Skip to content

Commit dffc757

Browse files
imran-siddiqueclaude
imran-siddique
and
claude
authored
chore: OSS readiness — governance docs, CI hardening, GitHub config (#114)
Aligns cmcp with agent-manifest OSS standards for the June 23 launch. Governance docs: - LICENSE (MIT — was missing, README only said MIT) - CONTRIBUTING.md (DCO, dev setup, commit format, security-critical paths) - CODE_OF_CONDUCT.md (Contributor Covenant v2.1) - SECURITY.md (private disclosure, SLAs, scope/out-of-scope) - CHANGELOG.md (Keep a Changelog format, v0.1.0 initial entries) - GOVERNANCE.md (contributor ladder, decision-making, AAIF upstream) - MAINTAINERS.md (reviewer/maintainer criteria, current roster) - ADOPTERS.md, ROADMAP.md, NOTICE (placeholders + v0.2/v1.0 targets) GitHub configuration: - CODEOWNERS (security-reviewers required on audit/, tee/, policy/) - dependabot.yml (weekly pip + Actions, max 5 PRs) - PULL_REQUEST_TEMPLATE.md (security impact field required) - ISSUE_TEMPLATE/ (bug report, feature request, config.yml) CI hardening (.github/workflows/): - ci.yml: matrix extended to 3.11/3.12/3.13 on ubuntu+windows; added bandit + pip-audit security scan step; coverage upload to Codecov - publish.yml: OIDC trusted publishing to PyPI on v* tags - codeql.yml: weekly CodeQL with security-extended queries - scorecard.yml: weekly OpenSSF Scorecard, SARIF → GitHub Security tab pyproject.toml: - classifiers (Alpha, MIT, Python 3.11/3.12/3.13, Security, AI, Typed) - bandit[toml] + pip-audit added to dev deps - [tool.bandit], [tool.coverage.run], [tool.coverage.report] sections README.md: - badges (CI, license, PyPI, Python, OpenSSF Scorecard) - architecture diagram updated to GatewayClaim envelope field names - status section updated; Contributing + Security links added Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent a554483 commit dffc757

21 files changed

Lines changed: 664 additions & 13 deletions

‎.github/CODEOWNERS‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Default owners for all files
2+
* @agentrust-io/maintainers
3+
4+
# Security-sensitive paths require security-reviewers sign-off
5+
src/cmcp_gateway/audit/ @agentrust-io/security-reviewers @agentrust-io/maintainers
6+
src/cmcp_gateway/tee/ @agentrust-io/security-reviewers @agentrust-io/maintainers
7+
src/cmcp_gateway/policy/ @agentrust-io/security-reviewers @agentrust-io/maintainers
8+
9+
# CI/CD workflow changes
10+
.github/workflows/ @agentrust-io/maintainers
11+
12+
# Package configuration
13+
pyproject.toml @agentrust-io/maintainers

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
name: Bug report
3+
about: Defect in gateway behavior
4+
labels: bug
5+
assignees: ''
6+
---
7+
8+
## cmcp-gateway version
9+
10+
<!-- Output of `cmcp-gateway --version` or the git SHA if building from source -->
11+
12+
## Python version
13+
14+
<!-- Output of `python --version` -->
15+
16+
## TEE provider
17+
18+
<!-- e.g. Intel TDX, AMD SEV-SNP, AWS Nitro Enclaves, none -->
19+
20+
## Reproduction steps
21+
22+
1.
23+
2.
24+
3.
25+
26+
## Expected behavior
27+
28+
<!-- What you expected to happen -->
29+
30+
## Actual behavior
31+
32+
<!-- What actually happened -->
33+
34+
## Relevant logs or TRACE Claim output
35+
36+
```
37+
<!-- Paste log output or TRACE Claim JSON here -->
38+
```
39+
40+
## Conformance test ID (if applicable)
41+
42+
<!-- Prefix with ATTEST, POLICY, AUDIT, or TRACE — e.g. ATTEST-007, POLICY-003 -->

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: Security vulnerability
4+
url: https://github.com/agentrust-io/cmcp/security/advisories/new
5+
about: Report a security vulnerability via GitHub Security Advisories. Do not open a public issue.
6+
- name: Design discussion
7+
url: https://github.com/agentrust-io/cmcp/discussions
8+
about: Start a design discussion or ask a broad question in GitHub Discussions before opening an issue.
9+
- name: Trace spec proposal
10+
url: https://github.com/agentrust-io/trace-spec/issues/new
11+
about: Propose a change to the cMCP trace specification in the trace-spec repo.

‎.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
name: Feature request
3+
about: Propose a new capability
4+
labels: enhancement
5+
---
6+
7+
## Problem statement
8+
9+
<!-- Describe the problem or gap this feature addresses. Be specific about who is affected and under what conditions. -->
10+
11+
## Proposed solution
12+
13+
<!-- Describe the capability you want added. Include enough detail for an implementer to scope the work. -->
14+
15+
## Alternatives considered
16+
17+
<!-- List other approaches you evaluated and why you ruled them out. -->
18+
19+
## Security/TEE impact
20+
21+
<!-- Required. Describe any impact on the TEE boundary, attestation flow, secret handling, or threat model. Write "None" if not applicable. -->
22+
23+
## Spec alignment
24+
25+
<!-- Does this require a change to the trace spec? If yes, describe which fields or events are affected and link to the relevant spec section. If no, write "No trace-spec change required." -->

