flowpact

Miradi inayofuata mazoea bora hapa chini inaweza kujihakikisha kwa hiari na kuonyesha kuwa wamepata nishani ya mazoea bora ya Open Source Security Foundation (OpenSSF).

Hakuna seti ya mazoea yawezayo kuhakikisha kuwa programu haitakuwa na kasoro au udhaifu; hata mbinu rasmi zinaweza kushindwa ikiwa vipimo au dhana ni sahihi. Wala hakuna seti ya mazoea yawezayo kuhakikisha kuwa mradi utaendelea kuwa na jamii ya maendeleo yenye afya na inayofanya kazi vizuri. Hata hivyo, kufuata mazoea bora kunaweza kusaidia kuboresha matokeo ya miradi. Kwa mfano, baadhi ya mazoea huwezesha ukaguzi wa watu wengi kabla ya kutolewa, ambayo inaweza kusaidia kupata udhaifu wa kiufundi ambao vinginevyo ni vigumu kupata na kusaidia kujenga uaminifu na hamu ya mwingiliano wa kurudia kati ya wasanidi programu kutoka makampuni tofauti. Ili kupata nishani, vigezo vyote vya LAZIMA na LAZIMA WALA USIWAHI lazima vifuatwe, vigezo vyote vya INAPASWA lazima vifuatwe AU visivyo fufufutiliana na thibitisho, na vigezo vyote vya PENDEKEZA lazima vifuatwe AU visivyo fufufutiliana (tunataka vifikiwe angalau). Ikiwa unataka kuingiza maandishi ya thibitisho kama maoni ya jumla, badala ya kuwa maelezo ya busara kwamba hali ni inakubaliwa, anza kifungu cha maandishi na '//' ikifuatiwa na nafasi. Maoni ni karibu kupitia tovuti ya GitHub kama masuala au maombi ya kuvuta Kuna pia orodha ya barua pepe kwa majadiliano ya jumla.

Tunafuraha kutoa habari katika lugha nyingi, hata hivyo, ikiwa kuna mgongano au kutokuwa na usawa kati ya tafsiri, toleo la Kiingereza ni toleo lenye mamlaka.
Ikiwa huu ni mradi wako, tafadhali onyesha hali ya nishani yako ya msingi kwenye ukurasa wa mradi wako! Hali ya nishani ya msingi inaonekana kama hii: Kiwango cha nishani ya msingi kwa mradi 15403 ni baseline-2 Huu ndiyo jinsi ya kuweka nishani ya msingi:
Unaweza kuonyesha hali ya nishani yako ya msingi kwa kuweka hii katika faili yako ya markdown:
[![OpenSSF Baseline](https://www.bestpractices.dev/projects/15403/baseline)](https://www.bestpractices.dev/projects/15403)
au kwa kuweka hii katika HTML yako:
<a href="https://www.bestpractices.dev/projects/15403"><img src="https://www.bestpractices.dev/projects/15403/baseline"></a>


Hizi ni vigezo vya Kiwango cha Msingi 1. Hizi ni vigezo vya toleo v2026.08.28.

Baseline Series: Kiwango cha Msingi 1 Kiwango cha Msingi 2 Kiwango cha Msingi 3

        

 Misingi

  • Jumla

    Kumbuka kwamba miradi mingine inaweza kutumia jina sawa.

    Data-flow linter for GitHub Actions: finds inputs, secrets and matrix values that arrive empty across reusable workflows, local actions and matrix combinations, and grades the release impact of changes. CLI, GitHub Action, VS Code extension.

    Tafadhali tumia muundo wa maneno ya leseni ya SPDX; mifano ni pamoja na "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "GPL-2.0+", "LGPL-3.0+", "MIT", na "(BSD-2-Clause OR Ruby)". Usitumie alama za nukuu za moja au mbili.
    Ikiwa kuna lugha zaidi ya moja, ziorodhe kama thamani zilizotengwa kwa koma (nafasi ni za hiari) na ziorodhe kuanzia iliyotumiwa zaidi hadi iliyotumiwa kidogo. Ikiwa kuna orodha ndefu, tafadhali orodhesha angalau tatu za kawaida zaidi. Ikiwa hakuna lugha (k.m., huu ni mradi wa nyaraka tu au wa majaribio tu), tumia herufi moja "-". Tafadhali tumia herufi kubwa za kawaida kwa kila lugha, k.m., "JavaScript".
    Common Platform Enumeration (CPE) ni mpango wa kuweka majina yenye muundo kwa mifumo ya teknolojia ya habari, programu, na vifurushi. Inatumika katika mifumo na hifadhidata nyingi wakati wa kuripoti udhaifu.

