pixel

The repository's default GITHUB_TOKEN permission is read-only, and every workflow declares minimal permissions at the top level, granting write access only to the job that needs it.

Each release has a unique Semantic Versioning number, tagged vX.Y.Z (tags are immutable by repository ruleset) and printed by pixel --version.

Each release's notes are its CHANGELOG.md section (Keep a Changelog), grouped as Added/Changed/Fixed/Security.

URL: https://github.com/Pixel-CLI/pixel/blob/main/CHANGELOG.md

Dependencies are resolved by Cargo from Cargo.toml and a committed Cargo.lock, release builds use --locked, and Dependabot proposes updates.

Every release archive, Linux bottle and install.sh carries a signed SLSA build-provenance attestation, and each archive ships with its SHA-256 checksum; verification steps are in SECURITY.md.

URL: https://github.com/Pixel-CLI/pixel/blob/main/SECURITY.md#verifying-a-release

CONTRIBUTING.md documents the dependency policy: Cargo with a committed lockfile, cargo-deny (deny.toml) on every pull request for advisories, licenses and sources, and Dependabot for updates.

URL: https://github.com/Pixel-CLI/pixel/blob/main/CONTRIBUTING.md#gates-run-before-every-pr

CONTRIBUTING.md lists the prerequisites (Rust toolchain, system packages) and the build commands, including feature flags.

URL: https://github.com/Pixel-CLI/pixel/blob/main/CONTRIBUTING.md#build

GOVERNANCE.md lists the maintainers and, for each sensitive resource (organization and repository settings, repository secrets, release tags and signing, the Homebrew tap, private vulnerability reports), who holds it.

URL: https://github.com/Pixel-CLI/pixel/blob/main/GOVERNANCE.md

GOVERNANCE.md describes the maintainers' roles and responsibilities (review and merge, release, security, dependencies and CI, project board) and what contributor write access covers.

URL: https://github.com/Pixel-CLI/pixel/blob/main/GOVERNANCE.md

CONTRIBUTING.md has a "Definition of done" checklist for pull requests: tests, Clippy with warnings denied, formatting, cargo-deny, mutation testing, changelog fragment, documentation and Conventional Commits.

URL: https://github.com/Pixel-CLI/pixel/blob/main/CONTRIBUTING.md#definition-of-done

The main branch ruleset requires the Record the green verdict and Dependency policy (cargo-deny) status checks to pass before a pull request merges; maintainers can only bypass explicitly, through GitHub's bypass option.

Every pull request runs the full test suite (cargo nextest), Clippy, MSRV, cargo-deny and mutation testing in GitHub Actions, and the main branch only accepts changes through pull requests.

ARCHITECTURE.md describes every crate, the daemon and its wire contract, the request path from the CLI, on-disk state, and what pixel install writes for each agent.

URL: https://github.com/Pixel-CLI/pixel/blob/main/ARCHITECTURE.md

The command surface (every subcommand, kept in sync with pixel --help by a test), the JSON envelope and the daemon socket contract are documented in ARCHITECTURE.md and at https://pixel-cli.dev/docs

SECURITY.md records the security assessment: trust boundaries (daemon socket permissions, planted history database, sidecar files, command and path injection, network access) and known limitations, alongside CodeQL and OpenSSF Scorecard in CI.

URL: https://github.com/Pixel-CLI/pixel/blob/main/SECURITY.md#security-model

SECURITY.md sets the coordinated disclosure process: private report through a GitHub security advisory, never a public issue, with a first response within 48 hours.

Private vulnerability reporting is enabled on the repository; SECURITY.md links it: https://github.com/Pixel-CLI/pixel/security/advisories/new

Fixed vulnerabilities are published as GitHub security advisories and in the Security section of each release's notes in CHANGELOG.md.