mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 4.7
79409ebf10
Tooling integration
* add .markdownlint-cli2.jsonc, .ansible-lint, .ansible-lint-ignore
configs (permissive day-1: cosmetic rules disabled, semantic ones on)
* extend scripts/install/lint.sh with generic install_pip_pkg helper +
ensure_ansible_lint / ensure_galaxy_importer / ensure_markdownlint_cli2
ensure_* functions (pip / npm with sudo / --user / --break-system-packages
fallbacks). install_ansible_tools now also pulls ansible-lint and
galaxy-importer; new `markdown` install group.
* extend scripts/lint/ansible.sh to run ansible-lint after the existing
syntax-check.
* add scripts/lint/markdown.sh and scripts/lint/galaxy.sh runners. The
galaxy runner parallelizes via xargs (-P=$(nproc)), prints OK/FAIL per
role, and treats `bare-name dependency` errors as success since our
roles/ tree is not a Galaxy collection layout. All other Galaxy schema
errors still fail.
* Makefile: new lint-markdown and lint-galaxy targets, both wired into
`make lint`.
* CI: new workflows lint-markdown.yml and lint-galaxy.yml; lint-ansible.yml
now installs ansible-core + ansible-lint; ci-orchestrator wires both
new lint workflows into lint-gate.
Galaxy schema fixes
* shorten the canonical `galaxy_info.company` block from three lines to
two ("Kevin Veen-Birkenbach\nhttps://www.veen.world", 45 chars) so it
stays under Galaxy's hard 50-char limit. Updated everywhere: 229 role
meta/main.yml plus _CANONICAL_COMPANY in
tests/lint/repository/test_role_meta_main_galaxy_schema.py.
* shorten 19 over-long role descriptions to <=255 chars.
* add stub READMEs for sys-svc-compose-ca and sys-utils-service-loader.
Markdown baseline fixes
* markdownlint-cli2 --fix run repo-wide (formatting normalization
across CHANGELOG, role READMEs, docs).
* manual MD041 fixes: prepend H1 in 15 files (CHANGELOG, LICENSE,
TODO.md helpers, role README templates, etc.).
* MD025 / MD003 / MD001 / MD032 manual fixes for heading-style and
list-spacing edge cases.
* role README content polish: "## Single Point of Truth (SPOT)" headings
renamed to "## User data resolution" (D3 self-label rule).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
76 lines
1.3 KiB
Markdown
76 lines
1.3 KiB
Markdown
# Repository Settings 🔧
|
|
|
|
See also [branch.md](branch/security.md) for branch protection rules.
|
|
|
|
## Dependency Management 📦
|
|
|
|
### Dependency Graph ❌
|
|
|
|
👉 Contributors may not have access to full dependency insights
|
|
|
|
### Dependabot Alerts ❌
|
|
|
|
👉 Vulnerabilities may go unnoticed
|
|
|
|
### Dependabot Security Updates ❌
|
|
|
|
👉 Contributors MUST update dependencies manually
|
|
|
|
### Dependabot Version Updates ❌
|
|
|
|
👉 No automatic upgrade PRs
|
|
|
|
---
|
|
|
|
## Code Scanning (Global) 🔬
|
|
|
|
### CodeQL ✅
|
|
|
|
👉 Security issues may be detected automatically
|
|
|
|
### Copilot Autofix ✅
|
|
|
|
👉 Suggested fixes may appear
|
|
|
|
---
|
|
|
|
## Secret Protection 🔐
|
|
|
|
For GHCR authentication configuration see [authentication.md](../ghcr/authentication.md).
|
|
|
|
### Secret Scanning ❌
|
|
|
|
👉 Secrets may accidentally be committed
|
|
|
|
### Push Protection ❌
|
|
|
|
👉 Commits with secrets are NOT blocked
|
|
|
|
---
|
|
|
|
## Summary for Contributors 📋
|
|
|
|
Once enabled, you MUST:
|
|
|
|
* Create a PR (no direct push)
|
|
* Get 2 approvals
|
|
* Get CODEOWNER approval (if applicable)
|
|
* Resolve all comments
|
|
* Re-approve after changes
|
|
* Keep branch up-to-date
|
|
* Use signed commits
|
|
* Pass code scanning & quality checks
|
|
|
|
You MUST NOT:
|
|
|
|
* Push directly to main
|
|
* Force push
|
|
* Merge without approvals
|
|
|
|
You MAY:
|
|
|
|
* Create branches freely
|
|
* Use merge commits
|
|
|
|
All rules above are **currently enforced** on `main`.
|