Skip to content

Commit 36a35a1

Browse files
hyperpolymathhyperpolymath
committed
Move Rescript-TEA into rescript-ecosystem/rescript-tea
1 parent 19cb4de commit 36a35a1

27 files changed

Lines changed: 2647 additions & 6 deletions

‎Rescript-TEA‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎rescript-ecosystem/rescript-tea/.github/dependabot.yml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,12 @@ updates:
1919
directory: "/"
2020
schedule:
2121
interval: "weekly"
22-
ignore:
23-
- dependency-name: "*"
24-
update-types: ["version-update:semver-patch"]
22+
# `open-pull-requests-limit: 0` suppresses routine version-update PRs
23+
# while leaving Dependabot SECURITY PRs flowing. The previous
24+
# `ignore: "*" patch` rule also silenced security PRs under GitHub\'s
25+
# current Dependabot behaviour. See rsr-template-repo commit 78b050e
26+
# and 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.
27+
open-pull-requests-limit: 0
2528

2629
# Elixir/Mix
2730
- package-ecosystem: "mix"

‎rescript-ecosystem/rescript-tea/.github/workflows/dependabot-automerge.yml‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
#
3+
# dependabot-automerge.yml — enable GitHub's native auto-merge on
4+
# Dependabot pull requests that match a declared severity / ecosystem
5+
# policy. Pairs with `.github/dependabot.yml`'s
6+
# `open-pull-requests-limit: 0` + security-only pattern (see the
7+
# cargo block there).
8+
#
9+
# What this does:
10+
# - Triggers on every Dependabot PR.
11+
# - Reads the PR's update-type metadata via the dependabot/fetch-metadata
12+
# action (no free-text parsing).
13+
# - Requires CI to be green before merge (GitHub's auto-merge enforces
14+
# required status checks).
15+
# - Gates merge behind a severity+ecosystem policy table. Default is
16+
# low+medium security updates only.
17+
#
18+
# Why auto-merge on GitHub (not via a bot like rhodibot) is the right
19+
# layer: GitHub enforces branch protection + required checks natively,
20+
# and the PR author is already `dependabot[bot]`. Rhodibot doesn't need
21+
# to know anything about ecosystems — GitHub handles the merge mechanics
22+
# once we approve.
23+
#
24+
# Threat model:
25+
# - A compromised upstream package with a bogus security advisory
26+
# could propose a malicious version bump. Mitigation: require at
27+
# least one non-automated reviewer for HIGH+CRITICAL severity
28+
# (done below — we explicitly refuse to auto-approve those).
29+
# - A compromised Dependabot itself is an Akerlof claim-grounder
30+
# problem. Not in scope here; track under
31+
# `project_claim_grounders_dual_use_akerlof.md`.
32+
#
33+
# Dogfooding: this workflow template is itself subject to the same
34+
# Dependabot config via the github-actions ecosystem block, so SHA
35+
# bumps for dependabot/fetch-metadata flow through the same path.
36+
37+
name: Dependabot Auto-Merge
38+
39+
on:
40+
pull_request:
41+
types: [opened, reopened, synchronize]
42+
43+
permissions:
44+
contents: write # needed to enable auto-merge
45+
pull-requests: write # needed to approve
46+
# NB: keep narrow — do NOT add secrets: read or id-token: write here.
47+
48+
jobs:
49+
automerge:
50+
# Only run for PRs actually authored by Dependabot.
51+
if: github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]'
52+
runs-on: ubuntu-latest
53+
54+
steps:
55+
- name: Fetch Dependabot metadata
56+
id: meta
57+
uses: dependabot/fetch-metadata@dbb049abf0d677abbd7f7eee0375145b417fdd34 # v2.2.0
58+
with:
59+
github-token: ${{ secrets.GITHUB_TOKEN }}
60+
61+
# --- Policy gate -------------------------------------------------------
62+
# Outputs from fetch-metadata we care about:
63+
# update-type → version-update:semver-{patch,minor,major}
64+
# dependency-type → direct:{development,production} | indirect
65+
# alert-state → AUTO_DISMISSED | DISMISSED | FIXED | OPEN
66+
# ghsa-id → GHSA-... if this is a security PR
67+
# --- Policy -------------------------------------------------------------
68+
# AUTO-APPROVE + AUTO-MERGE when:
69+
# 1. This is a SECURITY update (ghsa-id present), AND
70+
# 2. Update is patch or minor, AND
71+
# 3. Severity ≤ moderate (Dependabot doesn't expose severity
72+
# directly in fetch-metadata; infer from the absence of
73+
# HIGH/CRITICAL labels added by Dependabot).
74+
# Otherwise: do nothing. Human reviews HIGH+CRITICAL security
75+
# updates and all non-security bumps.
76+
- name: Decide policy outcome
77+
id: policy
78+
env:
79+
GHSA_ID: ${{ steps.meta.outputs.ghsa-id }}
80+
UPDATE_TYPE: ${{ steps.meta.outputs.update-type }}
81+
PR_LABELS: ${{ toJson(github.event.pull_request.labels.*.name) }}
82+
run: |
83+
set -euo pipefail
84+
85+
is_security=false
86+
is_patch_or_minor=false
87+
is_high_or_critical=false
88+
89+
[ -n "$GHSA_ID" ] && is_security=true
90+
case "$UPDATE_TYPE" in
91+
version-update:semver-patch|version-update:semver-minor)
92+
is_patch_or_minor=true ;;
93+
esac
94+
95+
# Dependabot adds severity labels like "severity: high",
96+
# "severity: critical". Look for those in the PR labels JSON.
97+
if echo "$PR_LABELS" | grep -qiE '"(severity: (high|critical))"'; then
98+
is_high_or_critical=true
99+
fi
100+
101+
if $is_security && $is_patch_or_minor && ! $is_high_or_critical; then
102+
echo "action=automerge" >> "$GITHUB_OUTPUT"
103+
else
104+
echo "action=skip" >> "$GITHUB_OUTPUT"
105+
fi
106+
echo "security=$is_security" >> "$GITHUB_OUTPUT"
107+
echo "update_type=$UPDATE_TYPE" >> "$GITHUB_OUTPUT"
108+
echo "ghsa=$GHSA_ID" >> "$GITHUB_OUTPUT"
109+
110+
- name: Approve PR (if policy allows)
111+
if: steps.policy.outputs.action == 'automerge'
112+
env:
113+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
114+
PR_URL: ${{ github.event.pull_request.html_url }}
115+
run: |
116+
gh pr review --approve "$PR_URL" \
117+
--body "Auto-approving Dependabot security update (${{ steps.policy.outputs.ghsa }}, ${{ steps.policy.outputs.update_type }}). Policy: low/moderate security patches/minors only."
118+
119+
- name: Enable auto-merge (if policy allows)
120+
if: steps.policy.outputs.action == 'automerge'
121+
env:
122+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
123+
PR_URL: ${{ github.event.pull_request.html_url }}
124+
run: |
125+
gh pr merge --auto --squash "$PR_URL"
126+
127+
- name: Write decision to step summary
128+
env:
129+
ACTION: ${{ steps.policy.outputs.action }}
130+
IS_SECURITY: ${{ steps.policy.outputs.security }}
131+
UPDATE_TYPE: ${{ steps.policy.outputs.update_type }}
132+
GHSA: ${{ steps.policy.outputs.ghsa }}
133+
run: |
134+
{
135+
echo "## Dependabot Auto-Merge Decision"
136+
echo ""
137+
echo "| Field | Value |"
138+
echo "|-------|-------|"
139+
echo "| Policy action | \`$ACTION\` |"
140+
echo "| Security update | \`$IS_SECURITY\` |"
141+
echo "| Update type | \`$UPDATE_TYPE\` |"
142+
echo "| GHSA ID | \`${GHSA:-n/a}\` |"
143+
} >> "$GITHUB_STEP_SUMMARY"

