diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index b495c7d..effb99d 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -12,4 +12,4 @@ permissions: contents: read jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@412a7031577112b31ee287cc6060179d638d6500 + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 0859959..87b24e1 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -9,10 +9,11 @@ on: permissions: actions: read contents: read - + security-events: write + id-token: write jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e permissions: contents: read security-events: write diff --git a/.machine_readable/self-validating/examples/ci-config.k9.ncl b/.machine_readable/self-validating/examples/ci-config.k9.ncl index 9fe314e..35b2d85 100644 --- a/.machine_readable/self-validating/examples/ci-config.k9.ncl +++ b/.machine_readable/self-validating/examples/ci-config.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "ci-config.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "ci-configuration", security = { @@ -16,7 +18,7 @@ K9! allow_subprocess = false, }, metadata = { - name = "ci-config", + version = "1.0.0", description = "CI/CD configuration with runtime validation", author = "Jonathan D.A. Jewell ", @@ -48,21 +50,21 @@ K9! # Workflow steps with validation steps = [ { - name = "Checkout", + action = "actions/checkout@v4", # Version must be SHA-pinned for security sha | String | std.string.NonEmpty = "b4ffde65f46336ab88eb53be808477a3936bae11", }, { - name = "Build", + run = "just build", }, { - name = "Test", + run = "just test", }, { - name = "Lint", + run = "just lint", }, ], @@ -87,15 +89,15 @@ K9! scanners = [ { - name = "CodeQL", + languages = ["rust", "javascript"], }, { - name = "OSSF Scorecard", + enabled = true, }, { - name = "TruffleHog", + scan_for = "secrets", }, ], diff --git a/.machine_readable/self-validating/examples/project-metadata.k9.ncl b/.machine_readable/self-validating/examples/project-metadata.k9.ncl index 14e0627..93adaf8 100644 --- a/.machine_readable/self-validating/examples/project-metadata.k9.ncl +++ b/.machine_readable/self-validating/examples/project-metadata.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "project-metadata.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "project-metadata", security = { @@ -16,7 +18,7 @@ K9! allow_subprocess = false, }, metadata = { - name = "project-metadata", + version = "1.0.0", description = "Pure data configuration for project metadata", author = "Jonathan D.A. Jewell ", @@ -25,7 +27,7 @@ K9! # Project configuration project = { - name = "my-project", + version = "0.1.0", description = "A project following Rhodium Standard Repositories", @@ -35,7 +37,7 @@ K9! }, author = { - name = "Jonathan D.A. Jewell", + email = "j.d.a.jewell@open.ac.uk", organization = "The Open University", }, diff --git a/.machine_readable/self-validating/examples/setup-repo.k9.ncl b/.machine_readable/self-validating/examples/setup-repo.k9.ncl index b635d5b..8225260 100644 --- a/.machine_readable/self-validating/examples/setup-repo.k9.ncl +++ b/.machine_readable/self-validating/examples/setup-repo.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "setup-repo.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "repository-setup", security = { @@ -17,7 +19,7 @@ K9! signature_required = true, }, metadata = { - name = "setup-repo", + version = "1.0.0", description = "Automated repository setup with RSR standards", author = "Jonathan D.A. Jewell ", diff --git a/.machine_readable/self-validating/template-hunt.k9.ncl b/.machine_readable/self-validating/template-hunt.k9.ncl index b3fcb47..d623df5 100644 --- a/.machine_readable/self-validating/template-hunt.k9.ncl +++ b/.machine_readable/self-validating/template-hunt.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "template-hunt.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "TODO: describe component type (e.g., 'deployment', 'setup-script')", security = { @@ -17,7 +19,7 @@ K9! signature_required = true, }, metadata = { - name = "TODO: component-name", + version = "1.0.0", description = "TODO: Detailed description of what this component does", author = "Jonathan D.A. Jewell ", diff --git a/.machine_readable/self-validating/template-kennel.k9.ncl b/.machine_readable/self-validating/template-kennel.k9.ncl index 4228b26..4a1ac9d 100644 --- a/.machine_readable/self-validating/template-kennel.k9.ncl +++ b/.machine_readable/self-validating/template-kennel.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "template-kennel.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "TODO: describe component type (e.g., 'build-config', 'metadata')", security = { @@ -16,7 +18,7 @@ K9! allow_subprocess = false, }, metadata = { - name = "TODO: component-name", + version = "1.0.0", description = "TODO: Brief description of what this component contains", author = "Jonathan D.A. Jewell ", diff --git a/.machine_readable/self-validating/template-yard.k9.ncl b/.machine_readable/self-validating/template-yard.k9.ncl index a723f5a..0f03269 100644 --- a/.machine_readable/self-validating/template-yard.k9.ncl +++ b/.machine_readable/self-validating/template-yard.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "template-yard.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "TODO: describe component type (e.g., 'validated-config', 'schema')", security = { @@ -16,7 +18,7 @@ K9! allow_subprocess = false, }, metadata = { - name = "TODO: component-name", + version = "1.0.0", description = "TODO: Brief description with validation details", author = "Jonathan D.A. Jewell ", diff --git a/.mise.toml b/.mise.toml new file mode 100644 index 0000000..3156a04 --- /dev/null +++ b/.mise.toml @@ -0,0 +1,2 @@ +[tools] +rust = "stable" diff --git a/.tool-versions b/.tool-versions deleted file mode 100644 index 3cd07d4..0000000 --- a/.tool-versions +++ /dev/null @@ -1 +0,0 @@ -rust stable