 Udhibiti 23/24 ●

  • Udhibiti


    Ya kutosha kwa nishani!

    Wakati mtumiaji anajaribu kusoma au kurekebisha rasilimali nyeti katika hifadhi ya mamlaka ya mradi, mfumo LAZIMA uhitaji mtumiaji kukamilisha mchakato wa uthibitishaji wa vipengele vingi. [OSPS-AC-01.01]
    Tekeleza uthibitishaji wa vipengele vingi kwa mfumo wa udhibiti wa toleo wa mradi, ikihitaji washirika kutoa aina ya pili ya uthibitishaji wakati wa kufikia data nyeti au kurekebisha mipangilio ya hifadhi. Funguo za kupitisha zinakubaliwa kwa udhibiti huu.

    The ciatlas GitHub organization that owns the authoritative repository (https://github.com/ciatlas/flowpact) requires two-factor authentication for every member and outside collaborator, and GitHub accepts passkeys for it. The only person with access is the maintainer, as org owner and repository admin.


    Ya kutosha kwa nishani!

    Wakati mshirika mpya anaongezwa, mfumo wa udhibiti wa toleo LAZIMA uhitaji mgawanyo wa ruhusa wa mikono, au kuzuia ruhusa za mshirika kwa upendeleo wa chini unapatikana kwa chaguo-msingi. [OSPS-AC-02.01]
    Mifumo mingi ya umma ya udhibiti wa toleo imesanidiwa kwa njia hii. Hakikisha mfumo wa udhibiti wa toleo wa mradi daima unapeana ruhusa za chini zinazopatikana kwa washirika kwa chaguo-msingi wanapongezwa, ikitoa ruhusa za ziada tu zinapohitajika.

    Organization members get only the base permission Read on ciatlas repositories, which on this public repository grants nothing beyond what anyone already has. Outside collaborators get no access until an owner invites them with a role chosen by hand. Today the maintainer is the only member and collaborator.


    Ya kutosha kwa nishani!

    Wakati ahadi ya moja kwa moja inajaribiwa kwenye tawi kuu la mradi, utaratibu wa kutekeleza LAZIMA uzuie mabadiliko yasitekelezwe. [OSPS-AC-03.01]
    Ikiwa VCS ni ya kati, weka ulinzi wa tawi kwenye tawi kuu katika VCS ya mradi. Vinginevyo, tumia mbinu isiyokuwa ya kati, kama ile ya kernel ya Linux, ambapo mabadiliko kwanza hupendekeza katika hifadhi nyingine, na kuunganisha mabadiliko katika hifadhi kuu kunahitaji kitendo tofauti mahususi.

    The active 'main' ruleset (https://github.com/ciatlas/flowpact/blob/main/.github/rulesets/main.json, also shown at https://github.com/ciatlas/flowpact/rules) requires every change to main to arrive as a squash-merged pull request that passes the 'CI passed' and 'Conventional PR title' checks. It blocks force pushes and has no bypass actors, so not even an admin can push to main directly.


    Ya kutosha kwa nishani!

    Wakati jaribio linafanywa kufuta tawi kuu la mradi, mfumo wa udhibiti wa toleo LAZIMA uichukulie hii kama shughuli nyeti na kuhitaji uthibitishaji wa wazi wa nia. [OSPS-AC-03.02]
    Weka ulinzi wa tawi kwenye tawi kuu katika mfumo wa udhibiti wa toleo wa mradi ili kuzuia ufutaji.

    The same 'main' ruleset includes a deletion rule and has no bypass actors (https://github.com/ciatlas/flowpact/blob/main/.github/rulesets/main.json), so GitHub refuses to delete main for everyone. An admin would first have to take the separate, explicit step of editing or disabling the ruleset, and the weekly settings sync would revert that.


    Ya kutosha kwa nishani!

