From 58689b17478747cbd57b662680df95cb2115f582 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 9 Apr 2026 07:55:28 +0900 Subject: [PATCH 1/2] ci: force github actions to node24 --- .github/workflows/codeql.yml | 3 +++ .github/workflows/dependency-review.yml | 3 +++ .github/workflows/quality-gate.yml | 3 +++ .github/workflows/release.yml | 3 +++ .github/workflows/scorecards.yml | 3 +++ .github/workflows/tests.yml | 3 +++ tests/test_workflow_runtime_env.py | 7 +++++++ 7 files changed, 25 insertions(+) create mode 100644 tests/test_workflow_runtime_env.py diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index c304e483..1cd2fe41 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,5 +1,8 @@ name: codeql +env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true + on: push: branches: [main, develop] diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 329d2db5..9bda0b9c 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -1,5 +1,8 @@ name: dependency-review +env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true + on: pull_request: diff --git a/.github/workflows/quality-gate.yml b/.github/workflows/quality-gate.yml index ab3a15c6..f88039cb 100644 --- a/.github/workflows/quality-gate.yml +++ b/.github/workflows/quality-gate.yml @@ -1,5 +1,8 @@ name: quality-gate +env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true + on: push: branches: [main, develop] diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index eb74edb0..3ff3fbae 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,5 +1,8 @@ name: release +env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true + on: push: tags: diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 96d9fe5b..14501bde 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -1,5 +1,8 @@ name: scorecards +env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true + on: push: branches: [develop] diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 66a0a476..3ff5c228 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -1,5 +1,8 @@ name: tests +env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true + on: push: branches: [main, develop] diff --git a/tests/test_workflow_runtime_env.py b/tests/test_workflow_runtime_env.py new file mode 100644 index 00000000..049ba0ab --- /dev/null +++ b/tests/test_workflow_runtime_env.py @@ -0,0 +1,7 @@ +from pathlib import Path + + +def test_javascript_actions_are_forced_to_node24(): + for workflow_path in sorted(Path(".github/workflows").glob("*.yml")): + text = workflow_path.read_text(encoding="utf-8") + assert "FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true" in text, workflow_path From 57fe8e8d9bb401e4eca97bb197fdadf2fc640c8e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 9 Apr 2026 09:05:26 +0900 Subject: [PATCH 2/2] docs: record OpenSSF badge decision (#11) * docs: record OpenSSF badge decision * docs: add changelog baseline (#12) --- CHANGELOG.md | 14 ++++++++ README.md | 2 ++ docs/adr/0001-openssf-best-practices-badge.md | 36 +++++++++++++++++++ docs/adr/README.md | 5 +++ tests/test_adr_docs.py | 12 +++++++ tests/test_changelog.py | 9 +++++ 6 files changed, 78 insertions(+) create mode 100644 CHANGELOG.md create mode 100644 docs/adr/0001-openssf-best-practices-badge.md create mode 100644 docs/adr/README.md create mode 100644 tests/test_adr_docs.py create mode 100644 tests/test_changelog.py diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 00000000..15098c15 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,14 @@ +# Changelog + +All notable changes to this project will be documented in this file. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +## [Unreleased] + +### Added + +- MinerU-backed DOM parsing API for scanned Japanese newspaper PDFs +- Synthetic newspaper fixture generation and structural equivalence checks +- Protected-branch CI, security gates, release provenance workflow, and Git Flow documentation diff --git a/README.md b/README.md index 7e9a0cb9..6e8aff54 100644 --- a/README.md +++ b/README.md @@ -56,6 +56,8 @@ Development setup, fixture handling rules, and local-only baseline maintenance a Version tags trigger a GitHub-native release workflow that builds distribution artifacts, checksums, and provenance attestations. +Project history is tracked in `CHANGELOG.md`. + Repository branch workflow is documented in `docs/workflow/git-flow.md`. ## Repository layout diff --git a/docs/adr/0001-openssf-best-practices-badge.md b/docs/adr/0001-openssf-best-practices-badge.md new file mode 100644 index 00000000..658530eb --- /dev/null +++ b/docs/adr/0001-openssf-best-practices-badge.md @@ -0,0 +1,36 @@ +# ADR-0001: OpenSSF Best Practices Badge Enrollment + +## Status + +Accepted + +## Context + +The repository already has branch protection, CI checks, CodeQL, OpenSSF Scorecard, Dependabot, a security policy, locked workflow dependencies, and a planned release pipeline. Scorecard still reports a best-practices gap because the OpenSSF Best Practices badge program has not been started. + +The current repository also has only one organization member and one repository collaborator, so external reviewer capacity is not yet in place. The first tagged release is not available yet because the current PR stack still needs external review before it can merge into protected branches. + +## Decision + +We will **defer** OpenSSF Best Practices badge enrollment until after: + +1. the current protected-branch PR stack is merged, +2. the first tagged release has been produced with release provenance, and +3. at least one external reviewer is available for normal protected-branch review flow. + +## Consequences + +### Positive + +- Keeps focus on finishing concrete repository hardening already underway. +- Avoids starting a badge questionnaire before the release and review processes are stable. +- Preserves a clear, auditable decision in the repository. + +### Negative + +- Scorecard will continue to report the best-practices gap until enrollment is revisited. + +## Follow-up + +- Revisit enrollment after issue #8 and issue #10 are resolved. +- If the repository still intends to pursue the badge at that time, assign an owner and complete the OpenSSF questionnaire. diff --git a/docs/adr/README.md b/docs/adr/README.md new file mode 100644 index 00000000..e62188d7 --- /dev/null +++ b/docs/adr/README.md @@ -0,0 +1,5 @@ +# Architecture Decision Records + +| ADR | Title | Status | +| --- | ----- | ------ | +| [0001](0001-openssf-best-practices-badge.md) | OpenSSF Best Practices Badge Enrollment | Accepted | diff --git a/tests/test_adr_docs.py b/tests/test_adr_docs.py new file mode 100644 index 00000000..a4203c54 --- /dev/null +++ b/tests/test_adr_docs.py @@ -0,0 +1,12 @@ +from pathlib import Path + + +def test_best_practices_decision_adr_exists_and_documents_deferral(): + path = Path("docs/adr/0001-openssf-best-practices-badge.md") + assert path.exists() + text = path.read_text(encoding="utf-8") + assert "Status" in text + assert "Accepted" in text + assert "defer" in text.lower() + assert "first tagged release" in text.lower() + assert "external reviewer" in text.lower() diff --git a/tests/test_changelog.py b/tests/test_changelog.py new file mode 100644 index 00000000..e7c7e499 --- /dev/null +++ b/tests/test_changelog.py @@ -0,0 +1,9 @@ +from pathlib import Path + + +def test_changelog_exists_and_uses_keep_a_changelog_format(): + text = Path("CHANGELOG.md").read_text(encoding="utf-8") + assert text.startswith("# Changelog") + assert "Keep a Changelog" in text + assert "## [Unreleased]" in text + assert "Semantic Versioning" in text