diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..2b7395d --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,50 @@ +# Contributing + +Contributions are licensed under the [Apache License, Version 2.0](LICENSE), as section 5 of the license describes; +there is no separate contributor agreement. +Report security issues through the [security policy](SECURITY.md), not a public issue. + +## Before you start + +Bug fixes, tests and documentation corrections are welcome as pull requests. +For changes to the exported API, trust boundaries, error policy or compatibility, open an issue first. +Those decisions are recorded in [docs/decisions](docs/decisions/README.md) and approved before implementation. +The [support matrix](docs/support.md) separates implemented behavior from deferred scope. + +## Development + +Use Go 1.27 or later; +the module keeps its `go 1.27.0` baseline. +Run these from the repository root before opening a pull request: + +```bash +gofmt -l . +go vet ./... +go mod verify +go test -race ./... +sh scripts/check-consumer.sh +GOOS=linux GOARCH=arm64 CGO_ENABLED=0 go build ./... +GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build ./... +git diff --check +``` + +`gofmt -l .` should print nothing. +Tests use the standard `testing` package, local HTTP test servers and synthetic fixtures. +Never commit real credentials, and do not call live AWS services from unit tests. + +## Style + +Follow [Effective Go](https://go.dev/doc/effective_go) and the [Google Go style guide](https://google.github.io/styleguide/go/). +Do not wrap code or prose at a fixed column. +In Markdown and comments, put each sentence on its own line, and break after a semicolon between independent clauses. + +## Commits and pull requests + +Pull requests are squash-merged, so the pull request title becomes the commit message. +Write it as a [Conventional Commit](https://www.conventionalcommits.org/): `feat:`, `fix:`, `docs:`, `refactor:` and so on. +Mark a breaking change with `!` in the title, such as `refactor!: rename X`, so Release Please records it. +Describe the resulting behavior, how you validated it and any limitations. + +Release Please owns CHANGELOG.md, versions and tags; +do not edit them by hand. +[AGENTS.md](AGENTS.md) records the full working agreement used in this repository. diff --git a/README.md b/README.md index c99712a..ccaf75b 100644 --- a/README.md +++ b/README.md @@ -71,7 +71,7 @@ do not select again from mutable headers. An action header does not authenticate a caller. The selector works with both ordinary Go HTTP servers and the Lambda adapter. -See the [runnable middleware example](action_example_test.go) and [accepted header contract](docs/decisions/0011-request-header-processing.md). +See the [runnable middleware example](actionheader/example_test.go) and [accepted header contract](docs/decisions/0011-request-header-processing.md). ## Response header budget @@ -129,6 +129,8 @@ post-handoff streaming panics become terminal errors. - [Repository working agreement](AGENTS.md) - [Release workflow and GitHub App setup](docs/releases.md) - [Initial codec benchmarks](docs/benchmarks.md) +- [Contributing](CONTRIBUTING.md) +- [Security policy](SECURITY.md) ## License diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..d753622 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,38 @@ +# Security policy + +This module sits on the authentication and authorization path of the applications that use it, so please report suspected vulnerabilities privately. + +## Supported versions + +Before v1, only the latest minor release receives security fixes. +Fixes ship as a new release; +earlier minor versions are not patched. + +## Reporting a vulnerability + +Use GitHub's [private vulnerability reporting](https://github.com/asteroid-computing/go-lambda-edge/security/advisories/new) (Security tab, then "Report a vulnerability"). +Do not open a public issue, pull request or discussion for a suspected vulnerability. + +Include the affected package and version, the impact you expect, and steps to reproduce. +Use synthetic credentials only. +Never send real access tokens, private keys, AWS credentials or signed IAM proofs, even in a private report. + +## Scope + +In scope: + +- Authentication or authorization bypass in `authn`, `iamproof` or `authz`. +- Caller confusion or replacement in `identity` or gateway identity handling. +- Credentials, claims or request values leaking through errors or diagnostics. +- Ways around documented resource limits. +- Action-selection ambiguity in `actionheader` that lets one request act as another. + +Out of scope: + +- Deployment configuration documented as the consumer's responsibility, such as API Gateway authorizers, CORS or TLS termination. +- Behavior the [support matrix](docs/support.md) already lists as unverified or deferred. +- Vulnerabilities in dependencies; report those upstream, and tell us if this module's use makes them exploitable. + +## Process + +The maintainer coordinates the fix and disclosure through a GitHub security advisory and credits reporters who want credit. diff --git a/docs/decisions/0024-release-automation.md b/docs/decisions/0024-release-automation.md index 69f0659..2451bbc 100644 --- a/docs/decisions/0024-release-automation.md +++ b/docs/decisions/0024-release-automation.md @@ -154,3 +154,7 @@ The working branch was pushed and PR #1 opened. [All four PR checks at f6a2624 passed](https://github.com/asteroid-computing/go-lambda-edge/actions/runs/35619720590). App installation/permissions and the main-branch release path still need execution evidence after merge. No release has been published. + +Release execution, verified on 2026-10-02: Release Please minted its App token, opened and maintained [the release PR](https://github.com/asteroid-computing/go-lambda-edge/pull/3), and its Go checks passed. +After the owner merged it, the release run succeeded and published [v0.1.0](https://github.com/asteroid-computing/go-lambda-edge/releases/tag/v0.1.0), tagged at the release commit 9423302 with the manifest at 0.1.0. +The accepted workflow is now proven end to end. diff --git a/docs/decisions/0025-main-branch-protection.md b/docs/decisions/0025-main-branch-protection.md index fa9f861..8bf8061 100644 --- a/docs/decisions/0025-main-branch-protection.md +++ b/docs/decisions/0025-main-branch-protection.md @@ -8,6 +8,10 @@ Owner direction on 2026-09-27: update readiness documentation, then the owner wi Branch protection was not approved as part of that instruction; this proposal remains unimplemented. +Owner direction on 2026-10-02: the owner will configure branch protection manually in repository settings. +No agent changes repository policy; +this record documents the recommended rule set for that configuration. + ## Evidence PR #1 at f6a2624469d14a150d89e0f5911644db86449e31 is mergeable, with all four [Go checks passing](https://github.com/asteroid-computing/go-lambda-edge/actions/runs/35619720590). diff --git a/docs/decisions/README.md b/docs/decisions/README.md index e838715..7e2eb14 100644 --- a/docs/decisions/README.md +++ b/docs/decisions/README.md @@ -31,6 +31,6 @@ Keep related decisions small enough to review and implement independently. | [0021: Authorization rules](0021-authorization-rules.md) | Accepted; rules, examples and local validation implemented | What rule API, IAM/JWT predicates, failure semantics and consumer resolution/dispatch boundaries should authz expose? | | [0022: Streaming writer review](0022-streaming-writer-review.md) | Accepted; writer, public entry points and local validation complete; SDK deployment gate retained | Should streaming omit inferred lengths, how should empty Content-Encoding affect sniffing, and what SDK evidence remains missing? | | [0023: Consumer readiness](0023-consumer-readiness.md) | R1–R6 accepted (Apache-2.0 license); local implementation complete; AWS deployment qualifications open | What complete consumer example, test support, deferred scope and release preparation should follow the implemented packages? | -| [0024: Release automation](0024-release-automation.md) | Accepted; PR-only validation and organization credentials; App installation verified, release execution pending | How should release PRs, validation, credentials and initial versioning work? | -| [0025: Main-branch protection](0025-main-branch-protection.md) | Proposed; awaiting owner review | Should the existing four CI checks and PR workflow be enforced before merging to main? | +| [0024: Release automation](0024-release-automation.md) | Accepted; PR-only validation and organization credentials; v0.1.0 released on 2026-10-02 | How should release PRs, validation, credentials and initial versioning work? | +| [0025: Main-branch protection](0025-main-branch-protection.md) | Proposed; owner configuring manually | Should the existing four CI checks and PR workflow be enforced before merging to main? | | [0026: Exported API review](0026-exported-api-review.md) | E1–E6 accepted and implemented in stacked PRs; E7 rejected | Which exported API changes does Google's Go style guidance support before the first release? | diff --git a/docs/plan.md b/docs/plan.md index 430ee99..5095110 100644 --- a/docs/plan.md +++ b/docs/plan.md @@ -335,7 +335,8 @@ The owner resolved R6 on 2026-10-02: Apache-2.0, with Andrew Beck as copyright h - [x] Obtain actual GitHub CI evidence for the foundation PR; all four jobs passed at f6a2624. Later commits require their own passing checks. -- [ ] Verify the main release workflow and resolve publication prerequisites before a release. +- [x] Verify the main release workflow and resolve publication prerequisites before a release. + v0.1.0 was released on 2026-10-02. Streaming deployment and live identity interoperability remain separate qualifications. The [complete dispatcher](../examples/dispatcher/README.md), [testing guide](consumer-testing.md), [support matrix](support.md) and [release checklist](release-readiness.md) are implemented. diff --git a/docs/release-readiness.md b/docs/release-readiness.md index 5b87db3..7c576a4 100644 --- a/docs/release-readiness.md +++ b/docs/release-readiness.md @@ -29,7 +29,8 @@ Secret metadata and repository access were verified on 2026-09-27; the obsolete repository variable and private-key secret were removed. The new key and Client ID were verified against the astrocompute-release-please App and its repository installation using read-only API calls without printing credentials. Its installation grants all three required write permissions. -No branch protection was configured. +No branch protection was configured; +the owner will configure it manually ([decision 0025](decisions/0025-main-branch-protection.md)). ## Outstanding evidence and owner choices @@ -39,7 +40,10 @@ Release Please has since executed successfully: the App opened [the v0.1.0 relea The owner chose the Apache License, Version 2.0 on 2026-10-02, with Andrew Beck as copyright holder ([decision 0023 R6](decisions/0023-consumer-readiness.md#r6-obtain-the-owners-distributionlicense-choice-before-publication)). LICENSE is the unmodified canonical text. -No repository visibility change, release tag or release publication has been performed. + +The owner merged the release PR on 2026-10-02, and the release run published [v0.1.0](https://github.com/asteroid-computing/go-lambda-edge/releases/tag/v0.1.0) at commit 9423302. +Repository visibility is unchanged; +make the repository public, enable private vulnerability reporting for the [security policy](../SECURITY.md), and then request the version from the Go module proxy so pkg.go.dev indexes it. REST streaming's SDK deployment qualification remains open: local probes cannot establish AWS acceptance of the observed mode-header/connection behavior. Authoritative clarification or a separately approved live test is still needed.