From 4e2fa9ffcbd39044623cc6b0d78491687eeec2cb Mon Sep 17 00:00:00 2001 From: AJ Beck Date: Fri, 2 Oct 2026 16:53:07 +0100 Subject: [PATCH] docs: record v0.1.0 release and add security and contributing guides Record the successful v0.1.0 release in decision 0024, the readiness checklist and the plan, and note in decision 0025 that the owner will configure branch protection manually. Add SECURITY.md for private vulnerability reports and CONTRIBUTING.md with the repository's checks and commit conventions. Fix the README link to the action-header example, which moved to the actionheader package. --- CONTRIBUTING.md | 50 +++++++++++++++++++ README.md | 4 +- SECURITY.md | 38 ++++++++++++++ docs/decisions/0024-release-automation.md | 4 ++ docs/decisions/0025-main-branch-protection.md | 4 ++ docs/decisions/README.md | 4 +- docs/plan.md | 3 +- docs/release-readiness.md | 8 ++- 8 files changed, 109 insertions(+), 6 deletions(-) create mode 100644 CONTRIBUTING.md create mode 100644 SECURITY.md diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..2b7395d --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,50 @@ +# Contributing + +Contributions are licensed under the [Apache License, Version 2.0](LICENSE), as section 5 of the license describes; +there is no separate contributor agreement. +Report security issues through the [security policy](SECURITY.md), not a public issue. + +## Before you start + +Bug fixes, tests and documentation corrections are welcome as pull requests. +For changes to the exported API, trust boundaries, error policy or compatibility, open an issue first. +Those decisions are recorded in [docs/decisions](docs/decisions/README.md) and approved before implementation. +The [support matrix](docs/support.md) separates implemented behavior from deferred scope. + +## Development + +Use Go 1.27 or later; +the module keeps its `go 1.27.0` baseline. +Run these from the repository root before opening a pull request: + +```bash +gofmt -l . +go vet ./... +go mod verify +go test -race ./... +sh scripts/check-consumer.sh +GOOS=linux GOARCH=arm64 CGO_ENABLED=0 go build ./... +GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build ./... +git diff --check +``` + +`gofmt -l .` should print nothing. +Tests use the standard `testing` package, local HTTP test servers and synthetic fixtures. +Never commit real credentials, and do not call live AWS services from unit tests. + +## Style + +Follow [Effective Go](https://go.dev/doc/effective_go) and the [Google Go style guide](https://google.github.io/styleguide/go/). +Do not wrap code or prose at a fixed column. +In Markdown and comments, put each sentence on its own line, and break after a semicolon between independent clauses. + +## Commits and pull requests + +Pull requests are squash-merged, so the pull request title becomes the commit message. +Write it as a [Conventional Commit](https://www.conventionalcommits.org/): `feat:`, `fix:`, `docs:`, `refactor:` and so on. +Mark a breaking change with `!` in the title, such as `refactor!: rename X`, so Release Please records it. +Describe the resulting behavior, how you validated it and any limitations. + +Release Please owns CHANGELOG.md, versions and tags; +do not edit them by hand. +[AGENTS.md](AGENTS.md) records the full working agreement used in this repository. diff --git a/README.md b/README.md index c99712a..ccaf75b 100644 --- a/README.md +++ b/README.md @@ -71,7 +71,7 @@ do not select again from mutable headers. An action header does not authenticate a caller. The selector works with both ordinary Go HTTP servers and the Lambda adapter. -See the [runnable middleware example](action_example_test.go) and [accepted header contract](docs/decisions/0011-request-header-processing.md). +See the [runnable middleware example](actionheader/example_test.go) and [accepted header contract](docs/decisions/0011-request-header-processing.md). ## Response header budget @@ -129,6 +129,8 @@ post-handoff streaming panics become terminal errors. - [Repository working agreement](AGENTS.md) - [Release workflow and GitHub App setup](docs/releases.md) - [Initial codec benchmarks](docs/benchmarks.md) +- [Contributing](CONTRIBUTING.md) +- [Security policy](SECURITY.md) ## License diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..d753622 