    Wakati bomba la CI/CD linapofanya kazi kwenye metadata isiyoaminika, vigezo hivyo LAZIMA visafishwe na kuthibitishwa kabla ya kutumika kwenye bomba hilo. [OSPS-BR-01.01]
    Mifuko ya CI/CD inapaswa kusafisha (kunukuu, kutoroka au kutoka kwa maadili yanayotarajiwa) pembejeo zote za metadata zinazohusiana na vyanzo visivyoaminika. Hii inajumuisha data kama vile majina ya matawi, ujumbe wa kujitolea, lebo, majina ya maombi ya kuvuta, na taarifa za mwandishi.

    No workflow puts an expression directly into a shell script. Untrusted metadata such as the PR title, head ref and base ref reaches run steps only through environment variables used quoted, and the PR title is checked against a strict Conventional Commits regex (https://github.com/ciatlas/flowpact/blob/main/.github/workflows/pr-title.yml). CodeQL's Actions queries (security-extended) and flowpact's own lint scan every workflow on each PR.


    Ya kutosha kwa nishani!

    Wakati mfuko wa CI/CD unafanya kazi kwenye picha za nambari za kanuni ambazo haziaminiki, LAZIMA uzuie upatikanaji wa vitambulisho vya CI/CD vilivyopendelewa na mali. [OSPS-BR-01.03]
    Mifuko ya CI/CD inapaswa kutenga picha za nambari za kanuni ambazo haziaminiki kutoka kwa vitambulisho vilivyopendelewa na mali. Hasa, miradi inapaswa kuwa makini kuhakikisha kwamba mtiririko wa kazi ambao hujenga au kutekeleza nambari kabla ya ukaguzi na mshirika hana upatikanaji wa vitambulisho vya CI/CD.

    Workflows that run code from pull requests use the pull_request trigger, never pull_request_target or workflow_run. Fork PRs therefore get a read-only GITHUB_TOKEN and no secrets, and a first-time contributor's run needs maintainer approval. Credentials are used only in jobs that run from main (release.yml, the 'Apply settings' job in repo-settings.yml), and https://github.com/ciatlas/flowpact/blob/main/.github/workflows/dependency-bundle.yml builds Renovate's branch in a job with no secrets, giving the bot token only to a separate job that runs none of the branch's code.


    Ya kutosha kwa nishani!

    Wakati mradi unaorodhesha URI kama njia rasmi ya mradi, URI hiyo LAZIMA itolewa pekee kwa kutumia njia zilizosimbwa. [OSPS-BR-03.01]
    Sanidi tovuti za mradi na mifumo ya udhibiti wa toleo ili kutumia njia zilizosimbwa kama SSH au HTTPS kwa maambukizi ya data. Hakikisha zana zote na vikoa vilivyorejelewa katika nyaraka za mradi vinaweza kufikika tu kupitia njia zilizosimbwa.

    Every official channel is HTTPS-only. That covers the repository, issues and security advisories on https://github.com/ciatlas/flowpact and the docs on GitHub Pages at https://ciatlas.github.io/flowpact, where HTTPS is enforced, along with the npm, VS Code Marketplace and Open VSX pages. Plain-HTTP requests to each of them redirect to HTTPS.


    Ya kutosha kwa nishani!

    Wakati mradi unaorodhesha URI kama kituo rasmi cha usambazaji, kituo hicho LAZIMA kilindwe dhidi ya mashambulizi ya adui-katikati-ya-mawasiliano kwa kutumia njia zilizothibitishwa kikriptografia. [OSPS-BR-03.02]
    Vipengele vinavyosambazwa na mradi vinapaswa kusambazwa kupitia njia zinazohakikisha uadilifu na uhalisi. Utumiaji wa HTTPS kwa upakuaji, matoleo yaliyotiwa saini, au usambazaji kupitia visimamizi vya vifurushi vinavyoaminika ni njia zote zinazokubalika za kulinda dhidi ya mashambulizi ya adui-katikati-ya-mawasiliano.

    Every distribution channel is authenticated. npm is served over HTTPS, with trusted publishing and npm provenance. GitHub Releases are served over HTTPS and, from 0.10.0, are immutable and covered by GitHub's signed release attestation; the npm tarball, the Action archive and the .vsix each carry a Sigstore bundle and in-toto provenance. The Action is fetched through git tags over HTTPS, which only the release bot and admins can create. The VS Code Marketplace and Open VSX are served over HTTPS. https://ciatlas.github.io/flowpact/docs/security/#verify-a-release shows how to verify each artifact.


