diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..7f63dcf --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,3 @@ +# Global Code Owners +# Maintained by Dennis Westermann and trusted-coders +* @cubetribe @VibecodingGermany/trusted-coders diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml new file mode 100644 index 0000000..9b6f98d --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -0,0 +1,37 @@ +name: 🐛 Bug Report +description: Report a bug or unexpected behavior in VCG Forum MCP +labels: ["bug"] +body: + - type: markdown + attributes: + value: | + Thanks for taking the time to report an issue! Please provide as much detail as possible. + - type: input + id: version + attributes: + label: VCG Forum MCP Version + description: What version are you using? (Run `vcg-forum-mcp --version` or check your npx output) + placeholder: e.g. 0.1.0 + validations: + required: true + - type: input + id: environment + attributes: + label: Environment & AI Client + description: OS and AI client where the issue occurred + placeholder: e.g. macOS Sequoia 15.2 / Claude Code 1.0.18 / Claude Desktop / Antigravity + validations: + required: true + - type: textarea + id: description + attributes: + label: What happened? + description: Describe the bug and what you expected to happen instead. + validations: + required: true + - type: textarea + id: logs + attributes: + label: Relevant Log Output + description: Please copy and paste any relevant terminal output (ensure no secrets are included!). + render: shell diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..ad16d7f --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,8 @@ +blank_issues_enabled: false +contact_links: + - name: 💬 VibeCoding Germany Community Forum + url: https://forum.vibecoding-germany.de + about: Ask questions, discuss workflows, or share your MCP setups with the community! + - name: 🔒 Report a Security Vulnerability + url: mailto:hey@dennis-westermann.de + about: Please report security vulnerabilities privately via email. diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml new file mode 100644 index 0000000..db2eb58 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -0,0 +1,22 @@ +name: ✨ Feature Request / Improvement +description: Suggest an idea or tool improvement for VCG Forum MCP +labels: ["enhancement"] +body: + - type: markdown + attributes: + value: | + Have an idea to make VCG Forum MCP better? We would love to hear it! + - type: textarea + id: feature-description + attributes: + label: Feature / Tool Description + description: What tool or functionality would you like to see added? + validations: + required: true + - type: textarea + id: use-case + attributes: + label: Use Case / AI Workflow + description: How would you use this with your AI assistant (Claude Code, Desktop, Cursor, etc.)? + validations: + required: true diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..f023555 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,20 @@ +## Description + + +## Type of Change +- [ ] 🐛 Bugfix (non-breaking fix) +- [ ] ✨ Feature (non-breaking feature addition) +- [ ] 🔒 Security (security patch or vulnerability mitigation) +- [ ] 📝 Documentation (updates to README, SETUP, or guides) +- [ ] 🔧 Refactor / Tooling (internal code cleanup, CI, or tests) + +## Verification + +- [ ] Local smoke test / CLI test passed +- [ ] Tested against live/mock Discourse endpoint +- [ ] CI matrix passed + +## Checklist +- [ ] My code follows the repository conventions and coding guidelines. +- [ ] I have updated the documentation where appropriate. +- [ ] No sensitive credentials or tokens are committed. diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..1cbd23c --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,29 @@ +version: 2 +updates: + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + open-pull-requests-limit: 10 + groups: + dependencies: + patterns: + - "*" + labels: + - "dependencies" + - "security" + + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + open-pull-requests-limit: 5 + groups: + github-actions: + patterns: + - "*" + labels: + - "github-actions" + - "security" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..46658f4 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,48 @@ +name: CI + +on: + push: + branches: + - main + - 'codex/**' + - 'feat/**' + - 'fix/**' + pull_request: + branches: + - main + +permissions: + contents: read + +jobs: + test: + name: Test & Smoke Check + runs-on: ${{ matrix.os }} + strategy: + fail-fast: false + matrix: + os: [ubuntu-latest, macos-latest] + node-version: [18.x, 20.x, 22.x] + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Setup Node.js ${{ matrix.node-version }} + uses: actions/setup-node@v4 + with: + node-version: ${{ matrix.node-version }} + cache: 'npm' + + - name: Install dependencies + run: npm ci + + - name: Verify CLI Version & Help + run: | + node src/cli.js --version + node src/cli.js --help + node src/cli.js config + + - name: Smoke Test (CLI Entrypoint & Arg Parser) + run: | + node -e "import('./src/cli.js');" -- --help diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..f963e67 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,32 @@ +name: "CodeQL Security Analysis" + +on: + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + schedule: + - cron: '35 6 * * 1' + +permissions: + contents: read + security-events: write + +jobs: + analyze: + name: Analyze (JavaScript) + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: 'javascript-typescript' + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:javascript-typescript" diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml new file mode 100644 index 0000000..3e8fe75 --- /dev/null +++ b/.github/workflows/security-audit.yml @@ -0,0 +1,28 @@ +name: Security Audit + +on: + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + schedule: + - cron: '0 0 * * 0' # Weekly on Sunday + +permissions: + contents: read + +jobs: + audit: + name: NPM Audit + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: '20.x' + + - name: Run npm audit + run: npm audit --audit-level=high || true diff --git a/SECURITY.md b/SECURITY.md index a5d86ec..754131e 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -78,11 +78,11 @@ Neither this wrapper nor `@discourse/mcp` runs any install-time scripts (`preins If you find a security issue in this wrapper: 1. **Do not open a public GitHub issue.** -2. **Email** `cubetribe@googlemail.com` with: +2. **Email** `hey@dennis-westermann.de` with: - A description of the vulnerability - Steps to reproduce (if applicable) - Potential impact -3. We will investigate and coordinate a fix/release. +3. We will acknowledge receipt within 48 hours and coordinate a fix/release. ## Secret management