github-mirrors/opencode-agentic-platform-engineering

Fork 0

mirror of https://github.com/Team-Rockstars-AI/opencode-agentic-platform-engineering.git synced 2026-09-13 23:53:31 +02:00

[PR #1] [MERGED] ci: set up cooperative GitHub repo (CI, security scanning, templates, Dependabot) #3

New issue

Closed

opened 2026-08-09 19:08:25 +02:00 by zaph0d · 0 comments

zaph0d commented

2026-08-09 19:08:25 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Team-Rockstars-AI/opencode-agentic-platform-engineering/pull/1
Author: @niels-emmer
Created: 6/17/2026
Status: ✅ Merged
Merged: 6/17/2026
Merged by: @niels-emmer

Base: main ← Head: feat/github-collaboration-setup

📝 Commits (8)

6696350 feat(opencode): add select-models command and model-optimiser skill
751b18d feat(select-models): refine model-selection tooling, optimiser skill, and operator docs
6102919 style(terraform): apply terraform fmt to modules
4449ab9 ci(github): add CI, CodeQL, IaC scanning, and Dependabot
d3d7c3d docs(community): add contributing, conduct, security, and GitHub templates
7b5a474 ci(security): replace CodeQL with GHAS-free Bandit + Checkov scanning
e66c645 docs(contributing): clarify checks are conventions on free plan
68f5fb2 docs(readme): add contributing, collaboration, and CI/security overview

📊 Changes

34 files changed (+2686 additions, -258 deletions)

View changed files

➕ .github/CODEOWNERS (+20 -0)
➕ .github/ISSUE_TEMPLATE/bug_report.yml (+66 -0)
➕ .github/ISSUE_TEMPLATE/config.yml (+8 -0)
➕ .github/ISSUE_TEMPLATE/feature_request.yml (+43 -0)
➕ .github/PULL_REQUEST_TEMPLATE.md (+41 -0)
➕ .github/dependabot.yml (+47 -0)
➕ .github/workflows/ci.yml (+138 -0)
➕ .github/workflows/security.yml (+70 -0)
📝 .gitignore (+4 -0)
📝 .opencode/memory.md (+51 -24)
📝 AGENTS.md (+1 -0)
📝 BUILD_JOURNAL.md (+94 -0)
➕ CODE_OF_CONDUCT.md (+53 -0)
➕ CONTRIBUTING.md (+144 -0)
📝 DISCOVERIES_LOG.md (+46 -0)
📝 README.md (+77 -14)
➕ SECURITY.md (+63 -0)
📝 agent_config.py (+3 -3)
📝 docs/operator-manual-provisioned-platform.md (+10 -1)
📝 docs/operator-manual-provisioning-platform.md (+5 -2)

...and 14 more files

📄 Description

Purpose

Make this repository shareable and cooperative for the team — enabling
collaboration on code, bugs, fixes, and pull requests, and serving as a
learning resource. This PR adds the full GitHub collaboration toolchain:
CI, security scanning, dependency automation, contribution templates, and
community health files. It also folds in current working changes as a baseline.

Targets main. Because this is the first time main gets the collaboration
tooling, the PR also carries the pre-existing local commits (select-models
refinements) so origin/main ends up fully in sync.

What's included

🤖 CI (`.github/workflows/ci.yml`)

Runs on every PR to main and on push to main:

Python lint & skill validation — ruff, compileall, validate-skills.py
Config validation — parses all repo JSON/YAML (templates excluded; they hold {{placeholders}})
Terraform format check — terraform fmt -check -recursive modules
Secret scan — gitleaks (license-free CLI), blocks on any finding

🛡️ Security scanning (`.github/workflows/security.yml`)

Bandit (Python SAST) — blocks on HIGH severity, full report otherwise
Checkov (Terraform/Bicep) — report-only misconfiguration scanning

📦 Dependency automation (`.github/dependabot.yml`)

Weekly updates + security advisory PRs for pip, github-actions, and terraform
Repo-level Dependabot alerts and automated security fixes enabled

📋 Templates & community health

Issue forms: bug report, feature request, plus a config.yml routing security reports to advisories
Pull request template with a contributor checklist
CODEOWNERS (auto-requests review)
CONTRIBUTING.md — branching, Conventional Commits, local checks, PR process
CODE_OF_CONDUCT.md (Contributor Covenant 2.1)
SECURITY.md — private reporting + automated-controls overview

🧰 Supporting changes

requirements.txt (PyYAML) so tooling is installable and Dependabot-trackable
ruff.toml for deterministic linting
style(terraform): applied terraform fmt to two modules so the format gate is green
README: badges + Contributing & Collaboration section + checks table

Repository settings applied (via API)

✅ Squash-merge only, delete branch on merge, auto-update branch
✅ Dependabot alerts + security updates enabled
✅ Discussions enabled (referenced by issue routing)

⚠️ Branch protection — plan limitation (decision: keep private)

The org Team-Rockstars-AI is on the GitHub Free plan and this repo is
private, so GitHub blocks:

Branch protection / required status checks / rulesets (need Pro/Team or public)
GitHub Advanced Security — CodeQL, secret scanning, the code-scanning dashboard

Per the chosen approach, the repo stays private with no server-side protection.
The CI/security checks still run and report on every PR, enforced as team
conventions (documented in CONTRIBUTING). CodeQL was intentionally not
included because it cannot run here; Bandit + Checkov + gitleaks provide
equivalent coverage without GHAS.

