From 6f18a6a94d1fd9fe2094a4f3d6a59e02173392c0 Mon Sep 17 00:00:00 2001 From: Renn F Date: Mon, 28 Sep 2026 23:31:59 +0200 Subject: [PATCH 1/2] chore(scaffold): add community health files - security policy, contributing guide, code of conduct, funding, pull request template, and issue template set (fastapi-guard baseline) --- .github/FUNDING.yml | 14 +++ .github/ISSUE_TEMPLATE/bug.yml | 53 ++++++++++ .github/ISSUE_TEMPLATE/config.yml | 11 ++ .github/ISSUE_TEMPLATE/docs.yml | 31 ++++++ .github/ISSUE_TEMPLATE/feature.yml | 35 +++++++ .github/PULL_REQUEST_TEMPLATE.md | 61 +++++++++++ CODE_OF_CONDUCT.md | 162 +++++++++++++++++++++++++++++ CONTRIBUTING.md | 39 +++++++ SECURITY.md | 36 +++++++ 9 files changed, 442 insertions(+) create mode 100644 .github/FUNDING.yml create mode 100644 .github/ISSUE_TEMPLATE/bug.yml create mode 100644 .github/ISSUE_TEMPLATE/config.yml create mode 100644 .github/ISSUE_TEMPLATE/docs.yml create mode 100644 .github/ISSUE_TEMPLATE/feature.yml create mode 100644 .github/PULL_REQUEST_TEMPLATE.md create mode 100644 CODE_OF_CONDUCT.md create mode 100644 CONTRIBUTING.md create mode 100644 SECURITY.md diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml new file mode 100644 index 0000000..f02f17a --- /dev/null +++ b/.github/FUNDING.yml @@ -0,0 +1,14 @@ +# These are supported funding model platforms + +github: rennf93 +# patreon: # Replace with a single Patreon username +# open_collective: # Replace with a single Open Collective username +# ko_fi: # Replace with a single Ko-fi username +# tidelift: # not applicable for this ecosystem +# community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry +# liberapay: # Replace with a single Liberapay username +# issuehunt: # Replace with a single IssueHunt username +# lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry +# polar: # Replace with a single Polar username +# buy_me_a_coffee: # Replace with a single Buy Me a Coffee username +custom: ['https://paypal.me/renzof93'] diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml new file mode 100644 index 0000000..5d27d94 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug.yml @@ -0,0 +1,53 @@ +name: Bug report +description: Guard Agent PHP does not behave as documented +title: "[BUG] " +labels: [bug] +body: + - type: input + id: value + attributes: + label: Value this delivers + description: One sentence a user could witness once this is fixed. + placeholder: "Requests whose JSON body contains a URL are no longer flagged on endpoints that disable suspicious-pattern detection." + validations: + required: true + - type: textarea + id: what + attributes: + label: What happened + description: What you did, what you expected, what you got. Error messages, tracebacks and logs go here. + validations: + required: true + - type: textarea + id: steps + attributes: + label: Steps to reproduce + placeholder: | + 1. Configure Guard Agent PHP with '...' + 2. Send a request to '...' + 3. See error + validations: + required: true + - type: input + id: versions + attributes: + label: Versions + description: guard-agent-php version, PHP version, guard-core-php version, OS. + placeholder: "guard-agent-php 3.1.0, PHP 8.3.14, guard-core-php 4.2.0, Ubuntu 24.04" + validations: + required: true + - type: textarea + id: config + attributes: + label: Configuration + description: Your config with secrets masked. + render: php + placeholder: | + use RenzoFranceschini\GuardCore\Config\SecurityConfig; + + $config = new SecurityConfig(...); + - type: textarea + id: context + attributes: + label: Additional context + description: Production or development, consistent or intermittent, workarounds tried. diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..5e0cdee --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,11 @@ +blank_issues_enabled: false +contact_links: + - name: Guard Agent PHP Documentation + url: https://rennf93.github.io/guard-agent-php/ + about: Check the documentation for usage information and tutorials + - name: Usage Questions + url: https://github.com/rennf93/guard-agent-php/discussions + about: Please ask and answer questions in GitHub Discussions + - name: Discord + url: https://discord.gg/ZW7ZJbjMkK + about: Questions and support in #help, new versions in #releases, development stream in #dev-feed \ No newline at end of file diff --git a/.github/ISSUE_TEMPLATE/docs.yml b/.github/ISSUE_TEMPLATE/docs.yml