‎rescript-ecosystem/rescript-tea/.github/workflows/hypatia-scan.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ on:
1313

1414
permissions:
1515
contents: read
16+
# security-events: read lets the built-in GITHUB_TOKEN query this
17+
# repo\'s own Dependabot alerts via the Hypatia DependabotAlerts rule.
18+
security-events: read
1619

1720
jobs:
1821
scan:

‎rescript-ecosystem/rescript-tea/.gitignore‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
<<<<<<< HEAD
12
# SPDX-License-Identifier: PMPL-1.0-or-later
23
# RSR-compliant .gitignore
34

@@ -105,3 +106,35 @@ sync_report*.txt
105106
*.cmt
106107
*.cmti
107108
*.cmi
109+
target/
110+
node_modules/
111+
_build/
112+
deps/
113+
.elixir_ls/
114+
.cache/
115+
build/
116+
dist/
117+
=======
118+
# Dependencies
119+
node_modules/
120+
121+
# ReScript build output
122+
lib/
123+
.bsb.lock
124+
*.bs.js
125+
126+
# Editor
127+
.vscode/
128+
.idea/
129+
*.swp
130+
*.swo
131+
132+
# OS
133+
.DS_Store
134+
Thumbs.db
135+
136+
# Debug
137+
npm-debug.log*
138+
yarn-debug.log*
139+
yarn-error.log*
140+
>>>>>>> 992e4b4 (feat: initial implementation of rescript-tea)

‎rescript-ecosystem/rescript-tea/.tool-versions‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
nodejs 20.11.1
1+
nodejs 22.13.1
22
just 1.36.0

‎rescript-ecosystem/rescript-tea/LICENSE‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
SPDX-License-Identifier: MPL-2.0
1+
<<<<<<< HEAD
2+
SPDX-License-Identifier: PMPL-1.0-or-later
23
SPDX-FileCopyrightText: 2024-2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
34

45
------------------------------------------------------------------------
@@ -406,3 +407,26 @@ Exhibit B - "Incompatible With Secondary Licenses" Notice
406407

407408
This Source Code Form is "Incompatible With Secondary Licenses", as
408409
defined by the Mozilla Public License, v. 2.0.
410+
=======
411+
MIT License
412+
413+
Copyright (c) 2024 Jonathan D.A. Jewell
414+
415+
Permission is hereby granted, free of charge, to any person obtaining a copy
416+
of this software and associated documentation files (the "Software"), to deal
417+
in the Software without restriction, including without limitation the rights
418+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
419+
copies of the Software, and to permit persons to whom the Software is
420+
furnished to do so, subject to the following conditions:
421+
422+
The above copyright notice and this permission notice shall be included in all
423+
copies or substantial portions of the Software.
424+
425+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
426+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
427+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
428+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
429+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
430+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
431+
SOFTWARE.
432+
>>>>>>> 992e4b4 (feat: initial implementation of rescript-tea)

0 commit comments

Comments
 (0)