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
## What
2+
3+
<!-- Brief description of the change. One to three sentences. -->
4+
5+
## Why
6+
7+
<!-- Motivation and context. Link the issue this closes, e.g. Closes #123. -->
8+
9+
## Security impact
10+
11+
<!-- Required. If this change touches TEE boundaries, message signing, audit chain integrity,
12+
capability tokens, or trust-score inputs, describe the impact. Otherwise write "None". -->
13+
14+
## Test plan
15+
16+
- [ ] `pytest` passes
17+
- [ ] `ruff check` passes
18+
- [ ] `mypy` passes
19+
- [ ] Manual test performed (describe steps below if applicable)
20+
21+
<!-- Manual test steps (delete if not applicable): -->
22+
23+
## DCO sign-off
24+
25+
- [ ] I certify that I wrote or have the right to submit this contribution, and I agree to the
26+
Developer Certificate of Origin (https://developercertificate.org).

‎.github/dependabot.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "pip"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"
7+
day: "monday"
8+
open-pull-requests-limit: 5
9+
ignore:
10+
- dependency-name: "*"
11+
update-types:
12+
- "version-update:semver-major"
13+
14+
- package-ecosystem: "github-actions"
15+
directory: "/"
16+
schedule:
17+
interval: "weekly"
18+
day: "monday"
19+
open-pull-requests-limit: 5

‎.github/workflows/ci.yml‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,11 @@ on:
88

99
jobs:
1010
test:
11-
runs-on: ubuntu-latest
11+
runs-on: ${{ matrix.os }}
1212
strategy:
1313
matrix:
14-
python-version: ["3.11", "3.12"]
14+
python-version: ["3.11", "3.12", "3.13"]
15+
os: [ubuntu-latest, windows-latest]
1516

1617
steps:
1718
- uses: actions/checkout@v4
@@ -23,11 +24,19 @@ jobs:
2324
- name: Install dependencies
2425
run: pip install -e ".[dev]"
2526

27+
- name: Security scan
28+
run: pip install bandit pip-audit && bandit -r src/ -c pyproject.toml && pip-audit
29+
2630
- name: Lint
2731
run: ruff check src/ tests/
2832

2933
- name: Type check
3034
run: mypy src/cmcp_gateway/
3135

3236
- name: Test
33-
run: pytest tests/unit/ -v --tb=short
37+
run: pytest tests/unit/ -v --tb=short --cov=src --cov-report=xml
38+
39+
- name: Upload coverage report
40+
uses: codecov/codecov-action@v4
41+
with:
42+
fail_ci_if_error: false

‎.github/workflows/codeql.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: CodeQL
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
branches:
9+
- main
10+
schedule:
11+
- cron: '15 3 * * 0'
12+
13+
permissions:
14+
actions: read
15+
contents: read
16+
security-events: write
17+
18+
jobs:
19+
analyze:
20+
name: Analyze (python)
21+
runs-on: ubuntu-latest
22+
23+
steps:
24+
- name: Checkout repository
25+
uses: actions/checkout@v4
26+
27+
- name: Initialize CodeQL
28+
uses: github/codeql-action/init@v3
29+
with:
30+
languages: python
31+
queries: +security-extended
32+
33+
- name: Autobuild
34+
uses: github/codeql-action/autobuild@v3
35+
36+
- name: Perform CodeQL Analysis
37+
uses: github/codeql-action/analyze@v3
38+
with:
39+
category: /language:python

‎.github/workflows/publish.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
name: Publish to PyPI
2+
3+
on:
4+
push:
5+
tags:
6+
- "v*"
7+
8+
permissions:
9+
contents: read
10+
id-token: write
11+
12+
jobs:
13+
build:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- uses: actions/checkout@v4
17+
18+
- name: Set up Python 3.11
19+
uses: actions/setup-python@v5
20+
with:
21+
python-version: "3.11"
22+
23+
- name: Install hatchling
24+
run: pip install hatchling
25+
26+
- name: Build package
27+
run: python -m hatchling build
28+
29+
- name: Upload dist artifact
30+
uses: actions/upload-artifact@v4
31+
with:
32+
name: dist
33+
path: dist/
34+
35+
publish:
36+
needs: build
37+
runs-on: ubuntu-latest
38+
environment: pypi
39+
steps:
40+
- name: Download dist artifact
41+
uses: actions/download-artifact@v4
42+
with:
43+
name: dist
44+
path: dist/
45+
46+
- name: Publish to PyPI
47+
uses: pypa/gh-action-pypi-publish@release/v1

‎.github/workflows/scorecard.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: OpenSSF Scorecard
2+
3+
on:
4+
branch_protection_rule:
5+
schedule:
6+
- cron: '30 4 * * 1'
7+
push:
8+
branches:
9+
- main
10+
11+
permissions:
12+
security-events: write
13+
id-token: write
14+
contents: read
15+
actions: read
16+
17+
jobs:
18+
scorecard:
19+
runs-on: ubuntu-latest
20+
steps:
21+
- name: Checkout
22+
uses: actions/checkout@v4
23+
with:
24+
persist-credentials: false
25+
fetch-depth: 0
26+
27+
- name: Run Scorecard
28+
uses: ossf/scorecard-action@v2
29+
with:
30+
results_file: scorecard-results.sarif
31+
results_format: sarif
32+
publish_results: true
33+
34+
- name: Upload SARIF
35+
uses: github/codeql-action/upload-sarif@v3
36+
with:
37+
sarif_file: scorecard-results.sarif

0 commit comments

Comments
 (0)