Skip to content

Commit d279352

Browse files
danielroedanielroe
committed
chore: init
0 parents  commit d279352

22 files changed

Lines changed: 5939 additions & 0 deletions

‎.editorconfig‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
root = true
2+
3+
[*]
4+
end_of_line = lf
5+
insert_final_newline = true
6+
trim_trailing_whitespace = true
7+
charset = utf-8
8+
9+
[*.js]
10+
indent_style = space
11+
indent_size = 2
12+
13+
[{package.json,*.yml,*.cjson}]
14+
indent_style = space
15+
indent_size = 2

‎.github/ISSUE_TEMPLATE/---bug-report.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: 🐛 Bug report
2+
description: Something's not working
3+
labels: [bug]
4+
body:
5+
- type: textarea
6+
validations:
7+
required: true
8+
attributes:
9+
label: 🐛 The bug
10+
description: What isn't working? Describe what the bug is.
11+
- type: input
12+
validations:
13+
required: true
14+
attributes:
15+
label: 🛠️ To reproduce
16+
description: A reproduction of the bug via https://stackblitz.com/github/danielroe/package-name/tree/main/playground
17+
placeholder: https://stackblitz.com/[...]
18+
- type: textarea
19+
validations:
20+
required: true
21+
attributes:
22+
label: 🌈 Expected behaviour
23+
description: What did you expect to happen? Is there a section in the docs about this?
24+
- type: textarea
25+
attributes:
26+
label: ℹ️ Additional context
27+
description: Add any other context about the problem here.

‎.github/workflows/agent-scan.yml‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
name: agent-scan
2+
3+
on:
4+
# zizmor: ignore[dangerous-triggers] - DO NOT add action/checkout in this workflow as it uses pull_request_target
5+
pull_request_target:
6+
types:
7+
- opened
8+
- reopened
9+
10+
concurrency:
11+
group: agent-scan-${{ github.event.pull_request.number }}
12+
cancel-in-progress: true
13+
14+
permissions:
15+
issues: write
16+
pull-requests: write
17+
18+
jobs:
19+
agentscan:
20+
runs-on: ubuntu-latest
21+
steps:
22+
- name: AgentScan
23+
id: agentscan
24+
uses: MatteoGabriele/agentscan-action@e02ef270c024bfad3541b2a71619c3c9f20b3312 # v2.2.0
25+
with:
26+
github-token: ${{ secrets.GITHUB_TOKEN }}
27+
mode: silent
28+
- name: Handle flagged PR
29+
if: contains(fromJSON('["automation","mixed"]'), steps.agentscan.outputs.classification) || steps.agentscan.outputs.community-flagged == 'true'
30+
env:
31+
CLASSIFICATION: ${{ steps.agentscan.outputs.classification }}
32+
COMMUNITY_FLAGGED: ${{ steps.agentscan.outputs.community-flagged }}
33+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
34+
with:
35+
script: |
36+
const prNumber = context.payload.pull_request.number;
37+
const classification = process.env.CLASSIFICATION;
38+
const communityFlagged = process.env.COMMUNITY_FLAGGED === 'true';
39+
const shouldClose = classification === 'automation' || communityFlagged;
40+
41+
const issue = context.payload.pull_request
42+
const labels = issue.labels?.map(l => l.name) || []
43+
44+
if (!labels.includes('possible bot')) {
45+
await github.rest.issues.addLabels({
46+
owner: context.repo.owner,
47+
repo: context.repo.repo,
48+
issue_number: prNumber,
49+
labels: ['possible bot'],
50+
})
51+
}
52+
53+
const comments = await github.paginate(github.rest.issues.listComments, {
54+
owner: context.repo.owner,
55+
repo: context.repo.repo,
56+
issue_number: prNumber,
57+
per_page: 100,
58+
})
59+
60+
const alreadyCommented = comments.some(
61+
c => c.user.type === 'Bot' && c.body.includes('AI-assisted contribution guidelines')
62+
)
63+
64+
if (!alreadyCommented) {
65+
const closingNote = shouldClose
66+
? "We're closing this for now as the account looks automated. If we got that wrong, please just reopen the PR and we'll take another look."
67+
: 'If this was flagged in error, we apologise! 😳 Just let us know. 🙏'
68+
69+
await github.rest.issues.createComment({
70+
owner: context.repo.owner,
71+
repo: context.repo.repo,
72+
issue_number: prNumber,
73+
body: [
74+
"We've flagged this as a potential contribution without a human behind it. We welcome the thoughtful use of AI tools when contributing, but ask all contributors to follow [two core principles](https://roe.dev/blog/using-ai-in-open-source):",
75+
'',
76+
'1. **Never let an LLM speak for you** - all comments, issues, and PR descriptions should be written in your own words, reflecting your own understanding.',
77+
'2. **Never let an LLM think for you** - only submit contributions you fully understand and can explain.',
78+
'',
79+
'Please review these AI-assisted contribution guidelines and update this contribution if needed.',
80+
'',
81+
closingNote,
82+
].join('\n'),
83+
})
84+
} else {
85+
core.info('Possible-bot comment already exists - skipping comment.')
86+
}
87+
88+
if (shouldClose && issue.state === 'open' && !alreadyCommented) {
89+
await github.rest.pulls.update({
90+
owner: context.repo.owner,
91+
repo: context.repo.repo,
92+
pull_number: prNumber,
93+
state: 'closed',
94+
title: '🚨 unwelcome pr from bot 🚨',
95+
})
96+
}
97+
98+
const actionTaken = [
99+
'Added `possible bot` label',
100+
alreadyCommented ? null : 'posted policy comment',
101+
shouldClose && !alreadyCommented ? 'closed PR' : null,
102+
].filter(Boolean).join(', ')
103+
104+
core.summary
105+
.addHeading('AgentScan: Possible Bot Flag', 2)
106+
.addTable([
107+
[{ data: 'Property', header: true }, { data: 'Value', header: true }],
108+
['Pull Request', `#${prNumber}`],
109+
['Classification', classification],
110+
['Community flagged', String(communityFlagged)],
111+
['Action', actionTaken || 'No action (already handled)'],
112+
])
113+
114+
await core.summary.write()

