From d9dcf389cd278376d8a5e8d2df87f839c8ca03c9 Mon Sep 17 00:00:00 2001 From: Renn F Date: Tue, 20 Oct 2026 19:50:34 +0200 Subject: [PATCH] docs(governance): maintainers, governance and support files --- .github/FUNDING.yml | 2 +- .github/ISSUE_TEMPLATE/bug.yml | 9 ++++----- .github/ISSUE_TEMPLATE/feature.yml | 2 +- .github/PULL_REQUEST_TEMPLATE.md | 6 +++--- GOVERNANCE.md | 29 +++++++++++++++++++++++++++++ MAINTAINERS.md | 21 +++++++++++++++++++++ SECURITY.md | 17 ++++++++--------- SUPPORT.md | 8 ++++++++ 8 files changed, 75 insertions(+), 19 deletions(-) create mode 100644 GOVERNANCE.md create mode 100644 MAINTAINERS.md create mode 100644 SUPPORT.md diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml index 8056266..b6b4f8d 100644 --- a/.github/FUNDING.yml +++ b/.github/FUNDING.yml @@ -4,7 +4,7 @@ github: rennf93 # patreon: # Replace with a single Patreon username # open_collective: # Replace with a single Open Collective username # ko_fi: # Replace with a single Ko-fi username -tidelift: pypi/echo-guard +# tidelift: # not applicable for this ecosystem # community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry # liberapay: # Replace with a single Liberapay username # issuehunt: # Replace with a single IssueHunt username diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml index 7c90f51..6070f58 100644 --- a/.github/ISSUE_TEMPLATE/bug.yml +++ b/.github/ISSUE_TEMPLATE/bug.yml @@ -32,8 +32,8 @@ body: id: versions attributes: label: Versions - description: Echo Guard version, Python version, framework and version, OS. - placeholder: "guard-core 3.15.0, Python 3.13.2, FastAPI 0.115.0, Ubuntu 24.04" + description: echo-guard version, Go version, OS. + placeholder: "echo-guard 2.0.0, go 1.26, Ubuntu 24.04" validations: required: true - type: textarea @@ -41,10 +41,9 @@ body: attributes: label: Configuration description: Your config with secrets masked. - render: python + render: go placeholder: | - from guard import SecurityConfig - config = SecurityConfig(...) + // Minimal setup that reproduces the issue (secrets masked) - type: textarea id: context attributes: diff --git a/.github/ISSUE_TEMPLATE/feature.yml b/.github/ISSUE_TEMPLATE/feature.yml index c489be2..fbab6bb 100644 --- a/.github/ISSUE_TEMPLATE/feature.yml +++ b/.github/ISSUE_TEMPLATE/feature.yml @@ -27,7 +27,7 @@ body: attributes: label: Example usage description: Pseudocode of how you would like to use it. - render: python + render: go - type: textarea id: context attributes: diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index f2b5e09..a9802b4 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -49,13 +49,13 @@ Checklist --------- - + -- [ ] My code follows the code style of this project (Mypy, Ruff) +- [ ] My code follows the code style of this project (gofmt, go vet, staticcheck) - [ ] I have added tests to cover my changes - [ ] All new and existing tests passed - [ ] My change requires a change to the documentation - [ ] I have updated the documentation accordingly - [ ] I have checked that my changes don't introduce any new warnings or errors - [ ] I have updated the version number if necessary -- [ ] I have added any new dependencies to the appropriate requirements file +- [ ] I have added any new dependencies to the go.mod diff --git a/GOVERNANCE.md b/GOVERNANCE.md new file mode 100644 index 0000000..18eac02 --- /dev/null +++ b/GOVERNANCE.md @@ -0,0 +1,29 @@ +# Governance + +Echo Guard is part of the [Guard Core](https://github.com/Guard-Core) ecosystem. I maintain it alone; [MAINTAINERS.md](MAINTAINERS.md) lists who I am and how to check it. + +## Decisions + +I make the final call on every change: features, releases, security fixes and repository access. A proposal starts as an issue, so the reasoning is public before any code is written. + +## How a change lands + +1. Every change is a pull request to `master`. +2. The branch ruleset requires signed commits, linear history, passing status checks and two approvals, one of them from a code owner ([CODEOWNERS](.github/CODEOWNERS)). As the only maintainer I cannot get those approvals, so I merge my own pull requests with admin rights. That skips the approval count only: I never merge with a failing check. +3. A pull request closes an open issue (`Closes #N`), or carries