From 13bff4175fef9e6c1d4893f8e3bbf67760cf662d Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 11 Jul 2026 05:20:47 +0000 Subject: [PATCH 1/2] chore: add PR/issue templates, SECURITY.md, CodeQL, dependabot configurator Bring the framework repo's GitHub configuration up to parity with SLASHED-Plugins: - Add PULL_REQUEST_TEMPLATE.md with a checklist mirroring the CI gates (lint:css, build, test, check:version, check:llm-guide, check:macros, check:registry, audit:check, CHANGELOG, migration docs). - Add ISSUE_TEMPLATE/ (bug_report, feature_request, config) with a cross-link to SLASHED-Plugins and blank issues disabled. - Add SECURITY.md advertising the private advisory channel that SLASHED-Plugins already points framework vulnerabilities to. - Add CodeQL workflow (javascript-typescript + actions). - Extend dependabot to cover the /configurator npm package. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01UPjqiNnKXeQPhcdu93krL5 --- .github/ISSUE_TEMPLATE/bug_report.yml | 42 ++++++++++++++++++++++ .github/ISSUE_TEMPLATE/config.yml | 8 +++++ .github/ISSUE_TEMPLATE/feature_request.yml | 36 +++++++++++++++++++ .github/PULL_REQUEST_TEMPLATE.md | 26 ++++++++++++++ .github/dependabot.yml | 5 +++ .github/workflows/codeql.yml | 33 +++++++++++++++++ SECURITY.md | 24 +++++++++++++ 7 files changed, 174 insertions(+) create mode 100644 .github/ISSUE_TEMPLATE/bug_report.yml create mode 100644 .github/ISSUE_TEMPLATE/config.yml create mode 100644 .github/ISSUE_TEMPLATE/feature_request.yml create mode 100644 .github/PULL_REQUEST_TEMPLATE.md create mode 100644 .github/workflows/codeql.yml create mode 100644 SECURITY.md diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml new file mode 100644 index 00000000..fb81b9ad --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -0,0 +1,42 @@ +name: Bug report +description: Something in the SLASHED CSS framework is broken +labels: [bug] +body: + - type: textarea + id: what-happened + attributes: + label: What happened + description: What went wrong, and what you expected instead. + validations: + required: true + - type: textarea + id: steps + attributes: + label: Steps to reproduce + description: A minimal repro helps — link a CodePen/JSFiddle or paste the smallest HTML + classes/tokens that show the problem. + placeholder: | + 1. Load `dist/slashed.css` + 2. Markup: ... + 3. Observed: ... + validations: + required: true + - type: input + id: version + attributes: + label: SLASHED version + description: The `/*! SLASHED vX.Y.Z */` header of the bundle you loaded, or the npm/release version. + validations: + required: true + - type: input + id: env + attributes: + label: Environment + description: Browser(s) and OS. Note if it's light or dark mode specific. + placeholder: Chrome 126, Firefox 128, Safari 17 — macOS 14 + validations: + required: true + - type: textarea + id: extra + attributes: + label: Anything else + description: Console output, screenshots, or notes on which token/class is involved. diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 00000000..70958ba5 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,8 @@ +blank_issues_enabled: false +contact_links: + - name: SLASHED for WordPress (Bricks / Gutenberg integration) + url: https://github.com/codeslash-dev/SLASHED-Plugins/issues + about: Report issues with the WordPress plugin or its builders, not the CSS framework itself. + - name: Security vulnerability + url: https://github.com/codeslash-dev/SLASHED/security/advisories/new + about: Report security issues privately (see SECURITY.md). Do not open a public issue. diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml new file mode 100644 index 00000000..36a25718 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -0,0 +1,36 @@ +name: Feature request +description: Suggest a new token, class, macro, or framework improvement +labels: [enhancement] +body: + - type: textarea + id: problem + attributes: + label: Problem + description: What are you trying to style or do that the framework makes hard or impossible? + validations: + required: true + - type: textarea + id: proposal + attributes: + label: Proposed solution + description: New token / class / macro, or a change to an existing one. Note if it's a PUBLIC or advanced API. + validations: + required: true + - type: dropdown + id: area + attributes: + label: Area + options: + - Core tokens / theme + - Layout primitives + - Components + - Optional layer + - Macros + - Configurator + - Docs / tooling + validations: + required: true + - type: textarea + id: alternatives + attributes: + label: Alternatives considered diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 00000000..b95f415e --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,26 @@ +## Summary + + + +## Type + +- [ ] fix +- [ ] feat +- [ ] docs +- [ ] chore / tooling + +## Checklist + +- [ ] Conventional Commit messages (`feat:`, `fix:`, `docs:`, …) — enforced by commitlint +- [ ] `npm run lint:css` passes (stylelint) +- [ ] `npm run build` rebuilds `dist/` (bundles are git-ignored; CI rebuilds and stamps headers) +- [ ] `npm test` passes (unit + Playwright e2e) +- [ ] Version references in sync if any version-related file changed (`npm run check:version`) +- [ ] LLM guide reviewed/updated if `core/*.css`, `optional/*.css`, or `token-registry.json` changed (`npm run check:llm-guide`) +- [ ] Generated artifacts regenerated, not hand-edited (`npm run check:macros`, `check:registry`, `audit:check`) +- [ ] `CHANGELOG.md` updated under `## [Unreleased]` (for user-facing changes) +- [ ] Breaking changes include migration docs + +## Notes + + diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 8b2c4c07..103b3f3d 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,3 +9,8 @@ updates: directory: / schedule: interval: weekly + + - package-ecosystem: npm + directory: /configurator + schedule: + interval: weekly diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 00000000..f527a345 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,33 @@ +name: CodeQL + +on: + push: + branches: [main] + pull_request: + schedule: + - cron: '0 8 * * 1' + +permissions: + contents: read + actions: read + security-events: write + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + language: [javascript-typescript, actions] + steps: + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + + - uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 + with: + languages: ${{ matrix.language }} + queries: security-extended + + - uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 + with: + category: /language:${{ matrix.language }} diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..29835dfe --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,24 @@ +# Security Policy + +## Supported versions + +Only the latest released version of SLASHED receives security fixes. Update +before reporting. + +## Reporting a vulnerability + +Report privately — **do not open a public issue or PR.** Use +[GitHub Security Advisories](https://github.com/codeslash-dev/SLASHED/security/advisories/new). + +Please include: + +- affected version (the `/*! SLASHED vX.Y.Z */` bundle header or release tag); +- which artifact is affected (CSS bundle, `configurator/` app, or build tooling); +- steps to reproduce or a proof of concept; +- impact. + +Vulnerabilities in the WordPress integration belong in the +[SLASHED-Plugins repo](https://github.com/codeslash-dev/SLASHED-Plugins/security/advisories/new). + +We aim to acknowledge a report within a few days, share a fix timeline once +triaged, and credit reporters in the release notes unless you prefer otherwise. From 521df14f8153d0459695e7cc2bc7ab1e8e0c410c Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 11 Jul 2026 06:55:02 +0000 Subject: [PATCH 2/2] =?UTF-8?q?ci:=20drop=20CodeQL=20workflow=20=E2=80=94?= =?UTF-8?q?=20repo=20already=20uses=20CodeQL=20default=20setup?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The advanced-setup codeql.yml conflicted with the CodeQL default setup already enabled on this repo, producing a "configuration error" and failing the Analyze jobs on the PR. Default setup already scans the repo (its Analyze jobs pass), so an explicit workflow is redundant here — unlike SLASHED-Plugins, which needs an advanced workflow for paths-ignore over committed build artifacts. Remove the workflow to clear the conflict. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01UPjqiNnKXeQPhcdu93krL5 --- .github/workflows/codeql.yml | 33 --------------------------------- 1 file changed, 33 deletions(-) delete mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index f527a345..00000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,33 +0,0 @@ -name: CodeQL - -on: - push: - branches: [main] - pull_request: - schedule: - - cron: '0 8 * * 1' - -permissions: - contents: read - actions: read - security-events: write - -jobs: - analyze: - name: Analyze (${{ matrix.language }}) - runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: - language: [javascript-typescript, actions] - steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - - uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 - with: - languages: ${{ matrix.language }} - queries: security-extended - - - uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 - with: - category: /language:${{ matrix.language }}