flowpact

The ciatlas GitHub organization that owns the authoritative repository (https://github.com/ciatlas/flowpact) requires two-factor authentication for every member and outside collaborator, and GitHub accepts passkeys for it. The only person with access is the maintainer, as org owner and repository admin.

Organization members get only the base permission Read on ciatlas repositories, which on this public repository grants nothing beyond what anyone already has. Outside collaborators get no access until an owner invites them with a role chosen by hand. Today the maintainer is the only member and collaborator.

The active 'main' ruleset (https://github.com/ciatlas/flowpact/blob/main/.github/rulesets/main.json, also shown at https://github.com/ciatlas/flowpact/rules) requires every change to main to arrive as a squash-merged pull request that passes the 'CI passed' and 'Conventional PR title' checks. It blocks force pushes and has no bypass actors, so not even an admin can push to main directly.

The same 'main' ruleset includes a deletion rule and has no bypass actors (https://github.com/ciatlas/flowpact/blob/main/.github/rulesets/main.json), so GitHub refuses to delete main for everyone. An admin would first have to take the separate, explicit step of editing or disabling the ruleset, and the weekly settings sync would revert that.

No workflow puts an expression directly into a shell script. Untrusted metadata such as the PR title, head ref and base ref reaches run steps only through environment variables used quoted, and the PR title is checked against a strict Conventional Commits regex (https://github.com/ciatlas/flowpact/blob/main/.github/workflows/pr-title.yml). CodeQL's Actions queries (security-extended) and flowpact's own lint scan every workflow on each PR.

Workflows that run code from pull requests use the pull_request trigger, never pull_request_target or workflow_run. Fork PRs therefore get a read-only GITHUB_TOKEN and no secrets, and a first-time contributor's run needs maintainer approval. Credentials are used only in jobs that run from main (release.yml, the 'Apply settings' job in repo-settings.yml), and https://github.com/ciatlas/flowpact/blob/main/.github/workflows/dependency-bundle.yml builds Renovate's branch in a job with no secrets, giving the bot token only to a separate job that runs none of the branch's code.

Every official channel is HTTPS-only. That covers the repository, issues and security advisories on https://github.com/ciatlas/flowpact and the docs on GitHub Pages at https://ciatlas.github.io/flowpact, where HTTPS is enforced, along with the npm, VS Code Marketplace and Open VSX pages. Plain-HTTP requests to each of them redirect to HTTPS.

Every distribution channel is authenticated. npm is served over HTTPS, with trusted publishing and npm provenance. GitHub Releases are served over HTTPS and, from 0.10.0, are immutable and covered by GitHub's signed release attestation; the npm tarball, the Action archive and the .vsix each carry a Sigstore bundle and in-toto provenance. The Action is fetched through git tags over HTTPS, which only the release bot and admins can create. The VS Code Marketplace and Open VSX are served over HTTPS. https://ciatlas.github.io/flowpact/docs/security/#verify-a-release shows how to verify each artifact.

Secret scanning with push protection is on for the repository. It is kept in code at https://github.com/ciatlas/flowpact/blob/main/.github/security.json and re-applied weekly, so a push containing a recognized credential is rejected before it lands. Publishing uses OIDC trusted publishing and GitHub secrets, so no credential files are part of the workflow.

The docs at https://ciatlas.github.io/flowpact cover installing and a first run (https://ciatlas.github.io/flowpact/docs/getting-started/), the CLI (https://ciatlas.github.io/flowpact/docs/cli/), the GitHub Action (https://ciatlas.github.io/flowpact/docs/action/), the editors (https://ciatlas.github.io/flowpact/docs/editors/), CI setup and configuration. The one dangerous capability, plugins that run repository code, is flagged with highlighted warning callouts on the Action and configuration pages and in https://ciatlas.github.io/flowpact/docs/security/#plugins-run-code.

The README's 'Feedback and contributing' section (https://github.com/ciatlas/flowpact#feedback-and-contributing) sends bug reports to GitHub Issues, where a bug report form (https://github.com/ciatlas/flowpact/blob/main/.github/ISSUE_TEMPLATE/bug_report.yml) asks for what happened, a minimal reproduction, the flowpact version and how it was run. The CLI docs ask users to report internal errors with --debug output (https://ciatlas.github.io/flowpact/docs/cli/), and vulnerabilities go privately through SECURITY.md.

