From e778077a6b35a806c002b463261e15d34736d66f Mon Sep 17 00:00:00 2001 From: lusoris Date: Thu, 5 Nov 2026 05:31:45 +0100 Subject: [PATCH 1/6] docs(readme): apply the README presentation standard to the org profile Adds a 120 px banner, one badge block in the standard group order, a bold tagline and the standard section order. The release and CodeRabbit badges are left out: the repository has no releases and CONTRIBUTING.md states that no review bot runs. The table delimiter row gets spaces so markdownlint MD060 passes. The four adoption exceptions in .standards.yaml get category A, entered 2026-10-22 (the adoption commit 74800d9) and an unchanged expiry, so the current engine accepts the manifest. Signed-off-by: lusoris --- .standards.yaml | 16 ++++-- profile/README.md | 75 ++++++++++++++++++++++++----- profile/golusoris-readme-banner.svg | 38 +++++++++++++++ 3 files changed, 112 insertions(+), 17 deletions(-) create mode 100644 profile/golusoris-readme-banner.svg diff --git a/.standards.yaml b/.standards.yaml index 0d51f5d..34fae7a 100644 --- a/.standards.yaml +++ b/.standards.yaml @@ -45,17 +45,25 @@ register: exceptions: - rule: HISS-11 path: .github/workflows/release.yml - reason: adoption found the release workflows short of the declared supply chain (SLSA Build Level 3 declared, Level 0 measured; enforce_cosign without a cosign signing step; require_sbom without an SBOM step); raise them as docs/guides/releasing.md in Praetor describes, then remove this entry + reason: adoption found the release workflows short of the declared supply chain (SLSA Build Level 3 declared, Level 0 measured; enforce_cosign without a cosign signing step; require_sbom without an SBOM step); raise them as docs/guides/releasing.md in Praetor describes, then remove this entry (category A, the interval stated in this entry) + entered: "2026-10-22" expires: "2027-01-20" + category: A - rule: declared-linters tool: gitleaks - reason: adoption scaffolds no CI job for gitleaks declared by facet "security:high"; run it in a workflow, or remove this entry + reason: adoption scaffolds no CI job for gitleaks declared by facet "security:high"; run it in a workflow, or remove this entry (category A, the interval stated in this entry) + entered: "2026-10-22" expires: "2027-01-20" + category: A - rule: declared-linters tool: semgrep - reason: adoption scaffolds no CI job for semgrep declared by profile "template-seed", facet "agent:sandboxed"; run it in a workflow, or remove this entry + reason: adoption scaffolds no CI job for semgrep declared by profile "template-seed", facet "agent:sandboxed"; run it in a workflow, or remove this entry (category A, the interval stated in this entry) + entered: "2026-10-22" expires: "2027-01-20" + category: A - rule: declared-linters tool: trivy - reason: adoption scaffolds no CI job for trivy declared by facet "security:high"; run it in a workflow, or remove this entry + reason: adoption scaffolds no CI job for trivy declared by facet "security:high"; run it in a workflow, or remove this entry (category A, the interval stated in this entry) + entered: "2026-10-22" expires: "2027-01-20" + category: A diff --git a/profile/README.md b/profile/README.md index 331ff11..30b5ce2 100644 --- a/profile/README.md +++ b/profile/README.md @@ -1,14 +1,48 @@ -# golusoris + + +
-Foundational Go libraries + the apps built on top of them. + golusoris — foundational Go libraries and applications -## What's here + + + [![REUSE](https://github.com/golusoris/.github/actions/workflows/reuse.yml/badge.svg?branch=main&event=push)](https://github.com/golusoris/.github/actions/workflows/reuse.yml) + + [![OpenSSF Scorecard](https://img.shields.io/badge/OpenSSF-Scorecard-06b6d4?style=for-the-badge&labelColor=111a35)](https://scorecard.dev/viewer/?uri=github.com/golusoris/.github) + + [![HISS-21](https://img.shields.io/badge/Standards-HISS--21-06b6d4?style=for-the-badge&logo=nasa&labelColor=111a35)](https://github.com/golusoris/.github/blob/main/AGENTS.md) + [![Conventional Commits](https://img.shields.io/badge/Commits-Conventional-8b5cf6?style=for-the-badge&logo=conventionalcommits&logoColor=white&labelColor=111a35)](https://github.com/golusoris/.github/blob/main/CONTRIBUTING.md) + + [![License](https://img.shields.io/badge/License-EUPL--1.2_·_CC--BY--SA--4.0-3b82f6?style=for-the-badge&labelColor=111a35)](https://github.com/golusoris/.github/blob/main/LICENSE) + + [![GitHub Sponsors](https://img.shields.io/badge/Sponsor-GitHub-8b5cf6?style=for-the-badge&logo=githubsponsors&logoColor=white&labelColor=111a35)](https://github.com/sponsors/lusoris) + [![Ko-fi](https://img.shields.io/badge/Support-Ko--fi-8b5cf6?style=for-the-badge&logo=kofi&logoColor=white&labelColor=111a35)](https://ko-fi.com/lusoris) + + **Foundational Go libraries and the applications built on top of them** + + *The central framework modules, service clients, and self-hosted apps of the golusoris ecosystem* + +
