From caa320fea24b5ea23c222ecec8431bf8cab737a2 Mon Sep 17 00:00:00 2001 From: ajianaz Date: Wed, 19 Aug 2026 13:15:01 +0700 Subject: [PATCH] chore(governance): sync governance files with uteke standard - Add SECURITY.md (private vulnerability reporting, SLA) - Add CODE_OF_CONDUCT.md (adapted from uteke) - Add ISSUE_TEMPLATE (bug_report.yml + feature_request.yml, adapted for skill suites) - Add dependabot.yml (github-actions weekly) - Upgrade PR template to uteke-style (What/Why/How/Validation/Checklist + CLA note) --- .github/ISSUE_TEMPLATE/bug_report.yml | 75 ++++++++++++++++++++++ .github/ISSUE_TEMPLATE/feature_request.yml | 53 +++++++++++++++ .github/dependabot.yml | 6 ++ .github/pull_request_template.md | 46 ++++++------- CODE_OF_CONDUCT.md | 18 ++++++ SECURITY.md | 35 ++++++++++ 6 files changed, 211 insertions(+), 22 deletions(-) create mode 100644 .github/ISSUE_TEMPLATE/bug_report.yml create mode 100644 .github/ISSUE_TEMPLATE/feature_request.yml create mode 100644 .github/dependabot.yml create mode 100644 CODE_OF_CONDUCT.md create mode 100644 SECURITY.md diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml new file mode 100644 index 0000000..03e96cb --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -0,0 +1,75 @@ +name: Bug report +description: Something is broken or behaving unexpectedly +labels: ["bug"] +body: + - type: markdown + attributes: + value: | + Thanks for taking the time to report a bug. Please fill in the fields below — it makes triage much faster. + + For **security issues**, do NOT open an issue. See [SECURITY.md](https://github.com/codecoradev/skill-suites/blob/develop/SECURITY.md). + + - type: input + id: version + attributes: + label: Affected suite / commit + description: Which skill suite (e.g. uteke, cora-code, titen) and the commit or release you're on. + placeholder: "cora-code @ v0.13.0" + validations: + required: true + + - type: dropdown + id: os + attributes: + label: Operating system + options: + - Linux + - macOS (Apple Silicon) + - macOS (Intel) + - Windows + - Other + validations: + required: true + + - type: textarea + id: what-happened + attributes: + label: What happened? + description: A clear and concise description of the bug. + validations: + required: true + + - type: textarea + id: expected + attributes: + label: What did you expect to happen? + validations: + required: true + + - type: textarea + id: steps + attributes: + label: Steps to reproduce + description: Numbered list of exact steps. Include the exact command or skill invocation. + placeholder: | + 1. Load the `cora-code` skill suite + 2. Run `cora review --base origin/develop` + 3. ... + validations: + required: true + + - type: textarea + id: logs + attributes: + label: Logs / output + description: Paste relevant terminal or agent output. + + - type: checkboxes + id: checks + attributes: + label: Before submitting + options: + - label: I searched existing issues and didn't find a duplicate + required: true + - label: I am running the latest version + required: false diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml new file mode 100644 index 0000000..7962bf6 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -0,0 +1,53 @@ +name: Feature request +description: Suggest a new feature or improvement +labels: ["enhancement"] +body: + - type: markdown + attributes: + value: | + Thanks for the idea! A short conversation here saves everyone time before any code is written. + + skill-suites is intentionally focused — not every idea will make it in. A "no" is not a judgment of the idea. + + - type: textarea + id: problem + attributes: + label: What problem does this solve? + description: | + The **why**, not the **what**. What were you trying to do when you wished this existed? + placeholder: "When I'm storing memories across different agents, I want namespaces so memories don't collide." + validations: + required: true + + - type: textarea + id: proposal + attributes: + label: Proposed solution + description: How would you imagine using this? CLI flag, API endpoint, config option — anything that helps picture it. + validations: + required: true + + - type: textarea + id: alternatives + attributes: + label: Alternatives considered + description: What workarounds have you tried? What other tools handle this well? + + - type: dropdown + id: contribution + attributes: + label: Are you willing to contribute the implementation? + options: + - "Yes, with guidance" + - "Yes, I can do it" + - "No, just suggesting" + validations: + required: true + + - type: checkboxes + id: checks + attributes: + label: Before submitting + options: + - label: I searched existing issues and didn't find a duplicate + required: true diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..5ace460 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 963eba5..35257bf 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,30 +1,32 @@ -## Description + - +## What + -## Type +## Why + -- [ ] `feat:` new skill or feature -- [ ] `fix:` bug fix or validation fix -- [ ] `docs:` documentation changes -- [ ] `refactor:` restructure without behavior change -- [ ] `chore:` meta, config, or cleanup - -## Changes - - - -- +## How + ## Validation -- [ ] Structure: SKILL.md, VERSION, README.md present -- [ ] Frontmatter: name matches dir, version + description + tags set -- [ ] Links: all relative links resolve -- [ ] Token size: reference files under 3k tokens -- [ ] Sanitization: no internal paths, credentials, or private domains -- [ ] Syntax: Python compiles, YAML parses +- [ ] Skill files parse (valid YAML frontmatter + markdown) +- [ ] Tested the changed skill locally in a Hermes/agent session +- [ ] Docs updated if the skill surface changed (README, examples) + +## Related Issues + -## Notes +## Checklist - +- [ ] Branch name follows convention (`fix/`, `feat/`, `docs/`, `chore/`, `refactor/`, `test/`) +- [ ] Branch is from `develop` +- [ ] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/) +- [ ] No secrets or credentials committed +- [ ] One logical change per PR (no mixed concerns) +- [ ] [CLA](https://github.com/codecoradev/.github/blob/main/.cla/signatures.json) signed (or will sign when the bot asks) diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..6725494 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,18 @@ +# Code of Conduct + +skill-suites is a small open-source project and we want it to stay a place people enjoy contributing to. + +## The rules, briefly + +- **Be respectful.** Disagreement is fine; rudeness, condescension, and personal attacks are not. +- **Stay on topic.** Keep discussions focused on the project and the contribution at hand. +- **No harassment.** Harassment of any kind will not be tolerated. +- **Assume good faith.** Most people are trying to help. + +## Enforcement + +Report issues to the maintainers via [GitHub Private Vulnerability Reporting](https://github.com/codecoradev/skill-suites/security/advisories/new) or by opening a private security advisory. Maintainers may remove comments, close issues/PRs, or ban repeat offenders. + +## Attribution + +Adapted from the [Uteke Code of Conduct](https://github.com/codecoradev/uteke/blob/develop/CODE_OF_CONDUCT.md). diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..d239f82 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,35 @@ +# Security Policy + +## Supported Versions + +| Version | Supported | +|---------|-----------| +| Latest release | ✅ | +| Older versions | ❌ | + +## Reporting a Vulnerability + +If you discover a security vulnerability in skill-suites, please report it responsibly. + +**Do NOT** open a public issue for security vulnerabilities. + +### How to Report + +Use [GitHub Private Vulnerability Reporting](https://github.com/codecoradev/skill-suites/security/advisories/new) — this ensures the report is confidential and only visible to maintainers. + +Include as much detail as possible: + +- Description of the vulnerability +- Steps to reproduce +- Potential impact +- Suggested fix (if any) + +### What to Expect + +- **Acknowledgment** within 48 hours +- **Initial assessment** within 5 business days +- **Fix timeline** depends on severity: + - Critical: 7 days + - High: 14 days + - Medium: 30 days + - Low: next minor release