From 05e7e2b705a5adf1f318aa66d6c42d22e3a81876 Mon Sep 17 00:00:00 2001 From: Renn F Date: Mon, 28 Sep 2026 23:31:48 +0200 Subject: [PATCH 1/3] chore(scaffold): add community health files, align engine dev stamp with adapters - security policy, contributing guide, code of conduct, funding, pull request template, and issue template set (fastapi-guard baseline) - ecosystem-gate ci-only engine stamp 4.1.99 -> 4.2.99 to match the 4.2.99 stamp every adapter ci/drift/scheduled workflow applies --- .github/FUNDING.yml | 14 +++ .github/ISSUE_TEMPLATE/bug.yml | 53 +++++++++ .github/ISSUE_TEMPLATE/config.yml | 11 ++ .github/ISSUE_TEMPLATE/docs.yml | 31 +++++ .github/ISSUE_TEMPLATE/feature.yml | 35 ++++++ .github/PULL_REQUEST_TEMPLATE.md | 61 ++++++++++ .github/workflows/ecosystem-gate.yml | 4 +- CODE_OF_CONDUCT.md | 162 +++++++++++++++++++++++++++ CONTRIBUTING.md | 40 +++++++ SECURITY.md | 36 ++++++ 10 files changed, 445 insertions(+), 2 deletions(-) create mode 100644 .github/FUNDING.yml create mode 100644 .github/ISSUE_TEMPLATE/bug.yml create mode 100644 .github/ISSUE_TEMPLATE/config.yml create mode 100644 .github/ISSUE_TEMPLATE/docs.yml create mode 100644 .github/ISSUE_TEMPLATE/feature.yml create mode 100644 .github/PULL_REQUEST_TEMPLATE.md create mode 100644 CODE_OF_CONDUCT.md create mode 100644 CONTRIBUTING.md create mode 100644 SECURITY.md diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml new file mode 100644 index 0000000..f02f17a --- /dev/null +++ b/.github/FUNDING.yml @@ -0,0 +1,14 @@ +# These are supported funding model platforms + +github: rennf93 +# patreon: # Replace with a single Patreon username +# open_collective: # Replace with a single Open Collective username +# ko_fi: # Replace with a single Ko-fi username +# tidelift: # not applicable for this ecosystem +# community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry +# liberapay: # Replace with a single Liberapay username +# issuehunt: # Replace with a single IssueHunt username +# lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry +# polar: # Replace with a single Polar username +# buy_me_a_coffee: # Replace with a single Buy Me a Coffee username +custom: ['https://paypal.me/renzof93'] diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml new file mode 100644 index 0000000..9bbe9b8 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug.yml @@ -0,0 +1,53 @@ +name: Bug report +description: Guard Core PHP does not behave as documented +title: "[BUG] " +labels: [bug] +body: + - type: input + id: value + attributes: + label: Value this delivers + description: One sentence a user could witness once this is fixed. + placeholder: "Requests whose JSON body contains a URL are no longer flagged on endpoints that disable suspicious-pattern detection." + validations: + required: true + - type: textarea + id: what + attributes: + label: What happened + description: What you did, what you expected, what you got. Error messages, tracebacks and logs go here. + validations: + required: true + - type: textarea + id: steps + attributes: + label: Steps to reproduce + placeholder: | + 1. Configure Guard Core PHP with '...' + 2. Send a request to '...' + 3. See error + validations: + required: true + - type: input + id: versions + attributes: + label: Versions + description: guard-core-php version, PHP version, OS. + placeholder: "guard-core-php 4.2.0, PHP 8.3.14, Ubuntu 24.04" + validations: + required: true + - type: textarea + id: config + attributes: + label: Configuration + description: Your config with secrets masked. + render: php + placeholder: | + use RenzoFranceschini\GuardCore\Config\SecurityConfig; + + $config = new SecurityConfig(...); + - type: textarea + id: context + attributes: + label: Additional context + description: Production or development, consistent or intermittent, workarounds tried. diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..c3f7631 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,11 @@ +blank_issues_enabled: false +contact_links: + - name: Guard Core PHP Documentation + url: https://rennf93.github.io/guard-core-php/ + about: Check the documentation for usage information and tutorials + - name: Usage Questions + url: https://github.com/rennf93/guard-core-php/discussions + about: Please ask and answer questions in GitHub Discussions + - name: Discord + url: https://discord.gg/ZW7ZJbjMkK + about: Questions and support in #help, new versions