new file mode 100644 index 0000000..a8b6529 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/docs.yml @@ -0,0 +1,31 @@ +name: Documentation +description: Wrong, missing or unclear Guard Agent PHP documentation +title: "[DOCS] " +labels: [documentation] +body: + - type: input + id: value + attributes: + label: Value this delivers + description: One sentence a reader could witness once this is fixed. + placeholder: "The Redis page shows the exact config for a TLS connection." + validations: + required: true + - type: input + id: page + attributes: + label: Page + description: URL of the page or section. + validations: + required: true + - type: textarea + id: problem + attributes: + label: What is wrong or missing + validations: + required: true + - type: textarea + id: proposal + attributes: + label: Proposed text + render: markdown diff --git a/.github/ISSUE_TEMPLATE/feature.yml b/.github/ISSUE_TEMPLATE/feature.yml new file mode 100644 index 0000000..4281a6a --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature.yml @@ -0,0 +1,35 @@ +name: Feature request +description: Suggest an improvement to Guard Agent PHP +title: "[FEATURE] " +labels: [enhancement] +body: + - type: input + id: value + attributes: + label: Value this delivers + description: One sentence a user could witness once this exists. + placeholder: "A single decorator disables all detection for one endpoint." + validations: + required: true + - type: textarea + id: job + attributes: + label: The job you are trying to get done + description: The outcome you need, not the mechanism you imagine. + validations: + required: true + - type: textarea + id: workaround + attributes: + label: How you work around it today + - type: textarea + id: example + attributes: + label: Example usage + description: Pseudocode of how you would like to use it. + render: php + - type: textarea + id: context + attributes: + label: Additional context + description: Similar features in other libraries, constraints, API implications. diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..f2b5e09 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,61 @@ +Delivers issue: # + + + +Description +=========== + + + +___ + +Motivation and Context +---------------------- + + + + +___ + +Type of change +-------------- + + + +- [ ] Bug fix (non-breaking change which fixes an issue) +- [ ] New feature (non-breaking change which adds functionality) +- [ ] Breaking change (fix or feature that would cause existing functionality to change) +- [ ] Documentation change +- [ ] Performance improvement +- [ ] Code cleanup or refactoring + +___ + +How Has This Been Tested +------------------------- + + + + + +___ + +Screenshots (if appropriate) +----------------------------- + +___ + +Checklist +--------- + + + + +- [ ] My code follows the code style of this project (Mypy, Ruff) +- [ ] I have added tests to cover my changes +- [ ] All new and existing tests passed +- [ ] My change requires a change to the documentation +- [ ] I have updated the documentation accordingly +- [ ] I have checked that my changes don't introduce any new warnings or errors +- [ ] I have updated the version number if necessary +- [ ] I have added any new dependencies to the appropriate requirements file diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..a733ba2 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,162 @@ +Contributor Covenant Code of Conduct +==================================== + +___ + +Our Pledge +----------- + +We as members, contributors, and leaders pledge to make participation in our +community a harassment-free experience for everyone, regardless of age, body +size, visible or invisible disability, ethnicity, sex characteristics, gender +identity and expression, level of experience, education, socio-economic status, +nationality, personal appearance, race, religion, or sexual identity +and orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, +diverse, inclusive, and healthy community. + +___ + +Our Standards +------------- + +Examples of behavior that contributes to a positive environment for our +community include: + +* Demonstrating empathy and kindness toward other people +* Being respectful of differing opinions, viewpoints, and experiences +* Giving and gracefully accepting constructive feedback +* Accepting responsibility and apologizing to those affected by our mistakes, + and learning