* chore: rename npm package + bin to @opengsd/gsd-core (functional) - package.json: name @opengsd/get-shit-done-redux → @opengsd/gsd-core, bin key get-shit-done-redux → gsd-core, repository/homepage/bugs URLs - package-lock.json: regenerated (npm install --package-lock-only) - tests/**, scripts/**, bin/**, .github/**, agents/**, commands/**, get-shit-done/bin/**, get-shit-done/workflows/**: applied the 4-rule replacement (scoped npm ref, GitHub repo path, bin/clone invocations) per #505 single-source refactor Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs: sweep live references to @opengsd/gsd-core Update all live documentation (README.md + translations, docs/**, CONTRIBUTING.md, VERSIONING.md, SECURITY.md, CONTEXT.md, docs/CANARY.md) to reflect the renamed package and repository. Rules applied: - @opengsd/get-shit-done-redux → @opengsd/gsd-core (scoped npm name) - open-gsd/get-shit-done-redux → open-gsd/gsd-core (GitHub repo) - GSD-redux/get-shit-done-redux → open-gsd/gsd-core (stale badge org) - bare bin/clone refs → gsd-core CHANGELOG.md, docs/adr/**, docs/RELEASE-*.md, docs/research/**, and .changeset/** are preserved byte-identical. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix: add negative lookbehind to slash-command regex in bug-2954 test The extractSlashReferences regex matched /gsd-core inside npm package URLs (@opengsd/gsd-core), producing a false /gsd:core command reference. Adding a negative lookbehind (?<![a-z]) excludes matches preceded by a letter, so only standalone /gsd-<cmd> and /gsd:<cmd> tokens are found. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#518): add changeset for package rename Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test(#518): update package-identity expectations to the renamed coordinates The rebase regenerated the seam to @opengsd/gsd-core (bin gsd-core, repo open-gsd/gsd-core). The #498 seam tests assert deriveIdentity against the REAL package.json, so their expected literals must follow the rename. The drift-lint unit test is left as-is — its SEAM is a self-consistent fixture and its stale-literal detection cases would shift if altered; the live-repo scan in it already passes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Tom Boucher
@@ -12,7 +12,7 @@
|
||||
### Repos in scope
|
||||
|
||||
All active, non-archived repositories under the `open-gsd` GitHub organization,
|
||||
beginning with the pilot repo `open-gsd/get-shit-done-redux`.
|
||||
beginning with the pilot repo `open-gsd/gsd-core`.
|
||||
|
||||
### Out of scope
|
||||
|
||||
@@ -26,7 +26,7 @@ beginning with the pilot repo `open-gsd/get-shit-done-redux`.
|
||||
|
||||
This section defines the mandatory security controls for every in-scope repo.
|
||||
Each control links to the PR that implements it in the pilot repo
|
||||
(`open-gsd/get-shit-done-redux`). Sibling repos adopt the same controls during
|
||||
(`open-gsd/gsd-core`). Sibling repos adopt the same controls during
|
||||
Phase 2 rollout (§ 6).
|
||||
|
||||
### 2.1 Dependency integrity
|
||||
@@ -45,9 +45,9 @@ integrity as a prerequisite.
|
||||
([SLSA](https://slsa.dev/))
|
||||
|
||||
**Implementation in pilot:** PR
|
||||
[#135](https://github.com/open-gsd/get-shit-done-redux/pull/135)
|
||||
[#135](https://github.com/open-gsd/gsd-core/pull/135)
|
||||
(linked to issue
|
||||
[#114](https://github.com/open-gsd/get-shit-done-redux/issues/114)).
|
||||
[#114](https://github.com/open-gsd/gsd-core/issues/114)).
|
||||
|
||||
**Verify locally:**
|
||||
|
||||
@@ -79,9 +79,9 @@ mechanism.
|
||||
([GitGuardian exclusion grammar](https://docs.gitguardian.com/internal-repositories-monitoring/integrations/cli/secrets))
|
||||
|
||||
**Implementation in pilot:** PR
|
||||
[#134](https://github.com/open-gsd/get-shit-done-redux/pull/134)
|
||||
[#134](https://github.com/open-gsd/gsd-core/pull/134)
|
||||
(linked to issue
|
||||
[#115](https://github.com/open-gsd/get-shit-done-redux/issues/115)).
|
||||
[#115](https://github.com/open-gsd/gsd-core/issues/115)).
