Chore/openssf gold prep - #455
Merged
Merged
Conversation
- .githooks/pre-push blocks non-fast-forward pushes at client level - AGENTS.md rule 4: explicit prohibition with root-cause prevention - Recovery table documents correct alternatives for common scenarios - Hook does not advertise bypass to prevent AI agents from self-bypassing
- GOVERNANCE.md: project leadership, decision-making, contribution process - docs/code-review-standards.md: review checklist, security-sensitive areas - Both required for OpenSSF Gold badge criteria
All source files now include: /* Copyright (c) 2016-2026 EDDI contributors * SPDX-License-Identifier: Apache-2.0 */ Required for OpenSSF Gold license_per_file criterion.
- Copyright headers now: 'Copyright EDDI contributors' (no year) - Avoids annual maintenance and historical inaccuracy for newer files - GOVERNANCE.md: corrected domain to https://eddi.labs.ai
- code-review-standards.md: SecretsVault -> VaultSecretProvider (actual class) - CODEOWNERS: replace TODO placeholder with @ginccc @rolandpickl
…ity doc - pom.xml: added -ea (enable assertions) to surefire argLine for dynamic_analysis_enable_assertions criterion - docs/security-review.md: formal security review summary covering automated tooling (CodeQL, Trivy, ZAP, fuzz) and manual review phases - docs/build-reproducibility.md: documents deterministic builds, dependency pinning, Cosign verification, and SBOM generation
…VE number, and CodeQL findings - Template engine: Qute, not Thymeleaf (Thymeleaf was migrated away from) - CVE: CVE-2026-25526 (from pom.xml), not fabricated CVE-2025-59340 - CodeQL findings: regex injection, path traversal, error exposure (not SQL injection)
- CODEOWNERS: remove duplicate comment and stale commented-out examples - security-review.md: fix misleading threat model cross-reference to docs/security.md
SBOM (CycloneDX) only runs on push events to main, not on every CI run including PRs (ci.yml line 346: if: github.event_name == 'push')
…ve sources Lesson from Thymeleaf confabulation: codebase grep hits in migration code gave the wrong signal. Rule: always verify tech stack claims against pom.xml/ci.yml/Dockerfile, never infer from grep results.
Contributor
|
Important Review skippedToo many files! This PR contains 300 files, which is 150 over the limit of 150. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (300)
You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Prepares the repository for OpenSSF Best Practices (Gold) by formalizing governance/review policies, tightening Git safety, improving security/build documentation, and aligning source files with SPDX license header requirements.
Changes:
- Added governance, code review standards, security review, and build reproducibility documentation.
- Added a pre-push Git hook and updated contributor guidance / CODEOWNERS to enforce safer workflows and reviews.
- Added SPDX license headers across many Java sources and enabled Java assertions for Maven Surefire tests.
Reviewed changes
Copilot reviewed 300 out of 1097 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
| src/main/java/ai/labs/eddi/engine/mcp/McpMemoryTools.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/mcp/McpGroupTools.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/mcp/McpGdprTools.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/mcp/McpDocResources.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/mcp/McpConversationTools.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/mcp/McpApiToolBuilder.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/mcp/McpAdminTools.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/lifecycle/internal/LifecycleManager.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/lifecycle/internal/ComponentCache.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/lifecycle/exceptions/WorkflowConfigurationException.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/lifecycle/exceptions/UnrecognizedExtensionException.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/lifecycle/exceptions/LifecycleException.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/lifecycle/exceptions/IllegalExtensionConfigurationException.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/lifecycle/exceptions/ConversationStopException.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/lifecycle/exceptions/CannotExecuteException.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/lifecycle/bootstrap/LifecycleModule.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/lifecycle/bootstrap/LifecycleExtensions.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/lifecycle/ILifecycleTask.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/lifecycle/ILifecycleManager.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/lifecycle/IConversation.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/lifecycle/IComponentCache.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/lifecycle/GroupConversationEventSink.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/lifecycle/ConversationEventSink.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/internal/RestLogAdmin.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/internal/RestGroupConversation.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/internal/RestCoordinatorAdmin.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/internal/RestAgentManagement.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/internal/RestAgentEngineStreaming.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/internal/RestAgentEngine.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/internal/RestAgentAdministration.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/internal/IContextLogger.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/internal/GroupConversationService.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/internal/ConversationService.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/internal/ContextLogger.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/httpclient/impl/VertxHttpClient.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/httpclient/impl/HttpClientWrapper.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/httpclient/bootstrap/HttpClientModule.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/httpclient/SafeHttpClient.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/httpclient/IResponse.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/httpclient/IRequest.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/httpclient/IHttpClient.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/httpclient/ICompleteListener.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/gdpr/UserDataExport.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/gdpr/RestGdprAdmin.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/gdpr/ProcessingRestrictedExceptionMapper.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/gdpr/ProcessingRestrictedException.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/gdpr/IRestGdprAdmin.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/gdpr/GdprDeletionResult.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/gdpr/GdprComplianceService.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/exception/SneakyThrow.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/exception/ResourceStoreExceptionMapper.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/exception/ResourceNotFoundExceptionMapper.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/exception/ResourceModifiedExceptionMapper.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/exception/ResourceAlreadyExistsExceptionMapper.