Python Workspace

Public Git repository on GitHub at https://github.com/Jekwwer/python-workspace

Git tracks all changes, authorship, and timestamps. Verifiable via git log on the repository. https://github.com/Jekwwer/python-workspace/commits/main

Repository's main branch contains every commit between tagged releases — feature/fix/security/chore/deps commits are visible in history before being included in the next semantic-release tag. https://github.com/Jekwwer/python-workspace/commits/main

Repository uses Git, a distributed version control system, hosted on GitHub.

Each release has a unique SemVer tag (v1.0.0 through v3.2.0), generated by semantic-release from Conventional Commits. https://github.com/Jekwwer/python-workspace/releases

SemVer 2.0.0 — versions follow MAJOR.MINOR.PATCH (currently v3.2.0). Bumps are computed automatically by semantic-release from Conventional Commits (fix: → patch, feat: → minor, BREAKING CHANGE: → major). Config: .releaserc.cjs.

Every release is tagged in git (v1.0.0, v1.0.1, v2.0.0, ..., v3.2.0). Tags are created automatically by semantic-release on each successful CI release run. https://github.com/Jekwwer/python-workspace/tags

CHANGELOG.md provides per-release human-readable summaries grouped into categories (🚀 New Features, 🐛 Bug Fixes, 🛡️ Security, 📦 Dependencies, 🔧 Chores, 📚 Documentation, ⚠️ BREAKING CHANGES) with links to commits/PRs. Generated by semantic-release with conventional-changelog from Conventional Commits, then mirrored to each GitHub Release page. Not a raw git log. https://github.com/Jekwwer/python-workspace/blob/main/CHANGELOG.md https://github.com/Jekwwer/python-workspace/releases

The project itself (the template scaffolding my_package) has had no publicly-known CVE assignments. Per the criterion: applies only to project results, not dependencies. Dependency vulnerability fixes still appear in CHANGELOG.md under 🛡️ Security with GHSA references for transparency.

GitHub Issues is the bug-reporting process. README and CONTRIBUTING.md link to the tracker; structured intake via .github/ISSUE_TEMPLATE/bug.yml (plus feature.yml, documentation.yml, other.yml) and SECURITY.md routes vulnerability reports privately. https://github.com/Jekwwer/python-workspace/issues

GitHub Issues tracks every individual issue with unique number, status, labels, milestones, comment thread, and assignee. https://github.com/Jekwwer/python-workspace/issues

No bug reports filed in the last 12 months (gh issue list --state all returns 0 issues). Vacuously Met — no unacknowledged reports exist. Repository accepts issues; bug template is wired up for future reports. https://github.com/Jekwwer/python-workspace/issues

No enhancement requests filed in the last 12 months. Vacuously Met. Feature-request issue template (.github/ISSUE_TEMPLATE/feature.yml) is in place for future requests. https://github.com/Jekwwer/python-workspace/issues

GitHub Issues serves as the publicly searchable archive for both open and closed issues, with full search syntax (label, state, author, date, text) and stable per-issue URLs. https://github.com/Jekwwer/python-workspace/issues?q=is%3Aissue

SECURITY.md publishes two private reporting channels: (1) email to report@jekwwer.com, (2) GitHub Private Security Advisories at https://github.com/Jekwwer/python-workspace/security/advisories. Standard /security policy tab on the repo links to the same. https://github.com/Jekwwer/python-workspace/blob/main/SECURITY.md

SECURITY.md describes two private channels: (1) email to report@jekwwer.com (TLS-protected via mail provider), (2) GitHub Private Security Advisories (HTTPS, end-to-end private until publication). Both are documented in SECURITY.md with explicit "Private Disclosure" labels. https://github.com/Jekwwer/python-workspace/blob/main/SECURITY.md

No vulnerability reports received in the last 6 months. SECURITY.md commits to a 48-hour initial response and 7-day resolution target for future reports.