    Ya kutosha kwa nishani!

    Mradi LAZIMA uzuie uhifadhi wa bila makusudi wa data nyeti isiyo-imeimbwa, kama siri na vyeti, katika mfumo wa udhibiti wa toleo. [OSPS-BR-07.01]
    Sanidi .gitignore au sawa ili kutofautisha faili ambazo zinaweza kuwa na maelezo nyeti. Tumia vizuizi vya kabla ya kujitolea na zana za uchunguzi zilizosaidiwa na kompyuta ili kugundua na kuzuia ujumuishaji wa data nyeti katika michango.

    Secret scanning with push protection is on for the repository. It is kept in code at https://github.com/ciatlas/flowpact/blob/main/.github/security.json and re-applied weekly, so a push containing a recognized credential is rejected before it lands. Publishing uses OIDC trusted publishing and GitHub secrets, so no credential files are part of the workflow.


    Ya kutosha kwa nishani!

    Wakati mradi umefanya utoaji, nyaraka za mradi LAZIMA zijumuishe miongozo ya watumiaji kwa utendaji wote wa kimsingi. [OSPS-DO-01.01]
    Unda miongozo ya watumiaji au nyaraka kwa utendaji wote wa kimsingi wa mradi, ikieleza jinsi ya kusakinisha, kusanidi, na kutumia vipengele vya mradi. Ikiwa kuna vitendo vinavyojulikana kuwa hatari au vya kuharibu, jumuisha maonyo yaliyo-wazi kabisa.

    The docs at https://ciatlas.github.io/flowpact cover installing and a first run (https://ciatlas.github.io/flowpact/docs/getting-started/), the CLI (https://ciatlas.github.io/flowpact/docs/cli/), the GitHub Action (https://ciatlas.github.io/flowpact/docs/action/), the editors (https://ciatlas.github.io/flowpact/docs/editors/), CI setup and configuration. The one dangerous capability, plugins that run repository code, is flagged with highlighted warning callouts on the Action and configuration pages and in https://ciatlas.github.io/flowpact/docs/security/#plugins-run-code.


    Ya kutosha kwa nishani!

    Wakati mradi umefanya utoaji, nyaraka za mradi LAZIMA zijumuishe mwongozo wa kuripoti hitilafu. [OSPS-DO-02.01]
    Inashauriwa kwamba miradi itumie kifuatiliaji cha masuala cha chaguo-msingi cha VCS yao. Ikiwa chanzo cha nje kinatumiwa, hakikisha kwamba nyaraka za mradi na mwongozo wa kuchangia zinaeleza wazi na kwa uonekano jinsi ya kutumia mfumo wa kuripoti. Inashauriwa kwamba nyaraka za mradi pia ziweke matarajio ya jinsi hitilafu zitatolewa kipaumbele na kutatuliwa.

    The README's 'Feedback and contributing' section (https://github.com/ciatlas/flowpact#feedback-and-contributing) sends bug reports to GitHub Issues, where a bug report form (https://github.com/ciatlas/flowpact/blob/main/.github/ISSUE_TEMPLATE/bug_report.yml) asks for what happened, a minimal reproduction, the flowpact version and how it was run. The CLI docs ask users to report internal errors with --debug output (https://ciatlas.github.io/flowpact/docs/cli/), and vulnerabilities go privately through SECURITY.md.


    Ya kutosha kwa nishani!

    Mradi LAZIMA uwe na utaratibu mmoja au zaidi wa mijadala ya hadharani kuhusu mabadiliko yanayopendekezwa na vikwazo vya matumizi. [OSPS-GV-02.01]
    Unda taratibu moja au zaidi za mijadala ya umma ndani ya mradi, kama orodha za barua, ujumbe wa papo hapo, au vifuatiliaji vya masuala, ili kuwezesha mawasiliano ya wazi na maoni.

    Proposed changes and usage problems are discussed publicly in GitHub Issues (https://github.com/ciatlas/flowpact/issues) and pull requests (https://github.com/ciatlas/flowpact/pulls). Anyone with a GitHub account can open or comment on them, and the README points users there.


    Ya kutosha kwa nishani!