Proposed changes and usage problems are discussed publicly in GitHub Issues (https://github.com/ciatlas/flowpact/issues) and pull requests (https://github.com/ciatlas/flowpact/pulls). Anyone with a GitHub account can open or comment on them, and the README points users there.

https://github.com/ciatlas/flowpact/blob/main/CONTRIBUTING.md explains the contribution process: setup, repository layout, and pull requests that are squash-merged after the 'CI passed' and 'Conventional PR title' checks pass and a code owner approves. It also covers the test expectations, the commit message convention and how releases happen. The README links to it.

The MIT license for the repository contents is approved by the Open Source Initiative (OSI).

Every released asset is MIT-licensed and ships the license. The npm tarball and the action archive contain LICENSE, the .vsix declares MIT and lists LICENSE among its files, and the code they bundle is under MIT, ISC, BSD-3-Clause or BlueOak-1.0.0, all OSI-approved. Each asset lists its bundled packages and their license texts in THIRD_PARTY_LICENSES.txt and in a CycloneDX SBOM attached to the release (https://github.com/ciatlas/flowpact/releases/tag/v0.12.2).

The MIT license is in a top-level LICENSE file at https://github.com/ciatlas/flowpact/blob/main/LICENSE. The project's other repository, the workflow model ciatlas/core, has its own MIT LICENSE at https://github.com/ciatlas/core/blob/main/LICENSE.

Every released asset carries the license. The npm package flowpact includes LICENSE (packages/cli/package.json files), the VS Code extension .vsix includes LICENSE.txt, and the GitHub Action archive flowpact-action-X.Y.Z.tar.gz includes LICENSE next to action.yml; see https://github.com/ciatlas/flowpact/releases. The Action at a release tag and GitHub's source archives contain the repository's LICENSE.

The source is in a public GitHub repository at the stable URL https://github.com/ciatlas/flowpact, with no mirrors. It moved there from the maintainer's personal account in 0.12.0, and GitHub redirects the old URL.

The public Git history at https://github.com/ciatlas/flowpact/commits/main records every change with its author and date. Each change arrives as a squash-merged pull request whose author is the commit author and whose individual commits stay visible on the PR. The main ruleset blocks force pushes and branch deletion for everyone, so history cannot be rewritten (https://github.com/ciatlas/flowpact/blob/main/.github/rulesets/main.json).

Direct dependencies are declared in the package.json of each workspace package (for example https://github.com/ciatlas/flowpact/blob/main/packages/lint/package.json) and locked in https://github.com/ciatlas/flowpact/blob/main/pnpm-lock.yaml. The lockfile also pins the git dependency @ciatlas/core to a commit. Each release also ships a CycloneDX SBOM of what is bundled.

The project has two repositories. The 'The workflow model: @ciatlas/core' section of https://github.com/ciatlas/flowpact/blob/main/CONTRIBUTING.md#the-workflow-model-ciatlascore documents the second one, https://github.com/ciatlas/core: what it is (the model flowpact's checks are built on), that it has its own tests and releases, and that the CLI, Action and extension bundle it from a release tag. The repository layout table in the same file lists the monorepo's own packages.

The only binary files in the repository are PNG images: brand assets, docs screenshots and the extension icon. This control explicitly allows those. No executables, libraries, archives or other compiled binaries are committed, and the GitHub Action bundle is plain-text JavaScript that CI checks against a fresh build (https://github.com/ciatlas/flowpact/blob/main/.github/workflows/ci.yml).

https://github.com/ciatlas/flowpact/blob/main/SECURITY.md#reporting-a-vulnerability says how to reach the project about security issues: privately through GitHub's private vulnerability reporting (https://github.com/ciatlas/flowpact/security/advisories/new), which is enabled and goes to the maintainers. The README and https://ciatlas.github.io/flowpact/docs/security link to it. ciatlas/core has its own SECURITY.md with the same channel.