bestax

The project provides a documented upgrade path rather than maintaining old lines. Supported versions are stated explicitly in https://github.com/allxsmith/bestax/blob/main/SECURITY.md (latest release line per package), semantic versioning driven by Conventional Commits means a major bump is the signal that an upgrade needs attention, and every breaking change is recorded with its BREAKING CHANGE note in the per-package CHANGELOG and GitHub Release. Migration guides live at https://bestax.io/docs/guides/getting-started/migration, and the project additionally ships a codemod, bestax-migrate, that performs the mechanical parts of an upgrade automatically.

The project uses the GitHub issue tracker for individual issues, with labels, templates and automated triage: https://github.com/allxsmith/bestax/issues

No vulnerabilities have been reported or resolved in this project in the last 12 months, so there is no reporter to credit. The published policy commits to crediting reporters in the release notes or advisory unless they request anonymity: https://github.com/allxsmith/bestax/blob/main/SECURITY.md

The response process is documented at https://github.com/allxsmith/bestax/blob/main/SECURITY.md - reports arrive by email to security@bestax.io or as a GitHub private security advisory; acknowledgement within 48 hours; triage and confirmation within 7 days; if accepted, a fix and a coordinated disclosure timeline agreed with the reporter; if declined, an explanation of why; credit to the reporter unless anonymity is requested; and publication of a GitHub Security Advisory once resolved. Because all packages release automatically from main, the fix ships as soon as it merges.

The style guides are identified and required. Formatting is Prettier (the project's Prettier configuration is the style guide of record, and it is pinned so formatting stays deterministic); lint rules are the ESLint flat config at https://github.com/allxsmith/bestax/blob/main/eslint.config.js, composed of eslint:recommended, typescript-eslint, eslint-react, react-hooks, storybook and prettier; commit messages follow Conventional Commits per https://github.com/allxsmith/bestax/blob/main/commitlint.config.js. Compliance is required of contributions by https://github.com/allxsmith/bestax/blob/main/CONTRIBUTING.md#code-quality-standards

Enforcement is automatic, not advisory: pnpm lint (ESLint) and pnpm format:check (Prettier) run in CI on every push and pull request and must pass before merge, commitlint runs on the husky commit-msg hook and again on pull request titles, and pnpm check:conformance enforces the additional house conventions. All of these are FLOSS tools.

The project produces no native binaries - all output is JavaScript, TypeScript declarations and CSS - so there are no CC, CFLAGS, CXX, CXXFLAGS or LDFLAGS variables for the build to honor.

There is no native compilation and so no debug-symbol option to preserve. The published JavaScript is not stripped of anything a debugger needs, and consumers debug against readable, typed output plus the TypeScript declarations shipped in each package.

The build is not a recursive make. It is a single Turborepo task graph over the workspace (pnpm build), which resolves all inter-package dependencies in one pass from the root.

Builds are deterministic and repeatable. Dependencies resolve from a committed pnpm lockfile installed with --frozen-lockfile against a pinned pnpm version and a pinned Node major, and the compilers (tsc, Vite/Rollup, Sass) emit output determined only by their inputs and configuration - the generation checks in CI depend on exactly this property: pnpm gen:api-docs:check, gen:catalog:check and gen:mcp:check regenerate artifacts and fail the build on any byte-level difference from what is committed.

Installation and removal use the ordinary JavaScript convention: npm install @allxsmith/bestax-bulma (or pnpm/yarn add) to install, npm uninstall to remove, and npm create bestax@latest my-app to scaffold. Nothing is written outside the consuming project's node_modules, and no install scripts run. Documented in the README quick start and at https://bestax.io/docs/guides/getting-started/installation

There is no separate installation system to parameterize - the npm client places packages according to its own standard conventions inside the consuming project, and the project neither writes files elsewhere nor defines an install path, so DESTDIR and similar variables do not apply.

