Skip to content

Commit ba0b758

Browse files
drhdevdrhdev
committed
chore: prepare production release
1 parent 300a6d4 commit ba0b758

27 files changed

Lines changed: 1765 additions & 168 deletions

‎.editorconfig‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
root = true
2+
3+
[*]
4+
charset = utf-8
5+
end_of_line = lf
6+
insert_final_newline = true
7+
trim_trailing_whitespace = true
8+
9+
[*.py]
10+
indent_style = space
11+
indent_size = 4
12+
13+
[{*.json,*.toml,*.yml,*.yaml,*.md}]
14+
indent_style = space
15+
indent_size = 2
16+
17+
[Makefile]
18+
indent_style = tab

‎.gitattributes‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
* text=auto eol=lf
2+
*.png binary
3+
*.jpg binary
4+
*.jpeg binary
5+
*.gif binary
6+
*.ico binary
7+
*.pdf binary
8+
*.gz binary
9+
*.zip binary
10+
*.whl binary

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
* @drhdev

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
name: Bug report
2+
description: Report a reproducible, non-sensitive defect
3+
title: "bug: "
4+
labels: [bug, triage]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: >-
9+
Never include tokens, private repository names, private URLs, proprietary source,
10+
manifests, or backup contents. Report security issues through SECURITY.md.
11+
- type: input
12+
id: version
13+
attributes:
14+
label: Version
15+
description: Output of `github-backup --version` or the container tag/digest.
16+
validations:
17+
required: true
18+
- type: dropdown
19+
id: deployment
20+
attributes:
21+
label: Deployment
22+
options:
23+
- Native Python
24+
- Docker
25+
- Other
26+
validations:
27+
required: true
28+
- type: dropdown
29+
id: storage
30+
attributes:
31+
label: Storage
32+
options:
33+
- Local filesystem
34+
- NAS-mounted filesystem
35+
- Amazon S3
36+
- S3-compatible service
37+
validations:
38+
required: true
39+
- type: textarea
40+
id: environment
41+
attributes:
42+
label: Environment
43+
description: OS, architecture, Python/Docker version, Git/Git LFS version, and GitHub.com or GHES version.
44+
validations:
45+
required: true
46+
- type: textarea
47+
id: steps
48+
attributes:
49+
label: Reproduction steps
50+
description: Minimal commands and sanitized configuration needed to reproduce the problem.
51+
validations:
52+
required: true
53+
- type: textarea
54+
id: expected
55+
attributes:
56+
label: Expected behavior
57+
validations:
58+
required: true
59+
- type: textarea
60+
id: actual
61+
attributes:
62+
label: Actual behavior and sanitized logs
63+
render: shell
64+
validations:
65+
required: true
66+
- type: checkboxes
67+
id: checks
68+
attributes:
69+
label: Safety checks
70+
options:
71+
- label: I removed all secrets and private/proprietary data.
72+
required: true
73+
- label: This is not a security vulnerability.
74+
required: true
75+
- label: I searched existing issues.
76+
required: true

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: Security vulnerability
4+
url: https://github.com/drhdev/github-backup/security/advisories/new
5+
about: Privately report token, private-data, or other security vulnerabilities.
6+
- name: Support guidance
7+
url: https://github.com/drhdev/github-backup/blob/main/SUPPORT.md
8+
about: Read the support and diagnostic-data guidance before filing an issue.

‎.github/ISSUE_TEMPLATE/feature_request.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: Feature request
2+
description: Propose a non-sensitive capability or improvement
3+
title: "feat: "
4+
labels: [enhancement, triage]
5+
body:
6+
- type: textarea
7+
id: problem
8+
attributes:
9+
label: Problem
10+
description: What operational or recovery problem should be solved?
11+
validations:
12+
required: true
13+
- type: textarea
14+
id: proposal
15+
attributes:
16+
label: Proposed behavior
17+
description: Include defaults, opt-in behavior, CLI/configuration impact, and restore expectations.
18+
validations:
19+
required: true
20+
- type: textarea
21+
id: alternatives
22+
attributes:
23+
label: Alternatives and tradeoffs
24+
validations:
25+
required: true
26+
- type: textarea
27+
id: security
28+
attributes:
29+
label: Security and operational impact
30+
description: Token permissions, sensitive data, storage, retention, rate limits, and compatibility.
31+
validations:
32+
required: true
33+
- type: checkboxes
34+
id: checks
35+
attributes:
36+
label: Checks
37+
options:
38+
- label: I removed all secrets and private/proprietary data.
39+
required: true
40+
- label: I searched existing issues and the roadmap in the README.
41+
required: true

