Commit graph

5 commits

Author SHA1 Message Date
jedarden
97fecb7b4b docs(contributing): add Argo-CI caveat, DCO sign-off, and contributor templates
- Restructured CONTRIBUTING.md with all nine required sections:
  - Project licensing (MIT OR Apache-2.0, DCO sign-off required)
  - Code of conduct (Contributor Covenant v2.1)
  - Security reporting (link to SECURITY.md)
  - Development setup (with OCR dependencies)
  - Local validation checklist (6 commands matching pdftract-ci)
  - CI on forks caveat (maintainer-triggered, 48-hour response)
  - PR template requirements
  - Commit message style (Conventional Commits)
  - Issue triage

- Created CODE_OF_CONDUCT.md (Contributor Covenant v2.1)

- Created .github/PULL_REQUEST_TEMPLATE.md with required fields:
  - Linked issue or RFC
  - Scope statement (Phase / Acceptance Scenario)
  - Test plan
  - Manual-test evidence
  - Performance impact

- Created issue templates:
  - bug_report.md (with pdftract doctor output requirement)
  - feature_request.md (with use case and proposed solution)
  - performance_regression.md (with baseline vs current)

- Updated README.md with Contributing section linking to CONTRIBUTING.md

- Added footer links to CONTRIBUTING.md in all templates

Closes: pdftract-i9rk

Verification: notes/pdftract-i9rk.md
Signed-off-by: jedarden <github@jedarden.com>
2026-05-24 06:00:48 -04:00
jedarden
080ceeb62b docs(pdftract-16wv): add Apache NOTICE licensing documentation to CONTRIBUTING.md
Add Licensing section to CONTRIBUTING.md explaining:
- Dual MIT OR Apache-2.0 licensing model
- Apache NOTICE file policy (optional for upstream, redistributors MAY add)
- Attribution guidelines for downstream redistributors

Also add verification note confirming all acceptance criteria PASS:
- LICENSE-MIT and LICENSE-APACHE files present at repo root
- All workspace crates declare "MIT OR Apache-2.0" license
- cargo deny check licenses passes (implicit deny-by-default via allow list)
- Binary and wheel distributions configured to include both license files

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-23 10:59:19 -04:00
jedarden
bb5346b305 docs(pdftract-58kz): add security policy documentation
Add comprehensive SECURITY.md covering:
- Supported versions policy
- Private vulnerability reporting (email + GitHub)
- 90-day disclosure window with timelines
- CVE assignment via GitHub Security Advisories
- In-scope and out-of-scope vulnerability classes
- Safe harbor policy for good-faith researchers

Add security issue template redirecting users to private reporting.
Add Security section to CONTRIBUTING.md and README.md with links to SECURITY.md.
Add docs/security/pgp-public-key.asc placeholder with generation instructions.

References: bead pdftract-58kz, plan line 3433

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-20 19:39:24 -04:00
jedarden
12f4cb4d81 feat(pdftract-2w02): pin MSRV to 1.78 with CI gate
Add MSRV (Minimum Supported Rust Version) pinning to 1.78 for
pdftract-core and pdftract-cli. The MSRV gate prevents silent
absorption of newer Rust features that would break downstream
consumers on older toolchains.

Changes:
- CI: Add quality-matrix DAG with msrv-check step (rust:1.78-slim)
- CI: Add clippy-check, fmt-check, cargo-audit, cargo-deny templates
- README: Add MSRV badge (shields.io)
- clippy.toml: Enable msrv=1.78 for MSRV-aware lints
- CONTRIBUTING.md: Document MSRV bump policy (MINOR version event)

The rust-version was already declared in workspace Cargo.toml;
this bead adds the CI enforcement and documentation.

Refs: pdftract-2w02
2026-05-20 19:03:53 -04:00
jedarden
9aa26a449e docs(pdftract-49f8): establish Cargo.lock policy and documentation
This commit implements the Cargo.lock policy for reproducible builds
across all workspace members (pdftract-core, pdftract-cli, pdftract-py).

Changes:
- Add CONTRIBUTING.md with lockfile-update workflow documentation
- Add .renovaterc.json for weekly lockfile-only PRs (human-gated)
- Add crates/pdftract-core/README.md with rationale for checked-in lockfiles
- Add notes/pdftract-49f8.md with verification note

The Argo workflow updates (pdftract-ci.yaml) are committed separately
in the declarative-config repo.

Acceptance criteria:
- PASS: Cargo.lock tracked by git, not in .gitignore
- PASS: Argo workflow templates document --locked/--frozen requirements
- WARN: Enforcement to be completed when placeholder templates are implemented
- WARN: Binary reproducibility verification deferred to pdftract-build-binaries implementation

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-20 18:13:14 -04:00