    Hati za mradi LAZIMA zijumuishe maelezo ya mchakato wa uchangiaji, au zieleze kwa uwazi kuwa michango ya hadharani haikubaliwi [OSPS-GV-03.01]
    Unda CONTRIBUTING.md au saraka ya CONTRIBUTING/ ili kuainisha mchakato wa kuchangia ukijumuisha hatua za kuwasilisha mabadiliko, na kushirikiana na watunzaji wa mradi.

    https://github.com/ciatlas/flowpact/blob/main/CONTRIBUTING.md explains the contribution process: setup, repository layout, and pull requests that are squash-merged after the 'CI passed' and 'Conventional PR title' checks pass and a code owner approves. It also covers the test expectations, the commit message convention and how releases happen. The README links to it.


    Ya kutosha kwa nishani!

    Leseni ya chanzo-msimbo LAZIMA ikidhi Ufafanuzi wa Open Source wa OSI au Ufafanuzi wa Programu Huru wa FSF. [OSPS-LE-02.01]
    Ongeza faili ya LICENSE kwenye hazina ya mradi na leseni ambayo ni leseni iliyoidhinishwa na Open Source Initiative (OSI), au leseni huria kama ilivyoidhinishwa na Free Software Foundation (FSF). Mifano ya leseni kama hizo ni pamoja na MIT, BSD 2-clause, BSD 3-clause revised, Apache 2.0, Lesser GNU General Public License (LGPL), na GNU General Public License (GPL). Kutolewa kwa umma kukidhi udhibiti huu ikiwa hakuna vizuizi vingine kama vile vimiliki.

    The MIT license for the repository contents is approved by the Open Source Initiative (OSI).


    Ya kutosha kwa nishani!

    Leseni ya vipengele vya programu vilivyotolewa LAZIMA ikidhi Ufafanuzi wa Open Source wa OSI au Ufafanuzi wa Programu Huru wa FSF. [OSPS-LE-02.02]
    Ikiwa leseni tofauti imejumuishwa na mali za programu zilizotolewa, hakikisha ni leseni iliyoidhinishwa na Open Source Initiative (OSI), au leseni huria kama ilivyoidhinishwa na Free Software Foundation (FSF). Mifano ya leseni kama hizo ni pamoja na MIT, BSD 2-clause, BSD 3-clause revised, Apache 2.0, Lesser GNU General Public License (LGPL), na GNU General Public License (GPL). Kumbuka kwamba leseni kwa mali za programu zilizotolewa inaweza kuwa tofauti na msimbo wa chanzo.

    Every released asset is MIT-licensed and ships the license. The npm tarball and the action archive contain LICENSE, the .vsix declares MIT and lists LICENSE among its files, and the code they bundle is under MIT, ISC, BSD-3-Clause or BlueOak-1.0.0, all OSI-approved. Each asset lists its bundled packages and their license texts in THIRD_PARTY_LICENSES.txt and in a CycloneDX SBOM attached to the release (https://github.com/ciatlas/flowpact/releases/tag/v0.12.2).


    Ya kutosha kwa nishani!

    Leseni ya chanzo-msimbo LAZIMA ihifadhiwe ndani ya faili la LICENSE, faili la COPYING, saraka ya LICENSES/, au saraka ya LICENSE/ ya hazina husika. [OSPS-LE-03.01]
    Jumuisha leseni ya chanzo-msimbo cha mradi ndani ya faili la LICENSE la mradi, faili la COPYING, saraka ya LICENSES/, au saraka ya LICENSE/ ili kutoa uwazi na ufafanuzi kuhusu masharti ya leseni. Jina la faili LINAWEZA kuwa na kiambatisho. Ikiwa mradi una hazina nyingi, hakikisha kila hazina inajumuisha faili la leseni.

    The MIT license is in a top-level LICENSE file at https://github.com/ciatlas/flowpact/blob/main/LICENSE. The project's other repository, the workflow model ciatlas/core, has its own MIT LICENSE at https://github.com/ciatlas/core/blob/main/LICENSE.


    Ya kutosha kwa nishani!