from the experience +* Focusing on what is best not just for us as individuals, but for the + overall community + +Examples of unacceptable behavior include: + +* The use of sexualized language or imagery, and sexual attention or + advances of any kind +* Trolling, insulting or derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or email + address, without their explicit permission +* Other conduct which could reasonably be considered inappropriate in a + professional setting + +___ + +Enforcement Responsibilities +---------------------------- + +Community leaders are responsible for clarifying and enforcing our standards of +acceptable behavior and will take appropriate and fair corrective action in +response to any behavior that they deem inappropriate, threatening, offensive, +or harmful. + +Community leaders have the right and responsibility to remove, edit, or reject +comments, commits, code, wiki edits, issues, and other contributions that are +not aligned to this Code of Conduct, and will communicate reasons for moderation +decisions when appropriate. + +___ + +Scope +----- + +This Code of Conduct applies within all community spaces, and also applies when +an individual is officially representing the community in public spaces. +Examples of representing our community include using an official e-mail address, +posting via an official social media account, or acting as an appointed +representative at an online or offline event. + +___ + +Enforcement +----------- + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported to the community leaders responsible for enforcement at +@rennf93. +All complaints will be reviewed and investigated promptly and fairly. + +All community leaders are obligated to respect the privacy and security of the +reporter of any incident. + +___ + +Enforcement Guidelines +---------------------- + +Community leaders will follow these Community Impact Guidelines in determining +the consequences for any action they deem in violation of this Code of Conduct: + +___ + +Correction +---------- + +**Community Impact**: Use of inappropriate language or other behavior deemed +unprofessional or unwelcome in the community. + +**Consequence**: A private, written warning from community leaders, providing +clarity around the nature of the violation and an explanation of why the +behavior was inappropriate. A public apology may be requested. + +___ + +Warning +------- + +**Community Impact**: A violation through a single incident or series +of actions. + +**Consequence**: A warning with consequences for continued behavior. No +interaction with the people involved, including unsolicited interaction with +those enforcing the Code of Conduct, for a specified period of time. This +includes avoiding interactions in community spaces as well as external channels +like social media. Violating these terms may lead to a temporary or +permanent ban. + +___ + +Temporary Ban +------------- + +**Community Impact**: A serious violation of community standards, including +sustained inappropriate behavior. + +**Consequence**: A temporary ban from any sort of interaction or public +communication with the community for a specified period of time. No public or +private interaction with the people involved, including unsolicited interaction +with those enforcing the Code of Conduct, is allowed during this period. +Violating these terms may lead to a permanent ban. + +___ + +Permanent Ban +------------- + +**Community Impact**: Demonstrating a pattern of violation of community +standards, including sustained inappropriate behavior, harassment of an +individual, or aggression toward or disparagement of classes of individuals. + +**Consequence**: A permanent ban from any sort of public interaction within +the community. + +___ + +Attribution +----------- + +This Code of Conduct is adapted from the [Contributor Covenant][homepage], +version 2.0, available at +. + +Community Impact Guidelines were inspired by [Mozilla's code of conduct +enforcement ladder](https://github.com/mozilla/diversity). + +[homepage]: https://www.contributor-covenant.org + +For answers to common questions about this code of conduct, see the FAQ at +. Translations are available at +. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..36ff1cf --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,39 @@ +# Contributing to Guard Agent PHP + +Thanks for considering a contribution to Guard Agent PHP, part of the Guard ecosystem (this repo follows the conventions of the Python baseline: guard-core and fastapi-guard). + +## Development Setup + +Requirements: + +- PHP ^8.2 (the library supports 8.2, 8.3, and 8.4) +- Composer 2 +- Docker (Redis runs as a CI service locally too, via `docker run -p 6379:6379 redis:7-alpine`; hosts without a PHP toolchain run everything through the `php:8.3-cli` and `composer:2` images, see the Makefile) + +```bash +composer install +composer test # the repo's test suite (bin/test_*.php) +composer lint # syntax sweep over src/ and bin/ +``` + +## Quality Gates + +Run before pushing (CI enforces the same checks): + +- `composer lint` (php -l sweep over src and bin) +- the test suite (`composer test`, Redis needed for the guard suites) +- `composer audit` (dependency vulnerability check, also on the weekly schedule) + +## Pull Requests + +- Every PR closes an open issue ("Delivers issue: #N") or carries the `no-issue` label (chores and dependency bumps). +- Keep the CI green; one clean push per PR is preferred. +- Commit messages: lowercase, imperative, conventional style (`fix(scope): ...`, `feat(scope): ...`, `ci(scope): ...`). No attribution trailers. + +## Security + +Never open public issues for security vulnerabilities. Follow SECURITY.md and report via GitHub security advisories. + +## Questions + +Open a GitHub Discussion in this repository or ask in the Guard Discord (#help). diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..2efbbd0 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,36 @@ +# Security Policy for Guard Agent PHP + +## Supported Versions + +We currently provide security updates for the following versions of Guard Agent PHP: + +| Version | Supported | +| ------- | ------------------ | +| 3.1.x | :white_check_mark: | +| 3.0.x | :white_check_mark: | +| < 3.0.0 | :x: | + +## Reporting a Vulnerability + +We take the security of Guard Agent PHP seriously. If you believe you've found a security vulnerability, please follow these steps: + +1. **Do not disclose the vulnerability publicly** until it has been addressed by the maintainers. +2. **Report the vulnerability through GitHub's security advisory feature**: + - Go to the [Security tab](https://github.com/rennf93/guard-agent-php/security/advisories) of the Guard Agent PHP repository + - Click on "New draft security advisory" + - Fill in the details of the vulnerability + - Submit the advisory + + Alternatively, you can report vulnerabilities through [GitHub's private vulnerability reporting feature](https://github.com/rennf93/guard-agent-php/security/advisories/new). + +3. Include the following information in your report: + - A description of the vulnerability and its potential impact + - Steps to reproduce the issue + - Affected versions + - Any potential mitigations or workarounds + +The maintainers will acknowledge your report within 48 hours and provide a detailed response within 7 days, including the next steps in handling the vulnerability. + +## Security Considerations + +Guard Agent PHP is a security library: report anything that weakens detection, bypasses rate limiting, leaks secrets into logs, or trusts unvalidated input. From 599c5035febe98e6cec7b046b780fb91273c64e0 Mon Sep 17 00:00:00 2001 From: Renn F Date: Tue, 29 Sep 2026 00:45:02 +0200 Subject: [PATCH 2/2] ci(security): add the semgrep security-audit and secrets gate --- .github/workflows/semgrep.yml | 38 +++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 .github/workflows/semgrep.yml diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml new file mode 100644 index 0000000..6dde008 --- /dev/null +++ b/.github/workflows/semgrep.yml @@ -0,0 +1,38 @@ +name: Semgrep + +on: + push: + branches: + - master + paths: + - 'src/**' + - '.github/workflows/semgrep.yml' + pull_request: + paths: + - 'src/**' + - '.github/workflows/semgrep.yml' + schedule: + - cron: '0 7 * * 1' + +permissions: + contents: read + +jobs: + semgrep: + name: Security audit (semgrep) + runs-on: ubuntu-latest + timeout-minutes: 15 + permissions: + contents: read + container: + image: semgrep/semgrep:1.177.0 + env: + SEMGREP_SEND_METRICS: off + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Scan src with the security-audit and secrets rulesets + run: semgrep scan --config p/security-audit --config p/secrets --metrics=off --error --quiet src