‎.github/workflows/ci.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
name: ci
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
push:
8+
branches:
9+
- main
10+
11+
jobs:
12+
lint:
13+
runs-on: ubuntu-latest
14+
15+
steps:
16+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
17+
- run: corepack enable
18+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
19+
with:
20+
node-version: lts/*
21+
cache: pnpm
22+
23+
- name: 📦 Install dependencies
24+
run: pnpm install
25+
26+
- name: 🔠 Lint project
27+
run: pnpm lint
28+
29+
- name: ✂️ Knip project
30+
run: pnpm test:knip
31+
32+
- name: ⚙️ Check package engines
33+
run: pnpm test:versions
34+
35+
test:
36+
runs-on: ubuntu-latest
37+
38+
steps:
39+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
40+
- run: corepack enable
41+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
42+
with:
43+
node-version: lts/*
44+
cache: pnpm
45+
46+
- name: 📦 Install dependencies
47+
run: pnpm install
48+
49+
- name: 🛠 Build project
50+
run: pnpm build
51+
52+
- name: 💪 Test types
53+
run: pnpm test:types
54+
55+
- name: 🧪 Test project
56+
run: pnpm test:unit -- --coverage
57+
58+
- name: 🟩 Coverage
59+
uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7

‎.github/workflows/provenance.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: ci
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
branches:
9+
- main
10+
permissions:
11+
contents: read
12+
jobs:
13+
check-provenance:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
17+
with:
18+
fetch-depth: 0
19+
- name: Check provenance downgrades
20+
uses: danielroe/provenance-action@41bcc969e579d9e29af08ba44fcbfdf95cee6e6c # v0.1.1
21+
with:
22+
fail-on-provenance-change: true

