@erclx/canon 5.42.0 → 5.43.0

package/tooling/public/manifest.toml

@@ -0,0 +1,8 @@
+[stack]
+name = "public"
+extends = ""
+runtime = "bun"
+scaffold = ""
+
+[sync]
+source = "configs"

package/tooling/public/reference.md

@@ -0,0 +1,53 @@
+# Tooling public reference
+
+## Overview
+
+The public stack is an add-on that ships the open-source files a public repository carries. It extends nothing and syncs beside any other stack at the same root with `canon tooling sync public . --write`.
+
+## Seeds
+
+A seed is copied only when its path is absent, so a project's filled `LICENSE`, `SECURITY.md`, or `CONTRIBUTING.md` is never overwritten. Fill each `<placeholder>` after the first sync.
+
+### Policy files
+
+These three name the project's owner and terms.
+
+- Use MIT for `LICENSE`, which needs a year and a holder. Swap the text by hand for a different license.
+- Point `SECURITY.md` and the issue chooser at GitHub private vulnerability reporting only, with no email.
+- Switch private reporting on under the repository's Settings, Code security.
+- Ship no `CODE_OF_CONDUCT.md`. Add one when outside contributors arrive.
+
+### Issue forms
+
+`bug.yml`, `feature.yml`, and `config.yml` turn blank issues off.
+
+- Add fields specific to the project, such as its CLI's version command, by hand.
+
+### Release files
+
+These two start release-please at version zero.
+
+- Start `release-please-config.json` on the `simple` release type, with `initial-version` `0.0.1` and `bump-minor-pre-major` on.
+- Switch the type and add `extra-files` for a package that carries its version in a manifest.
+- Start `.release-please-manifest.json` at `0.0.0`.
+
+## Release workflow
+
+`release-please.yml` is a config, so each sync overwrites it and a fix reaches every public repository.
+
+- Run it on every push to `main`. It keeps one release pull request open and tags the release when that pull request merges.
+- Publish nothing. A project that publishes a package adds its own workflow keyed on the release, and never edits this one.
+- Open the release pull request with `RELEASE_PLEASE_TOKEN` when the secret exists, and fall back to the default token otherwise.
+- Set the secret to a personal token so CI runs on the release pull request, since the default token's author does not start it.
+- Keep the token read-only at the top, with `contents: write` and `pull-requests: write` on the one job.
+
+## Dependabot
+
+`dependabot.yml` is how an existing repository keeps its seeded workflows' action majors current, since a seed never updates after install.
+
+- Update `github-actions` weekly with an `ci` commit prefix.
+- Group minor and patch updates into one pull request per run, and leave majors ungrouped so each arrives alone.
+
+## Beside another stack
+
+Run `canon tooling sync public . --write` on a repository that already carries a stack. The install stamp keeps the core chain and lists the add-on after it.

package/tooling/public/seeds/.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,48 @@
+name: Bug report
+description: Something does not work as expected
+labels: [bug]
+body:
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: What you did, what you expected, and what happened instead.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Run `<command>`
+        2. ...
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: The smallest input that shows the problem. Paste it, or link a repository or gist.
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: The release or commit you ran.
+    validations:
+      required: true
+  - type: input
+    id: runtime
+    attributes:
+      label: Runtime and version
+      placeholder: Node 22.12.0, or Bun 1.3.0
+    validations:
+      required: true
+  - type: input
+    id: os
+    attributes:
+      label: Operating system
+      placeholder: macOS 26.1, Windows 11, Ubuntu 24.04
+    validations:
+      required: true

package/tooling/public/seeds/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/<owner>/<repo>/security/advisories/new
+    about: Report it privately rather than in a public issue.

package/tooling/public/seeds/.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,16 @@
+name: Feature request
+description: Suggest something this project should do
+labels: [enhancement]
+body:
+  - type: textarea
+    id: job
+    attributes:
+      label: The job
+      description: What you were trying to get done when the project fell short, and how you work around it today.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What you would like
+      description: The behavior you have in mind, if you have one.