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,38 @@ +# Security policy + +This module sits on the authentication and authorization path of the applications that use it, so please report suspected vulnerabilities privately. + +## Supported versions + +Before v1, only the latest minor release receives security fixes. +Fixes ship as a new release; +earlier minor versions are not patched. + +## Reporting a vulnerability + +Use GitHub's [private vulnerability reporting](https://github.com/asteroid-computing/go-lambda-edge/security/advisories/new) (Security tab, then "Report a vulnerability"). +Do not open a public issue, pull request or discussion for a suspected vulnerability. + +Include the affected package and version, the impact you expect, and steps to reproduce. +Use synthetic credentials only. +Never send real access tokens, private keys, AWS credentials or signed IAM proofs, even in a private report. + +## Scope + +In scope: + +- Authentication or authorization bypass in `authn`, `iamproof` or `authz`. +- Caller confusion or replacement in `identity` or gateway identity handling. +- Credentials, claims or request values leaking through errors or diagnostics. +- Ways around documented resource limits. +- Action-selection ambiguity in `actionheader` that lets one request act as another. + +Out of scope: + +- Deployment configuration documented as the consumer's responsibility, such as API Gateway authorizers, CORS or TLS termination. +- Behavior the [support matrix](docs/support.md) already lists as unverified or deferred. +- Vulnerabilities in dependencies; report those upstream, and tell us if this module's use makes them exploitable. + +## Process + +The maintainer coordinates the fix and disclosure through a GitHub security advisory and credits reporters who want credit. diff --git a/docs/decisions/0024-release-automation.md b/docs/decisions/0024-release-automation.md index 69f0659..2451bbc 100644 --- a/docs/decisions/0024-release-automation.md +++ b/docs/decisions/0024-release-automation.md @@ -154,3 +154,7 @@ The working branch was pushed and PR #1 opened. [All four PR checks at f6a2624 passed](https://github.com/asteroid-computing/go-lambda-edge/actions/runs/35619720590). App installation/permissions and the main-branch release path still need execution evidence after merge. No release has been published. + +Release execution, verified on 2026-10-02: Release Please minted its App token, opened and maintained [the release PR](https://github.com/asteroid-computing/go-lambda-edge/pull/3), and its Go checks passed. +After the owner merged it, the release run succeeded and published [v0.1.0](https://github.com/asteroid-computing/go-lambda-edge/releases/tag/v0.1.0), tagged at the release commit 9423302 with the manifest at 0.1.0. +The accepted workflow is now proven end to end. diff --git a/docs/decisions/0025-main-branch-protection.md b/docs/decisions/0025-main-branch-protection.md index fa9f861..8bf8061 100644 --- a/docs/decisions/0025-main-branch-protection.md +++ b/docs/decisions/0025-main-branch-protection.md @@ -8,6 +8,10 @@ Owner direction on 2026-09-27: update readiness documentation, then the owner wi Branch protection was not approved as part of that instruction; this proposal remains unimplemented. +Owner direction on 2026-10-02: the owner will configure branch protection manually in repository settings. +No agent changes repository policy; +this record documents the recommended rule set for that configuration. + ## Evidence PR #1 at f6a2624469d14a150d89e0f5911644db86449e31 is mergeable, with all four [Go checks passing](https://github.com/asteroid-computing/go-lambda-edge/actions/runs/35619720590). diff --git a/docs/decisions/README.md b/docs/decisions/README.md index e838715..7e2eb14 100644 --- a/docs/decisions/README.md +++ b/docs/decisions/README.md @@ -31,6 +31,6 @@ Keep related decisions small enough to review and implement independently. | [0021: Authorization rules](0021-authorization-rules.md) | Accepted; rules, examples and local validation implemented | What rule API, IAM/JWT predicates, failure semantics and consumer resolution/dispatch boundaries should authz expose? | | [0022: Streaming writer review](0022-streaming-writer-review.md) | Accepted; writer, public entry points and