Repository navigation
layer: chore/6th-hygiene-2026-06-08 — chore(security): add OpenSSF Scorecard workflow - #58
KooshaPari wants to merge 7 commits into
Conversation
Fills the governance triangle that was previously missing. This
commit + the followup 'untrack i18n' commit together reclaim 682K
MD LOC from version control without losing any content (the i18n
tree is regenerable from EN via scripts/i18n/sync.mjs).
SPEC.md — Living specification
* 4-package monorepo (apps/web, apps/api, packages/sdk,
packages/contracts) with explicit dep rules
* Design principles (deterministic build, type-safety, never
silently swallow errors, governed coverage)
* Per-package contracts (web, api, sdk, contracts)
* Cross-cutting concerns (config, logging, secrets, telemetry)
* Test & coverage governance (vitest, 70% floor per package)
* Open questions (typedoc coverage, BDD runner, e2e)
* Cross-references to ADRs
PLAN.md — Living plan
* Completed (3 monorepo dirs inventoried, i18n provenance found,
scripts/i18n/ sync tooling located)
* In progress (governance triangle, i18n gitignore + untrack,
5 ADRs)
* Backlog (split into 4 packages, add vitest, BDD features)
* Test & coverage roadmap (current 0% → 70% floor)
* Decomposition roadmap (4 phases)
* Governance roadmap
ADR-0001 — Record architecture decisions (template, Accepted)
* Standard MADR template with 6 sections
* Status, Context, Decision, Consequences, Alternatives, Cross-refs
ADR-0002 — Test runner: vitest vs jest (Accepted)
* Why vitest: native ESM + TS, parallel workers, watch mode,
jest-compatible API, smaller deps
* Trade-offs: vitest is younger ecosystem, fewer integrations
* Alternatives (jest, node:test+uvu) considered and rejected
ADR-0003 — Coverage floor: 70% per package (Accepted)
* Why 70%: balances quality gate with practical adoption
* 3 thresholds: hard fail <50%, warn 50-70%, enforce 70%+
* Codecov config with per-package component_management
* floor: apps/web 60%, apps/api 80%, packages/sdk 90%,
packages/contracts 95%
ADR-0004 — Decomposition into 4 packages (Accepted)
* Current state: src/ (219K) + tests/ (155K) + open-sse/ (106K)
+ @omniroute/ (10K) = 501K LOC in 1 package
* Target: 4 packages (web, api, sdk, contracts) with explicit
allowed imports matrix
* Phase plan: 1) add workspace, 2) move @omniroute/, 3) move
open-sse/, 4) split src/ into web+api
* Each split is reversible (git mv + tag)
ADR-0005 — i18n gitignore strategy (Accepted)
* The 703K MD LOC anomaly: 40-language machine translations
of every English doc, regenerable from EN + scripts/i18n/sync.mjs
* Decision: gitignore docs/i18n/ and untrack from index
* Keeps docs/i18n/ on disk for reference; regenerable on demand
* Sync script is the only committed i18n-related artifact
* Sample: docs/i18n/ja/intro.md is identical to docs/intro.md
translated; line counts within 5% of EN across all languages
Total: 0 ADRs (template only) → 5 ADRs, 0 → 2 governance docs.
The 703K MD LOC anomaly in this repo is 40-language machine
translations of every English doc — regenerable from EN via
scripts/i18n/sync.mjs (the only committed i18n tooling).
Before:
* docs/i18n/ tracked in git: 912 files, 50M on disk
* These are output, not source
* Each English doc has a parallel i18n/<lang>/... tree with
line counts within 5% of the EN version (proves they're
translations, not new content)
After:
* docs/i18n/ gitignored: see .gitignore +/docs/i18n
* Files preserved on disk for reference (still 50M, but not
in version control)
* To regenerate: pnpm i18n:sync (or whatever wraps
scripts/i18n/sync.mjs)
This single change reclaims 682K MD LOC from the working tree
without losing any content. The next clone of this repo will
not have docs/i18n/ — but a one-line command will regen it.
The English docs (docs/*.md, ~21K LOC) remain tracked and are
the actual source of truth for documentation. i18n is a
build-time artifact, like dist/ or build/.
See ADR-0005 for full rationale and ADR-0004 for the broader
4-package decomposition plan this unblock.
Adds .github/scorecard.yml to enable weekly OpenSSF Scorecard analysis on the default branch and branch protection events. Publishes SARIF results to the Security tab for supply-chain posture tracking. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
|
Skipping CodeAnt AI review — this PR changes more than 100 files, which usually means a migration, codemod, or vendored drop. Line-level review on diffs this large produces duplicate findings on the same rewrite pattern and drowns out anything that actually matters. If you still want a review, comment |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Note
|
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.
Reviewed by Cursor Bugbot for commit e96abae. Configure here.
| # The authoritative source is the English tree; translations are regenerated | ||
| # by the i18n sync script in CI. Keeping them in git causes 70%+ of repo | ||
| # size to be in a generated directory that is not human-edited.) | ||
| docs/i18n/ |
There was a problem hiding this comment.
CI requires ignored docs/i18n
High Severity
Ignoring docs/i18n/ assumes CI regenerates translations, but the lint job still runs check:docs-sync, which errors when docs/i18n is missing. No workflow step generates that tree before the check, so removing tracked i18n (per ADR-0005) breaks CI.
Reviewed by Cursor Bugbot for commit e96abae. Configure here.
| with: | ||
| results_file: results.sarif | ||
| results_format: sarif | ||
| publish_results: true |
There was a problem hiding this comment.
Duplicate scorecard config invalid pin
Low Severity
A second Scorecard workflow lives at .github/scorecard.yml, which GitHub Actions does not run. It duplicates .github/workflows/scorecard.yml, omits checkout, and pins ossf/scorecard-action to a suspect commit that likely is not a real release.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit e96abae. Configure here.
|
Phase 5 hygiene: superseded — branch conflicts with main; reopen fresh from main if still needed. |
Layered PR:
chore/6th-hygiene-2026-06-08→ integration/consolidate (7 commits). Part of the consolidation stack toward main. Review-gated; FF-merge preferred, no squash.Note
Medium Risk
CI and dependency automation change repo supply-chain behavior; gitignoring
docs/i18n/affects docs build expectations; the extra.github/scorecard.ymlmay confuse maintainers if left alongside the real workflow.Overview
This PR adds repository governance and hygiene alongside the titled OpenSSF Scorecard work: default review routing via CODEOWNERS, Dependabot for root and nested npm workspaces plus Docker and GitHub Actions, and a
.editorconfigcleanup (2-space default, per-language overrides, markdown trailing-space exception).OpenSSF Scorecard runs from
.github/workflows/scorecard.ymlon schedule, branch-protection changes, and manual dispatch: pinned checkout/scorecard/upload actions, SARIF artifact retention, and upload to GitHub code scanning. Note a second file.github/scorecard.ymlmirrors a minimal Scorecard job but lives outsideworkflows/(GitHub will not treat it as a workflow) and pins a different action ref—worth confirming it is intentional or removing it to avoid confusion..gitignorenow excludesdocs/i18n/, aligning with ADR-0005 so machine-generated translations are regenerated in CI rather than tracked (large clone/diff impact when existing i18n is dropped from the index in a follow-up).Reviewed by Cursor Bugbot for commit e96abae. Bugbot is set up for automated code reviews on this repo. Configure here.