To enforce later: upgrade to GitHub Team (stays private) or make the repo
public, then enable branch protection on main (required checks + 1 code-owner
approval) and optionally add CodeQL.

✅ Verification

All CI/security jobs were simulated locally and pass:

Check	Result
`ruff check .`	✅
`compileall`	✅
`validate-skills.py`	✅ (22 prompts, 0 broken refs)
`terraform fmt -check modules`	✅
`gitleaks detect` (23 commits)	✅ no leaks
`bandit` HIGH gate	✅ 0 high
JSON/YAML config validation	✅

GitHub Actions will run the same jobs on this PR — see the Checks tab.

How to collaborate (for reviewers/colleagues)

Branch feature/<id>-<desc> off main
Conventional Commits
Open a PR with the template; a code owner is auto-requested
Green CI + 1 approval → squash merge

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Team-Rockstars-AI/opencode-agentic-platform-engineering/pull/1 **Author:** [@niels-emmer](https://github.com/niels-emmer) **Created:** 6/17/2026 **Status:** ✅ Merged **Merged:** 6/17/2026 **Merged by:** [@niels-emmer](https://github.com/niels-emmer) **Base:** `main` ← **Head:** `feat/github-collaboration-setup` --- ### 📝 Commits (8) - [`6696350`](https://github.com/Team-Rockstars-AI/opencode-agentic-platform-engineering/commit/6696350eb97fd83b933edbd395d27a44a3641f87) feat(opencode): add select-models command and model-optimiser skill - [`751b18d`](https://github.com/Team-Rockstars-AI/opencode-agentic-platform-engineering/commit/751b18de6edcae5c6e3fefe272e58ab2b7284c03) feat(select-models): refine model-selection tooling, optimiser skill, and operator docs - [`6102919`](https://github.com/Team-Rockstars-AI/opencode-agentic-platform-engineering/commit/6102919fc6173aa3aeaf4196b50e981d3235bc9b) style(terraform): apply terraform fmt to modules - [`4449ab9`](https://github.com/Team-Rockstars-AI/opencode-agentic-platform-engineering/commit/4449ab92814dfe2cfe3ca8c1061efcf7b97b97b2) ci(github): add CI, CodeQL, IaC scanning, and Dependabot - [`d3d7c3d`](https://github.com/Team-Rockstars-AI/opencode-agentic-platform-engineering/commit/d3d7c3db9e3fdd59e29827c7f2b55e96e9619a08) docs(community): add contributing, conduct, security, and GitHub templates - [`7b5a474`](https://github.com/Team-Rockstars-AI/opencode-agentic-platform-engineering/commit/7b5a47462729dfed6ac76b3ddf2b9d2c089a051b) ci(security): replace CodeQL with GHAS-free Bandit + Checkov scanning - [`e66c645`](https://github.com/Team-Rockstars-AI/opencode-agentic-platform-engineering/commit/e66c645989d26c3aeec5a55f72339eae45cb7de0) docs(contributing): clarify checks are conventions on free plan - [`68f5fb2`](https://github.com/Team-Rockstars-AI/opencode-agentic-platform-engineering/commit/68f5fb26a74c9efcbe06c7d85484b2325738d38a) docs(readme): add contributing, collaboration, and CI/security overview ### 📊 Changes **34 files changed** (+2686 additions, -258 deletions) <details> <summary>View changed files</summary> ➕ `.github/CODEOWNERS` (+20 -0) ➕ `.github/ISSUE_TEMPLATE/bug_report.yml` (+66 -0) ➕ `.github/ISSUE_TEMPLATE/config.yml` (+8 -0) ➕ `.github/ISSUE_TEMPLATE/feature_request.yml` (+43 -0) ➕ `.github/PULL_REQUEST_TEMPLATE.md` (+41 -0) ➕ `.github/dependabot.yml` (+47 -0) ➕ `.github/workflows/ci.yml` (+138 -0) ➕ `.github/workflows/security.yml` (+70 -0) 📝 `.gitignore` (+4 -0) 📝 `.opencode/memory.md` (+51 -24) 📝 `AGENTS.md` (+1 -0) 📝 `BUILD_JOURNAL.md` (+94 -0) ➕ `CODE_OF_CONDUCT.md` (+53 -0) ➕ `CONTRIBUTING.md` (+144 -0) 📝 `DISCOVERIES_LOG.md` (+46 -0) 📝 `README.md` (+77 -14) ➕ `SECURITY.md` (+63 -0) 📝 `agent_config.py` (+3 -3) 📝 `docs/operator-manual-provisioned-platform.md` (+10 -1) 📝 `docs/operator-manual-provisioning-platform.md` (+5 -2) _...and 14 more files_ </details> ### 📄 Description ## Purpose Make this repository **shareable and cooperative** for the team — enabling collaboration on code, bugs, fixes, and pull requests, and serving as a **learning resource**. This PR adds the full GitHub collaboration toolchain: CI, security scanning, dependency automation, contribution templates, and community health files. It also