From 31a91218ef6659d85da149a8cd28ab3162fea8db Mon Sep 17 00:00:00 2001 From: Wilmer Arambula Date: Sat, 31 Oct 2026 12:38:55 -0300 Subject: [PATCH] docs: rename `docs/security.md` to `docs/content-security-policy.md`; the organization `SECURITY.md` is the reporting policy. --- .editorconfig | 26 ++++++++++++++++++++++ .github/linters/.codespellrc | 2 ++ .github/linters/.editorconfig-checker.json | 17 ++++++++++++++ .github/linters/.gitleaks.toml | 4 ++++ .github/linters/.markdown-lint.yml | 5 +++++ .github/workflows/linter.yml | 17 -------------- .github/workflows/quality.yml | 22 ++++++++++++++++++ .github/workflows/security.yml | 19 ++++++++++++++++ .prettierignore | 11 +++++++++ .prettierrc.json | 22 ++++++++++++++++++ SECURITY.md | 22 +++++++++--------- profile/README.md | 2 +- 12 files changed, 139 insertions(+), 30 deletions(-) create mode 100644 .editorconfig create mode 100644 .github/linters/.codespellrc create mode 100644 .github/linters/.editorconfig-checker.json create mode 100644 .github/linters/.gitleaks.toml create mode 100644 .github/linters/.markdown-lint.yml delete mode 100644 .github/workflows/linter.yml create mode 100644 .github/workflows/quality.yml create mode 100644 .github/workflows/security.yml create mode 100644 .prettierignore create mode 100644 .prettierrc.json diff --git a/.editorconfig b/.editorconfig new file mode 100644 index 0000000..2cd85d1 --- /dev/null +++ b/.editorconfig @@ -0,0 +1,26 @@ +# editorconfig.org + +root = true + +[*] +charset = utf-8 +end_of_line = lf +insert_final_newline = true +indent_style = space +indent_size = 4 +trim_trailing_whitespace = true + +# Prettier owns Markdown indentation; ordered-list continuations are 3 spaces. +[*.md] +indent_size = unset +trim_trailing_whitespace = false + +[*.yaml] +indent_size = 2 + +[*.yml] +indent_size = 2 + +[LICENSE*] +indent_style = unset +indent_size = unset diff --git a/.github/linters/.codespellrc b/.github/linters/.codespellrc new file mode 100644 index 0000000..66477e4 --- /dev/null +++ b/.github/linters/.codespellrc @@ -0,0 +1,2 @@ +[codespell] +skip = ./.git,.claude/*,.codex/*,.config/gh/*,.github/agents/*,.github/copilot-instructions.md,.github/copilot/*,.github/instructions/*,.github/prompts/*,.github/skills/*,.vscode/*,logo/* diff --git a/.github/linters/.editorconfig-checker.json b/.github/linters/.editorconfig-checker.json new file mode 100644 index 0000000..fdca56b --- /dev/null +++ b/.github/linters/.editorconfig-checker.json @@ -0,0 +1,17 @@ +{ + "Exclude": [ + "\\.min\\.css$", + "\\.min\\.js$", + "^\\.claude/", + "^\\.codex/", + "^\\.config/gh/", + "^\\.github/agents/", + "^\\.github/copilot-instructions\\.md$", + "^\\.github/copilot/", + "^\\.github/instructions/", + "^\\.github/prompts/", + "^\\.github/skills/", + "^\\.vscode/", + "^logo/" + ] +} diff --git a/.github/linters/.gitleaks.toml b/.github/linters/.gitleaks.toml new file mode 100644 index 0000000..1f08510 --- /dev/null +++ b/.github/linters/.gitleaks.toml @@ -0,0 +1,4 @@ +title = "gitleaks config" + +[extend] +useDefault = true diff --git a/.github/linters/.markdown-lint.yml b/.github/linters/.markdown-lint.yml new file mode 100644 index 0000000..0a6d8fc --- /dev/null +++ b/.github/linters/.markdown-lint.yml @@ -0,0 +1,5 @@ +--- +MD007: + indent: 2 +MD013: false +MD033: false diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml deleted file mode 100644 index 7b46557..0000000 --- a/.github/workflows/linter.yml +++ /dev/null @@ -1,17 +0,0 @@ ---- -on: - - pull_request - - push - -name: linter - -permissions: - checks: write - contents: read - statuses: write - -jobs: - linter: - uses: yii2-framework/actions/.github/workflows/super-linter.yml@v1 - secrets: - AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml new file mode 100644 index 0000000..8b3d9e6 --- /dev/null +++ b/.github/workflows/quality.yml @@ -0,0 +1,22 @@ +--- +on: + - pull_request + - push + +name: quality + +permissions: + contents: read + +jobs: + quality: + uses: yii2-framework/actions/.github/workflows/quality.yml@e02758a41a2a811fb3e706735192979171b2260d # v2.0.1 + permissions: + contents: read + with: + codespell-config: .github/linters/.codespellrc + editorconfig-checker-config: .github/linters/.editorconfig-checker.json + markdownlint-config: .github/linters/.markdown-lint.yml + prettier-config: .prettierrc.json + prettier-ignore-path: .prettierignore + yamllint-targets: .github diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 0000000..8d212d1 --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,19 @@ +--- +on: + - pull_request + - push + +name: security + +permissions: + contents: read + +jobs: + security: + uses: yii2-framework/actions/.github/workflows/security.yml@e02758a41a2a811fb3e706735192979171b2260d # v2.0.1 + permissions: + contents: read + with: + gitleaks-config: .github/linters/.gitleaks.toml + secrets: + GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} diff --git a/.prettierignore b/.prettierignore new file mode 100644 index 0000000..32c430a --- /dev/null +++ b/.prettierignore @@ -0,0 +1,11 @@ +# Local agent and editor state. +.claude/** +.codex/** +.config/gh/** +.github/agents/** +.github/copilot-instructions.md +.github/copilot/** +.github/instructions/** +.github/prompts/** +.github/skills/** +.vscode/** diff --git a/.prettierrc.json b/.prettierrc.json new file mode 100644 index 0000000..c9f33af --- /dev/null +++ b/.prettierrc.json @@ -0,0 +1,22 @@ +{ + "tabWidth": 4, + "useTabs": false, + "singleQuote": false, + "trailingComma": "all", + "printWidth": 80, + "overrides": [ + { + "files": ["**/*.{yml,yaml}"], + "options": { + "tabWidth": 2 + } + }, + { + "files": "**/*.md", + "options": { + "embeddedLanguageFormatting": "off", + "tabWidth": 2 + } + } + ] +} diff --git a/SECURITY.md b/SECURITY.md index b793a83..485e1a4 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,26 +4,24 @@ **Do not open a public issue for security vulnerabilities.** -Use the GitHub Security Advisories feature in the affected repository to report vulnerabilities privately: +Use GitHub's private vulnerability reporting in the affected repository: -1. Navigate to the affected repository (for example, `https://github.com/php-forge/`, replacing - `` with the affected repository). +1. Open the affected repository under `https://github.com/php-forge/`. 2. Go to the **Security** tab. -3. Click **Report a vulnerability**. -4. Provide a detailed description including steps to reproduce, impact, and any suggested fix. +3. Click **Report a vulnerability** and describe the issue, how to reproduce it, its impact and any suggested fix. -For more information, see [Privately reporting a security vulnerability](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability). +See [Privately reporting a security vulnerability](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability). + +If the **Report a vulnerability** button is not available in a repository, open a public issue that only asks for a private contact. Do not include vulnerability details in it. ## Supported Versions -Security fixes are applied to the latest release of each package. Older versions do not receive security updates. +Security fixes are applied to the latest stable release of each package unless the repository documents a different support policy. Older and development versions receive no security updates, although reports about them are welcome. -## Response Timeline +## Response -- **Acknowledgment**: Within 48 hours of the report. -- **Assessment**: Within 7 days, an initial assessment and plan of action. -- **Fix and disclosure**: A fix is developed, tested, and released before public disclosure. +This project is maintained on a best-effort basis. Reports are reviewed as maintainer availability permits; receipt is acknowledged and updates are given through the private report. No acknowledgment, assessment or remediation deadline is guaranteed. Please do not include vulnerability details in public issues or discussions. ## Scope -This policy applies to all repositories under the [PHP Forge](https://github.com/php-forge) organization. +This policy applies to all repositories under the [php-forge](https://github.com/php-forge) organization. diff --git a/profile/README.md b/profile/README.md index 97d871b..f49df22 100644 --- a/profile/README.md +++ b/profile/README.md @@ -3,7 +3,7 @@ # PHP Forge -**Code Craftsmanship for Reliability** +Code Craftsmanship for Reliability Foundational, framework-agnostic tools that power the next generation of PHP applications.