in #releases, development stream in #dev-feed \ No newline at end of file diff --git a/.github/ISSUE_TEMPLATE/docs.yml b/.github/ISSUE_TEMPLATE/docs.yml new file mode 100644 index 0000000..d9c8b3d --- /dev/null +++ b/.github/ISSUE_TEMPLATE/docs.yml @@ -0,0 +1,31 @@ +name: Documentation +description: Wrong, missing or unclear Guard Core PHP documentation +title: "[DOCS] " +labels: [documentation] +body: + - type: input + id: value + attributes: + label: Value this delivers + description: One sentence a reader could witness once this is fixed. + placeholder: "The Redis page shows the exact config for a TLS connection." + validations: + required: true + - type: input + id: page + attributes: + label: Page + description: URL of the page or section. + validations: + required: true + - type: textarea + id: problem + attributes: + label: What is wrong or missing + validations: + required: true + - type: textarea + id: proposal + attributes: + label: Proposed text + render: markdown diff --git a/.github/ISSUE_TEMPLATE/feature.yml b/.github/ISSUE_TEMPLATE/feature.yml new file mode 100644 index 0000000..a135ee4 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature.yml @@ -0,0 +1,35 @@ +name: Feature request +description: Suggest an improvement to Guard Core PHP +title: "[FEATURE] " +labels: [enhancement] +body: + - type: input + id: value + attributes: + label: Value this delivers + description: One sentence a user could witness once this exists. + placeholder: "A single decorator disables all detection for one endpoint." + validations: + required: true + - type: textarea + id: job + attributes: + label: The job you are trying to get done + description: The outcome you need, not the mechanism you imagine. + validations: + required: true + - type: textarea + id: workaround + attributes: + label: How you work around it today + - type: textarea + id: example + attributes: + label: Example usage + description: Pseudocode of how you would like to use it. + render: php + - type: textarea + id: context + attributes: + label: Additional context + description: Similar features in other libraries, constraints, API implications. diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..f2b5e09 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,61 @@ +Delivers issue: # + + + +Description +=========== + + + +___ + +Motivation and Context +---------------------- + + + + +___ + +Type of change +-------------- + + + +- [ ] Bug fix (non-breaking change which fixes an issue) +- [ ] New feature (non-breaking change which adds functionality) +- [ ] Breaking change (fix or feature that would cause existing functionality to change) +- [ ] Documentation change +- [ ] Performance improvement +- [ ] Code cleanup or refactoring + +___ + +How Has This Been Tested +------------------------- + + + + + +___ + +Screenshots (if appropriate) +----------------------------- + +___ + +Checklist +--------- + + + + +- [ ] My code follows the code style of this project (Mypy, Ruff) +- [ ] I have added tests to cover my changes +- [ ] All new and existing tests passed +- [ ] My change requires a change to the documentation +- [ ] I have updated the documentation accordingly +- [ ] I have checked that my changes don't introduce any new warnings or errors +- [ ] I have updated the version number if necessary +- [ ] I have added any new dependencies to the appropriate requirements file diff --git a/.github/workflows/ecosystem-gate.yml b/.github/workflows/ecosystem-gate.yml index 5e42edd..8f4ce17 100644 --- a/.github/workflows/ecosystem-gate.yml +++ b/.github/workflows/ecosystem-gate.yml @@ -75,7 +75,7 @@ jobs: # consumer's github VCS fallback hard-fails (anonymous GitHub API auth). # CI-only patch, runner filesystem only, published files untouched: # stamp a version onto this checkout's composer.json so the consumer's - # path repository supplies a ^4.1.0 version without git (shallow + # path repository supplies a ^4.2.0 version without git (shallow # detached checkout, dubious ownership inside the container), and drop # the engine VCS repo entry so composer never eagerly clones github. - name: Resolve the engine from this checkout (CI-only patch) @@ -87,7 +87,7 @@ jobs: engine = "guard-core-php/composer.json" with open(engine) as f: d = json.load(f) - d["version"] = "4.1.99" + d["version"] = "4.2.99" with open(engine, "w") as f: json.dump(d, f, indent=4) f.write("\n") diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..a733ba2 