude Code on Windows 11"
26+
validations:
27+
required: true
28+
- type: textarea
29+
id: repro
30+
attributes:
31+
label: Steps to reproduce + what happened
32+
description: "Exact commands/inputs and exact output."
33+
validations:
34+
required: true
35+
- type: textarea
36+
id: expected
37+
attributes:
38+
label: Expected behavior

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
blank_issues_enabled: true
2+
contact_links:
3+
- name: Security issue
4+
url: https://github.com/{{ORG}}/{{REPO_NAME}}/security/advisories/new
5+
about: "Report a vulnerability through GitHub's private vulnerability reporting — see SECURITY.md."

‎.github/dependabot.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: github-actions
4+
directory: /
5+
schedule:
6+
interval: weekly
7+
cooldown:
8+
default-days: 7
9+
commit-message:
10+
prefix: ci
11+
# Assign every bump PR to the maintainer -> a notification fires (assignment is
12+
# a "participating" event, delivered at any watch level). Human still merges.
13+
assignees:
14+
- HetCreep
15+
# Group all github/codeql-action/* paths (init/analyze/upload-sarif) into ONE PR
16+
# so they bump together -> no init/analyze version skew (which reds CodeQL).
17+
groups:
18+
codeql-action:
19+
patterns:
20+
- "github/codeql-action*"

‎.github/workflows/ci.yml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [main]
6+
paths-ignore:
7+
# skip verify/test only for NON-shipped docs — a SHIPPED markdown artifact (skills/**/SKILL.md, commands/*.md) MUST run CI (verify checks dist-sync)
8+
- 'README.md'
9+
- 'CHANGELOG.md'
10+
- 'CONTRIBUTING.md'
11+
- 'PRIVACY.md'
12+
- 'SECURITY.md'
13+
- 'LICENSE'
14+
pull_request:
15+
branches: [main]
16+
paths-ignore:
17+
# skip verify/test only for NON-shipped docs — a SHIPPED markdown artifact (skills/**/SKILL.md, commands/*.md) MUST run CI (verify checks dist-sync)
18+
- 'README.md'
19+
- 'CHANGELOG.md'
20+
- 'CONTRIBUTING.md'
21+
- 'PRIVACY.md'
22+
- 'SECURITY.md'
23+
- 'LICENSE'
24+
25+
permissions:
26+
contents: read
27+
28+
jobs:
29+
gate:
30+
name: gate (${{ matrix.os }} · node ${{ matrix.node }})
31+
strategy:
32+
fail-fast: false
33+
matrix:
34+
os: [ubuntu-latest, windows-latest, macos-latest]
35+
node: [22, 24] # supported LTS only (24 Active, 22 Maintenance); 18/20 are EOL — bump as the Node LTS schedule moves
36+
runs-on: ${{ matrix.os }}
37+
steps:
38+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
39+
with:
40+
# 0 = all history for ALL branches AND tags (action.yml @ this pinned tag: "0
41+
# indicates all history for all branches and tags") — without this, git's
42+
# shallow default leaves no tag reachable, so task #38's dist-changelog gate
43+
# (scripts/lib/dist-changelog.mjs) SKIPs on every CI run. fetch-tags is NOT
44+
# needed alongside this: its own description scopes it to "even if
45+
# fetch-depth > 0" — the shallow case — which fetch-depth: 0 isn't.
46+
fetch-depth: 0
47+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
48+
with:
49+
node-version: ${{ matrix.node }}
50+
# Zero-dependency: no install step. Run the same fail-loud gate as a local pre-push,
51+
# cross-platform — verify (dist-sync + repo consistency checks) then the test suite.
52+
# No build step here: rebuilding the dist in CI would mask a stale COMMITTED
53+
# plugin/ — the exact drift verify exists to catch.
54+
- run: node scripts/verify.mjs
55+
- run: node scripts/test.mjs
56+
# PowerShell parity tests (the PS twins of the Node hooks) — pwsh ships on the GitHub
57+
# runners; skip gracefully if it is ever absent so the node gate above still gates.
58+
- name: PowerShell parity tests
59+
shell: bash
60+
run: |
61+
if command -v pwsh >/dev/null 2>&1; then
62+
pwsh -NoProfile -File scripts/lib/ps-config.test.ps1
63+
pwsh -NoProfile -File scripts/lib/ps-hooks.test.ps1
64+
else
65+
echo "pwsh not found — skipping PS parity tests"
66+
fi
67+
68+
69+
# A single STABLE required-check context (the matrix names drift; this does not).
70+
# Succeeds iff every matrix gate passed or was legitimately skipped; fails if any
71+
# gate failed. Rulesets require `all-green`, never the per-matrix names.
72+
all-green:
73+
name: all-green
74+
needs: gate
75+
if: always()
76+
runs-on: ubuntu-latest
77+
steps:
78+
- name: gate result
79+
run: |
80+
case "${{ needs.gate.result }}" in
81+
success|skipped) echo "gate ${{ needs.gate.result }}"; exit 0 ;;
82+
*) echo "gate ${{ needs.gate.result }}"; exit 1 ;;
83+
esac

