go-derive

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

The master branch contains the active development history, not only release tags.

Development workflow:

• all changes land through pull requests
• pull requests are squash-merged
• merge commits follow Conventional Commits formatting

Repository activity:

• 29 merged pull requests visible in GitHub history
• releases are preceded by multiple development PRs and commits

Example:

• release v0.2.5 was preceded by PRs:
  • #23
  • #25
  • #26
• each merged independently onto master

Review traceability:

• PR descriptions preserved
• review discussions preserved
• file diffs preserved
• CI execution history preserved

Repository on GitHub, which uses git. git is distributed.

Each release uses a unique Semantic Version identifier.

Versioning workflow:

• release-please calculates versions from Conventional Commits
• versions are synchronized across:
  • git tags (e.g. v0.2.7)
  • the Version constant in derive.go
  • .github/.release-please-manifest.json

Release integrity:

• repository ruleset release-tag-protection (id 15981700) prevents:
  • tag reuse
  • tag rewriting

Release history is published through the GitHub Releases page.

Each release is identified by a git tag using the format:

• vX.Y.Z
• example: v0.2.7

Tag management:

• tags are created automatically by release-please
• tags are generated when the auto-generated release PR is merged

Tag protection:

• repository ruleset release-tag-protection (id 15981700) prevents:
  • tag reuse
  • tag deletion
  • tag rewriting

The complete release tag history is available through the GitHub Tags page.

Non-trivial release notes file in repository: https://github.com/amiwrpremium/go-derive/blob/master/CHANGELOG.md.

No publicly known runtime vulnerabilities have been disclosed for go-derive.

Current security status across releases v0.1.0 → v0.2.7:

• no assigned CVEs
• no GitHub Security Advisories
• no reported runtime vulnerabilities

Security scanning performed in CI includes:

• govulncheck
• osv-scanner
• Trivy
• gosec
• Semgrep
• CodeQL

Release notes:

• CHANGELOG.md is generated automatically by release-please
• changelog entries are derived from Conventional Commits
• any future security fixes would appear under "Bug Fixes" and include the relevant CVE reference when applicable

Non-trivial SECURITY[.md] file found file in repository: https://github.com/amiwrpremium/go-derive/blob/master/SECURITY.md. [osps_do_02_01]

GitHub Issues at https://github.com/amiwrpremium/go-derive/issues, with structured templates in .github/ISSUE_TEMPLATE/ (bug_report, feature_request, config).

The project is 2 days old.
First release: v0.1.0 on 2026-05-05.

Issue tracker status:

• 2 total issues
• both are bot-generated

Issues:

• #5 Renovate config notice
  • closed by PR #1
• #7 Renovate Dependency Dashboard
  • intentionally kept open

No user-submitted bug reports have been filed so far.

The maintainer is the sole responder and handles issue triage through GitHub notifications.

No user-submitted enhancement requests have been filed.

Project status:

• first release: v0.1.0 on 2026-05-05
• only 2 issues exist
• both are Renovate-generated meta-issues

Issues:

• #5 closed
• #7 Renovate Dependency Dashboard kept open by design

The "majority responded" requirement is satisfied vacuously.

All issues (open + closed, including full comment threads) are archived and searchable at:
https://github.com/amiwrpremium/go-derive/issues?q=is%3Aissue

GitHub provides:

• full-text search across titles, bodies, and comments
• filtering by:
  • author
  • label
  • state
  • date

SECURITY.md:
https://github.com/amiwrpremium/go-derive/blob/master/SECURITY.md

Security reporting policy:

• reporters must not open public GitHub issues
• vulnerabilities must be submitted through GitHub Private Vulnerability Reporting:
  https://github.com/amiwrpremium/go-derive/security/advisories/new

The policy documents:

• required report fields
• optional report fields
• response SLAs by severity

Response targets:

• Critical/High:
  • acknowledgment within 72 hours
  • triage within 7 days
• Medium/Low:
  • acknowledgment within 5 business days
  • triage on a best-effort basis

SECURITY.md §Reporting a vulnerability:
https://github.com/amiwrpremium/go-derive/blob/master/SECURITY.md#reporting-a-vulnerability

Private Vulnerability Reporting:
https://github.com/amiwrpremium/go-derive/security/advisories/new

Policy:

• reporters must not open public issues
• vulnerabilities must be submitted through GitHub Private Vulnerability Reporting

Privacy guarantees:

• reports are visible only to repository maintainers and the reporter
• reports are not indexed in:
  • public issues
  • repository timeline
  • GitHub search

No vulnerability reports have been received.