+ +golusoris provides foundational Go libraries and the suite of applications built +on top of them. It encompasses composable `fx` framework modules covering core +backend infrastructure, zero-dependency typed clients for media automation and +metadata services, and production self-hosted applications. + +--- + +## At a glance ### Libraries + - **[golusoris/golusoris](https://github.com/golusoris/golusoris)** — the framework: composable `fx` modules covering config, logging, errors, database, HTTP, OTel, jobs, cache, auth, k8s runtime, notifications, storage, AI, and more. - **[golusoris/goenvoy](https://github.com/golusoris/goenvoy)** — typed clients for the *arr stack, metadata services (TMDB, AniList, Trakt, …), and download/indexer APIs. 60+ zero-dependency modules. ### Apps + All apps are built on the `golusoris` framework and live here with the `app-` prefix: - **[app-revenge](https://github.com/golusoris/app-revenge)** — high-performance Go media server @@ -19,21 +53,36 @@ All apps are built on the `golusoris` framework and live here with the `app-` pr ## Naming convention | Prefix | Kind | Example | -|---|---|---| +| --- | --- | --- | | none | library | `golusoris/goenvoy` | | `app-` | application consuming the framework | `golusoris/app-revenge` | | `cmd-` | standalone CLI (future) | `golusoris/cmd-…` | The namesake repo `golusoris/golusoris` is the framework itself. +## Contribute + +Start with [CONTRIBUTING.md](https://github.com/golusoris/.github/blob/main/CONTRIBUTING.md) +for contribution guidelines, signing expectations, and Conventional Commits conventions. +Report vulnerabilities privately as described in [SECURITY.md](https://github.com/golusoris/.github/blob/main/SECURITY.md). + ## Support -

- - Support me on Ko-fi - -    - - GitHub Sponsors - -

+golusoris is free and open source. Support ongoing development, maintenance, and +infrastructure costs: + +- **[GitHub Sponsors](https://github.com/sponsors/lusoris)** (sponsors/lusoris) +- **[Ko-fi](https://ko-fi.com/lusoris)** (lusoris) + +## Upstream and licence + +Code and workflows in this repository are licensed under the European Union Public +Licence v. 1.2 ([`EUPL-1.2`](https://github.com/golusoris/.github/blob/main/LICENSE)). +Markdown prose and documentation files are licensed under Creative Commons +Attribution-ShareAlike 4.0 International ([`CC-BY-SA-4.0`](https://github.com/golusoris/.github/blob/main/LICENSES/CC-BY-SA-4.0.txt)) +per [`REUSE.toml`](https://github.com/golusoris/.github/blob/main/REUSE.toml). + +## Standards & Governance + +This repository conforms to High-Integrity Systems Standards (HISS-21) +and Conventional Commits conventions. diff --git a/profile/golusoris-readme-banner.svg b/profile/golusoris-readme-banner.svg new file mode 100644 index 0000000..d595410 --- /dev/null +++ b/profile/golusoris-readme-banner.svg @@ -0,0 +1,38 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + golusoris. + + Foundational Go libraries · Application suite + Composable fx modules · Zero-dependency clients + + From 710db0c66d5d26eb4b59ff33467f1f200bb275b0 Mon Sep 17 00:00:00 2001 From: lusoris Date: Sun, 8 Nov 2026 15:21:42 +0100 Subject: [PATCH 2/6] docs(profile): link each claim and drop the dead app links The four app repositories do not exist yet, so their links returned 404. The apps keep their names and descriptions, and the list says that the repositories are not published yet. The tagline context line and the intro paragraph now link each claim to the repository behind it: golusoris/golusoris for the framework modules, golusoris/goenvoy for the service clients, and uber-go/fx for fx. The intro no longer claims shipped production applications. The governance section no longer claims conformance to HISS. It says that AGENTS.md declares the 21 invariants of the High-Integrity Systems Standard from Praetor and that its table marks which ones are enforced and which are advisory only. Signed-off-by: lusoris --- profile/README.md | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-) diff --git a/profile/README.md b/profile/README.md index 30b5ce2..2dcc314 100644 --- a/profile/README.md +++ b/profile/README.md @@ -23,14 +23,17 @@ **Foundational Go libraries and the applications built on top of them** - *The central framework modules, service