feat(github): add OSS repository governance & supply-chain hardening - #34
Merged
Conversation
Pins pytest/pytest-cov/mypy/ruff so Dependabot's pip ecosystem has real versions to track, and adds an E9+F ruff selection scoped to what already passes today (broader rule sets are a follow-up). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Clears the codebase for the new lint CI job added in a later task. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TAZPZwzSutmru6kSCEogu6
Records the audit findings (repo public since 2026-08-29 with v1.0.1 released but zero branch protection, develop/master release drift, missing label taxonomy/dependabot/issue forms/lint job) and the NOW-tier implementation plan those findings led to. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TAZPZwzSutmru6kSCEogu6
type:/area:/priority:/size: labels plus needs-triage and blocked, synced from .github/labels.yml by EndBug/label-sync on push to develop or manual dispatch. Keeps existing default labels rather than deleting them. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TAZPZwzSutmru6kSCEogu6
…iage Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TAZPZwzSutmru6kSCEogu6
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Lint is scoped to E9+F (already clean, prior commit); broader ruff rule sets are a follow-up, not bundled here. Dependency audit installs the pinned dev toolchain directly, not this project's own unpublished package (pip-audit's --strict and --skip-editable can never coexist, so the audited environment simply never includes anything editable), and upgrades pip first to clear pip's own known CVEs. pytest==8.4.2 carries a real CVE (CVE-2025-71176 / PYSEC-2026-1845, local /tmp directory hijack) whose fix requires pytest>=9.0.3, which in turn requires Python>=3.10. Decided (human call, project has no users yet) to drop Python 3.9 support rather than carry a permanent ignore-vuln exception: requires-python, classifiers, ruff target-version, and the CI matrix all move to 3.10 as the floor. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TAZPZwzSutmru6kSCEogu6
The dependency-audit job can't install via `.[dev]` (it must not install this project's own unpublished package -- see the existing comment), so its pytest/pytest-cov/mypy/ruff versions are a manual copy of pyproject.toml's dev extra. Dependabot only updates the extra, not this workflow file, so flag the duplication for whoever bumps one and not the other. Also verified the full CI pytest invocation (with --cov-fail-under=85) under the pytest==9.1.1 pin, not just the bare test run from the prior commit's verification. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TAZPZwzSutmru6kSCEogu6
…iew) Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The public transition happened 2026-08-29 with v1.0.0/v1.0.1 already released, but branch protection was never applied -- update the docs to reflect actual re-verified state instead of the old plan. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TAZPZwzSutmru6kSCEogu6
§4/§8/§9 already state the repo has been public since 2026-08-29 with branch protection still missing; §2's "확인된 사실" bullets still said the repo "is private" and that PR template doesn't exist, directly contradicting those sections. The missing-branch-protection fact itself was still accurate and is kept -- only the private-repo framing and the now-false "no PR template" claim needed correcting. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TAZPZwzSutmru6kSCEogu6
…ance-hardening # Conflicts: # changelog.md # handoff.md # improvements.md
…ance-hardening # Conflicts: # changelog.md # handoff.md
This was referenced Sep 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #31. Part of epic #21.
What
OSS 저장소 거버넌스/공급망 hardening 전체 작업을
develop으로 통합한다.origin/develop(Cline adapter, improvements backlog)을 이미 이 브랜치에 merge 했다.Included
type:epic포함),path-based PR labeler, new-issue triage, weekly grouped Dependabot(target
develop).pip-audit --strictdependency-audit CI gates; Python floor 3.9 → 3.10.curl | bash→ versioned SHA-512-verified artifact;release Actions SHA-pinned; PR-title injection 제거.
docs/oss-repository-governance-audit.md등).Supersedes
chore/sync-develop-with-v1.0.1) — 그 head508b860이 이 브랜치의 ancestor.Follow-up (merge 직후)
22101891required checks 동기화 (Rollout: branch ruleset 22101891 required checks 동기화 #25): Python 3.9 제거, 3.10 ×3 +lint+dependency-audit추가.