    Leseni ya vipengele vya programu vilivyotolewa LAZIMA ijumuishwe ndani ya chanzo-msimbo kilichotolewa, au ndani ya faili la LICENSE, faili la COPYING, au saraka ya LICENSE/ karibu na vipengele husika vya toleo. [OSPS-LE-03.02]
    Jumuisha leseni ya rasilimali za programu zilizotolewa za mradi katika msimbo wa chanzo uliotolewa, au katika faili ya LICENSE, faili ya COPYING, au saraka ya LICENSE/ pembeni na rasilimali za toleo linalohusiana ili kutoa mwonekano na uwazi wa masharti ya leseni. Jina la faili YAWEZA kuwa na kiendelezi. Ikiwa mradi una hazina nyingi, hakikisha kwamba kila hazina inajumuisha faili ya leseni.

    Every released asset carries the license. The npm package flowpact includes LICENSE (packages/cli/package.json files), the VS Code extension .vsix includes LICENSE.txt, and the GitHub Action archive flowpact-action-X.Y.Z.tar.gz includes LICENSE next to action.yml; see https://github.com/ciatlas/flowpact/releases. The Action at a release tag and GitHub's source archives contain the repository's LICENSE.


    Ya kutosha kwa nishani!

    Hazina ya chanzo-msimbo ya mradi LAZIMA isomeke hadharani kwenye URL tuli. [OSPS-QA-01.01]
    Tumia VCS ya kawaida kama GitHub, GitLab, au Bitbucket. Hakikisha hazina inaweza kusomwa hadharani. Epuka kunakili au kuakisi hazina isipokuwa nyaraka zinazoonekana sana zinatoa wazi chanzo kikuu. Epuka mabadiliko ya mara kwa mara kwenye hazina ambayo ingeathiri URL ya hazina. Hakikisha hazina ni ya umma.

    The source is in a public GitHub repository at the stable URL https://github.com/ciatlas/flowpact, with no mirrors. It moved there from the maintainer's personal account in 0.12.0, and GitHub redirects the old URL.


    Ya kutosha kwa nishani!

    Mfumo wa udhibiti wa toleo LAZIMA uwe na kumbukumbu inayoweza kusomwa hadharani ya mabadiliko yote yaliyofanywa, nani alifanya mabadiliko, na mabadiliko yalifanywa lini. [OSPS-QA-01.02]
    Tumia VCS ya kawaida kama GitHub, GitLab, au Bitbucket ili kudumisha historia ya kuwasilisha inayoweza kusomwa hadharani. Epuka kusonga au kuandika upya miwasilisho kwa namna ambayo ingeweza kuficha mwandishi wa miwasilisho yoyote.

    The public Git history at https://github.com/ciatlas/flowpact/commits/main records every change with its author and date. Each change arrives as a squash-merged pull request whose author is the commit author and whose individual commits stay visible on the PR. The main ruleset blocks force pushes and branch deletion for everyone, so history cannot be rewritten (https://github.com/ciatlas/flowpact/blob/main/.github/rulesets/main.json).


    Ya kutosha kwa nishani!

    Wakati mfumo wa usimamizi wa kifurushi unaposaidia, hazina ya msimbo wa chanzo LAZIMA iwe na orodha ya utegemezi inayohesabu utegemezi wa moja kwa moja wa lugha. [OSPS-QA-02.01]
    Hii inaweza kuwa kwa namna ya faili ya usimamizi wa kifurushi au faili ya utegemezi wa lugha inayoorodhesha utegemezi wote wa moja kwa moja kama package.json, Gemfile, au go.mod.

    Direct dependencies are declared in the package.json of each workspace package (for example https://github.com/ciatlas/flowpact/blob/main/packages/lint/package.json) and locked in https://github.com/ciatlas/flowpact/blob/main/pnpm-lock.yaml. The lockfile also pins the git dependency @ciatlas/core to a commit. Each release also ships a CycloneDX SBOM of what is bundled.


    Ya kutosha kwa nishani!

    Miradi yenye hazina nyingi LAZIMA iandike orodha ya misingi ya msimbo (codebases) inayohusika na mradi. [OSPS-QA-04.01]
    Weka kwenye nyaraka hazina zozote za ziada za msimbo wa miradi midogo zinazozalishwa na mradi na kukusanywa katika toleo. Nyaraka hii inapaswa kujumuisha hali na nia ya hazina ya msimbo husika.

