Skip to content

Commit 68aad9d

Browse files
author
TheStreamCode
committed
chore: fleet hygiene (community files, CI permissions, dependabot)
Add SECURITY.md (private advisories + info@mikesoft.it fallback + never-log-keys rule, adapted from hermes-chutes-provider), CONTRIBUTING.md, CODE_OF_CONDUCT.md (with private-contact line), and structured issue forms + PR template (adapted from hermes-chutes-provider). Add permissions: contents: read to ci.yml and grouped-weekly dependabot.yml (github-actions; the plugin is stdlib-only by design, so no pip entry). Closes the review P0 and P1 file items for hermes-muse-code.
1 parent e335011 commit 68aad9d

10 files changed

Lines changed: 247 additions & 0 deletions

File tree

‎.github/ISSUE_TEMPLATE/bug.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: Bug report
2+
description: Report reproducible behavior in the Hermes Muse Code provider
3+
title: "[Bug]: "
4+
labels: ["bug"]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: |
9+
Thanks for helping improve this independent, unofficial integration.
10+
Remove subscription keys, credentials, private prompts, and account data before submitting.
11+
- type: textarea
12+
id: summary
13+
attributes:
14+
label: Problem summary
15+
description: What happened, and what did you expect instead?
16+
validations:
17+
required: true
18+
- type: textarea
19+
id: reproduction
20+
attributes:
21+
label: Reproduction steps
22+
description: Provide the smallest sequence that reproduces the problem.
23+
placeholder: |
24+
1. Configure...
25+
2. Run...
26+
3. Observe...
27+
validations:
28+
required: true
29+
- type: dropdown
30+
id: installation
31+
attributes:
32+
label: Installation route
33+
options:
34+
- Manual directory install from a release tag
35+
- Development checkout from main
36+
- Entry-point or native install under development
37+
- Other
38+
validations:
39+
required: true
40+
- type: input
41+
id: plugin-version
42+
attributes:
43+
label: Plugin version or commit
44+
placeholder: v0.2.0 or a commit SHA
45+
validations:
46+
required: true
47+
- type: input
48+
id: hermes-version
49+
attributes:
50+
label: Hermes Agent version or commit
51+
validations:
52+
required: true
53+
- type: input
54+
id: environment
55+
attributes:
56+
label: Environment
57+
description: Include Python version and operating system.
58+
placeholder: Python 3.12 on Windows 11
59+
validations:
60+
required: true
61+
- type: textarea
62+
id: logs
63+
attributes:
64+
label: Sanitized logs
65+
description: Include only relevant output after removing sensitive data.
66+
render: shell
67+
- type: checkboxes
68+
id: safety
69+
attributes:
70+
label: Sensitive-data check
71+
options:
72+
- label: I removed subscription keys, credentials, private prompts, and account data.
73+
required: true

‎.github/ISSUE_TEMPLATE/compatibility.yml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
name: Compatibility report
2+
description: Report a compatibility problem with a Hermes or Muse change
3+
title: "[Compatibility]: "
4+
labels: ["compatibility"]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: |
9+
Use this form when the provider stops matching a released Hermes version or a documented Muse subscription behavior.
10+
Remove subscription keys, credentials, private prompts, and account data before submitting.
11+
- type: dropdown
12+
id: affected-system
13+
attributes:
14+
label: Affected system
15+
options:
16+
- Hermes Agent
17+
- Muse subscription login
18+
- Both or unclear
19+
validations:
20+
required: true
21+
- type: input
22+
id: plugin-version
23+
attributes:
24+
label: Plugin version or commit
25+
placeholder: v0.2.0 or a commit SHA
26+
validations:
27+
required: true
28+
- type: input
29+
id: upstream-version
30+
attributes:
31+
label: Hermes or Muse version reference
32+
description: Provide a release, commit, dated behavior change, or authoritative link.
33+
validations:
34+
required: true
35+
- type: textarea
36+
id: observed-behavior
37+
attributes:
38+
label: Observed compatibility problem
39+
description: Explain the regression and provide minimal reproduction steps.
40+
validations:
41+
required: true
42+
- type: textarea
43+
id: evidence
44+
attributes:
45+
label: Sanitized evidence
46+
description: Add relevant logs or links after removing sensitive data.
47+
- type: checkboxes
48+
id: safety
49+
attributes:
50+
label: Sensitive-data check
51+
options:
52+
- label: I removed subscription keys, credentials, private prompts, and account data.
53+
required: true

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: Report a security vulnerability
4+
url: https://github.com/TheStreamCode/hermes-muse-code/security/advisories/new
5+
about: Send sensitive findings privately. Never include credentials in a public issue.
6+
- name: Hermes Agent support
7+
url: https://github.com/NousResearch/hermes-agent/issues
8+
about: Report issues that also occur without this provider to the Hermes Agent project.