‎.github/workflows/codeql.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: CodeQL
2+
3+
on:
4+
push:
5+
branches: [main]
6+
paths-ignore:
7+
# CodeQL analyzes js/ts only — NO markdown needs a security scan, so skip ALL docs (a doc-only commit doesn't run CodeQL). Shipped SKILL.md/commands consistency is ci.yml's job (verify dist-sync), not CodeQL's.
8+
- '**.md'
9+
- 'LICENSE'
10+
pull_request:
11+
branches: [main]
12+
paths-ignore:
13+
# CodeQL analyzes js/ts only — NO markdown needs a security scan, so skip ALL docs (a doc-only commit doesn't run CodeQL). Shipped SKILL.md/commands consistency is ci.yml's job (verify dist-sync), not CodeQL's.
14+
- '**.md'
15+
- 'LICENSE'
16+
schedule:
17+
- cron: '0 6 * * 1'
18+
19+
permissions:
20+
contents: read
21+
22+
jobs:
23+
analyze:
24+
name: analyze (javascript)
25+
runs-on: ubuntu-latest
26+
permissions:
27+
security-events: write
28+
steps:
29+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
30+
- uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
31+
with:
32+
languages: javascript-typescript
33+
queries: security-and-quality
34+
- uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4

‎.github/workflows/dependabot-auto-merge.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Dependabot auto-merge
2+
3+
# Auto-merge Dependabot PATCH/MINOR bumps AFTER the required checks pass, for the
4+
# maintainer's bot ONLY. A ruleset on `main` (require all-green + analyze, bypass
5+
# the owner) makes `--auto` WAIT for CI+CodeQL — without it `--auto` would merge
6+
# immediately, so the ruleset is load-bearing, not optional. A red check leaves the
7+
# PR open (the dependabot.yml `assignees` then notifies the maintainer). MAJOR bumps
8+
# are never auto-merged (a human reviews the breaking change). Only `dependabot[bot]`
9+
# reaches the merge step, so a human-opened PR never auto-merges.
10+
on: pull_request
11+
12+
# Minimal top-level token (Scorecard Token-Permissions best practice); only the
13+
# merge job escalates to the write scopes `gh pr merge` needs.
14+
permissions:
15+
contents: read
16+
17+
jobs:
18+
auto-merge:
19+
if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
20+
runs-on: ubuntu-latest
21+
permissions:
22+
contents: write
23+
pull-requests: write
24+
steps:
25+
- name: Fetch Dependabot metadata
26+
id: meta
27+
uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
28+
with:
29+
github-token: ${{ secrets.GITHUB_TOKEN }}
30+
# Patch + minor auto-merge; a major bump waits for a human.
31+
- name: Enable auto-merge (patch/minor)
32+
if: ${{ steps.meta.outputs.update-type != 'version-update:semver-major' }}
33+
run: gh pr merge --squash --auto "${{ github.event.pull_request.html_url }}"
34+
env:
35+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/markdownlint.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: markdownlint
2+
3+
on:
4+
push:
5+
branches: [main]
6+
paths:
7+
- '**.md'
8+
pull_request:
9+
branches: [main]
10+
paths:
11+
- '**.md'
12+
13+
permissions:
14+
contents: read
15+
16+
jobs:
17+
lint:
18+
runs-on: ubuntu-latest
19+
steps:
20+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
21+
- uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff # v24.2.0
22+
continue-on-error: true # report-only: a focused markdownlint cleanup is a separate pass
23+
with:
24+
globs: '**/*.md'

0 commit comments

Comments
 (0)