Poetry handles the build. poetry build (or via semantic-release prepareCmd in CI) produces both wheel and sdist deterministically. Build backend declared in pyproject.toml (requires = ["poetry-core>=2.0.0,<3.0.0"], build-backend = "poetry.core.masonry.api"). https://github.com/Jekwwer/python-workspace/blob/main/pyproject.toml

Build uses Poetry (PEP 517/518 build frontend, the standard Python ecosystem tool) plus GNU make for orchestration. Both are common, well-documented, cross-distro tools. https://github.com/Jekwwer/python-workspace/blob/main/Makefile https://github.com/Jekwwer/python-workspace/blob/main/pyproject.toml

All build tools are FLOSS: Python (PSF), Poetry (MIT), poetry-core (MIT), GNU make (GPL). No proprietary dependencies in the build chain.

pytest (MIT-licensed FLOSS) drives the test suite under tests/, with pytest-cov, pytest-xdist, and hypothesis. Run via make test (locally and in CI). Documented in README.md (Usage section), CONTRIBUTING.md, and CLAUDE.md. CI runs the suite on every push/PR via .github/workflows/ci.yml. https://github.com/Jekwwer/python-workspace/tree/main/tests https://github.com/Jekwwer/python-workspace/blob/main/Makefile

Standard invocation: make test (project) or pytest / poetry run pytest (language-standard). Coverage gate (--cov-fail-under=90) is wired into pyproject.toml addopts, so plain pytest enforces it. https://github.com/Jekwwer/python-workspace/blob/main/Makefile

Coverage gate is enforced at ≥90% via --cov-fail-under=90 (pytest addopts) and fail_under = 90 in [tool.coverage.report]. Both pytest-cov branch coverage (branch = true) and pytest's standard test suite cover the package; current coverage runs at 100% on my_package. https://github.com/Jekwwer/python-workspace/blob/main/pyproject.toml

GitHub Actions runs the test suite on every push and PR (.github/workflows/ci.yml), in addition to pre-commit hooks that run pytest on every commit locally. Coverage uploaded to Codecov. Status badges in README. https://github.com/Jekwwer/python-workspace/actions/workflows/ci.yml

Coverage gate --cov-fail-under=90 (pyproject.toml) plus a pytest pre-commit hook enforces test coverage at every commit — adding code without tests breaks the build, which functions as a hard policy. CONTRIBUTING.md "Testing and Quality Assurance" section documents test invocation; STYLEGUIDE.md sets test layout (tests/<module>_test.py).

Tests in tests/ mirror every public function in src/my_package/ (greet → utils_test.py, CLI → cli_test.py). Most recent functional addition (hypothesis property-based test for greet) was added with the same commit that introduced the dependency. Coverage runs at 100% on my_package. https://github.com/Jekwwer/python-workspace/tree/main/tests

CONTRIBUTING.md "Testing and Quality Assurance" section documents the test workflow and how to run tests; pyproject.toml hard-codes the ≥90% coverage gate so the requirement to add tests is encoded in the toolchain itself. Effectively documented for any contributor reading CONTRIBUTING.md or running make test.

Multiple linters and type checkers gate every commit and CI run: Ruff (rulesets E, F, W, C, ANN, B, D, I, Q, UP — covers pycodestyle, pyflakes, mccabe, annotations, bugbear, docstrings, isort, quotes, pyupgrade), MyPy in strict mode, plus markdownlint, yamllint, actionlint, gitleaks, validate-pyproject, cspell. All wired through pre-commit and Makefile. https://github.com/Jekwwer/python-workspace/blob/main/pyproject.toml https://github.com/Jekwwer/python-workspace/blob/main/.pre-commit-config.yaml

CI fails on any Ruff or MyPy warning; pre-commit blocks commits with warnings. Repository builds cleanly — no warnings remain. Verifiable: make check (format + lint + type + spell) returns 0 on main.

MyPy is strict = true with disallow_untyped_defs = true, warn_unused_ignores = true. Ruff selects 10 rulesets including all of pycodestyle, pyflakes, bugbear, pyupgrade, annotations, pydocstyle (Google convention). Coverage gate ≥90% (currently 100%). No # noqa or # type: ignore suppressions in src/. https://github.com/Jekwwer/python-workspace/blob/main/pyproject.tom

Primary maintainer applies secure-design practices visible in the repo: least-privilege CI tokens (permissions: {} top-level, narrowly scoped at job level in all GitHub Actions workflows), pinned third-party action SHAs (no floating tags), separated build-vs-publish jobs, signed releases via sigstore keyless OIDC, supply-chain scanning (Dependabot for 5 ecosystems, CodeQL SAST, OpenSSF Scorecard, Codecov dependency review). Private vulnerability disclosure via GitHub Security Advisories + email. Failure modes default to deny (strict CI gates, branch protection rules, two-factor auth on the GitHub account).