A developer gets the whole workspace running with git clone, pnpm install and pnpm build - all four packages, the docs site and Storybook. The steps, plus how to run the docs site (pnpm docs), Storybook (pnpm storybook), the full CI suite locally (pnpm all) and a throwaway scaffolded app, are documented at https://github.com/allxsmith/bestax/blob/main/CONTRIBUTING.md#setting-up--running-the-project

External dependencies are listed in computer-processable form in the per-package package.json files and resolved exactly by the committed lockfile: https://github.com/allxsmith/bestax/blob/main/pnpm-lock.yaml and https://github.com/allxsmith/bestax/blob/main/bulma-ui/package.json. The library ships a single runtime dependency (Bulma v1); icon libraries are optional peer dependencies. A machine-readable SBOM is additionally generated for every release by https://github.com/allxsmith/bestax/blob/main/.github/workflows/supply-chain.yml

Dependencies are monitored continuously and from several directions: Dependabot opens weekly grouped update pull requests, the dependency-review workflow blocks any pull request that introduces a dependency with a known advisory, the Socket.dev GitHub App reviews every dependency change for malware and install scripts, pnpm audit runs at high severity, and a 3-day minimumReleaseAge cooldown keeps just-published releases out. The only two accepted advisory bypasses are transitive Docusaurus build-time packages with no patched version available - both verified as not reachable from published code, and both carrying a dated review marker that fails CI when it expires. See https://github.com/allxsmith/bestax/blob/main/SECURITY.md

All reused components are ordinary npm dependencies declared in package.json and pinned by the lockfile - there are no vendored or convenience copies anywhere in the tree - so updating one is a version bump plus pnpm install, which is what Dependabot automates weekly. The published library reuses exactly one runtime component, Bulma v1, on a caret range so consumers pick up its patches.

The stack is current and free of deprecated APIs: React function components with hooks only (no legacy class lifecycle, no legacy context, no findDOMNode), React 19 with a CI matrix that also proves React 18 compatibility, ESLint flat config, ES modules throughout, Bulma v1, and TypeScript 6. eslint-react and react-hooks rules flag deprecated React usage, and the typecheck catches removed APIs on every dependency upgrade.

The full automated suite runs on every push and pull request to main and reports pass or fail as a required GitHub status check: build, typecheck, unit tests, coverage, bundle stats, lint, format check and conformance checks, plus a React 18/19 compatibility matrix and Playwright end-to-end scaffolding runs. See https://github.com/allxsmith/bestax/blob/main/.github/workflows/ci.yml and the checks on any pull request at https://github.com/allxsmith/bestax/pulls

Well over half of the bugs fixed in the last six months came with a regression test in the same pull request; the 99% coverage gate on bulma-ui makes it very difficult to merge a fix without one, and CONTRIBUTING.md requires unit tests for bug fixes as well as features. See merged fix commits at https://github.com/allxsmith/bestax/pulls?q=is%3Apr+is%3Amerged+fix

Statement coverage is enforced above 80% by jest, a FLOSS tool, and the build fails below it: 99% statements (and branches, functions, lines) for bulma-ui per https://github.com/allxsmith/bestax/blob/main/bulma-ui/jest.config.js, and 95% for every other jest package. pnpm test:coverage runs on every push and pull request in CI.

The written policy is in the contribution requirements: all tests must pass and per-package coverage thresholds must be met for a pull request to be accepted, and unit tests are required for all new features and bug fixes - https://github.com/allxsmith/bestax/blob/main/CONTRIBUTING.md#code-quality-standards. Because coverage is a hard gate in CI rather than a request, adding functionality without tests fails the build.

The policy is documented in the contribution instructions - https://github.com/allxsmith/bestax/blob/main/CONTRIBUTING.md#development-workflow step 5 (update/add unit tests, coverage must stay above the threshold) - and repeated as a checklist item in the pull request template: https://github.com/allxsmith/bestax/blob/main/.github/pull_request_template.md

TypeScript strict mode is on repository-wide with noUnusedLocals, ESLint runs recommended plus React, react-hooks, Storybook and Prettier rule sets, and additional house rules are enforced by pnpm check:conformance (documentation and story coverage, SCSS patterns, an inline-style ratchet, and expiry dates on every supply-chain bypass).

The secure design principles named in know_secure_design are implemented where they apply. Least privilege: every workflow defaults to contents: read, the release job re-declares only the scopes it needs, and the release App token is scoped to three permissions on one repository and expires within the hour. No long-lived secrets: npm publishing uses OIDC trusted publishing, so there is no NPM_TOKEN to steal. Fail closed: the inbound security triage flags rather than passes when it errors, and it holds no write-capable credentials so an injected scan cannot write to the repository. Limited attack surface in the produced software: the library performs no network access, no persistence and no dynamic code evaluation, renders through React's escaping rather than raw HTML, and ships a single runtime dependency. Defence in depth around changes: protected main, required human review, layered automated review, dependency review, Socket.dev, and CodeQL. See https://github.com/allxsmith/bestax/blob/main/SECURITY.md