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/exception/RejectedExecutionExceptionMapper.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/exception/IllegalArgumentExceptionMapper.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/compliance/ComplianceStartupChecks.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/caching/ICacheFactory.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/caching/ICache.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/caching/CacheImpl.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/caching/CacheFactory.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/audit/rest/RestAuditStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/audit/rest/IRestAuditStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/audit/model/AuditEntry.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/audit/IAuditStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/audit/IAuditEntryCollector.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/audit/AuditStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/audit/AuditLedgerService.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/audit/AuditHmac.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/api/IRestLogAdmin.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/api/IRestGroupConversation.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/api/IRestCoordinatorAdmin.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/api/IRestAgentSetup.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/api/IRestAgentManagement.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/api/IRestAgentEngineStreaming.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/api/IRestAgentEngine.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/api/IRestAgentAdministration.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/api/ILogoutEndpoint.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/api/IGroupConversationService.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/api/IConversationService.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/a2a/RestA2AEndpoint.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/a2a/AgentCardService.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/a2a/A2ATaskHandler.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/engine/a2a/A2AModels.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/serialization/SerializationCustomizer.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/serialization/JsonSerialization.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/serialization/IdSerializer.java | Add SPDX license header for compliance (file contains third-party notice) |
| src/main/java/ai/labs/eddi/datastore/serialization/IdDeserializer.java | Add SPDX license header for compliance (file contains third-party notice) |
| src/main/java/ai/labs/eddi/datastore/serialization/Id.java | Add SPDX license header for compliance (file contains third-party notice) |
| src/main/java/ai/labs/eddi/datastore/serialization/IJsonSerialization.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/serialization/IDocumentBuilder.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/serialization/IDescriptorStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/serialization/DocumentBuilder.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/serialization/DeserializationException.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/postgres/PostgresUserMemoryStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/postgres/PostgresUserConversationStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/postgres/PostgresScheduleStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/postgres/PostgresResourceStorageFactory.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/postgres/PostgresResourceStorage.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/postgres/PostgresMigrationManager.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/postgres/PostgresMigrationLogStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/postgres/PostgresHealthCheck.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/postgres/PostgresDeploymentStorage.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/postgres/PostgresDatabaseLogs.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/postgres/PostgresConversationMemoryStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/postgres/PostgresAuditStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/postgres/PostgresAttachmentStorage.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/postgres/PostgresAgentTriggerStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/mongo/codec/JacksonProvider.java | Add SPDX license header for compliance (file contains third-party notice) |
| src/main/java/ai/labs/eddi/datastore/mongo/codec/JacksonCodec.java | Add SPDX license header for compliance (file contains third-party notice) |
| src/main/java/ai/labs/eddi/datastore/mongo/ResultManipulator.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/mongo/ResourceFilter.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/mongo/MongoResourceStorageFactory.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/mongo/MongoResourceStorage.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/mongo/ModifiableHistorizedResourceStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/mongo/HistorizedResourceStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/mongo/DescriptorStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/mongo/AbstractMongoResourceStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/model/ResourceId.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/bootstrap/PersistenceModule.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/ModifiableHistorizedResourceStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/IResourceStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/IResourceStorageFactory.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/IResourceStorage.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/IResourceFilter.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/HistorizedResourceStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/DescriptorStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/DataStoreProducers.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/datastore/AbstractResourceStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/workflows/rest/RestWorkflowStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/workflows/rest/RestWorkflowStepStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/workflows/mongo/WorkflowStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/workflows/model/WorkflowConfiguration.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/workflows/model/ExtensionDescriptor.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/workflows/IWorkflowStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/workflows/IRestWorkflowStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/workflows/IRestWorkflowStepStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/snippets/rest/RestPromptSnippetStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/snippets/mongo/PromptSnippetStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/snippets/model/PromptSnippet.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/snippets/IRestPromptSnippetStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/snippets/IPromptSnippetStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/schema/JsonSchemaCreator.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/schema/IJsonSchemaCreator.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/rules/rest/RestRuleSetStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/rules/mongo/RuleSetStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/rules/model/RuleSetConfiguration.