Skip to content

Commit 012daf1

Browse files
srpatchasrpatcha
committed
chore(audit-2026-05): apply org-uniform CI/release/README baseline
- Phase C: add .github/workflows/sync-release-branch.yml so release branch auto-tracks vX.Y.Z tags. - Phase E: add .github/dependabot.yml with weekly cadence + correct ecosystems. - Phase F: inject org-uniform README badge row + release-model section (idempotent markers). See embeddedos-org/.github/STANDARDS.md for the canonical release model and tag scheme. This commit is part of the 2026-05 production-readiness audit.
1 parent 2e7375a commit 012daf1

3 files changed

Lines changed: 166 additions & 6 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 72 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,75 @@
1-
# Dependabot disabled — dependency updates are managed manually.
2-
# To re-enable, set open-pull-requests-limit to a positive number.
1+
# Standard, org-uniform Dependabot configuration template.
2+
#
3+
# Each repo should drop this file at .github/dependabot.yml and uncomment the
4+
# ecosystem entries that apply. Keep weekly cadence so review backlogs stay
5+
# manageable. Auto-assigning all PRs to a single triage owner (@srpatcha)
6+
# prevents the "ten people CC'd, no one acts" failure mode.
7+
#
8+
# Reference template lives at embeddedos-org/.github/.github/dependabot-template.yml.
9+
310
version: 2
411
updates:
5-
- package-ecosystem: "github-actions"
6-
directory: "/"
12+
# GitHub Actions — every repo should keep this enabled.
13+
- package-ecosystem: github-actions
14+
directory: /
715
schedule:
8-
interval: "monthly"
9-
open-pull-requests-limit: 0
16+
interval: weekly
17+
day: monday
18+
open-pull-requests-limit: 5
19+
assignees:
20+
- srpatcha
21+
labels:
22+
- dependencies
23+
- github-actions
24+
25+
# Python — uncomment in repos with pyproject.toml or requirements.txt.
26+
# - package-ecosystem: pip
27+
# directory: /
28+
# schedule:
29+
# interval: weekly
30+
# day: monday
31+
# open-pull-requests-limit: 5
32+
# assignees:
33+
# - srpatcha
34+
# labels:
35+
# - dependencies
36+
# - python
37+
38+
# Node.js — uncomment in repos with package.json.
39+
# - package-ecosystem: npm
40+
# directory: /
41+
# schedule:
42+
# interval: weekly
43+
# day: monday
44+
# open-pull-requests-limit: 5
45+
# assignees:
46+
# - srpatcha
47+
# labels:
48+
# - dependencies
49+
# - npm
50+
51+
# Go — uncomment in repos with go.mod.
52+
# - package-ecosystem: gomod
53+
# directory: /
54+
# schedule:
55+
# interval: weekly
56+
# day: monday
57+
# open-pull-requests-limit: 5
58+
# assignees:
59+
# - srpatcha
60+
# labels:
61+
# - dependencies
62+
# - go
63+
64+
# Docker — uncomment in repos with Dockerfile.
65+
# - package-ecosystem: docker
66+
# directory: /
67+
# schedule:
68+
# interval: weekly
69+
# day: monday
70+
# open-pull-requests-limit: 3
71+
# assignees:
72+
# - srpatcha
73+
# labels:
74+
# - dependencies
75+
# - docker