package/tooling/public/seeds/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.0.0"
+}

package/tooling/public/seeds/CONTRIBUTING.md

@@ -0,0 +1,50 @@
+# Contributing to <project>
+
+This page covers getting a working checkout, how to test a change, and the commit and pull request rules the hooks enforce.
+
+## Setup
+
+<Prerequisites, such as the runtime and its minimum version.>
+
+```bash
+git clone https://github.com/<owner>/<repo>.git
+cd <repo>
+<install command>
+<check command>
+```
+
+<What the install step activates, such as git hooks, and what the check command runs.>
+
+## Layout
+
+| Path     | What it holds |
+| -------- | ------------- |
+| `<path>` | <role>        |
+
+## Tests
+
+<The commands that run the tests and what each one covers.>
+
+## Commit messages
+
+Commits follow [Conventional Commits](https://www.conventionalcommits.org), and release-please reads them to cut each release.
+
+- The header reads `<type>(<scope>): <subject>`, such as `fix(server): close the socket on shutdown`
+- The header is at most 72 characters
+- The first word of the subject is lowercase, and the subject ends with no period
+
+The types are `feat`, `fix`, `refactor`, `docs`, `chore`, `perf`, `test`, `style`, `build`, `ci`, and `revert`.
+
+## Pull requests
+
+Branch from `main` and open the pull request against it. Say what the change does and why, which files it touches, and how you tested it.
+
+CI runs on every pull request, and a pull request merges once it passes. Keep each one to a single concern. A refactor that a feature needs reads better as its own pull request ahead of the feature.
+
+## Releases
+
+release-please cuts every release from the conventional commits on `main`. Each push to `main` keeps one release pull request open, holding the next version and its `CHANGELOG.md` entry. Merging that pull request tags the release.
+
+## AI-assisted contributions
+
+Contributions written with a coding agent are welcome. You are the author of what you submit, so read every line before you open the pull request and be ready to explain it.

package/tooling/public/seeds/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) <year> <holder>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/tooling/public/seeds/SECURITY.md

@@ -0,0 +1,13 @@
+# Security policy
+
+<One sentence on what in this project is security-sensitive.>
+
+## Reporting a vulnerability
+
+Report it privately through GitHub's [private vulnerability reporting](https://github.com/<owner>/<repo>/security/advisories/new). Do not open a public issue for it.
+
+Include the version, your OS, and the steps that reproduce the problem. You get a reply in the advisory thread.
+
+## Supported versions
+
+Only the latest release receives fixes.

package/tooling/public/seeds/release-please-config.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "include-component-in-tag": false,
+  "packages": {
+    ".": {
+      "release-type": "simple",
+      "changelog-path": "CHANGELOG.md",
+      "initial-version": "0.0.1",
+      "bump-minor-pre-major": true
+    }
+  }
+}

package/tooling/shell/configs/.github/workflows/shell.yml

@@ -7,13 +7,16 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   shell-checks:
     name: 🐚 Shell Checks
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2

package/tooling/web/configs/.github/workflows/readme-screenshot.yml

@@ -20,6 +20,9 @@ concurrency:
   group: readme-screenshot-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   capture:
     name: 🖼️ Refresh README Screenshot
@@ -32,7 +35,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.head_ref }}
 
@@ -48,7 +51,7 @@ jobs:
           fi
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '22'
 
@@ -62,7 +65,7 @@ jobs:
 
       - name: Cache Playwright Browser
         id: playwright-cache
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.cache/ms-playwright
           key: playwright-${{ runner.os }}-chromium-${{ hashFiles('**/package.json') }}

package/tooling/web/configs/.github/workflows/verify.yml

@@ -9,16 +9,19 @@ concurrency:
   group: verify-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   static-checks:
     name: 🔍 Static Checks
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '22'
 
@@ -44,10 +47,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '22'
 
@@ -67,10 +70,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '22'
 
@@ -86,7 +89,7 @@ jobs:
         run: bun run build
 
       - name: Upload Build Output
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: build-output
           path: dist/
@@ -98,10 +101,10 @@ jobs:
     needs: [static-checks, unit-tests, build-verify]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '22'
 
@@ -114,7 +117,7 @@ jobs:
         run: bun install --frozen-lockfile
 
       - name: Download Build Output
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: build-output
           path: dist/
@@ -124,7 +127,7 @@ jobs:
 
       - name: Cache Playwright Browsers
         id: playwright-cache
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.cache/ms-playwright
           key: playwright-chromium-${{ runner.os }}-${{ hashFiles('**/package.json') }}
@@ -139,7 +142,7 @@ jobs:
         run: bun run test:e2e --project=chromium
 
       - name: Upload E2E Report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: playwright-report