‎.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
name: Feature request
3+
about: Suggest an improvement for the Muse Code provider plugin
4+
title: "[FEAT] "
5+
labels: enhancement
6+
assignees: ''
7+
---
8+
9+
## Problem
10+
What problem does this solve?
11+
12+
## Proposed Solution
13+
How you'd like it to work.
14+
15+
## Alternatives Considered
16+
Other approaches you've thought about.
17+
18+
## Additional Context
19+
Any other relevant information.

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
## Summary
2+
3+
-
4+
5+
## Validation
6+
7+
- [ ] `python -m pytest -q`
8+
- [ ] Upstream `plugin-validate` outcome noted (CI runs it non-blocking)
9+
10+
## Compatibility and Security
11+
12+
- [ ] No credentials, secrets, or private data are included
13+
- [ ] Hermes Agent and Muse subscription compatibility claims were verified

‎.github/dependabot.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "github-actions"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"
7+
day: "monday"
8+
labels:
9+
- "dependencies"
10+
- "github-actions"
11+
commit-message:
12+
prefix: "chore(actions)"
13+
include: "scope"
14+
groups:
15+
actions-minor-patch:
16+
update-types:
17+
- "minor"
18+
- "patch"

‎.github/workflows/ci.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ on:
44
push:
55
pull_request:
66

7+
permissions:
8+
contents: read
9+
710
jobs:
811
unit:
912
runs-on: ubuntu-latest

‎CODE_OF_CONDUCT.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Code of Conduct
2+
3+
Contributors are expected to keep discussion professional, constructive, and
4+
focused on improving the project.
5+
6+
Unacceptable behavior includes harassment, personal attacks, discriminatory
7+
language, and knowingly misleading security, privacy, or compatibility claims.
8+
9+
Maintainers may moderate issues, pull requests, and discussions to preserve a
10+
safe and useful project environment.
11+
12+
To report a conduct concern privately, email `info@mikesoft.it` with the
13+
subject `Hermes Muse Code Code of Conduct Report`.

‎CONTRIBUTING.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Contributing to hermes-muse-code
2+
3+
Thanks for your interest in improving this project! Bug reports, fixes, docs,
4+
and tests are all welcome. This plugin stays stdlib-only by design — do not
5+
add third-party runtime dependencies.
6+
7+
## Validation
8+
9+
Run the unit suite before opening a pull request:
10+
11+
```bash
12+
python -m pytest -q
13+
```
14+
15+
CI also runs the upstream `plugin-validate` step in non-blocking mode (the
16+
upstream pip guard rejects it; the failure reason is documented in `ci.yml`).
17+
18+
## Pull requests
19+
20+
- Keep changes focused; one concern per PR.
21+
- Add or update tests for behavior changes.
22+
- Never commit credentials, subscription keys, or account data.
23+
- Never log the cached subscription key in code or fixtures.

‎SECURITY.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Security Policy
2+
3+
## Reporting a Vulnerability
4+
5+
Use GitHub's
6+
[private vulnerability reporting](https://github.com/TheStreamCode/hermes-muse-code/security/advisories/new)
7+
for sensitive findings. If that route is unavailable, email
8+
`info@mikesoft.it` with the subject `Hermes Muse Code Security Report`.
9+
Do not disclose API keys, credentials, private prompts, or account data in a
10+
public issue.
11+
12+
For non-sensitive security hardening, open an issue with the affected component,
13+
observed behavior, impact, and a minimal reproduction where practical.
14+
15+
## Supported Version
16+
17+
Security fixes target the latest published release and the current `main` branch.
18+
19+
## Credential Handling
20+
21+
This project must never log, persist, or commit Muse subscription credentials.
22+
The subscription key lives owner-only in the local credential cache and in
23+
process memory; it is never written to logs. Local credentials belong in the
24+
active Hermes profile's ignored environment configuration.

0 commit comments

Comments
 (0)