|
||||
Exclusion annotation files: `.secretscanignore` (top-level) and
|
||||
`.base64scanignore` (top-level, for base64-encoded values).
|
||||
|
||||
@@ -114,9 +114,9 @@ risks in automated pipelines.
|
||||
([CNCF Security TAG](https://github.com/cncf/tag-security))
|
||||
|
||||
**Implementation in pilot:** PR
|
||||
[#133](https://github.com/open-gsd/get-shit-done-redux/pull/133)
|
||||
[#133](https://github.com/open-gsd/gsd-core/pull/133)
|
||||
(linked to issue
|
||||
[#113](https://github.com/open-gsd/get-shit-done-redux/issues/113)).
|
||||
[#113](https://github.com/open-gsd/gsd-core/issues/113)).
|
||||
|
||||
**Verify locally:**
|
||||
|
||||
@@ -142,9 +142,9 @@ supply-chain vectors (CVE-2021-42574 — "Trojan Source"). Detecting them at sca
|
||||
time prevents invisible payload injection in source and output files.
|
||||
|
||||
**Implementation in pilot:** PR
|
||||
[#132](https://github.com/open-gsd/get-shit-done-redux/pull/132)
|
||||
[#132](https://github.com/open-gsd/gsd-core/pull/132)
|
||||
(linked to issue
|
||||
[#116](https://github.com/open-gsd/get-shit-done-redux/issues/116)).
|
||||
[#116](https://github.com/open-gsd/gsd-core/issues/116)).
|
||||
|
||||
**Verify locally:**
|
||||
|
||||
@@ -174,7 +174,7 @@ OpenSSF Scorecard's "Pinned-Dependencies" check measures this directly.
|
||||
([OpenSSF Scorecard](https://github.com/ossf/scorecard/blob/main/docs/checks.md))
|
||||
|
||||
**Implementation in pilot:** PR for issue
|
||||
[#117](https://github.com/open-gsd/get-shit-done-redux/issues/117)
|
||||
[#117](https://github.com/open-gsd/gsd-core/issues/117)
|
||||
(see PR #136).
|
||||
|
||||
**Verify locally:**
|
||||
@@ -280,7 +280,7 @@ Post-Incident Activity.
|
||||
### Where to report
|
||||
|
||||
Report security vulnerabilities via **private security advisory** on GitHub:
|
||||
`https://github.com/open-gsd/get-shit-done-redux/security/advisories/new`
|
||||
`https://github.com/open-gsd/gsd-core/security/advisories/new`
|
||||
|
||||
Do not open public issues for security vulnerabilities.
|
||||
|
||||
@@ -294,7 +294,7 @@ If private advisory filing is unavailable, contact the open-gsd maintainers and
|
||||
|
||||
```text
|
||||
Title: [Short description, e.g., "Secret exposed in CI log for PR #NNN"]
|
||||
Affected repo: open-gsd/get-shit-done-redux (or sibling repo name)
|
||||
Affected repo: open-gsd/gsd-core (or sibling repo name)
|
||||
Affected ver: [npm version range, e.g., "<=1.42.3" or "all versions"]
|
||||
Reporter: [Your name / handle, or "Anonymous"]
|
||||
Date found: YYYY-MM-DD
|
||||
@@ -383,7 +383,7 @@ Responsibilities:
|
||||
|
||||
| Step | Detail |
|
||||
|---|---|
|
||||
| 1 | Requester opens a GitHub issue in `open-gsd/get-shit-done-redux` tagged `security-exception` |
|
||||
| 1 | Requester opens a GitHub issue in `open-gsd/gsd-core` tagged `security-exception` |
|
||||
| 2 | Issue describes: which control, why the exception is needed, proposed compensating control |
|
||||
| 3 | One maintainer approves the exception in the issue thread |
|
||||
| 4 | Exception is time-limited: maximum 90 days. Requester must file a renewal or close the issue. |
|
||||
@@ -393,7 +393,7 @@ Responsibilities:
|
||||
|
||||
## 6. Rollout plan
|
||||
|
||||
### Phase 1 — Pilot: `open-gsd/get-shit-done-redux` (in progress)
|
||||
### Phase 1 — Pilot: `open-gsd/gsd-core` (in progress)
|
||||
|
||||
| Item | Status | Owner | Target date | Exit criteria |
|
||||
|---|---|---|---|---|
|
||||
|
||||
Reference in New Issue
Block a user