Project status:

• first release: v0.1.0 on 2026-05-05
• GitHub Security Advisories currently empty

The 14-day initial-response requirement is satisfied vacuously.

SECURITY.md response targets:

• Critical/High:
  • acknowledgment within 72 hours
• Medium/Low:
  • acknowledgment within 5 business days

Both response targets are below the 14-day requirement.

Non-trivial build file in repository: https://github.com/amiwrpremium/go-derive/blob/master/Makefile.

Non-trivial build file in repository: https://github.com/amiwrpremium/go-derive/blob/master/Makefile.

Build command:
go build ./...

Required tooling:

• Go toolchain
• BSD-3-Clause
• FLOSS

Dependency licensing:

• dependencies in go.mod are open-source Go modules
• verified by go-licenses workflow:
  https://github.com/amiwrpremium/go-derive/blob/master/.github/workflows/license-check.yml
• checked against an MIT/BSD/Apache/MPL/LGPL allow-list

No proprietary build tools, IDEs, compilers, SDKs, or licensing servers are required.

CI linters are also FLOSS:

• gofmt
• goimports
• go vet
• golangci-lint
• govulncheck
• staticcheck

Testing framework:

• Go standard testing package
• BSD-3-Clause
• included with the Go toolchain

Test command:
go test -race -count=1 ./...

Documented in:

• CONTRIBUTING.md:
  https://github.com/amiwrpremium/go-derive/blob/master/CONTRIBUTING.md#local-checks-before-pushing
• Makefile:
  • make test
  • make test-race
• CI workflow:
  .github/workflows/ci.yml

CI execution:

• runs on every push and pull request
• test matrix:
  • ubuntu-latest
  • macos-latest
  • windows-latest
• Go versions:
  • 1.25
  • 1.26

Integration tests:

• located under test/
• protected behind an integration build tag
• dispatched manually through:
  .github/workflows/integration.yml

Tests are executed with:

• go test ./...
• go test -race -count=1 ./...

The project uses:

• standard _test.go test files
• Go's built-in testing package

No custom test runner or test harness is required.

Coverage:

• 90.2% statement coverage
• measured with:
  go test -race -coverprofile -coverpkg=...

Test suite size:

• 110 _test.go files
• 7,369 LOC of tests
• 8,378 LOC of source

Coverage reporting:

• Codecov:
  https://codecov.io/gh/amiwrpremium/go-derive
• Codacy:
  https://app.codacy.com/gh/amiwrpremium/go-derive/dashboard

Coverage regressions are flagged on pull requests.

Continuous integration uses GitHub Actions.

CI workflow:

• .github/workflows/ci.yml
• runs on every push and pull request

CI tasks:

• gofmt
• go vet
• go test -race -coverprofile
• govulncheck
• go build

Test matrix:

• ubuntu
• macos
• windows
• Go 1.25
• Go 1.26

Branch protection:

• merging to master requires 14 status checks
• enforced by:
  master-branch-protection ruleset (15981309)

Workflow coverage:

• tests
• linting
• security scanning
• supply-chain verification
• release verification

Security tooling:

• CodeQL
• gosec
• Semgrep
• Trivy
• Codacy
• osv-scanner
• gitleaks
• TruffleHog

Additional checks:

• pin-check
• license-check
• govulncheck

CONTRIBUTING.md §Coverage:
https://github.com/amiwrpremium/go-derive/blob/master/CONTRIBUTING.md#coverage

Policy:
"Patches that meaningfully drop coverage will get flagged on the PR."

Enforcement:

• Codecov posts diff-coverage comments
• Codacy runs:
  • Codacy Coverage Variation
  • Codacy Diff Coverage

Checks run on every pull request and mechanically surface new functionality lacking tests.

