commitment-issues

Each release intended for users has a unique semantic version identifier in package.json, such as 3.0.1. The release workflow is triggered by version tags matching v* and verifies that the Git tag matches the package.json version before publishing. This ensures user-facing releases are uniquely identified.

https://github.com/RoryGlenn/commitment-issues/blob/main/package.json [version_unique]

Non-trivial release notes file in repository: https://github.com/RoryGlenn/commitment-issues/blob/main/CHANGELOG.md. [release_notes]

The project lists external dependencies in computer-processable npm metadata. package.json declares runtime dependencies, development dependencies, peer dependencies, and the supported Node engine, while package-lock.json records resolved dependency versions, integrity hashes, licenses, and transitive dependency metadata. Evidence is here: https://github.com/RoryGlenn/commitment-issues/blob/main/package.json and https://github.com/RoryGlenn/commitment-issues/blob/main/package-lock.json. [external_dependencies]

Already publishing with npm publish --provenance, npm generates a Sigstore attestation for the published package. If GitHub Release assets are also published, they should either be signed or accompanied by a signed manifest containing their hashes.

The project provides a quick, common development setup using git and npm. Potential developers can fork and clone the repository, run npm install, then verify the development/test environment with npm test, npm run lint, and npm run format:check. The contributing guide also documents how to run the full test suite and individual test files. Evidence is here: https://github.com/RoryGlenn/commitment-issues/blob/main/.github/CONTRIBUTING.md#getting-started. [installation_development_quick]

The project maintains documentation identifying the individuals with access to sensitive project resources, including repository administration, release publishing, package publishing, security settings, and signing credentials. This documentation is kept up to date while the project is active.

The project documentation defines the roles and responsibilities for each project member. This includes responsibilities for project governance, reviewing contributions, approving and publishing releases, responding to security reports, maintaining project documentation, managing CI/CD and repository settings, and maintaining dependencies. The documentation is kept current as project membership changes.

The contributing guide documents requirements for acceptable contributions. Pull requests should include tests for behavior changes and regression tests for bug fixes, stay focused to one logical change, pass npm test, npm run lint, and npm run format:check, update the changelog and documentation for user-visible changes, and follow the project's advisory-first design philosophy. The guide also documents the coding style: Prettier for formatting, ESLint flat config for linting, small composable functions, clear names, and comments only where intent is non-obvious.

https://github.com/RoryGlenn/commitment-issues/blob/main/.github/CONTRIBUTING.md#contribution-requirements [contribution_requirements]

The project applies an automated test suite on each check-in to the shared repository through GitHub Actions. The CI workflow runs on pushes to main and pull requests, and it reports success or failure for linting, formatting, automated tests, package lifecycle smoke tests, coverage, and package-manager smoke tests. Evidence is here: https://github.com/RoryGlenn/commitment-issues/blob/main/.github/workflows/ci.yml. [automated_integration_testing]

The project applies an automated test suite on each check-in to the shared repository through GitHub Actions. The CI workflow runs on pushes to main and pull requests, and it reports success or failure for linting, formatting, automated tests, package lifecycle smoke tests, coverage, and package-manager smoke tests. Evidence is here: https://github.com/RoryGlenn/commitment-issues/blob/main/.github/workflows/ci.yml. [automated_integration_testing]

The project documents its high-level architecture and public interface through the contributing guide and external interface reference. The contributing guide describes the project layout, including entry-point scripts, shared helper modules, tests, docs, and CI workflows. The external interface reference documents CLI commands, init-added scripts, Git hook entrypoints, configuration keys/defaults, output behavior, and exit behavior. Evidence is here: https://github.com/RoryGlenn/commitment-issues/blob/main/.github/CONTRIBUTING.md#project-layout and https://github.com/RoryGlenn/commitment-issues/blob/main/docs/external-interface.md [documentation_architecture]

[documentation_interface]

The project performed a documented security review on 2026-07-08. The review considered the security boundary: commitment-issues runs locally in user repositories, shells out to local tools such as ESLint, Prettier, and the configured test runner, reads local Git state/files, does not expose a network service, and does not transmit repository content. The review covered CLI entrypoints, shared helpers, Git hook wiring, pre-commit/pre-push execution paths, and release/CI workflows. [security_review]

The project publishes its vulnerability reporting process in SECURITY.md: https://github.com/RoryGlenn/commitment-issues/blob/main/.github/SECURITY.md. The policy tells users how to report vulnerabilities privately through GitHub Security Advisories, asks reporters not to open public issues for suspected vulnerabilities, and explains what details to include in a report. [vulnerability_report_process]

The project supports private vulnerability reports and documents how to send them privately in SECURITY.md: https://github.com/RoryGlenn/commitment-issues/blob/main/.github/SECURITY.md. The policy instructs reporters to use GitHub's private vulnerability reporting / Security Advisories flow and explicitly says not to open a public issue for suspected vulnerabilities. [vulnerability_report_private]