the `no-issue` label when it is a small fix with nothing to discuss. + +## Releases + +Versions follow semantic versioning. Adapters version on their own, because each one follows its framework, and declare the engine versions they support. Releases are cut from tags and recorded in [CHANGELOG.md](CHANGELOG.md). + +## Security + +Vulnerabilities go through [SECURITY.md](SECURITY.md), never through public issues. + +## New maintainers + +Contributors with a record of reviewed and merged work can be invited as maintainers. A new maintainer is added to MAINTAINERS.md and CODEOWNERS in a pull request. + +## Conduct + +The [Code of Conduct](CODE_OF_CONDUCT.md) applies to every space of this project. diff --git a/MAINTAINERS.md b/MAINTAINERS.md new file mode 100644 index 0000000..b841539 --- /dev/null +++ b/MAINTAINERS.md @@ -0,0 +1,21 @@ +# Maintainers + +Echo Guard has one maintainer. + +| Name | GitHub | Email | Role | +|---|---|---|---| +| Renzo Franceschini | [@rennf93](https://github.com/rennf93) | rennf93@guard-core.com | Lead maintainer: reviews and merges every change, publishes every release, handles security reports | + +## Identity + +- GitHub profile [@rennf93](https://github.com/rennf93): name Renzo Franceschini, website guard-core.com. +- [guard-core.com/company](https://guard-core.com/company) names Renzo Franceschini and links to @rennf93. +- The [Guard-Core](https://github.com/Guard-Core) GitHub organization has guard-core.com as a verified domain. +- Go: the module path is `github.com/rennf93/echo-guard/v2`. + +## Related files + +- Code ownership: [CODEOWNERS](.github/CODEOWNERS) +- How decisions are made: [GOVERNANCE.md](GOVERNANCE.md) +- Security reports: [SECURITY.md](SECURITY.md) +- Getting help: [SUPPORT.md](SUPPORT.md) diff --git a/SECURITY.md b/SECURITY.md index 4863900..4138a90 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,19 +2,18 @@ ## Supported Versions -We currently provide security updates for the following versions of Echo Guard: +I provide security updates for the following versions of Echo Guard: -| Version | Supported | -| ------- | ------------------ | -| 1.2.x | :white_check_mark: | -| 1.1.x | :white_check_mark: | -| < 1.1.0 | :x: | +| Version | Supported | +| ------- | --------- | +| 2.x | :white_check_mark: bug and security fixes | +| 1.x | :white_check_mark: security fixes only | ## Reporting a Vulnerability -We take the security of Echo Guard seriously. If you believe you've found a security vulnerability, please follow these steps: +I take the security of Echo Guard seriously. If you believe you've found a security vulnerability, please follow these steps: -1. **Do not disclose the vulnerability publicly** until it has been addressed by the maintainers. +1. **Do not disclose the vulnerability publicly** until I have fixed it. 2. **Report the vulnerability through GitHub's security advisory feature**: - Go to the [Security tab](https://github.com/Guard-Core/echo-guard/security/advisories) of the Echo Guard repository - Click on "New draft security advisory" @@ -29,7 +28,7 @@ We take the security of Echo Guard seriously. If you believe you've found a secu - Affected versions - Any potential mitigations or workarounds -The maintainers will acknowledge your report within 48 hours and provide a detailed response within 7 days, including the next steps in handling the vulnerability. +I will acknowledge your report within 48 hours and send a detailed response within 7 days, including the next steps in handling the vulnerability. ## Security Considerations diff --git a/SUPPORT.md b/SUPPORT.md new file mode 100644 index 0000000..f22d06c --- /dev/null +++ b/SUPPORT.md @@ -0,0 +1,8 @@ +# Support + +- Documentation: [https://guard-core.github.io/echo-guard/](https://guard-core.github.io/echo-guard/) +- Questions: [GitHub Discussions](https://github.com/Guard-Core/echo-guard/discussions) +- Chat: [Discord](https://discord.gg/ZW7ZJbjMkK), #help for questions, #releases for new versions. +- Bugs and feature requests: [issues](https://github.com/Guard-Core/echo-guard/issues/new/choose), using the templates. +- Security reports: [SECURITY.md](SECURITY.md), never a public issue. +- The hosted Guard Core app (app.guard-core.com): [saas-issues](https://github.com/Guard-Core/saas-issues).