Primary maintainer is aware of common vulnerability classes (OWASP Top 10, CWE Top 25 — injection, XSS, deserialization, path traversal, SSRF, broken access control, insecure deps, weak crypto, unsafe defaults) and standard mitigations: parameterized queries, input validation at boundaries, output encoding, least privilege, secret-scanning (gitleaks pre-commit), static analysis (CodeQL, Ruff bugbear ruleset), vulnerable-dep alerts (Dependabot + pip-audit + npm audit), and supply-chain integrity (sigstore attestations). The repo's security CI pipeline reflects this knowledge in practice.

All distribution surfaces are HTTPS: GitHub release artifacts, Codespaces, GitHub Pages docs, git-over-HTTPS clones, GitHub Actions runners. Releases additionally ship sigstore-attested build provenance (*.intoto.jsonl bundle on each Release; verify via gh attestation verify <artifact> --owner Jekwwer). https://github.com/Jekwwer/python-workspace/blob/main/SECURITY.md

No build, install, or release path retrieves a hash over HTTP. Pinned third-party GitHub Actions are referenced by full commit SHA (with # vX.Y.Z comment) over HTTPS. Poetry resolves dependencies via PEP 503 HTTPS index with hash verification (poetry.lock carries SHA-256 digests).

No publicly-known unpatched vulnerabilities for more than 60 days. The most recent transitive dependency CVEs (11 GHSAs flagged by OpenSSF Scorecard, including critical handlebars and high glob, plus black/filelock/pygments/requests/starlette/urllib3/virtualenv chain) were cleared within the same week via npm audit fix + poetry update and shipped in v3.3.0. Continuous monitoring by Dependabot, CodeQL, Codecov dependency review, and OpenSSF Scorecard.

Most recent critical-severity finding (handlebars prototype pollution flagged by npm audit) was patched within hours via npm audit fix and released the same week. Dependabot is configured for 5 ecosystems with default-day cooldowns to ensure rapid uptake of security fixes.

gitleaks runs as a pre-commit hook on every commit (.pre-commit-config.yaml), blocking secret commits at the source. CI also runs gitleaks on every push/PR. No credentials, tokens, keys, or env files are tracked in the repository — verifiable by gitleaks detect --source . --no-git. https://github.com/Jekwwer/python-workspace/blob/main/.pre-commit-config.yaml

CodeQL SAST (.github/workflows/codeql.yml) runs on every push to main, every PR against main, and on a weekly schedule. Ruff with bugbear (B) ruleset and MyPy strict run on every commit (pre-commit) and CI push/PR. https://github.com/Jekwwer/python-workspace/blob/main/.github/workflows/codeql.yml

CodeQL ships GitHub's curated query packs for Python, including security-extended and security-and-quality suites covering CWE Top 25 (injection, path traversal, deserialization, SSRF, XSS, etc.). Ruff bugbear ruleset (B) flags common bug patterns. https://github.com/Jekwwer/python-workspace/security/code-scanning

No outstanding CodeQL findings of medium or higher severity on main. Code-scanning alerts page is empty (verifiable at https://github.com/Jekwwer/python-workspace/security/code-scanning). Pre-commit and CI gate all PRs.

Ruff + MyPy run on every commit via pre-commit and on every push/PR via CI. CodeQL runs on every push to main, every PR, and weekly on schedule. Effective cadence: every commit. https://github.com/Jekwwer/python-workspace/blob/main/.github/workflows/codeql.yml

Hypothesis (property-based testing, MIT-licensed) drives tests/utils_test.py::test_greet_returns_str over st.text(), generating randomized input drawn from a wide unicode range each run. pytest-cov dynamically tracks line and branch coverage during execution. Both run on every commit (pre-commit) and CI. https://github.com/Jekwwer/python-workspace/tree/main/tests

The software is written in Python only — a memory-safe language. No C/C++/unsafe-Rust components.

pytest's assertion rewriting (pytest enables it by default) provides rich assertion introspection during dynamic test runs. Hypothesis additionally enforces invariants via assert statements inside its examples. No -O / __debug__=False builds are used.

No medium-or-higher severity findings exist from the dynamic analysis suite (pytest + hypothesis + coverage). Test runs are clean; CI failure on any regression. https://github.com/Jekwwer/python-workspace/actions/workflows/ci.yml