mirror of
https://github.com/DeBrosOfficial/orama.git
synced 2026-06-16 21:54:14 +00:00
3676b000a6
Standardization batch — no application code changes. Pulls in the
DeBros DAO baseline rules (v0.1.0, sha 51ce3f8) for supply-chain
defense and toolchain pinning.
Files added:
- DEBROS.md + debros.json — adopted-rules manifest
- .debros/compliance/{go,javascript-typescript,zig}.md — per-language
compliance docs
- .github/workflows/security.yml — auto-detecting security CI
(npm audit + go vulncheck), runs on main + weekly cron
- renovate.json — 30-day dependency cooldown, no auto-merge,
vulnerability alerts bypass cooldown
- .nvmrc — pin Node 20.18.0
- vault/.zigversion — pin Zig 0.14.0
- sdk/.npmrc, website/.npmrc — supply-chain hardening
(ignore-scripts, strict-peer-dependencies, save-exact, etc.)
Files modified:
- core/go.mod, os/agent/go.mod, website/invest-api/go.mod —
add `toolchain go1.24.6` directive for reproducible builds
- VERSION + sdk/package.json — bump to 0.122.11
14 lines
386 B
Plaintext
14 lines
386 B
Plaintext
# DeBros baseline (DEBROS.md §1.3) — supply-chain hardening
|
|
ignore-scripts=true
|
|
audit-level=moderate
|
|
auto-install-peers=false
|
|
strict-peer-dependencies=true
|
|
prefer-offline=true
|
|
save-exact=true
|
|
fund=false
|
|
update-notifier=false
|
|
|
|
# Project-specific: GitHub Packages registry for @network/* scope
|
|
@network:registry=https://npm.pkg.github.com
|
|
//npm.pkg.github.com/:_authToken=${NPM_TOKEN}
|