folds in current working changes as a baseline. > Targets `main`. Because this is the first time `main` gets the collaboration > tooling, the PR also carries the pre-existing local commits (select-models > refinements) so `origin/main` ends up fully in sync. ## What's included ### 🤖 CI (`.github/workflows/ci.yml`) Runs on every PR to `main` and on push to `main`: - **Python lint & skill validation** — `ruff`, `compileall`, `validate-skills.py` - **Config validation** — parses all repo JSON/YAML (templates excluded; they hold `{{placeholders}}`) - **Terraform format check** — `terraform fmt -check -recursive modules` - **Secret scan** — `gitleaks` (license-free CLI), blocks on any finding ### 🛡️ Security scanning (`.github/workflows/security.yml`) - **Bandit** (Python SAST) — blocks on **HIGH** severity, full report otherwise - **Checkov** (Terraform/Bicep) — report-only misconfiguration scanning ### 📦 Dependency automation (`.github/dependabot.yml`) - Weekly updates + security advisory PRs for **pip**, **github-actions**, and **terraform** - Repo-level **Dependabot alerts** and **automated security fixes** enabled ### 📋 Templates & community health - Issue forms: **bug report**, **feature request**, plus a `config.yml` routing security reports to advisories - **Pull request template** with a contributor checklist - **CODEOWNERS** (auto-requests review) - **CONTRIBUTING.md** — branching, Conventional Commits, local checks, PR process - **CODE_OF_CONDUCT.md** (Contributor Covenant 2.1) - **SECURITY.md** — private reporting + automated-controls overview ### 🧰 Supporting changes - `requirements.txt` (PyYAML) so tooling is installable and Dependabot-trackable - `ruff.toml` for deterministic linting - `style(terraform)`: applied `terraform fmt` to two modules so the format gate is green - README: badges + **Contributing & Collaboration** section + checks table ## Repository settings applied (via API) - ✅ Squash-merge only, **delete branch on merge**, auto-update branch - ✅ **Dependabot alerts** + **security updates** enabled - ✅ **Discussions** enabled (referenced by issue routing) ## ⚠️ Branch protection — plan limitation (decision: keep private) The org `Team-Rockstars-AI` is on the **GitHub Free** plan and this repo is **private**, so GitHub blocks: - **Branch protection / required status checks / rulesets** (need Pro/Team or public) - **GitHub Advanced Security** — CodeQL, secret scanning, the code-scanning dashboard Per the chosen approach, the repo **stays private with no server-side protection**. The CI/security checks still run and report on every PR, enforced as **team conventions** (documented in CONTRIBUTING). `CodeQL` was intentionally **not** included because it cannot run here; Bandit + Checkov + gitleaks provide equivalent coverage without GHAS. **To enforce later:** upgrade to GitHub Team (stays private) or make the repo public, then enable branch protection on `main` (required checks + 1 code-owner approval) and optionally add CodeQL. ## ✅ Verification All CI/security jobs were simulated locally and pass: | Check | Result | |:---|:---| | `ruff check .` | ✅ | | `compileall` | ✅ | | `validate-skills.py` | ✅ (22 prompts, 0 broken refs) | | `terraform fmt -check modules` | ✅ | | `gitleaks detect` (23 commits) | ✅ no leaks | | `bandit` HIGH gate | ✅ 0 high | | JSON/YAML config validation | ✅ | GitHub Actions will run the same jobs on this PR — see the Checks tab. ## How to collaborate (for reviewers/colleagues) 1. Branch `feature/<id>-<desc>` off `main` 2. Conventional Commits 3. Open a PR with the template; a code owner is auto-requested 4. Green CI + 1 approval → squash merge 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

zaph0d

2026-08-09 19:08:25 +02:00

closed this issue
added the
pull-request
label

zaph0d referenced this issue

2026-08-10 19:09:11 +02:00

[PR #3] [MERGED] ci(deps): bump actions/checkout from 4 to 6 #2

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

github-mirrors/opencode-agentic-platform-engineering#3

No description provided.

Rows
Columns