Anwesh
6e0091e256
* docs(architecture): add canonical package-layering doc (T-10)
Write docs/ARCHITECTURE.md — the authoritative layering contract already
referenced by surfaces/__init__.py: the four-tier layer table, folder
diagram, per-layer responsibilities, cross-layer flow examples, and how
.importlinter.strict / check_direct_imports.py enforce it.
Wire it into AGENTS.md (repo map), REFACTOR_CHECKLIST.md, and
docs/DEVELOPMENT.md so refactor work starts from a single source of truth.
* docs(architecture): trim to architecture, drop enforcement/refactor framing
Refocus docs/ARCHITECTURE.md on the system's shape — layer table, folder
diagram, per-layer responsibilities, cross-layer flows, and the key design
decisions (nothing imports surfaces; core<->platform coupling). Reduce
CI-enforcement to a single sentence and drop the burn-down-debt section and
refactor-process framing, which are policing detail, not architecture.
Revert the REFACTOR_CHECKLIST.md pointer and de-emphasize refactor language
in the AGENTS.md / DEVELOPMENT.md index rows.
* docs(architecture): fix layer diagram edges (greploop)
Address Greptile review: add the missing GATEWAY -> INTEGRATIONS edge so the
diagram matches the layer table, and replace subgraph-source edges
(T1/T2/T3 -> CONFIG) with explicit node edges that render on GitHub. Draw
adjacent-tier edges only for readability, with a caption noting the full
'any lower tier' rule.
* docs(architecture): state tools/integrations edge as enforced reality (greploop)
Resolve Greptile P1 self-contradiction: the layer table called tools and
integrations independent peers ('must not import each other'), but the CLI
flow diagram and step 3 correctly show tools -> integrations. State the
enforced rule instead — integrations must never import tools, while the
reverse edge exists, so integrations effectively sits below tools. Flow
diagram now matches the contract.
* docs(architecture): split Tier 2 row for asymmetric tools/integrations rule (greploop)
Address Greptile 4/5: the shared Tier 2 'May import' cell omitted the
tools -> integrations edge that the peer-rule column, prose, and CLI diagram
all state is valid. Split into per-package rows so each 'May import' /
'Must never import' cell is precise: tools may import integrations; integrations
must never import tools.
* ci(codeql): skip analysis for docs-only PRs
Add paths-ignore (Markdown/MDX and docs/) to the pull_request trigger so
docs-only PRs don't spend CI minutes on a Python security scan that has
nothing to analyze. CodeQL is not a required check, so a skipped run cannot
block merge; push-to-main and the weekly schedule keep full coverage.
44 lines
1.0 KiB
YAML
44 lines
1.0 KiB
YAML
name: CodeQL
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
# Skip CodeQL for docs-only PRs (Markdown/MDX and the docs site tree) to
|
|
# save CI minutes. Not a required check, so skipping cannot block merge.
|
|
# `push` to main and the weekly schedule keep full coverage regardless.
|
|
paths-ignore:
|
|
- '**/*.md'
|
|
- '**/*.mdx'
|
|
- 'docs/**'
|
|
schedule:
|
|
- cron: "0 6 * * 1"
|
|
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
actions: read
|
|
|
|
jobs:
|
|
analyze:
|
|
if: github.repository == 'Tracer-Cloud/opensre'
|
|
name: Analyze (python)
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@v4
|
|
with:
|
|
languages: python
|
|
build-mode: none
|
|
config-file: .github/codeql/codeql-config.yml
|
|
queries: security-and-quality
|
|
|
|
- name: Perform CodeQL Analysis
|
|
uses: github/codeql-action/analyze@v4
|
|
with:
|
|
category: /language:python
|