local validation complete; SDK deployment gate retained | Should streaming omit inferred lengths, how should empty Content-Encoding affect sniffing, and what SDK evidence remains missing? | | [0023: Consumer readiness](0023-consumer-readiness.md) | R1–R6 accepted (Apache-2.0 license); local implementation complete; AWS deployment qualifications open | What complete consumer example, test support, deferred scope and release preparation should follow the implemented packages? | -| [0024: Release automation](0024-release-automation.md) | Accepted; PR-only validation and organization credentials; App installation verified, release execution pending | How should release PRs, validation, credentials and initial versioning work? | -| [0025: Main-branch protection](0025-main-branch-protection.md) | Proposed; awaiting owner review | Should the existing four CI checks and PR workflow be enforced before merging to main? | +| [0024: Release automation](0024-release-automation.md) | Accepted; PR-only validation and organization credentials; v0.1.0 released on 2026-10-02 | How should release PRs, validation, credentials and initial versioning work? | +| [0025: Main-branch protection](0025-main-branch-protection.md) | Proposed; owner configuring manually | Should the existing four CI checks and PR workflow be enforced before merging to main? | | [0026: Exported API review](0026-exported-api-review.md) | E1–E6 accepted and implemented in stacked PRs; E7 rejected | Which exported API changes does Google's Go style guidance support before the first release? | diff --git a/docs/plan.md b/docs/plan.md index 430ee99..5095110 100644 --- a/docs/plan.md +++ b/docs/plan.md @@ -335,7 +335,8 @@ The owner resolved R6 on 2026-10-02: Apache-2.0, with Andrew Beck as copyright h - [x] Obtain actual GitHub CI evidence for the foundation PR; all four jobs passed at f6a2624. Later commits require their own passing checks. -- [ ] Verify the main release workflow and resolve publication prerequisites before a release. +- [x] Verify the main release workflow and resolve publication prerequisites before a release. + v0.1.0 was released on 2026-10-02. Streaming deployment and live identity interoperability remain separate qualifications. The [complete dispatcher](../examples/dispatcher/README.md), [testing guide](consumer-testing.md), [support matrix](support.md) and [release checklist](release-readiness.md) are implemented. diff --git a/docs/release-readiness.md b/docs/release-readiness.md index 5b87db3..7c576a4 100644 --- a/docs/release-readiness.md +++ b/docs/release-readiness.md @@ -29,7 +29,8 @@ Secret metadata and repository access were verified on 2026-09-27; the obsolete repository variable and private-key secret were removed. The new key and Client ID were verified against the astrocompute-release-please App and its repository installation using read-only API calls without printing credentials. Its installation grants all three required write permissions. -No branch protection was configured. +No branch protection was configured; +the owner will configure it manually ([decision 0025](decisions/0025-main-branch-protection.md)). ## Outstanding evidence and owner choices @@ -39,7 +40,10 @@ Release Please has since executed successfully: the App opened [the v0.1.0 relea The owner chose the Apache License, Version 2.0 on 2026-10-02, with Andrew Beck as copyright holder ([decision 0023 R6](decisions/0023-consumer-readiness.md#r6-obtain-the-owners-distributionlicense-choice-before-publication)). LICENSE is the unmodified canonical text. -No repository visibility change, release tag or release publication has been performed. + +The owner merged the release PR on 2026-10-02, and the release run published [v0.1.0](https://github.com/asteroid-computing/go-lambda-edge/releases/tag/v0.1.0) at commit 9423302. +Repository visibility is unchanged; +make the repository public, enable private vulnerability reporting for the [security policy](../SECURITY.md), and then request the version from the Go module proxy so pkg.go.dev indexes it. REST streaming's SDK deployment qualification remains open: local probes cannot establish AWS acceptance of the observed mode-header/connection behavior. Authoritative clarification or a separately approved live test is still needed.