49 lines
1.9 KiB
Markdown
49 lines
1.9 KiB
Markdown
|
# TODO — core-devops
|
||
|
|
|
||
|
|
**Updated:** 2026-02-21 (Phase 0 assessment)
|
||
|
|
**See:** [FINDINGS.md](FINDINGS.md) for full assessment details.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## Phase 1 — Immediate (main branch health)
|
||
|
|
|
||
|
|
- [ ] Merge `dev` → `main` after review (dev is 20+ commits ahead)
|
||
|
|
- [ ] Update `VERSION` in `scripts/install-core.sh` to auto-detect latest release (fix is on `dev`)
|
||
|
|
- [ ] Verify `COMPOSER_EXPECTED_SIG` in `scripts/install-deps.sh` is current
|
||
|
|
- [ ] Update `GO_VERSION` in `scripts/install-deps.sh` to 1.24.x
|
||
|
|
|
||
|
|
## Phase 2 — Shell script quality
|
||
|
|
|
||
|
|
- [ ] Install `shellcheck` in CI and run against all `.sh` files
|
||
|
|
- [ ] Add BATS (Bash Automated Testing System) tests for `install-deps.sh` and `install-core.sh`
|
||
|
|
- [ ] Fix `${var,,}` bash 4+ syntax in `install-core.sh` for macOS bash 3 compatibility (fix on `dev`)
|
||
|
|
- [ ] Add GitHub Actions workflow to lint shell scripts on push
|
||
|
|
|
||
|
|
## Phase 3 — CI/CD for this repo
|
||
|
|
|
||
|
|
- [ ] Add `.github/workflows/ci.yml` to run `shellcheck` and BATS tests
|
||
|
|
- [ ] Add `scripts/install-core.sh` smoke test in CI (build-from-source path)
|
||
|
|
- [ ] Enable CodeQL scanning (workflow exists on `dev`)
|
||
|
|
- [ ] Add Trivy/Gitleaks security scanning (workflows on `dev`)
|
||
|
|
|
||
|
|
## Phase 4 — Documentation
|
||
|
|
|
||
|
|
- [ ] Merge VitePress docs site from `dev` (`.vitepress/`, `doc/`)
|
||
|
|
- [ ] Add architecture diagram to README
|
||
|
|
- [ ] Document `.core/` folder spec for package maintainers
|
||
|
|
- [ ] Add SECURITY.md (exists on `dev`)
|
||
|
|
- [ ] Add CONTRIBUTING.md (exists on `dev`)
|
||
|
|
|
||
|
|
## Phase 5 — Workspace tooling
|
||
|
|
|
||
|
|
- [ ] Confirm `core` CLI v0.1.0 is released and binaries are available on GitHub
|
||
|
|
- [ ] Add `core doctor --fix` smoke test to CI
|
||
|
|
- [ ] Validate `repos.yaml` schema in CI (YAML lint + custom validation)
|
||
|
|
- [ ] Add `make test` target that runs shell script tests
|
||
|
|
|
||
|
|
## Deferred
|
||
|
|
|
||
|
|
- [ ] TLS certificate pinning for script downloads (currently relies on system CA store)
|
||
|
|
- [ ] Separate trust root for binary checksums (currently same origin as binaries)
|
||
|
|
- [ ] GPG signing of `core` CLI release tags
|