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/rules/model/RuleGroupConfiguration.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/rules/model/RuleConfiguration.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/rules/model/RuleConditionConfiguration.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/rules/IRuleSetStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/rules/IRestRuleSetStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/rest/RestVersionInfo.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/rag/rest/RestRagStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/rag/rest/RestRagIngestion.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/rag/mongo/RagStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/rag/model/RagConfiguration.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/rag/IRestRagStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/rag/IRestRagIngestion.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/rag/IRagStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/propertysetter/rest/RestPropertySetterStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/propertysetter/mongo/PropertySetterStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/propertysetter/model/PropertySetterConfiguration.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/propertysetter/IRestPropertySetterStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/propertysetter/IPropertySetterStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/properties/rest/RestUserMemoryStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/properties/rest/RestPropertiesStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/properties/mongo/PropertiesMigrationService.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/properties/mongo/MongoUserMemoryStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/properties/model/UserMemoryEntry.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/properties/model/PropertyInstruction.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/properties/model/Property.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/properties/model/Properties.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/properties/IUserMemoryStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/properties/IRestUserMemoryStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/properties/IRestPropertiesStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/patch/PatchInstruction.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/parser/rest/RestParserStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/parser/mongo/ParserStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/parser/model/ParserConfiguration.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/parser/IRestParserStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/parser/IParserStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/output/rest/keys/RestOutputActions.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/output/rest/RestOutputStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/output/mongo/OutputStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/output/model/OutputConfigurationSet.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/output/model/OutputConfiguration.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/output/keys/IRestOutputActions.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/output/IRestOutputStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/output/IOutputStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/migration/model/MigrationLog.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/migration/V6RenameMigration.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/migration/V6QuteMigration.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/migration/TemplateSyntaxMigrator.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/migration/MigrationManager.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/migration/MigrationLogStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/migration/IMigrationManager.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/migration/IMigrationLogStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/migration/IDocumentMigration.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/mcpcalls/rest/RestMcpCallsStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/mcpcalls/mongo/McpCallsStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/mcpcalls/model/McpCallsConfiguration.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/mcpcalls/model/McpCall.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/mcpcalls/IRestMcpCallsStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/mcpcalls/IMcpCallsStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/llm/rest/RestLlmStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/llm/mongo/LlmStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/llm/IRestLlmStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/llm/ILlmStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/groups/rest/RestAgentGroupStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/groups/mongo/GroupConversationStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/groups/mongo/AgentGroupStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/groups/model/GroupConversation.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/groups/model/DiscussionStylePresets.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/groups/model/AgentGroupConfiguration.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/groups/IRestAgentGroupStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/groups/IGroupConversationStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/groups/IAgentGroupStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/dictionary/rest/RestDictionaryStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/dictionary/mongo/DictionaryStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/dictionary/model/DictionaryConfiguration.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/dictionary/expression/RestExpression.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/dictionary/expression/RestAction.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/dictionary/IRestExpression.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/dictionary/IRestDictionaryStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/dictionary/IRestAction.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/dictionary/IDictionaryStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/descriptors/rest/RestDocumentDescriptorStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/descriptors/mongo/DocumentDescriptorStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/descriptors/model/SimpleDocumentDescriptor.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/descriptors/model/ResourceDescriptor.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/descriptors/model/DocumentDescriptor.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/descriptors/ResourceUtilities.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/descriptors/IRestDocumentDescriptorStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/descriptors/IDocumentDescriptorStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/deployment/rest/RestDeploymentStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/deployment/mongo/MongoDeploymentStorage.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/deployment/mongo/DeploymentStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/deployment/model/DeploymentInfo.