    The project has two repositories. The 'The workflow model: @ciatlas/core' section of https://github.com/ciatlas/flowpact/blob/main/CONTRIBUTING.md#the-workflow-model-ciatlascore documents the second one, https://github.com/ciatlas/core: what it is (the model flowpact's checks are built on), that it has its own tests and releases, and that the CLI, Action and extension bundle it from a release tag. The repository layout table in the same file lists the monorepo's own packages.


    Si ya kutosha kwa nishani.

    Mfumo wa kudhibiti matoleo LAZIMA usiwe na mabaki yanayoweza kutekelezwa yaliyotengenezwa. [OSPS-QA-05.01]
    Ondoa vitu vilivyozalishwa vinavyoweza kutekelezwa katika mfumo wa udhibiti wa toleo wa mradi. Inashauriwa kwamba hali yoyote ambapo kifaa kilichozalishwa kinachoweza kutekelezwa kinaonekana muhimu kwa mchakato kama vile majaribio, badala yake kinapaswa kuzalishwa wakati wa ujenzi au kuhifadhiwa kando na kuchukuliwa wakati wa hatua maalum ya mfumo wa kuendeshea iliyoandikwa vizuri.

    The repository commits one generated file, the GitHub Action's bundle packages/action/dist/index.js, because GitHub runs a JavaScript action from the ref that uses: names. A required CI job rebuilds it from source on every pull request and fails on any difference (https://github.com/ciatlas/flowpact/blob/main/.github/workflows/ci.yml, job action-dist), and the release archive is built reproducibly; it remains a generated artifact in version control.


    Ya kutosha kwa nishani!

    Mfumo wa kudhibiti matoleo LAZIMA usiwe na mabaki ya jozi yasiyoweza kukaguliwa. [OSPS-QA-05.02]
    Usiongeze vitu vyovyote vya binary visivyoweza kukaguliwa katika mfumo wa udhibiti wa toleo wa mradi. Hii inajumuisha programu za binary za maombi, faili za maktaba, na vitu sawa. Haijumuishi mali kama picha za kigraphiki, faili za sauti au muziki, na maudhui sawa ambayo kwa kawaida huhifadhiwa katika muundo wa binary.

    The only binary files in the repository are PNG images: brand assets, docs screenshots and the extension icon. This control explicitly allows those. No executables, libraries, archives or other compiled binaries are committed, and the GitHub Action bundle is plain-text JavaScript that CI checks against a fresh build (https://github.com/ciatlas/flowpact/blob/main/.github/workflows/ci.yml).


    Ya kutosha kwa nishani!

    Nyaraka za mradi LAZIMA ziwe na anwani za mawasiliano za usalama. [OSPS-VM-02.01]
    Unda faili ya security.md (au inayoitwa sawa) inayohifadhi anwani za kuwasiliana za usalama kwa mradi.

    https://github.com/ciatlas/flowpact/blob/main/SECURITY.md#reporting-a-vulnerability says how to reach the project about security issues: privately through GitHub's private vulnerability reporting (https://github.com/ciatlas/flowpact/security/advisories/new), which is enabled and goes to the maintainers. The README and https://ciatlas.github.io/flowpact/docs/security link to it. ciatlas/core has its own SECURITY.md with the same channel.



Unaweza kutumia zana na mifumo ya AI kupendekeza mabadiliko kupitia URL rahisi, kama vile https://www.bestpractices.dev/sw/projects/15403/choose/edit?osps_ac_01_01_status=Met&osps_ac_01_01_justification=GitHub+enforced. Angalia mfumo wetu wa mapendekezo ya otomatiki kwa jinsi ya kufanya hivyo. Data hii inapatikana chini ya Community Data License Agreement – Permissive, Version 2.0 (CDLA-Permissive-2.0). Hii inamaanisha kuwa Mpokeaji wa Data anaweza kushiriki Data, na au bila marekebisho, mradi Mpokeaji wa Data anapatanisha maandishi ya mkataba huu na Data iliyoshirikiwa. Tafadhali tambua Ruman Kazi na wachangiaji wa nishani ya Mazoea Bora ya OpenSSF.

Ingizo la nishani ya mradi linamilikiwa na: Ruman Kazi.
Ingizo liliundwa siku 2026-10-12 07:45:57 UTC, iliyosasishwa mara ya mwisho siku 2026-10-12 10:15:42 UTC. Ilipata mara ya mwisho nishani ya kupita siku 2026-10-12 07:46:35 UTC.