clients, and self-hosted apps of the golusoris ecosystem* + *The central [framework modules](https://github.com/golusoris/golusoris), [service clients](https://github.com/golusoris/goenvoy), and self-hosted apps of the golusoris ecosystem* golusoris provides foundational Go libraries and the suite of applications built -on top of them. It encompasses composable `fx` framework modules covering core -backend infrastructure, zero-dependency typed clients for media automation and -metadata services, and production self-hosted applications. +on top of them. It encompasses [composable framework modules covering core +backend infrastructure](https://github.com/golusoris/golusoris) using Uber's +[`fx`](https://github.com/uber-go/fx) dependency-injection framework, +[zero-dependency typed clients for media automation and metadata +services](https://github.com/golusoris/goenvoy), and self-hosted applications +built on both, listed under Apps. --- @@ -43,12 +46,13 @@ metadata services, and production self-hosted applications. ### Apps -All apps are built on the `golusoris` framework and live here with the `app-` prefix: +All apps are built on the `golusoris` framework. Their repositories are not +published yet; each will use the `app-` prefix here: -- **[app-revenge](https://github.com/golusoris/app-revenge)** — high-performance Go media server -- **[app-lurkarr](https://github.com/golusoris/app-lurkarr)** — automated media hunting for *arr apps -- **[app-subdo](https://github.com/golusoris/app-subdo)** — visual flow editor for media processing automation -- **[app-arca](https://github.com/golusoris/app-arca)** — self-hosted ROM management platform +- **app-revenge** — high-performance Go media server +- **app-lurkarr** — automated media hunting for *arr apps +- **app-subdo** — visual flow editor for media processing automation +- **app-arca** — self-hosted ROM management platform ## Naming convention @@ -84,5 +88,11 @@ per [`REUSE.toml`](https://github.com/golusoris/.github/blob/main/REUSE.toml). ## Standards & Governance -This repository conforms to High-Integrity Systems Standards (HISS-21) -and Conventional Commits conventions. +The `golusoris/.github` repository declares the 21 invariants of the +High-Integrity Systems Standard (HISS) from +[Praetor](https://github.com/cordanaLLM/praetor) in +[`AGENTS.md`](https://github.com/golusoris/.github/blob/main/AGENTS.md). Its +table names the check that enforces each invariant and marks the invariants +that are advisory only. Commits follow Conventional Commits, as +[`CONTRIBUTING.md`](https://github.com/golusoris/.github/blob/main/CONTRIBUTING.md) +describes. From 8eb66425260b97d04402c2c59c121b1e6c42cae7 Mon Sep 17 00:00:00 2001 From: lusoris Date: Sun, 8 Nov 2026 15:33:24 +0100 Subject: [PATCH 3/6] docs(profile): add the Best Practices, Codacy and CodeRabbit badges The README standard puts the OpenSSF Best Practices level and the review bots that check every pull request into the security group. This repository now has all three: Best Practices project 16160, the Codacy grade and CodeRabbit reviews. The Codacy badge is the grade image Codacy serves itself; its token is badges.grade of the repository record in the Codacy API. The CodeRabbit badge is the same static badge VMAFx uses. Each image answers in under 0.4 s, inside the 4 s limit of GitHub's image proxy. Signed-off-by: lusoris --- profile/README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/profile/README.md b/profile/README.md index 2dcc314..d4c0cc2 100644 --- a/profile/README.md +++ b/profile/README.md @@ -12,6 +12,9 @@ [![REUSE](https://github.com/golusoris/.github/actions/workflows/reuse.yml/badge.svg?branch=main&event=push)](https://github.com/golusoris/.github/actions/workflows/reuse.yml) [![OpenSSF Scorecard](https://img.shields.io/badge/OpenSSF-Scorecard-06b6d4?style=for-the-badge&labelColor=111a35)](https://scorecard.dev/viewer/?uri=github.com/golusoris/.github) + [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/16160/badge)](https://www.bestpractices.dev/projects/16160) + [![Codacy](https://app.codacy.com/project/badge/Grade/616e991478d846b6a826f536d9645dd2)](https://app.codacy.com/gh/golusoris/.github/dashboard) + [![CodeRabbit](https://img.shields.io/badge/Reviews-CodeRabbit-8b5cf6?style=for-the-badge&logo=coderabbit&logoColor=white&labelColor=111a35)](https://coderabbit.ai) [![HISS-21](https://img.shields.io/badge/Standards-HISS--21-06b6d4?style=for-the-badge&logo=nasa&labelColor=111a35)](https://github.com/golusoris/.github/blob/main/AGENTS.md) [![Conventional