chore: repo hygiene — health files, CodeQL, GHCR Docker publish#43
Merged
Conversation
Brings the repo up to standard OSS health-file expectations and closes a
distribution gap (Docker image was being built in CI then thrown away).
Health files:
* SECURITY.md — supported versions, disclosure process via GitHub
private advisory, response timeline, hardening notes for operators
(CORS, retention, HMAC pepper rotation).
* CHANGELOG.md — Keep-a-Changelog format, populated with the v0.2.0
release + v0.2.1 (yanked) / 0.2.2 / 0.2.3 patches.
* CONTRIBUTING.md — onboarding, branch naming, conventional-commits,
make targets for local checks, KVKK/GDPR privacy rules, release
procedure for maintainers.
* .github/ISSUE_TEMPLATE/{bug_report.yml, feature_request.yml,
config.yml} — YAML form-style templates; bug-report enforces
version + python + repro fields; feature-request has a KVKK
privacy checkbox.
* .github/PULL_REQUEST_TEMPLATE.md — type-of-change checklist + test
plan + KVKK check.
Workflows:
* .github/workflows/codeql.yml — Python security/quality scan on
push, PR, and Mondays.
* .github/workflows/publish.yml — extended with a `publish-docker`
job that pushes to ghcr.io/mftnakrsu/anpr-pipeline on tag push
(semver tag pattern + `latest`) via docker/metadata-action +
docker/build-push-action. Also opt-in via workflow_dispatch.
CI was building the Docker image and throwing it away. With this job
the image is pushed to ghcr.io/mftnakrsu/anpr-pipeline on every tag
push (semver `{version}` + `{major}.{minor}` + `latest` tags), or
manually via workflow_dispatch.
Uses docker/metadata-action to derive the tag set + OCI labels in one
place, docker/build-push-action with GHA cache for layer reuse, and
the workflow's built-in GITHUB_TOKEN with `packages: write` — no PAT
needed.
After this lands, the existing `pypi` and new `docker` publish steps
fan out from the same tag, so a single `git push origin vX.Y.Z`
covers both distribution channels.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Polishes the repo to standard OSS health-file expectations and closes a distribution gap.
Health files
uv sync+make test), branch naming, conventional-commit prefixes, KVKK/GDPR design rules ("don't persist raw plate text"), release procedure for maintainers..github/ISSUE_TEMPLATE/bug_report.yml— YAML form, enforces version + python + repro fields..github/ISSUE_TEMPLATE/feature_request.yml— incl. a KVKK privacy-impact checkbox..github/ISSUE_TEMPLATE/config.yml— directs security issues to the private advisory; links to PyPI..github/PULL_REQUEST_TEMPLATE.md— type-of-change checklist + test plan + KVKK check.Workflows
.github/workflows/codeql.yml— free Python security/quality scan on push, PR, and weekly (Mon 04:32 UTC)..github/workflows/publish.yml— extended with apublish-dockerjob. On every tag push, the existing PyPI publish now runs alongside a Docker publish toghcr.io/mftnakrsu/anpr-pipeline(semver{version}+{major}.{minor}+latesttags) viadocker/metadata-action+docker/build-push-actionwith GHA layer cache. Opt-in manual run viaworkflow_dispatch.Out of scope
docker pull ghcr.io/...instructions — will come in a follow-up after the first tag triggers the GHCR job and the image is live.