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,162 @@ +Contributor Covenant Code of Conduct +==================================== + +___ + +Our Pledge +----------- + +We as members, contributors, and leaders pledge to make participation in our +community a harassment-free experience for everyone, regardless of age, body +size, visible or invisible disability, ethnicity, sex characteristics, gender +identity and expression, level of experience, education, socio-economic status, +nationality, personal appearance, race, religion, or sexual identity +and orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, +diverse, inclusive, and healthy community. + +___ + +Our Standards +------------- + +Examples of behavior that contributes to a positive environment for our +community include: + +* Demonstrating empathy and kindness toward other people +* Being respectful of differing opinions, viewpoints, and experiences +* Giving and gracefully accepting constructive feedback +* Accepting responsibility and apologizing to those affected by our mistakes, + and learning from the experience +* Focusing on what is best not just for us as individuals, but for the + overall community + +Examples of unacceptable behavior include: + +* The use of sexualized language or imagery, and sexual attention or + advances of any kind +* Trolling, insulting or derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or email + address, without their explicit permission +* Other conduct which could reasonably be considered inappropriate in a + professional setting + +___ + +Enforcement Responsibilities +---------------------------- + +Community leaders are responsible for clarifying and enforcing our standards of +acceptable behavior and will take appropriate and fair corrective action in +response to any behavior that they deem inappropriate, threatening, offensive, +or harmful. + +Community leaders have the right and responsibility to remove, edit, or reject +comments, commits, code, wiki edits, issues, and other contributions that are +not aligned to this Code of Conduct, and will communicate reasons for moderation +decisions when appropriate. + +___ + +Scope +----- + +This Code of Conduct applies within all community spaces, and also applies when +an individual is officially representing the community in public spaces. +Examples of representing our community include using an official e-mail address, +posting via an official social media account, or acting as an appointed +representative at an online or offline event. + +___ + +Enforcement +----------- + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported to the community leaders responsible for enforcement at +@rennf93. +All complaints will be reviewed and investigated promptly and fairly. + +All community leaders are obligated to respect the privacy and security of the +reporter of any incident. + +___ + +Enforcement Guidelines +---------------------- + +Community leaders will follow these Community Impact Guidelines in determining +the consequences for any action they deem in violation of this Code of Conduct: + +___ + +Correction +---------- + +**Community Impact**: Use of inappropriate language or other behavior deemed +unprofessional or unwelcome in the community. + +**Consequence**: A private, written warning from community leaders, providing +clarity around the nature of the violation and an explanation of why the +behavior was inappropriate. A public apology may be requested. + +___ + +Warning +------- + +**Community Impact**: A violation through a single incident or series +of actions. + +**Consequence**: A warning with consequences for continued behavior. No +interaction with the people involved, including unsolicited interaction with +those enforcing the Code of Conduct, for a specified period of time. This +includes avoiding interactions in community spaces as well as external channels +like social media. Violating these terms may lead to a temporary or +permanent ban. + +___ + +Temporary Ban +------------- + +**Community Impact**: A serious violation of community standards, including +sustained inappropriate behavior. + +**Consequence**: A temporary ban from any sort of interaction or public +communication with the community for a specified period of time. No public or +private interaction with the people involved, including unsolicited interaction +with those enforcing the Code of Conduct, is allowed during this period. +Violating these terms may lead to a permanent ban. + +___ + +Permanent Ban +------------- + +**Community Impact**: Demonstrating a pattern of violation of community +standards, including sustained inappropriate behavior, harassment of an +individual, or aggression toward or disparagement of classes of individuals. + +**Consequence**: A permanent ban from any sort of public interaction within +the community. + +___ + +Attribution +----------- + +This Code of Conduct is adapted from the [Contributor Covenant][homepage], +version 2.0, available at +. + +Community Impact Guidelines were inspired by [Mozilla's code of conduct +enforcement ladder](https://github.com/mozilla/diversity). + +[homepage]: https://www.contributor-covenant.org + +For answers to common questions about this code of conduct, see the FAQ at +. Translations are available at +. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..c39190d --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,40 @@ +# Contributing to Guard Core PHP + +Thanks for considering a contribution to Guard Core PHP, part of the Guard ecosystem (this repo follows the conventions of the Python baseline: guard-core and fastapi-guard). + +## Development Setup + +Requirements: + +- PHP ^8.2 (the library supports 8.2, 8.3, and 8.4) +- Composer 2 +- Docker (Redis runs as a CI service locally too, via `docker run -p 6379:6379 redis:7-alpine`; hosts without a PHP toolchain run everything through the `php:8.3-cli` and `composer:2` images, see the Makefile) + +```bash +composer install +composer conformance # engine conformance suite +composer lint # syntax sweep over src/ and bin/ +make test # full runner sweep over bin/test_*.php (Docker fallback included) +``` + +## Quality Gates + +Run before pushing (CI enforces the same checks): + +- `composer lint` (php -l sweep over src and bin) +- the runner suites under `bin/` (`make test`) +- `composer audit` (dependency vulnerability check, also on the weekly schedule) + +## Pull Requests + +- Every PR closes an open issue ("Delivers issue: #N") or carries the `no-issue` label (chores and dependency bumps). +- Keep the CI green; one clean push per PR is preferred. +- Commit messages: lowercase, imperative, conventional style (`fix(scope): ...`, `feat(scope): ...`, `ci(scope): ...`). No attribution trailers. + +## Security + +Never open public issues for security vulnerabilities. Follow SECURITY.md and report via GitHub security advisories. + +## Questions + +Open a GitHub Discussion in this repository or ask in the Guard Discord (#help). diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..5c78421 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,36 @@ +# Security Policy for Guard Core PHP + +## Supported Versions + +We currently provide security updates for the following versions of Guard Core PHP: + +| Version | Supported | +| ------- | ------------------ | +| 4.2.x | :white_check_mark: | +| 4.0.x | :white_check_mark: | +| < 4.0.0 | :x: | + +## Reporting a Vulnerability + +We take the security of Guard Core PHP seriously. If you believe you've found a security vulnerability, please follow these steps: + +1. **Do not disclose the vulnerability publicly** until it has been addressed by the maintainers. +2. **Report the vulnerability through GitHub's security advisory feature**: + - Go to the [Security tab](https://github.com/rennf93/guard-core-php/security/advisories) of the Guard Core PHP repository + - Click on "New draft security advisory" + - Fill in the details of the vulnerability + - Submit the advisory + + Alternatively, you can report vulnerabilities through [GitHub's private vulnerability reporting feature](https://github.com/rennf93/guard-core-php/security/advisories/new). + +3. Include the following information in your report: + - A description of the vulnerability and its potential impact + - Steps to reproduce the issue + - Affected versions + - Any potential mitigations or workarounds + +The maintainers will acknowledge your report within 48 hours and provide a detailed response within 7 days, including the next steps in handling the vulnerability. + +## Security Considerations + +Guard Core PHP is a security library: report anything that weakens detection, bypasses rate limiting, leaks secrets into logs, or trusts unvalidated input. From 18095406bd7408275af04e7dbd86be5e46dd3aef