‎.github/workflows/sync-release-branch.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
name: sync-release-branch
2+
3+
# When a vMAJOR.MINOR.PATCH (or rc) tag is pushed to master, force-push that
4+
# exact commit to the `release` branch so `release` is always a rolling
5+
# pointer to the latest released tag. This is the org-uniform release model:
6+
#
7+
# master = line of development, every PR lands here.
8+
# release = exact commit of the latest released vX.Y.Z tag, updated only
9+
# by this workflow. Never push to release manually.
10+
# tags = immutable named snapshots created on master.
11+
#
12+
# Mirror of this file lives in embeddedos-org/.github/.github/workflows/sync-release-branch.yml.
13+
# Drift from that template should be considered a bug.
14+
15+
on:
16+
push:
17+
tags:
18+
- 'v[0-9]+.[0-9]+.[0-9]+'
19+
- 'v[0-9]+.[0-9]+.[0-9]+-rc.[0-9]+'
20+
21+
permissions:
22+
contents: write
23+
24+
concurrency:
25+
group: sync-release-branch
26+
cancel-in-progress: false
27+
28+
jobs:
29+
sync:
30+
name: Force-push tag commit to release branch
31+
runs-on: ubuntu-latest
32+
steps:
33+
- name: Checkout tagged commit
34+
uses: actions/checkout@v4
35+
with:
36+
fetch-depth: 1
37+
ref: ${{ github.ref }}
38+
39+
- name: Compute target SHA
40+
id: target
41+
run: |
42+
sha=$(git rev-parse HEAD)
43+
echo "sha=$sha" >> "$GITHUB_OUTPUT"
44+
echo "Force-pushing $sha (from tag ${GITHUB_REF#refs/tags/}) to refs/heads/release"
45+
46+
- name: Force-push to release
47+
env:
48+
GH_TOKEN: ${{ github.token }}
49+
run: |
50+
set -euo pipefail
51+
# Try to update; if release doesn't exist, create it.
52+
if gh api "repos/${GITHUB_REPOSITORY}/git/refs/heads/release" >/dev/null 2>&1; then
53+
gh api -X PATCH "repos/${GITHUB_REPOSITORY}/git/refs/heads/release" \
54+
-f sha="${{ steps.target.outputs.sha }}" -F force=true >/dev/null
55+
echo "release fast-forwarded / force-updated"
56+
else
57+
gh api -X POST "repos/${GITHUB_REPOSITORY}/git/refs" \
58+
-f ref=refs/heads/release -f sha="${{ steps.target.outputs.sha }}" >/dev/null
59+
echo "release created"
60+
fi
61+
62+
- name: Summary
63+
run: |
64+
{
65+
echo "## release branch updated"
66+
echo ""
67+
echo "- tag: \`${GITHUB_REF#refs/tags/}\`"
68+
echo "- sha: \`${{ steps.target.outputs.sha }}\`"
69+
echo "- repo: \`${GITHUB_REPOSITORY}\`"
70+
echo ""
71+
echo "release branch now points at the same commit as the tag."
72+
} >> "$GITHUB_STEP_SUMMARY"

‎README.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,14 @@
11
# EmbeddedOS (EoS) Research Foundation
22

3+
<!-- begin: org-uniform badges (audit-2026-05) -->
4+
[![CI](https://github.com/embeddedos-org/www.embeddedos.org/actions/workflows/ci.yml/badge.svg)](https://github.com/embeddedos-org/www.embeddedos.org/actions/workflows/ci.yml)
5+
[![CodeQL](https://github.com/embeddedos-org/www.embeddedos.org/actions/workflows/codeql.yml/badge.svg)](https://github.com/embeddedos-org/www.embeddedos.org/actions/workflows/codeql.yml)
6+
[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/embeddedos-org/www.embeddedos.org/badge)](https://securityscorecards.dev/viewer/?uri=github.com/embeddedos-org/www.embeddedos.org)
7+
[![Release](https://img.shields.io/github/v/tag/embeddedos-org/www.embeddedos.org?label=release&sort=semver)](https://github.com/embeddedos-org/www.embeddedos.org/releases)
8+
[![License](https://img.shields.io/github/license/embeddedos-org/www.embeddedos.org)](LICENSE)
9+
<!-- end: org-uniform badges (audit-2026-05) -->
10+
11+
312
[![Validate & Deploy](https://github.com/embeddedos-org/www.embeddedos.org/actions/workflows/deploy.yml/badge.svg)](https://github.com/embeddedos-org/www.embeddedos.org/actions/workflows/deploy.yml)
413
[![Website Tests](https://github.com/embeddedos-org/www.embeddedos.org/actions/workflows/tests.yml/badge.svg)](https://github.com/embeddedos-org/www.embeddedos.org/actions/workflows/tests.yml)
514
[![Weekly Release](https://github.com/embeddedos-org/www.embeddedos.org/actions/workflows/weekly-release.yml/badge.svg)](https://github.com/embeddedos-org/www.embeddedos.org/actions/workflows/weekly-release.yml)
@@ -165,6 +174,19 @@ gh variable set SENTRY_DSN --body "https://...@sentry" # Error monitoring
165174
| [embeddedos-org.github.io/eApps](https://embeddedos-org.github.io/eApps/) | App Store — browse/download 60+ apps |
166175
| [github.com/embeddedos-org](https://github.com/embeddedos-org) | GitHub organization — all source code |
167176

177+
<!-- begin: release-model (audit-2026-05) -->
178+
## Release model
179+
180+
`master` is the line of development; every PR lands here. `release` is a
181+
rolling pointer to the latest released `vX.Y.Z` tag, updated automatically
182+
by [`.github/workflows/sync-release-branch.yml`](.github/workflows/sync-release-branch.yml).
183+
Tags are immutable.
184+
185+
See [embeddedos-org/.github/STANDARDS.md](https://github.com/embeddedos-org/.github/blob/master/STANDARDS.md)
186+
for the org-wide tag scheme, release model, and the compliance frameworks
187+
every product targets.
188+
<!-- end: release-model (audit-2026-05) -->
189+
168190
## License
169191

170192
MIT — see [LICENSE](licenses.html) for details.

0 commit comments

Comments
 (0)