treestamp

The repository's default workflow token permission is read-only, and every workflow sets read-only top-level permissions. Jobs that need more access request it explicitly.

Release Please assigns each release a unique Semantic Versioning version and tag: https://github.com/reponomics/treestamp/releases.

Release Please generates each GitHub Release's notes and the matching CHANGELOG.md section from Conventional Commit messages, grouped by type under Markdown headings. New features are listed under Features, and bug fixes, including security fixes, under Bug Fixes: https://github.com/reponomics/treestamp/blob/main/CHANGELOG.md.

CI, release builds, and the container image install dependencies with uv from the committed uv.lock.

The wheel and source distribution are published to PyPI through Trusted Publishing, with a PEP 740 Sigstore attestation for each file that records the file's SHA-256 digest. GitHub Releases have no uploaded assets.

CONTRIBUTING describes how dependencies are selected, obtained from PyPI through uv and the committed uv.lock, and tracked with Dependabot and OSV-Scanner: https://github.com/reponomics/treestamp/blob/main/.github/CONTRIBUTING.md#dependencies.

CONTRIBUTING lists the required Python, uv, and Node versions and the Makefile targets that install locked dependencies, run checks, and build the distributions: https://github.com/reponomics/treestamp/blob/main/.github/CONTRIBUTING.md.

GOVERNANCE.md lists the project members with access to sensitive resources: https://github.com/reponomics/treestamp/blob/main/docs/GOVERNANCE.md#members-and-access.

GOVERNANCE.md describes the responsibilities of the maintainer, reviewers, and contributors: https://github.com/reponomics/treestamp/blob/main/docs/GOVERNANCE.md#roles-and-responsibilities.

CONTRIBUTING sets the requirements for acceptable changes: run the complete lint, formatting, type-check, and test targets before review, include release notes when a change requires users to modify their documents or workflows, and keep Markdown prose unwrapped: https://github.com/reponomics/treestamp/blob/main/.github/CONTRIBUTING.md.

Contributions are made through GitHub pull requests, under GitHub's Terms of Service (section D.6): content added to a repository with a license notice is licensed under that license, and the contributor agrees they have the right to license it: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service#6-contributions-under-repository-license.

The default-branch ruleset requires the four regression-suite checks and the PR title check to pass on an up-to-date branch before merging. It has no bypass actors.

Required CI checks run the pytest suite on Linux and Windows for every pull request, and results are shown on the PR. Contributors can run the same suite locally with make ci.

The design document describes the actors in the system and the actions of the command-line tool, terminal editor, hosted editor, and build and release pipeline: https://github.com/reponomics/treestamp/blob/main/docs/design.md.

The design document describes the command-line interface and exit codes, the terminal editor, the document format, the pre-commit hooks, and the hosted editor's HTTP endpoints, including their inputs and outputs: https://github.com/reponomics/treestamp/blob/main/docs/design.md#external-interfaces.

The security assessment identifies the most likely and impactful threats to the hosted editor, the command-line tool and terminal editor, and the supply chain and release process, with their mitigations and remaining risks: https://github.com/reponomics/treestamp/blob/main/docs/security-assessment.md.

SECURITY.md sets out the coordinated disclosure policy: reports are acknowledged within 14 days, and the project aims to release a fix and publish the vulnerability within 90 days, coordinating the date with the reporter: https://github.com/reponomics/treestamp/blob/main/.github/SECURITY.md#coordinated-disclosure.

SECURITY.md directs vulnerability reports to GitHub private vulnerability reporting, which goes directly to the project maintainers: https://github.com/reponomics/treestamp/security/policy.

SECURITY.md commits to publishing confirmed vulnerabilities as GitHub security advisories with the affected and fixed versions, how to tell whether a system is affected, and how to remediate it: https://github.com/reponomics/treestamp/blob/main/.github/SECURITY.md#coordinated-disclosure. No vulnerabilities have been reported so far; advisories will appear at https://github.com/reponomics/treestamp/security/advisories.