cachegate 1.0.0 → 1.1.1

package/.gitattributes

@@ -0,0 +1,12 @@
+# Force LF regardless of the checking-out platform's git config
+# (core.autocrlf). Real incident this exists to prevent: a Windows
+# checkout of sync-oss-release.sh got CRLF line endings, which broke
+# it immediately with "$'\r': command not found" - no bash interpreter
+# on any platform handles a CRLF shebang/script correctly. See
+# OPEN_SOURCE_ROADMAP.md step 16.
+*.sh text eol=lf
+
+# Everything else: let git decide text vs. binary automatically, but
+# normalize line endings to LF in the repository itself either way -
+# this project has no reason to ever store CRLF.
+* text=auto eol=lf

package/.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1,5 @@
-# NOTE (remove before step 15/16 ships): the URL below has a placeholder
-# "OWNER" - fill in the real GitHub org/username once the public repo
-# actually exists.
-blank_issues_enabled: true
-contact_links:
-  - name: Security vulnerability
-    url: https://github.com/OWNER/cachegate/security/advisories/new
-    about: Do not open a public issue for a vulnerability - use private vulnerability reporting instead. See SECURITY.md.
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/iDebunk/cachegate/security/advisories/new
+    about: Do not open a public issue for a vulnerability - use private vulnerability reporting instead. See SECURITY.md.

package/Dockerfile

@@ -1,16 +1,24 @@
-FROM node:20-slim
-WORKDIR /app
-COPY package*.json ./
-RUN npm ci --omit=dev
-COPY . .
-# The official Node images already ship a non-root "node" user (uid 1000) -
-# use it instead of running as root, standard practice for a public image.
-RUN chown -R node:node /app
-USER node
-EXPOSE 4000
-# No curl/wget in the slim base image - Node's own http module does the
-# check instead. Uses the real GET /health endpoint (public, no auth,
-# exists specifically for this).
-HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
-  CMD node -e "require('http').get('http://localhost:'+(process.env.PORT||4000)+'/health',(r)=>process.exit(r.statusCode===200?0:1)).on('error',()=>process.exit(1))"
-CMD ["node", "server.js"]
+FROM node:20-slim
+
+# Standard OCI labels - GHCR reads image.source automatically on every push
+# and uses it to link this package to the repo (the alternative to clicking
+# "Connect Repository" by hand once, which doesn't survive a re-publish).
+LABEL org.opencontainers.image.source="https://github.com/iDebunk/cachegate" \
+      org.opencontainers.image.description="Self-hostable, OpenAI-compatible LLM proxy: routes to the cheapest healthy provider, caches responses exactly and semantically, tracks cost and latency per call." \
+      org.opencontainers.image.licenses="MIT"
+
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci --omit=dev
+COPY . .
+# The official Node images already ship a non-root "node" user (uid 1000) -
+# use it instead of running as root, standard practice for a public image.
+RUN chown -R node:node /app
+USER node
+EXPOSE 4000
+# No curl/wget in the slim base image - Node's own http module does the
+# check instead. Uses the real GET /health endpoint (public, no auth,
+# exists specifically for this).
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD node -e "require('http').get('http://localhost:'+(process.env.PORT||4000)+'/health',(r)=>process.exit(r.statusCode===200?0:1)).on('error',()=>process.exit(1))"
+CMD ["node", "server.js"]