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
## Summary
2+
3+
Describe the problem and the focused change.
4+
5+
## Validation
6+
7+
- [ ] Tests added or updated where behavior changed
8+
- [ ] Ruff, Mypy, pytest with coverage, and dependency audit pass
9+
- [ ] Package/container smoke tests pass where applicable
10+
- [ ] Restore or migration behavior was considered
11+
12+
## Security and operations
13+
14+
- [ ] No credentials, private metadata, repository names, or backup data are included
15+
- [ ] Least-privilege/token implications are documented
16+
- [ ] Storage, retention, logging, and compatibility implications are documented
17+
18+
## Release note
19+
20+
Use a Conventional Commit title (`feat:`, `fix:`, `docs:`, and so on). Note any breaking change
21+
explicitly.

‎.github/dependabot.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,32 @@ updates:
44
directory: "/"
55
schedule:
66
interval: weekly
7+
day: monday
8+
time: "05:00"
9+
timezone: Europe/Berlin
10+
open-pull-requests-limit: 10
11+
labels: [dependencies, python]
712
groups:
813
python-dependencies:
914
patterns: ["*"]
1015
- package-ecosystem: github-actions
1116
directory: "/"
1217
schedule:
1318
interval: weekly
19+
day: monday
20+
time: "05:30"
21+
timezone: Europe/Berlin
22+
open-pull-requests-limit: 10
23+
labels: [dependencies, github-actions]
24+
groups:
25+
github-actions:
26+
patterns: ["*"]
27+
- package-ecosystem: docker
28+
directory: "/"
29+
schedule:
30+
interval: weekly
31+
day: monday
32+
time: "06:00"
33+
timezone: Europe/Berlin
34+
open-pull-requests-limit: 5
35+
labels: [dependencies, docker]

‎.github/workflows/ci.yml‎

Lines changed: 52 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,26 +4,72 @@ on:
44
push:
55
branches: [main]
66
pull_request:
7+
workflow_dispatch:
8+
9+
concurrency:
10+
group: ci-${{ github.workflow }}-${{ github.ref }}
11+
cancel-in-progress: true
712

813
permissions:
914
contents: read
1015

1116
jobs:
17+
quality:
18+
runs-on: ubuntu-latest
19+
timeout-minutes: 15
20+
steps:
21+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
22+
- uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
23+
with:
24+
python-version: "3.13"
25+
- run: python -m pip install "uv==0.11.24"
26+
- run: uv sync --frozen --extra dev --extra s3
27+
- run: uv run ruff check .
28+
- run: uv run mypy src
29+
- run: uv run pip-audit
30+
- run: uv build --out-dir dist
31+
- name: Smoke-test built wheel
32+
run: |
33+
python -m venv /tmp/github-backup-wheel-test
34+
/tmp/github-backup-wheel-test/bin/python -m pip install --no-deps dist/*.whl
35+
/tmp/github-backup-wheel-test/bin/github-backup --version
36+
/tmp/github-backup-wheel-test/bin/github-backup help run
37+
1238
test:
1339
runs-on: ubuntu-latest
40+
timeout-minutes: 15
1441
strategy:
1542
fail-fast: false
1643
matrix:
1744
python-version: ["3.11", "3.12", "3.13"]
1845
steps:
19-
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
20-
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
46+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
47+
- uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
2148
with:
2249
python-version: ${{ matrix.python-version }}
23-
cache: pip
2450
- run: python -m pip install "uv==0.11.24"
2551
- run: uv sync --frozen --extra dev --extra s3
26-
- run: uv run ruff check .
27-
- run: uv run mypy src
2852
- run: uv run pytest --cov=github_backup --cov-report=term-missing --cov-fail-under=80
29-
- run: uv run pip-audit
53+
54+
docker:
55+
runs-on: ubuntu-latest
56+
timeout-minutes: 20
57+
steps:
58+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
59+
- name: Build container image
60+
run: docker build --pull --provenance=false --tag github-backup:ci .
61+
- name: Scan container for actionable high/critical vulnerabilities
62+
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
63+
with:
64+
image-ref: github-backup:ci
65+
scanners: vuln
66+
vuln-type: os,library
67+
severity: CRITICAL,HIGH
68+
ignore-unfixed: true
69+
exit-code: "1"
70+
- name: Smoke-test container image
71+
run: |
72+
docker run --rm --read-only --cap-drop=ALL --security-opt=no-new-privileges \
73+
github-backup:ci --version
74+
docker run --rm --read-only --cap-drop=ALL --security-opt=no-new-privileges \
75+
github-backup:ci help run

0 commit comments

Comments
 (0)