Stackyard

The repository's default workflow permissions are set to read only, so a job that declares nothing gets a read-only token. Verified on the repository Actions settings.

Semantic versions with a matching vX.Y.Z tag, most recently v1.9.2: https://github.com/SandObserver/Stackyard/releases

Every release page is published from the matching CHANGELOG.md section, which is Keep a Changelog format and checked in CI for structure, date and compare link: https://github.com/SandObserver/Stackyard/blob/main/CHANGELOG.md

npm ci against a committed package-lock.json for the development tooling, apk for the two Alpine packages, and a base image pinned by sha256 digest: https://github.com/SandObserver/Stackyard/blob/main/Dockerfile

Each release image is signed with cosign keyless signing bound to the building workflow and logged in Sigstore, and an SBOM is attested to the same digest: https://github.com/SandObserver/Stackyard/blob/main/.github/workflows/release.yml

CONTRIBUTING.md states the selection policy: the API ships zero runtime npm packages and the frontend has no framework and no build step, so a change that needs a dependency is discussed in an issue first. Tracking is automated in dependabot.yml, which takes minor and patch updates weekly for the dev tooling, the pinned base image and the pinned GitHub Actions, and leaves major bumps manual. https://github.com/SandObserver/Stackyard/blob/main/CONTRIBUTING.md

https://stackyard.sandobserver.com/docs/installation/build-from-source/ for building the image, and CONTRIBUTING.md for the local toolchain and the full check sequence: https://github.com/SandObserver/Stackyard/blob/main/CONTRIBUTING.md

GOVERNANCE.md names the maintainer and lists exactly what that account holds: repository administration, the Actions secrets, the release GitHub App, the ghcr.io and Docker Hub accounts, and the documentation site deployment. No other account holds any of them. https://github.com/SandObserver/Stackyard/blob/main/GOVERNANCE.md

GOVERNANCE.md defines the maintainer role, which covers review, merge, release and vulnerability response, and the contributor role, which carries no repository permissions. https://github.com/SandObserver/Stackyard/blob/main/GOVERNANCE.md

CONTRIBUTING.md lists the constraints a change must keep, the exact check sequence CI runs, the coverage floor, the comment and documentation standard, and the requirement that a CodeQL finding is resolved before merge: https://github.com/SandObserver/Stackyard/blob/main/CONTRIBUTING.md

Contributions arrive as GitHub pull requests, and GitHub's Terms of Service require a contributor to license their submission under the repository's Apache-2.0 terms. The criterion's own guidance accepts platform terms of service for this control. No separate DCO status check is configured.

The ruleset on main requires the test, analyze and e2e checks to pass before a pull request can merge. All three are required, none is advisory.

Every pull request runs the API unit suite under a coverage gate, the frontend unit suite, lint, format, two typecheck passes, a docker build, and the Playwright end-to-end suite: https://github.com/SandObserver/Stackyard/blob/main/.github/actions/checks/action.yml

docs/architecture.md describes the two processes, the request routing between nginx and the API, the dispatch path with its auth and origin checks, and the route surface. The browser side is in docs/frontend.md and the widget contract in docs/widgets.md: https://github.com/SandObserver/Stackyard/blob/main/docs/architecture.md

Settings and configuration surface: https://stackyard.sandobserver.com/docs/settings-reference/ ; badge and widget request interface: https://stackyard.sandobserver.com/docs/badges/ ; environment variables: https://stackyard.sandobserver.com/docs/advanced-configuration/ ; API error responses: https://github.com/SandObserver/Stackyard/blob/main/docs/api-errors.md

docs/security.md is the written assessment: it states the deployment assumption and trust boundary, names what the outbound-request guard does and does not protect against, and works through network exposure, third-party requests, cookie handling, SSRF, authentication, secret storage and container privileges: https://github.com/SandObserver/Stackyard/blob/main/docs/security.md

SECURITY.md gives the private reporting route, what to include, the supported versions, and an initial response within a few days: https://github.com/SandObserver/Stackyard/blob/main/SECURITY.md

GitHub private vulnerability reporting is enabled: https://github.com/SandObserver/Stackyard/security/advisories/new . SECURITY.md points reporters there and tells them not to open a public issue.

No vulnerability has been discovered in Stackyard to date, so no vulnerability data has been published. The channel is in place and named in SECURITY.md: GitHub Security Advisories at https://github.com/SandObserver/Stackyard/security/advisories , with the fix recorded under a Security heading in the affected release's CHANGELOG.md section.