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/deployment/IRestDeploymentStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/deployment/IDeploymentStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/deployment/IDeploymentStorage.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/apicalls/rest/RestApiCallsStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/apicalls/mongo/ApiCallsStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/apicalls/model/RetryApiCallInstruction.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/apicalls/model/Request.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/apicalls/model/QuickRepliesBuildingInstruction.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/apicalls/model/PreRequest.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/apicalls/model/PostResponse.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/apicalls/model/OutputBuildingInstruction.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/apicalls/model/HttpPreRequest.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/apicalls/model/HttpPostResponse.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/apicalls/model/HttpCodeValidator.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/apicalls/model/BuildingInstruction.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/apicalls/model/BatchRequestBuildingInstruction.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/apicalls/model/ApiCallsConfiguration.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/apicalls/model/ApiCall.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/apicalls/IRestApiCallsStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/apicalls/IApiCallsStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/agents/rest/RestCapabilityRegistry.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/agents/rest/RestAgentStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/agents/mongo/AgentStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/agents/model/AgentConfiguration.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/agents/IRestCapabilityRegistry.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/agents/IRestAgentStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/agents/IAgentStore.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/agents/CapabilityRegistryService.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/agents/AgentSigningService.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/admin/rest/RestOrphanAdmin.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/admin/model/OrphanReport.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/admin/model/OrphanInfo.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/admin/IRestOrphanAdmin.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/OpenApiConfig.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/configs/IRestVersionInfo.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/backup/model/SyncRequest.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/backup/model/SyncMapping.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/backup/model/ImportPreview.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/backup/model/ExportPreview.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/backup/impl/ZipResourceSource.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/backup/impl/ZipArchive.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/backup/impl/UpgradeExecutor.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/backup/impl/StructuralMatcher.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/backup/impl/SourceUrlValidator.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/backup/impl/RestImportService.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/backup/impl/RestExportService.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/backup/impl/RemoteApiResourceSource.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/backup/impl/CallbackMatcher.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/backup/impl/AbstractBackupService.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/backup/IZipArchive.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/backup/IRestImportService.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/backup/IRestExportService.java | Add SPDX license header for compliance |
| src/main/java/ai/labs/eddi/backup/IResourceSource.java | Add SPDX license header for compliance |
| pom.xml | Enable Java assertions for Surefire test runs |
| docs/security-review.md | Add formal security review summary documentation |
| docs/code-review-standards.md | Add code review standards documentation |
| docs/build-reproducibility.md | Add build reproducibility documentation |
| GOVERNANCE.md | Add governance and project decision-making documentation |
| AGENTS.md | Strengthen contributor guidance around force-push avoidance and verification |
| .github/CODEOWNERS | Update code owners to core maintainers |
| .githooks/pre-push | Add hook to block non-fast-forward pushes |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Renumber AGENTS.md workflow steps 3-8 (was duplicating step 7) - Fix 5 third-party derived files: Portions copyright EDDI contributors (JacksonCodec, JacksonProvider, Id, IdDeserializer, IdSerializer) - Harden pre-push hook for shallow clones: auto-fetch remote ref before declaring non-fast-forward, remove non-ASCII emoji from output
…ew.md Verified against ci.yml: - Cosign: every push to main + tags (not just releases) - SLSA Provenance: same - Trivy: filesystem scan on every push+PR, image scan in Docker job
rolandpickl
approved these changes
Apr 26, 2026
ginccc
added a commit
that referenced
this pull request
Apr 27, 2026
- changelog: corrected LogSanitizer behavior description (replace vs strip) - AgentOrchestrator: sanitize groupIds entries before logging (CWE-117) - LogSanitizerTest: fixed @DisplayName range to include 0x0B-0x0C
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces several important improvements to project governance, security, and development workflow, along with new documentation and minor codebase changes. The main highlights are the addition of formal governance and code review standards, stricter enforcement and documentation of safe git practices (especially around force-push), and enhanced build and security documentation.
Key changes include:
Governance and Code Review Policy
GOVERNANCE.mdfile outlining project leadership roles, decision-making processes, contribution workflow, code review policy, release process, and license details.docs/code-review-standards.mdspecifying code review requirements, security-sensitive review areas, merge policy, and AI-assisted code review rules.Security and Build Documentation
docs/security-review.mdsummarizing security reviews, automated tooling, manual audits, threat model, and compliance (EU AI Act, HIPAA, GDPR/CCPA).docs/build-reproducibility.mddetailing how builds are made reproducible, dependency pinning, CI environment controls, and artifact verification (Cosign, SBOM).Development Workflow and Git Safety
AGENTS.mdto strictly prohibit force-pushes, document safe alternatives, and clarify commit/rebase/reset rules. Added a troubleshooting table for common git mistakes and their safe resolutions..githooks/pre-pushscript to block non-fast-forward pushes (force-pushes) as a safety net..github/CODEOWNERSto reflect current maintainers for all code review.Codebase and Build Configuration
-ea) in the Maven Surefire plugin configuration for improved test coverage and debugging.These changes collectively improve project transparency, security posture, and development safety, while making the build and review process more robust and auditable.