diff --git a/.cargo/config.toml b/.cargo/config.toml index 2594963..0d27fbe 100644 --- a/.cargo/config.toml +++ b/.cargo/config.toml @@ -2,8 +2,12 @@ # Development quality enforcement aliases check-all = "clippy --all-targets --workspace -- -D warnings" test-all = "test --workspace" -cov = "llvm-cov --workspace --fail-under-lines 100" +cov = "llvm-cov --workspace --ignore-filename-regex main\\.rs --summary-only" verify = ["fmt --all -- --check", "check-all", "test-all"] +# Dogfooding: build the runnable daemon + reference CLI in release mode. +build-release = ["build", "--release", "-p", "nunciod", "-p", "nuncio-cli"] +# Remove the entire workspace target directory (all crates, all profiles). +clean-all = "clean" [build] # Treat warnings as errors and forbid unsafe code at local build time diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index 272defa..34460c6 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -1,6 +1,6 @@ # Contributing to Nuncio -Thank you for contributing to Nuncio ([nuncio.mx](https://nuncio.mx))! +Thank you for contributing to Nuncio! ## Semantic Versioning 2.0.0 & Tagging @@ -9,7 +9,10 @@ Nuncio follows **Semantic Versioning 2.0.0** (`vMAJOR.MINOR.PATCH`): - `MINOR`: Incremented for new functionality added in a backward-compatible manner. - `PATCH`: Incremented for backward-compatible bug fixes. -Tagging a commit with `vX.Y.Z` triggers [.github/workflows/release.yml](file:///R:/Git.Local/KofTwentyTwo/nuncio/.github/workflows/release.yml) to automatically compile cross-platform release artifacts (Windows `.zip`/`.msi`, macOS `.tar.gz`/`.dmg`, Linux `.tar.gz`/`.AppImage`), generate release notes from Conventional Commits, compute SHA256 checksums, and publish an official GitHub Release. +Tagging a commit with `vX.Y.Z` is intended to drive the release workflow under +`.github/workflows/`. **Pre-alpha note:** the release pipeline is being rebuilt and +**no functional release exists yet** — see roadmap milestone M7 (issue #209). Do not +tag releases until the backend is declared client-ready. ## Architecture Decoupling Rules diff --git a/.github/SECURITY.md b/.github/SECURITY.md index 257b825..c066030 100644 --- a/.github/SECURITY.md +++ b/.github/SECURITY.md @@ -1,13 +1,17 @@ # Security Policy -Nuncio ([nuncio.mx](https://nuncio.mx)) takes security and data privacy seriously. Because Nuncio handles sensitive mail payloads, calendar schedules, and authentication credentials across Windows, macOS, and Linux, we maintain strict security disclosures and cryptographic standards. +Nuncio handles sensitive mail, calendar, and contact data plus authentication +credentials, so security is a first-class concern. **Status: pre-alpha.** Several +hardening items — at-rest encryption correctness, key zeroization, a fail-closed +signature-verifying updater, and transport/egress hardening — are tracked under +roadmap milestone M6 and are not all complete. **Do not use Nuncio with real +accounts or sensitive data yet.** ## Supported Versions | Version | Supported | | :--- | :--- | -| `0.1.x` | Supported | -| `< 0.1.0` | Unsupported | +| all pre-1.0 | **Not supported** — non-functional pre-alpha, under active reconstruction | ## Reporting a Vulnerability diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 29049ba..f32a5c6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -10,6 +10,9 @@ env: CARGO_TERM_COLOR: always RUSTFLAGS: "-D warnings" +permissions: + contents: read + jobs: fmt: name: Code Formatting Check @@ -36,8 +39,8 @@ jobs: sudo apt-get install -y libglib2.0-dev libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev build-essential curl wget file libssl-dev - name: Cache Cargo Dependencies uses: Swatinem/rust-cache@v2 - - name: Run Clippy Linter - run: cargo clippy --workspace -- -D warnings + - name: Run Clippy Linter (all targets, matches local `cargo check-all`) + run: cargo check-all test: name: Test Suite Execution @@ -68,8 +71,12 @@ jobs: uses: taiki-e/install-action@cargo-llvm-cov - name: Cache Cargo Dependencies uses: Swatinem/rust-cache@v2 - - name: Measure & Enforce Code Coverage Threshold - run: cargo llvm-cov --workspace --ignore-filename-regex "main\.rs" --fail-under-lines 100 + # Coverage is informational for now. The former `--fail-under-lines 100` + # gate excluded all main.rs (the integration wiring) and incentivized + # stub+matching-test theater. A realistic threshold plus a required + # mock-server E2E gate lands with Phase 1.C.6 (GH #143). + - name: Measure Code Coverage (informational) + run: cargo llvm-cov --workspace --ignore-filename-regex "main\.rs" --summary-only build-matrix: name: Cross-Platform Build Matrix (${{ matrix.os }}) diff --git a/.github/workflows/release-desktop.yml b/.github/workflows/release-desktop.yml index d20a09c..69e76a0 100644 --- a/.github/workflows/release-desktop.yml +++ b/.github/workflows/release-desktop.yml @@ -1,11 +1,10 @@ name: Nuncio Desktop GUI Release Pipeline (MSI, DMG, AppImage, Deb) on: + # Desktop installers are built ONLY from version tags (per the release policy). + # Branch-push triggers were removed during the pre-alpha rebuild: they ran on + # every dev push and failed (the Tauri GUI is archived under _reference/). push: - branches: - - main - - rc - - dev tags: - 'v*' workflow_dispatch: diff --git a/.github/workflows/release-nightly.yml b/.github/workflows/release-nightly.yml index 2f67704..0c83128 100644 --- a/.github/workflows/release-nightly.yml +++ b/.github/workflows/release-nightly.yml @@ -1,11 +1,9 @@ name: Nuncio Nightly & Snapshot Release Pipeline on: - push: - branches: - - dev - schedule: - - cron: '0 2 * * *' # Daily Nightly Build at 02:00 UTC + # Auto-nightly is DISABLED during the pre-alpha rebuild: no public releases + # until V3, and this pipeline builds the presentation GUI now archived under + # _reference/. Manual-only until the release path is restored in Phase 4. workflow_dispatch: permissions: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 12e7898..d94b03f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,15 +1,13 @@ name: Nuncio Multi-Platform Release Pipeline (Dev, RC, Prod) on: + # Releases are cut ONLY from version tags (vMAJOR.MINOR.PATCH), per the release + # policy (no public release until V3). Branch-push and nightly-cron triggers were + # removed during the pre-alpha rebuild: they ran on every dev push and failed + # (they build the presentation GUI now archived under _reference/). push: - branches: - - main - - rc - - dev tags: - 'v*' - schedule: - - cron: '0 0 * * *' # Daily Nightly Build at 00:00 UTC workflow_dispatch: permissions: diff --git a/.github/workflows/wiki-sync.yml b/.github/workflows/wiki-sync.yml index 51e9a18..0ef4340 100644 --- a/.github/workflows/wiki-sync.yml +++ b/.github/workflows/wiki-sync.yml @@ -10,6 +10,9 @@ on: - '.github/workflows/wiki-sync.yml' workflow_dispatch: +permissions: + contents: write + jobs: sync-wiki: name: Sync docs/ to GitHub Wiki @@ -27,15 +30,18 @@ jobs: token: ${{ secrets.GITHUB_TOKEN }} path: wiki-repo - - name: Sync docs and assets to Wiki + - name: Sync docs and assets to Wiki (mirror with delete) run: | + # Mirror docs/ -> wiki so that files removed from docs/ are also removed + # from the wiki. Preserve only the wiki's .git directory. + find wiki-repo -mindepth 1 -maxdepth 1 -not -name '.git' -exec rm -rf {} + mkdir -p wiki-repo/assets cp -r docs/* wiki-repo/ 2>/dev/null || true cp -r assets/* wiki-repo/assets/ 2>/dev/null || true cd wiki-repo git config user.name "github-actions[bot]" git config user.email "github-actions[bot]@users.noreply.github.com" - git add . + git add -A if git diff --staged --quiet; then echo "No changes to commit to Wiki." else diff --git a/.gitignore b/.gitignore index 12c6284..e3a6a68 100644 --- a/.gitignore +++ b/.gitignore @@ -28,3 +28,10 @@ Thumbs.db **/build/ package-lock.json + +# Agent scratch + regenerable build artifacts (keep out of the repo) +.superpowers/ +excalidraw.log +_reference/**/gen/ +**/node_modules/ +**/dist/ diff --git a/.idea/runConfigurations/Run_nuncio_gui.xml b/.idea/runConfigurations/Cargo_Build_Release.xml similarity index 70% rename from .idea/runConfigurations/Run_nuncio_gui.xml rename to .idea/runConfigurations/Cargo_Build_Release.xml index 299ad39..b3897b9 100644 --- a/.idea/runConfigurations/Run_nuncio_gui.xml +++ b/.idea/runConfigurations/Cargo_Build_Release.xml @@ -1,13 +1,12 @@ - -