PermLang

Small tasks for new contributors carry the good first issue label, with what to do and how to test it: https://github.com/PermLang/PermLang/labels/good%20first%20issue (for example, adding adapters for Resend and SendGrid, and declaring more packages pure).

The PermLang GitHub organization requires two-factor authentication for every member, so reading or changing the repository's sensitive resources (settings, branch protection, security advisories) needs it. The maintainers' other accounts use 2FA too: https://github.com/PermLang/PermLang/blob/main/MAINTAINERS.md [osps_ac_01_01]

The maintainer signs in to GitHub with a passkey, not SMS, and the PermLang organization requires two-factor authentication for every member. Publishing to npm uses trusted publishing (OIDC), so no person's npm credentials are involved in a release: https://github.com/PermLang/PermLang/blob/main/MAINTAINERS.md

CONTRIBUTING.md says how code review is done (a maintainer reviews every pull request on GitHub, and once there are two maintainers, one who isn't its author), what the reviewer checks (a test that fails without the change, any new access in the permission diff and the locks, security, especially for workflows, the Action, releases and dependencies, and the docs and changelog), and what it takes to merge: https://github.com/PermLang/PermLang/blob/main/CONTRIBUTING.md#code-review

Building the same source gives the same package, byte for byte: CI builds twice on every pull request and compares, and SECURITY.md says how to rebuild a release and compare it with npm's: https://github.com/PermLang/PermLang/blob/main/SECURITY.md#rebuilding-a-release

npm test runs the whole suite: https://github.com/PermLang/PermLang/blob/main/CONTRIBUTING.md#setting-up

CI runs every test on Node 20, 22, 24 and 26 on Linux, and Node 24 on Windows, for every pull request and push to main, and merging waits for it: https://github.com/PermLang/PermLang/blob/main/.github/workflows/ci.yml

98.9% of statements are covered (7,186 of 7,266, Vitest's V8 coverage of src on 2026-10-07; Codecov, which counts a partly covered line as missed, reports less): https://github.com/PermLang/PermLang/blob/main/docs/policies.md#tests

98.3% of branches are covered (6,937 of 7,059, Vitest's V8 coverage of src on 2026-10-07): https://github.com/PermLang/PermLang/blob/main/docs/policies.md#tests

The command line has no network code. The Action talks to GitHub through git, the GitHub CLI, and GitHub's own Actions, all over HTTPS: https://github.com/PermLang/PermLang/blob/main/docs/design.md#files-written-processes-and-network

PermLang's own code makes no TLS connections. The tools the Action calls (git and the GitHub CLI) connect only to GitHub, which accepts TLS 1.2 or later.

PermLang's threat model, written and reviewed in October 2026, covers its security requirements and boundaries; that review found five vulnerabilities, all fixed and published (https://github.com/PermLang/PermLang/blob/main/docs/threat-model.md#vulnerabilities-found-and-fixed). A full code review the same month found 79 problems, all fixed in 0.4.0: https://github.com/PermLang/PermLang/blob/main/CHANGELOG.md

TypeScript strict mode with noUncheckedIndexedAccess; objects with no prototype for data from repositories; iterative walks instead of recursion; git and tar run without a shell; Node run by its full path; Actions pinned by commit; text from code escaped wherever it's shown: https://github.com/PermLang/PermLang/blob/main/docs/threat-model.md#common-weaknesses-countered

fast-check property tests generate hundreds of inputs for each rule (fuzzing), and run in CI on every pull request and in the release workflow before every release, alongside end-to-end tests of the command line on real repositories: https://github.com/PermLang/PermLang/blob/main/docs/policies.md#tests

The code checks its inputs and its own state as it runs, and stops with an error (exit code 2) when something doesn't hold, so it never passes a check by mistake; the tests run with every one of these checks on.