greenbump 0.5.0 → 0.7.0

package/CONTRIBUTING.md

@@ -1,52 +0,0 @@
-# Contributing
-
-## Setup
-
-```bash
-npm install
-npm run build
-npm test
-```
-
-`npm test` builds the project then runs every `*.test.js` file under `dist/`
-with Node's built-in test runner. Some tests (`git.test.ts`) create real
-temporary git repositories and shell out to the actual `git` binary — no
-mocking — so they need `git` on `PATH` but touch nothing outside `os.tmpdir()`.
-
-## Adding or fixing an ecosystem adapter
-
-Each package manager lives in its own file under
-`src/engine/ecosystems/<id>.ts` and implements the `EcosystemAdapter`
-interface (`src/engine/ecosystems/types.ts`): `detect`, `outdated`, `install`,
-`defaultCheckCommands`.
-
-If you're fixing a parser bug, please:
-1. Reproduce it against the *real* CLI output, not a guessed format — most
-   existing bugs here came from a test fixture that didn't match what the
-   real tool actually prints (e.g. `mix hex.outdated`'s "Only" column, or
-   `pod outdated`'s `(latest version X)` suffix).
-2. Add or update the corresponding case in
-   `src/engine/ecosystems/parsers.test.ts` with a comment explaining the
-   real-world quirk, not just the happy path.
-3. If you have the toolchain installed locally, run the adapter against a
-   throwaway project to confirm `detect`/`outdated`/`install` work end to end
-   before setting `verified: true`.
-
-## Code style
-
-- No unnecessary abstractions — match the size of the existing adapters.
-- Don't add error handling for cases that can't happen; only validate at
-  actual boundaries (parsing untrusted CLI/API output, user-supplied paths).
-- Keep PRs scoped: a parser fix doesn't need to also refactor the adapter
-  around it.
-
-## Reporting a bug in a specific ecosystem
-
-Include:
-- The ecosystem id (`--ecosystem <id>` or auto-detected)
-- The exact manifest/lockfile involved (redact anything private)
-- The raw output of the underlying CLI command that greenbump would have
-  parsed (e.g. `npm outdated --json`, `pod outdated`)
-
-For security issues, see [SECURITY.md](SECURITY.md) instead of opening a
-public issue.

package/SECURITY.md

@@ -1,38 +0,0 @@
-# Security Policy
-
-## Reporting a vulnerability
-
-Please do **not** open a public GitHub issue for security vulnerabilities.
-
-Instead, report it privately via GitHub's
-[private vulnerability reporting](https://github.com/shidesheng0218/greenbump/security/advisories/new)
-(https://github.com/shidesheng0218/greenbump), or by
-emailing the maintainer directly if that's not enabled yet.
-
-Include:
-- A description of the issue and its impact
-- Steps to reproduce
-- The version/commit affected
-
-We'll acknowledge reports as quickly as we can and credit you in the fix
-unless you'd prefer otherwise.
-
-## Scope and known risk areas
-
-greenbump is a CLI/GitHub Action that:
-- Runs shell commands from your project's own package manager (`npm`,
-  `poetry`, `cargo`, etc.) against your working directory.
-- Gives an LLM-driven agent tool access (`read_file`, `write_file`,
-  `search_code`, `run_check`) scoped to the project directory — see
-  `src/agent/fixer.ts`'s `safePath()` for the path-escape guard.
-- Sends your build/test failure output, and optionally dependency changelogs,
-  to the LLM provider you configure (your own API key — nothing is sent to
-  any greenbump-operated server).
-
-If you find a way for the fix agent to escape the project directory, run
-arbitrary commands beyond your configured build/test scripts, or exfiltrate
-data beyond what's needed for the fix loop, that's a valid report.
-
-Vulnerabilities in third-party dependencies (`@anthropic-ai/sdk`, `openai`,
-`commander`, etc.) should be reported upstream, though we're happy to hear
-about them too if they materially affect greenbump.