diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..0f525da --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1 @@ +* @aryanjasala @AnuragVasanwala @Adi-ty @justlevine diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml new file mode 100644 index 0000000..01d0ef3 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug.yml @@ -0,0 +1,98 @@ +name: Bug report +description: A reusable workflow fails, misbehaves or rejects a valid caller. +type: Bug +labels: + - "Type: Bug" +body: + - type: markdown + attributes: + value: >- + Thanks for reporting a bug. Please search + [existing issues](https://github.com/rtCamp/wp-shared-workflows/issues?q=is%3Aissue) + first. + - type: markdown + attributes: + value: >- + **Found a security issue?** Do not open a public issue. Report it + privately through + [GitHub's vulnerability reporting](https://github.com/rtCamp/wp-shared-workflows/security/advisories/new), + as [SECURITY.md](https://github.com/rtCamp/wp-shared-workflows/blob/main/SECURITY.md) + describes. + - type: input + id: workflow + attributes: + label: Workflow file + description: The reusable workflow that fails. Name the leaf if you know it, otherwise the orchestrator you call. + placeholder: ci-lint-php.yml + validations: + required: true + - type: input + id: caller-ref + attributes: + label: Caller ref + description: The ref after the `@` in your `uses:` line. + placeholder: v1 + validations: + required: true + - type: dropdown + id: runner + attributes: + label: Runner + description: What your caller passes as `runs-on`. + options: + - GitHub-hosted (the "ubuntu-latest" default or another hosted label) + - rtCamp self-hosted ('["self-hosted"]') + - Another self-hosted runner + validations: + required: true + - type: input + id: run-link + attributes: + label: Run link + description: The failing Actions run. If the repository is private, paste the relevant log output below instead. + placeholder: https://github.com///actions/runs/ + validations: + required: false + - type: textarea + id: caller + attributes: + label: Caller job + description: The job that calls the workflow, with its `with:` and `secrets:` keys. Replace secret values with placeholders. + render: yaml + placeholder: | + lint-php: + uses: rtCamp/wp-shared-workflows/.github/workflows/ci-lint-php.yml@v1 + with: + php-version: "8.3" + validations: + required: true + - type: textarea + id: what-happened + attributes: + label: What happened? + description: The failing step and its error, or the behaviour you saw. + validations: + required: true + - type: textarea + id: expected + attributes: + label: What did you expect to happen? + validations: + required: true + - type: textarea + id: logs + attributes: + label: Relevant log output + description: Paste the failing step's log. It is rendered as code, so no backticks are needed. + render: text + validations: + required: false + - type: checkboxes + id: checks + attributes: + label: Before you submit + options: + - label: I searched the existing issues and this is not a duplicate. + required: true + - label: I removed secrets, tokens and private URLs from everything above. + required: true diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..3ba13e0 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1 @@ +blank_issues_enabled: false diff --git a/.github/ISSUE_TEMPLATE/feature.yml b/.github/ISSUE_TEMPLATE/feature.yml new file mode 100644 index 0000000..08b629e --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature.yml @@ -0,0 +1,69 @@ +name: Feature request +description: Suggest a new input, output, workflow or behaviour. +type: Feature +labels: + - "Type: Feature" +body: + - type: markdown + attributes: + value: >- + Thanks for the suggestion. Please search + [existing issues](https://github.com/rtCamp/wp-shared-workflows/issues?q=is%3Aissue) + first. + - type: markdown + attributes: + value: >- + A tagged workflow's inputs, secrets and outputs are public API: every + caller pinned at `@v1` picks up a change on its next run. Within v1, new + inputs must be optional; removing, renaming or newly requiring one waits + for the next major. Logic that needs a real language belongs in + [`@rtcamp/wp-tooling`](https://github.com/rtCamp/wp-tooling). + [CONTRIBUTING.md](https://github.com/rtCamp/wp-shared-workflows/blob/main/CONTRIBUTING.md) + explains how to build it yourself. + - type: input + id: workflow + attributes: + label: Workflow file + description: The workflow you want to change, or "new workflow". + placeholder: ci-test-php.yml + validations: + required: false + - type: textarea + id: problem + attributes: + label: What problem does this solve? + description: What you are trying to do in your caller workflow, and what stops you today. + validations: + required: true + - type: textarea + id: proposal + attributes: + label: Proposed change + description: The inputs, outputs or steps you have in mind. A sketch of the caller's `with:` block helps. + validations: + required: true + - type: textarea + id: alternatives + attributes: + label: Alternatives considered + description: Workarounds you use now, or other designs you ruled out. + validations: + required: false + - type: dropdown + id: compatibility + attributes: + label: Compatibility + description: How the change affects callers pinned at `@v1`. + options: + - "Additive: a new optional input, output or workflow" + - "Breaking: renames, removes or newly requires an input, secret or output" + - Not sure + validations: + required: true + - type: checkboxes + id: checks + attributes: + label: Before you submit + options: + - label: I searched the existing issues and this is not a duplicate. + required: true diff --git a/.github/ISSUE_TEMPLATE/task.md b/.github/ISSUE_TEMPLATE/task.md deleted file mode 100644 index be825e7..0000000 --- a/.github/ISSUE_TEMPLATE/task.md +++ /dev/null @@ -1,140 +0,0 @@ ---- -name: Task -about: A self-contained unit of work for this milestone -title: '[] ' -labels: 'Type: Task' ---- - - - -**Repo:** `rtCamp/` -**Milestone:** `` -**Sprint:** Sprint · Week -**Effort:** -**Priority:** -**Labels:** `Type: Task` · `Scope: ` · `Priority: ` - ---- - -## Why we need this - - - ---- - -## Before you start - -### You can start once these are closed - -- [ ] # — -<!-- or: "Nothing. You can pick this up right away." --> - -### You'll need - -- Write access to `rtCamp/<repo>` -- <tool> <version> (`<check-command>`) - -### Worth reading first - -- `CLAUDE.md` → section "<name>" -- <any-other-doc-path> - ---- - -## What you're building - -### In scope - -- - -### Out of scope - -- - ---- - -## How to build it - -### File layout - -``` -<tree> -``` - -### Implementation - -<!-- Code blocks, class signatures, config snippets. Exact, not pseudo-code. --> - -### Conventions to follow - -- - -### Things to avoid - -- - ---- - -## How to verify your work - -Run these locally before opening the PR. All must exit 0: - -```bash -$ ... -``` - -### Quick smoke test - -```bash -$ ... -``` - ---- - -## Acceptance criteria - -### Runtime behavior -- [ ] - -### Code quality -- [ ] - -### Housekeeping -- [ ] `examples/<workflow>.yml` added or updated to match - ---- - -## Reviewer checklist - -- [ ] - ---- - -## Submitting your work - -| | | -|---|---| -| **Base your branch on** | `main` | -| **Branch name** | `<type>/<slug>`, e.g. `fix/runs-on-input` | -| **PR target** | `main` | -| **PR title** | A [Conventional Commit](https://www.conventionalcommits.org/) `<type>(<scope>): <short changelog entry>` | - -```bash -git fetch origin -git checkout main -git pull -git checkout -b <type>/<slug> -# work, commit -git push -u origin <type>/<slug> -``` - -PR description starts with `Closes #<this-issue>` so the Project card auto-moves to Done on merge. - ---- - -## What this unblocks - -- #<N> — <title> diff --git a/.github/labels.yml b/.github/labels.yml new file mode 100644 index 0000000..99e7f52 --- /dev/null +++ b/.github/labels.yml @@ -0,0 +1,124 @@ +# Labels for rtCamp/wp-shared-workflows. +# +# Labels are repository settings, not files, so adding an entry here does not +# create the label. A maintainer applies this list by running, for each entry: +# +# gh label create "<name>" --color <color> --description "<description>" --force +# +# Quote the name and description: most contain spaces or colons. Missing labels +# are created and existing ones updated. That never deletes a label, so removing +# an entry here does not remove it on GitHub. +# +# The "Shared" sections are the same in all five rtCamp framework repositories +# (wp-shared-workflows, wp-primitives, wp-tooling, theme-elementary and +# plugin-elementary), apart from the wording of the BC descriptions; change them +# in all five together. The sections after them belong to this repository. +# release-please writes the release notes from pull request titles, so these +# labels are for triage only. + +# --- Shared: type ------------------------------------------------------------ +- name: "Type: Bug" + color: "D93F0B" + description: "Something is broken or behaves unexpectedly" +- name: "Type: Feature" + color: "A2EEEF" + description: "New capability or an improvement to an existing one" +- name: "Type: Task" + color: "0E8A16" + description: "Self-contained unit of work for a milestone" +- name: "Type: Chore" + color: "C5DEF5" + description: "Maintenance, tooling, docs, housekeeping" +- name: "Type: Epic" + color: "5319E7" + description: "Large initiative spanning multiple issues" +- name: "Type: Story" + color: "1D76DB" + description: "Group of related tasks within an epic" +- name: "Type: Docs" + color: "BFD4F2" + description: "Documentation-only change" + +# --- Shared: priority -------------------------------------------------------- +- name: "Priority: P0" + color: "B60205" + description: "Critical: blocks milestone" +- name: "Priority: P1" + color: "D93F0B" + description: "High: sprint commitment" +- name: "Priority: P2" + color: "FBCA04" + description: "Medium: nice to have this sprint" +- name: "Priority: P3" + color: "C2E0C6" + description: "Low: can slip" + +# --- Shared: status ---------------------------------------------------------- +- name: "Status: Blocked" + color: "E99695" + description: "Waiting on another issue or external dependency" +- name: "Status: Needs Review" + color: "FEF2C0" + description: "Human review requested" +- name: "Status: Rotating" + color: "D4C5F9" + description: "Engineer rotated out: awaiting pickup (see Handoff log)" +- name: "Status: Needs BC Check" + color: "F9D0C4" + description: "Run /check-bc before merge" + +# --- Shared: backward compatibility ------------------------------------------ +- name: "BC: Breaking" + color: "B60205" + description: "Breaking change: new major tag required" +- name: "BC: Additive" + color: "0E8A16" + description: "Additive only: safe for current major tag" +- name: "BC: Deprecation" + color: "FBCA04" + description: "Adds or removes a @deprecated input/output" + +# --- Shared: dependencies and outside contributors --------------------------- +- name: "dependencies" + color: "0366d6" + description: "Pull requests that update a dependency file" +- name: "good first issue" + color: "7057ff" + description: "Good for newcomers" +- name: "help wanted" + color: "008672" + description: "Extra attention is needed" + +# --- This repository: scope -------------------------------------------------- +- name: "Scope: CD Orchestrator" + color: "006B75" + description: "wp-cd.yml" +- name: "Scope: CD Product" + color: "006B75" + description: "cd-github-release, cd-wp-org and cd-s3 workflows" +- name: "Scope: CD Services" + color: "006B75" + description: "cd-built-branch workflow (main to main-built)" +- name: "Scope: CI Build" + color: "006B75" + description: "ci-build + ci-test-build-artifact workflows" +- name: "Scope: CI Lint" + color: "006B75" + description: "ci-lint-* workflows" +- name: "Scope: CI Orchestrator" + color: "006B75" + description: "wp-ci.yml + ci-detect-changes" +- name: "Scope: CI Test" + color: "006B75" + description: "ci-test-* workflows" +- name: "Scope: Docs" + color: "FEF2C0" + description: "README + caller examples" +- name: "Scope: Version Monitor" + color: "006B75" + description: "version-monitor.yml: non-Composer projects" + +# --- This repository: status ------------------------------------------------- +- name: "Status: Needs QA Coordination" + color: "FEF2C0" + description: "Pa11y workflow: coordinate with Team-QA" diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..cb5969c --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,29 @@ +# Security policy + +## Supported versions + +| Version | Supported | +|---|---| +| v1 (`@v1`, and the `v1.x` and `v1.x.y` tags) | Yes | +| Branches, untagged commits and other refs | No; pin `@v1` | + +Fixes ship as a new v1 release. A caller pinned at `@v1` picks a fix up on +its next run; a caller pinned at an exact `@v1.x.y` tag must move to the new +tag. + +## Reporting a vulnerability + +Please do not report security issues in public issues, pull requests or +discussions. + +Report them privately through GitHub instead: open the repository's +**Security** tab and choose **Report a vulnerability**, or go straight to +<https://github.com/rtCamp/wp-shared-workflows/security/advisories/new>. The +report stays visible only to you and the maintainers, and the fix, the release +and the advisory are coordinated in that same thread. + +Include what you can of: + +- the affected workflow file and the ref you call it at (for example `@v1`); +- the impact, and the conditions an attacker needs; +- steps or a minimal proof of concept that reproduce it.