‎.github/workflows/release.yml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
name: release
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
types: [closed]
8+
branches: [main]
9+
# this is required to trigger releases when the release PR is merged, or to rerun a release if needed
10+
workflow_dispatch:
11+
12+
permissions: {}
13+
14+
jobs:
15+
# Parse commits since the last tag, push a `release/vX.Y.Z` branch, open
16+
# or update a draft release PR, and close any superseded release PRs
17+
# (e.g. `release/v1.0.1` when the bump is now `release/v1.1.0`).
18+
pr:
19+
if: github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
20+
runs-on: ubuntu-latest
21+
permissions:
22+
contents: write # push the `release/vX.Y.Z` branch and delete superseded ones
23+
pull-requests: write # create a release PR, update its body, close superseded PRs
24+
steps:
25+
- uses: danielroe/uppt/pr@7bcfb5397c37202ef882363f755423130419d28a # v0.5.5
26+
with:
27+
token: ${{ secrets.GITHUB_TOKEN }}
28+
29+
# The release PR was merged: tag the squash commit, cut a GitHub release
30+
# from the PR body, and dispatch the publish workflow. The `release/v`
31+
# head-ref guard keeps regular feature-PR merges from triggering this;
32+
# the head-repo guard keeps merged fork PRs from triggering it.
33+
release:
34+
if: |
35+
github.event_name == 'pull_request'
36+
&& github.event.pull_request.merged == true
37+
&& startsWith(github.event.pull_request.head.ref, 'release/v')
38+
&& github.event.pull_request.head.repo.full_name == github.repository
39+
runs-on: ubuntu-latest
40+
concurrency:
41+
group: release-${{ github.event.pull_request.number }}
42+
cancel-in-progress: false
43+
permissions:
44+
contents: write # push the `vX.Y.Z` tag and create the GitHub release
45+
actions: write # `gh workflow run release.yml --ref vX.Y.Z` chained dispatch
46+
steps:
47+
- uses: danielroe/uppt/release@7bcfb5397c37202ef882363f755423130419d28a # v0.5.5
48+
with:
49+
token: ${{ secrets.GITHUB_TOKEN }}
50+
51+
# The chained dispatch from `release` lands here as a `workflow_dispatch`
52+
# event on a `vX.Y.Z` tag ref. The `pack` job installs deps, runs
53+
# `pnpm pack` (or `npm pack`), and uploads the tarball as a workflow
54+
# artifact. Manual recovery uses the same path (Run workflow -> pick a `v*` tag).
55+
pack:
56+
if: github.event_name == 'workflow_dispatch' && startsWith(github.ref, 'refs/tags/v')
57+
runs-on: ubuntu-latest
58+
concurrency:
59+
group: pack-${{ github.ref }}
60+
cancel-in-progress: false
61+
permissions: {}
62+
outputs:
63+
files: ${{ steps.pack.outputs.files }}
64+
steps:
65+
- id: pack
66+
uses: danielroe/uppt/pack@7bcfb5397c37202ef882363f755423130419d28a # v0.5.5
67+
68+
# `publish` downloads the prebuilt tarball from the pack job's
69+
# artifact and stages it for publish.
70+
publish:
71+
if: |
72+
github.event_name == 'workflow_dispatch'
73+
&& startsWith(github.ref, 'refs/tags/v')
74+
&& needs.pack.outputs.files != '[]'
75+
needs: pack
76+
runs-on: ubuntu-latest
77+
concurrency:
78+
group: publish-${{ github.ref }}
79+
cancel-in-progress: false
80+
permissions:
81+
id-token: write # OIDC claim for npm trusted publisher
82+
environment: npm # must match the trusted-publisher entry on npmjs.com
83+
steps:
84+
- uses: danielroe/uppt/publish@7bcfb5397c37202ef882363f755423130419d28a # v0.5.5
85+
with:
86+
files: ${{ needs.pack.outputs.files }}

‎.gitignore‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
dist
2+
node_modules
3+
coverage
4+
.vscode
5+
.DS_Store
6+
.eslintcache
7+
*.log*
8+
*.env*

‎CODE_OF_CONDUCT.md‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# Contributor Covenant Code of Conduct
2+
3+
## Our pledge
4+
5+
In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to make participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.
6+
7+
## Our standards
8+
9+
Examples of behavior that contributes to creating a positive environment include:
10+
11+
- Using welcoming and inclusive language
12+
- Being respectful of differing viewpoints and experiences
13+
- Gracefully accepting constructive criticism
14+
- Focusing on what is best for the community
15+
- Showing empathy towards other community members
16+
17+
Examples of unacceptable behavior by participants include:
18+
19+
- The use of sexualized language or imagery and unwelcome sexual attention or advances
20+
- Trolling, insulting/derogatory comments, and personal or political attacks
21+
- Public or private harassment
22+
- Publishing others' private information, such as a physical or electronic address, without explicit permission
23+
- Other conduct which could reasonably be considered inappropriate in a professional setting
24+
25+
## Our responsibilities
26+
27+
Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
28+
29+
Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
30+
31+
## Scope
32+
33+
This Code of Conduct applies within all project spaces, and it also applies when an individual is representing the project or its community in public spaces. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.
34+
35+
## Enforcement
36+
37+
Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at [daniel@roe.dev](mailto:daniel@roe.dev). All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
38+
39+
Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
40+
41+
## Attribution
42+
43+
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
44+
45+
[homepage]: https://www.contributor-covenant.org
46+
47+
For answers to common questions about this code of conduct, see https://www.contributor-covenant.org/faq

0 commit comments

Comments
 (0)