From fc2425538d54e87d2bb374c052cc8460d3dfec04 Mon Sep 17 00:00:00 2001 From: Amit Kumar Date: Thu, 23 Apr 2026 06:35:55 +0000 Subject: [PATCH 1/2] chore: add CHANGELOG.md + fill missing BestPractices criteria MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - CHANGELOG.md: pointer to GitHub Releases (auto-generated per-release notes) plus a summary log. Fixes the `release_notes` Unmet auto-check on bestpractices.dev which requires a CHANGELOG/NEWS file at repo root. - .bestpractices.json: add two entries that were missing from the prior passing-tier pass: - documentation_interface — points to docs/cli-reference.md, rest-api.md, mcp-tools.md - test_continuous_integration — points to .github/workflows/ci.yml Totals: 78 Met / 10 N/A / 0 Unknown (88 entries). Co-Authored-By: Claude Opus 4.7 (1M context) --- .bestpractices.json | 6 ++++++ CHANGELOG.md | 34 ++++++++++++++++++++++++++++++++++ 2 files changed, 40 insertions(+) create mode 100644 CHANGELOG.md diff --git a/.bestpractices.json b/.bestpractices.json index 7171407..ea6cc60 100644 --- a/.bestpractices.json +++ b/.bestpractices.json @@ -11,6 +11,12 @@ "contribution_requirements_status": "Met", "contribution_requirements_justification": "CONTRIBUTING.md documents PR requirements: go test suite passing, go vet clean, CodeQL passing, Conventional Commit style. https://github.com/RandomCodeSpace/docsiq/blob/main/CONTRIBUTING.md", + "documentation_interface_status": "Met", + "documentation_interface_justification": "CLI interface documented in docs/cli-reference.md; REST API documented in docs/rest-api.md; MCP tool catalogue in docs/mcp-tools.md. https://github.com/RandomCodeSpace/docsiq/tree/main/docs", + + "test_continuous_integration_status": "Met", + "test_continuous_integration_justification": "CI runs full test suite (unit + integration + fuzz) on every PR and every push to main. https://github.com/RandomCodeSpace/docsiq/blob/main/.github/workflows/ci.yml", + "license_location_status": "Met", "license_location_justification": "https://github.com/RandomCodeSpace/docsiq/blob/main/LICENSE", diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..7d46f76 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,34 @@ +# Changelog + +All notable changes to docsiq are published on +[GitHub Releases](https://github.com/RandomCodeSpace/docsiq/releases) +with auto-generated summaries grouped by label (security fixes, breaking +changes, new features, bug fixes, dependencies). Each release is tagged +with its signed SHA256SUMS and SLSA build provenance. + +This file summarises notable releases. The canonical source is the +Releases page linked above. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +## [Unreleased] + +### Added +- Governance and community files: `CODE_OF_CONDUCT.md`, `GOVERNANCE.md`, + `.github/CODEOWNERS`, `.github/release.yml`, `docs/ACCESSIBILITY.md` +- `.bestpractices.json` to track OpenSSF BestPractices criteria + +### Changed +- `SECURITY.md`: added "Report archive" section documenting GitHub Issues + and Security Advisories as the public archive + +## [0.0.2] — 2026-04-20 + +See + +## [0.0.1] — 2026-04-15 + +Initial release. + +See From 040ebf2e5746b656c7afe0a4f02679518e354692 Mon Sep 17 00:00:00 2001 From: Amit Kumar Date: Thu, 23 Apr 2026 06:41:53 +0000 Subject: [PATCH 2/2] chore(bp): vulnerability_report_process justification = URL only bestpractices.dev validator flagged 'URL required, but no URL found' even though the prior justification embedded the link. Some criteria require the justification field to be a bare URL for auto-detection. Co-Authored-By: Claude Opus 4.7 (1M context) --- .bestpractices.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.bestpractices.json b/.bestpractices.json index ea6cc60..be17f38 100644 --- a/.bestpractices.json +++ b/.bestpractices.json @@ -66,7 +66,7 @@ "enhancement_responses_justification": "Enhancement requests receive a triage response within 14 days.", "vulnerability_report_process_status": "Met", - "vulnerability_report_process_justification": "Private vulnerability reporting via GitHub's private advisories; documented in SECURITY.md with 72h acknowledgement SLA. https://github.com/RandomCodeSpace/docsiq/blob/main/SECURITY.md", + "vulnerability_report_process_justification": "https://github.com/RandomCodeSpace/docsiq/blob/main/SECURITY.md", "vulnerability_report_private_status": "Met", "vulnerability_report_private_justification": "GitHub private vulnerability reporting is enabled on the repo. https://github.com/RandomCodeSpace/docsiq/security/advisories",