Evidence:

• 90.2% coverage existed at v0.1.0 and remained stable across 7 releases
• tests were committed alongside source from the beginning

Examples:

• PR #10 removed Trade.Realized and its dedicated test in the same commit
• PR #17 refactored internal/retry/backoff.go to use crypto/rand
  • existing backoff_test.go validated the new implementation without modification

PR enforcement:

• every PR includes:
  • Codecov delta checks
  • Codacy Diff Coverage checks
• untested new code is flagged automatically

Test expectations are documented in CONTRIBUTING.md through the coverage policy and CI enforcement rules, but there is no explicit standalone "tests must accompany changes" instruction in the change-proposal workflow.

Adding an explicit requirement for contributors to include or update tests alongside behavioral changes is therefore suggested.

The repository uses multiple FLOSS Go linters and analysis tools:

• golangci-lint
• staticcheck
• gosec
• go vet
• gofmt
• goimports

Workflows:

• .github/workflows/lint.yml
• .github/workflows/gosec.yml
• .github/workflows/ci.yml

Git hooks:

• Lefthook runs:
  • gofmt
  • goimports
  • go vet
  • golangci-lint run --new-from-rev=HEAD
• documented in CONTRIBUTING.md §Git hooks

Policy:

• lint warnings fail CI
• required status checks block merges on lint failures

Linter warnings are treated as build failures.

Enforced tooling:

• golangci-lint
• staticcheck
• gosec
• go vet
• gofmt

Policy:

• any finding exits non-zero
• all are required status checks on the master ruleset
• PRs cannot merge with open lint warnings

Example:

• PR #17 triggered gosec G404 on math/rand/v2
• the code was rewritten to use crypto/rand
• the warning was fixed, not suppressed

Code-scanning alerts from:

• gosec
• Semgrep
• CodeQL
• Trivy

are actively triaged and documented in:
docs/known-tool-issues.md

All linters run in strict/default mode with no rule exclusions.

Configuration:

• golangci-lint uses upstream defaults
• staticcheck uses upstream defaults
• gosec scans the full repository and uploads SARIF
• gofmt and goimports fail on unformatted files
• go vet runs without exclusions

Suppression policy:

• zero in-source:
  • nolint
  • nosec
  • noqa
    suppressions

Project policy:

• issues are fixed at source instead of suppressed
• unavoidable tool false positives remain visible and are documented in:
  docs/known-tool-issues.md

Documented examples:

• Codacy deadcode-on-generics parser bug
• remark-lint resolver false positives

Self-attested security evidence in the repository includes:

• correct EIP-712 typed-data signing in pkg/auth
• separate EIP-191 and EIP-712 signing flows
• session-key delegation to avoid keeping owner keys in process memory

Security improvements:

• cryptographic randomness via crypto/rand
  • PR #17
• explicit validation on every workflow_dispatch input
  • PR #18

Supply-chain hardening:

• CycloneDX + SPDX SBOMs
• cosign keyless signatures
• SLSA Level 3 provenance
• SHA-pinned GitHub Actions enforced by:
  .github/workflows/pin-check.yml

CI hardening:

• step-security/harden-runner on every CI job

Security process:

• private vulnerability reporting documented in SECURITY.md
• severity-based response SLAs

Defence-in-depth:

• 9 SAST/secret/dependency scanners
• daily OpenSSF Scorecard scans

Self-attested security mitigations in the repository include:

• weak randomness mitigation:

  • crypto/rand

• integer narrowing protection:

  • explicit & 0xFFFF mask in pkg/auth/nonce.go

• auth-bypass prevention:

  • separate EIP-191 and EIP-712 signing flows
  • session-key delegation keeps owner keys off-host

• input injection protection:

  • regex validation for workflow_dispatch.inputs
  • implemented in PR #18

• race-condition detection:

  • go test -race on every CI build

• secret-leak detection:

  • gitleaks
  • TruffleHog
  • GitGuardian

• dependency vulnerability scanning:

  • govulncheck
  • osv-scanner
  • Trivy
  • Renovate

• supply-chain hardening:

  • SHA-pinned GitHub Actions
  • cosign-signed SBOMs
  • SLSA Level 3 provenance

• static analysis and bug detection:

  • CodeQL
  • gosec
  • Semgrep
  • Codacy
  • golangci-lint
  • staticcheck