Commits](https://img.shields.io/badge/Commits-Conventional-8b5cf6?style=for-the-badge&logo=conventionalcommits&logoColor=white&labelColor=111a35)](https://github.com/golusoris/.github/blob/main/CONTRIBUTING.md) From 6800305ded217cfae1d38efc985eead80d1fc380 Mon Sep 17 00:00:00 2001 From: lusoris Date: Sun, 8 Nov 2026 15:46:29 +0100 Subject: [PATCH 4/6] docs(profile): state the commit rules CONTRIBUTING.md sets The governance paragraph said that commits follow Conventional Commits. CONTRIBUTING.md asks for something else: pull request titles follow Conventional Commits, and commits are signed and carry a Signed-off-by trailer. The paragraph now says the same as the file it links. Signed-off-by: lusoris --- profile/README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/profile/README.md b/profile/README.md index d4c0cc2..70ea4ac 100644 --- a/profile/README.md +++ b/profile/README.md @@ -96,6 +96,7 @@ High-Integrity Systems Standard (HISS) from [Praetor](https://github.com/cordanaLLM/praetor) in [`AGENTS.md`](https://github.com/golusoris/.github/blob/main/AGENTS.md). Its table names the check that enforces each invariant and marks the invariants -that are advisory only. Commits follow Conventional Commits, as +that are advisory only. Pull request titles follow Conventional Commits, and +commits are signed with a `Signed-off-by` trailer, as [`CONTRIBUTING.md`](https://github.com/golusoris/.github/blob/main/CONTRIBUTING.md) describes. From 6afdc8e0dc4d4b39970c7734da61bd5234812f03 Mon Sep 17 00:00:00 2001 From: lusoris Date: Sun, 8 Nov 2026 16:02:21 +0100 Subject: [PATCH 5/6] docs(profile): state commit signing and sign-off separately The profile said commits "are signed with a Signed-off-by trailer", which reads as if the trailer were the signature. CONTRIBUTING.md asks for both: a cryptographic signature (git commit -S) and a Signed-off-by trailer (git commit -s). The sentence now names each requirement on its own. Found by the CodeRabbit review of 6800305. Signed-off-by: lusoris --- profile/README.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/profile/README.md b/profile/README.md index 70ea4ac..07ec201 100644 --- a/profile/README.md +++ b/profile/README.md @@ -96,7 +96,8 @@ High-Integrity Systems Standard (HISS) from [Praetor](https://github.com/cordanaLLM/praetor) in [`AGENTS.md`](https://github.com/golusoris/.github/blob/main/AGENTS.md). Its table names the check that enforces each invariant and marks the invariants -that are advisory only. Pull request titles follow Conventional Commits, and -commits are signed with a `Signed-off-by` trailer, as +that are advisory only. Pull request titles follow Conventional Commits. Every +commit carries a cryptographic signature (`git commit -S`) and, separately, a +`Signed-off-by` trailer (`git commit -s`), as [`CONTRIBUTING.md`](https://github.com/golusoris/.github/blob/main/CONTRIBUTING.md) describes. From 7ff358f073818b60bf7cd398b5fe19fa5722ec6b Mon Sep 17 00:00:00 2001 From: lusoris Date: Sun, 8 Nov 2026 16:16:02 +0100 Subject: [PATCH 6/6] docs(profile): link the licence badge to both licences The License badge names EUPL-1.2 and CC-BY-SA-4.0 but opened only the EUPL text in LICENSE. It now links to the profile's "Upstream and licence" section, which names both licences and points at REUSE.toml. Signed-off-by: lusoris --- profile/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/profile/README.md b/profile/README.md index 07ec201..156a84d 100644 --- a/profile/README.md +++ b/profile/README.md @@ -19,7 +19,7 @@ [![HISS-21](https://img.shields.io/badge/Standards-HISS--21-06b6d4?style=for-the-badge&logo=nasa&labelColor=111a35)](https://github.com/golusoris/.github/blob/main/AGENTS.md) [![Conventional Commits](https://img.shields.io/badge/Commits-Conventional-8b5cf6?style=for-the-badge&logo=conventionalcommits&logoColor=white&labelColor=111a35)](https://github.com/golusoris/.github/blob/main/CONTRIBUTING.md) - [![License](https://img.shields.io/badge/License-EUPL--1.2_·_CC--BY--SA--4.0-3b82f6?style=for-the-badge&labelColor=111a35)](https://github.com/golusoris/.github/blob/main/LICENSE) + [![License](https://img.shields.io/badge/License-EUPL--1.2_·_CC--BY--SA--4.0-3b82f6?style=for-the-badge&labelColor=111a35)](https://github.com/golusoris/.github/blob/main/profile/README.md#upstream-and-licence) [![GitHub Sponsors](https://img.shields.io/badge/Sponsor-GitHub-8b5cf6?style=for-the-badge&logo=githubsponsors&logoColor=white&labelColor=111a35)](https://github.com/sponsors/lusoris) [![Ko-fi](https://img.shields.io/badge/Support-Ko--fi-8b5cf6?style=for-the-badge&logo=kofi&logoColor=white&labelColor=111a35)](https://ko-fi.com/lusoris)