james.maesandCodex GPT-6
38dd5c1488
This replaces the blocked history in PR #3 with one properly attributed, signed/DCO commit. The owner personally reviewed and approved PR #3 in the release session. **No file changes from the approved candidate:** bothbaee14f492ande605df62c4have exact Git treea85912cbad. Original PR #3 and its commits are preserved for review history. Historical commits were locally signed but GitHub reported no_user; protected merge checks those introduced commits even for squash merging. This commit resolves attribution without bypassing or weakening signature rules. The reader, Settings, themes, source highlighting/split, live reload, file associations, Print/PDF, About credits, toolbar/footer/editor fixes, user-first README/screenshots and developer guides are exactly the approved implementation. Stable/dev separation and protected Azure signing caller are unchanged. Evidence: - Approved treebaee14f/ CI38285775463 passes all checks. Downloaded focused29/29, published111/111, stable110/110 and dev110/110 TRXs have zero failures/skips. Core coverage100% lines/98.86% branches; actual update/restart/coexistence/default-preservation receipts verify. - New single-commit hooks, online workflow security, signing and DCO pass. GitHub must rerun all required checks on this commit; results are not copied across SHAs. - Live repository setup validates18 Actions-bound checks, with only fuzzing added and all prior protections preserved. - OpenSSF project15417 is now owner-reviewed and saved at70% under owner-confirmed CDLA-Permissive2.0. This is an in-progress assessment, not a passing badge. - Production CI OIDC and signed1.0/dev publication remain required; local representative signing is not CI proof. Substantial AI assistance: Codex (GPT-6). Supersedes PR #3. Release work remains tracked in #33. Closes #4, #6, #7, #8, #9, #10, #11, #12, #13, #14, #15, #16, #17, #18, #19, #20, #21, #22, #23, #24, #25, #26, #27, #28, #29, #32, #34. Refs #1, #5, #30, #31, #33. Signed-off-by: James Maes <james@kof22.com> Co-authored-by: Codex GPT-6 <noreply@openai.com>
4.8 KiB
Set up a generated repository
Generate the app, restore dependencies, commit the resulting locks, install the hooks, and run CONTRIBUTING.md's checks. Node 24 and PowerShell 7.4+ are required for repository tooling; neither ships in the app.
Preview
The default command works offline and writes thirteen non-secret API requests:
./build/Initialize-GitHubRepository.ps1 -Repository KofTwentyTwo/MarkdownViewr.Windows
Get-Content artifacts/repository-setup.json
Generated names and owner are substituted. Pass -MaintainerCount 2 when there
are multiple maintainers: this requires one independent approval. The default
single-maintainer policy requires review / automated and no bypass on main.
Bootstrap and apply
An administrator must authorize creation and the first push separately. Create a
public repository, push the reviewed initial tree to main, and open a small
bootstrap PR. Wait for every documented CI context to succeed. Read the automated
review of its current head and post your own acknowledgement on that PR:
<!-- k22-automated-review:FULL_CURRENT_PR_COMMIT_SHA -->
Tool: Codex
Findings: none
Summary: Describe the actual reviewed scope and evidence here.
Maintainer acknowledgement: I read the review and resolved or answered every finding.
The privileged review workflow executes trusted main code only. New PR commits
need a new record; stale or incomplete records fail. An agent must not acknowledge
on your behalf. Organization-owned repositories must change the configured human
maintainer in .github/scripts/review-gate.cjs and its tests before bootstrap.
With GitHub CLI signed in as an authorized administrator:
$sha = gh pr view BOOTSTRAP_PR_NUMBER --json headRefOid --jq .headRefOid
./build/Initialize-GitHubRepository.ps1 -Mode Apply -CheckSha $sha -WhatIf
# After reviewing and authorizing this exact plan:
./build/Initialize-GitHubRepository.ps1 -Mode Apply -CheckSha $sha
./build/Initialize-GitHubRepository.ps1 -Mode Validate
The plan uses GitHub's actual job check names: reusable build checks have the
ci / prefix, while standalone checks are installed-updates, powershell and
javascript. The template source also requires template, which exercises both
generated variants; generated applications have no template-packaging check.
Never add a workflow-name prefix to standalone job names in required contexts.
The tool verifies the exact public target, main, administrator access, absence
of repository secrets/self-hosted runners, current bootstrap PR SHA and successful
GitHub Actions checks. Both apply and read-only validation resolve the official
GitHub Actions application and require its ID on every required context. Checks
from another producer and missing/wrong policy bindings fail before writes; the
reviewed offline plan remains unchanged and reusable. The tool
creates both rulesets and the tag-only release environment, enables security
features, restricts Actions, and reads settings back. Existing matching policy is
reused; conflicting rules or release policies stop before writes. Unrelated rules
and environment protections are retained. API failures stop immediately; earlier
successful requests may remain, so validate and resolve the reported failure before
rerunning. The tool never creates repositories, pushes, merges, tags or releases.
The selected Actions policy permits the shared standards workflows, GitHub-owned and verified actions, and the exact digest-pinned Gitleaks/Trivy container actions used by the published security builder. GitHub also checks container actions against this policy; missing entries prevent the security workflow from starting. Review these exact references whenever the shared builder pin changes.
Finish and verify
Register ownership/tier in the standards MAINTAINERS.md inventory through a
reviewed PR. Set the description/topics and review account community defaults.
Configure signing using the verified existing Azure service; keep credentials in
the protected environment and use OIDC wherever supported. Run the standards
conformance checker against the live repository and try a failing disposable PR
to prove the checks block merging. Enroll in OpenSSF Best Practices with actual
owner attestations; never add an unearned badge.
Local fixture tests prove planning, refusal boundaries, application/readback and idempotence. A disposable live generated repository has not yet been provisioned; that proof requires authorized creation/push and successful hosted CI.
API shapes follow GitHub's official rulesets, Actions permissions and deployment branch policies documentation.