Mon Sep 17 00:00:00 2001 From: Renn F Date: Tue, 29 Sep 2026 00:44:58 +0200 Subject: [PATCH 2/3] ci(security): add the semgrep security-audit and secrets gate --- .github/workflows/semgrep.yml | 38 +++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 .github/workflows/semgrep.yml diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml new file mode 100644 index 0000000..6dde008 --- /dev/null +++ b/.github/workflows/semgrep.yml @@ -0,0 +1,38 @@ +name: Semgrep + +on: + push: + branches: + - master + paths: + - 'src/**' + - '.github/workflows/semgrep.yml' + pull_request: + paths: + - 'src/**' + - '.github/workflows/semgrep.yml' + schedule: + - cron: '0 7 * * 1' + +permissions: + contents: read + +jobs: + semgrep: + name: Security audit (semgrep) + runs-on: ubuntu-latest + timeout-minutes: 15 + permissions: + contents: read + container: + image: semgrep/semgrep:1.177.0 + env: + SEMGREP_SEND_METRICS: off + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Scan src with the security-audit and secrets rulesets + run: semgrep scan --config p/security-audit --config p/secrets --metrics=off --error --quiet src From 7d53a4e6447ac5740d2f071f74b50c73d062d136 Mon Sep 17 00:00:00 2001 From: Renn F Date: Wed, 30 Sep 2026 02:20:46 +0200 Subject: [PATCH 3/3] ci(gate): give the slim-guard consumer the psr15-guard path sibling slim-guard 1.2.0 added the rennf93/psr15-guard path repository and its composer.lock pins psr15-guard at the CI-only 1.2.99 path version, which Packagist cannot satisfy, so the consumer-test install fails with 'Source path ../psr15-guard is not found' on every run that checks the consumer out at its current default branch (the failure first surfaced on this PR's ecosystem gate; master last passed before the 1.2.0 lock landed). Check the sibling out next to slim-guard and version-stamp it 1.2.99 in the CI-only patch step, mirroring slim-guard's own ci.yml pattern; verified locally: composer install + update resolve both path packages and bin/test_slim.php passes 81/81. --- .github/workflows/ecosystem-gate.yml | 33 +++++++++++++++++++++++++--- 1 file changed, 30 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ecosystem-gate.yml b/.github/workflows/ecosystem-gate.yml index 8f4ce17..2f781f8 100644 --- a/.github/workflows/ecosystem-gate.yml +++ b/.github/workflows/ecosystem-gate.yml @@ -70,6 +70,21 @@ jobs: ref: ${{ github.event.inputs.consumer_ref }} path: ${{ matrix.consumer.path }} + # slim-guard 1.2.0 added the rennf93/psr15-guard path repository and + # its composer.lock pins psr15-guard at the CI-only 1.2.99 path + # version, which Packagist cannot satisfy: without the sibling the + # install fails with "Source path ../psr15-guard is not found". Check + # the sibling out next to the consumer (same pattern as slim-guard's + # own ci.yml); the patch step below stamps it. + - name: Checkout the psr15-guard path sibling (slim-guard) + if: matrix.consumer.repo == 'rennf93/slim-guard' + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: rennf93/psr15-guard + ref: master + path: psr15-guard + persist-credentials: false + # guard-core-php v4.1.0 was yanked: the tag is deleted and Packagist # no longer lists it, so ^4.1.0 cannot resolve from Packagist and the # consumer's github VCS fallback hard-fails (anonymous GitHub API auth). @@ -92,14 +107,26 @@ jobs: json.dump(d, f, indent=4) f.write("\n") + # The slim-guard sibling gets the same CI-only version stamp: a + # detached checkout carries no version a path repository can + # infer, and the consumer's lock pins psr15-guard at 1.2.99. + psr15 = "psr15-guard/composer.json" + if os.path.isfile(psr15): + with open(psr15) as f: + d = json.load(f) + d["version"] = "1.2.99" + with open(psr15, "w") as f: + json.dump(d, f, indent=4) + f.write("\n") + consumer = "${{ matrix.consumer.path }}/composer.json" with open(consumer) as f: d = json.load(f) # Drop every VCS repo entry (any github fallback hard-fails on # anonymous API auth now) and every path entry whose directory is - # not checked out in this workspace (slim-guard also carries a - # psr15-guard pair whose sibling does not exist here; it resolves - # from Packagist instead). + # not checked out in this workspace; those resolve from Packagist. + # The slim-guard job checks the psr15-guard sibling out above, so + # its path pair is kept and installs from the workspace. d["repositories"] = [ repo for repo in d.get("repositories", [])