Bring project maintenance up to current cross-project standard #33

New issue

Closed

opened 2026-07-19 04:50:58 +00:00 by coding-agent-marvin8 · 1 comment

coding-agent-marvin8 commented

2026-07-19 04:50:58 +00:00

(Migrated from codeberg.org)

zaojun has drifted from the maintenance standard now established in feed2fedi:

The lockfile carries a HIGH-severity transitive vulnerability: click 8.3.1 is affected by PYSEC-2026-2132 (command injection in click.edit()).
Several direct and dev dependencies are behind the latest releases that have cleared the 7-day supply-chain quarantine, and .pre-commit-config.yaml hook revisions have drifted from the versions in pyproject.toml (the zaojun hook still points at 1.7.0).
CI jobs still run on shared Codeberg runners, install uv via curl | sh, and fetch the latest gitleaks release unpinned and without checksum verification.
README shows a retired Woodpecker CI badge, a retired CodeLimit badge, and links to the old codeberg.page docs address.
Project agent instructions live in CLAUDE.md only (a CLAUDE.md -> AGENTS.md rename was started locally but never committed), contain stale tool references, and duplicate rules that now live in the global instructions.
The release-notes workflow lacks the template-based reset and the fediverse-validate / fediverse-post recipes that feed2fedi and cang now use.

zaojun has drifted from the maintenance standard now established in feed2fedi: - The lockfile carries a HIGH-severity transitive vulnerability: click 8.3.1 is affected by PYSEC-2026-2132 (command injection in click.edit()). - Several direct and dev dependencies are behind the latest releases that have cleared the 7-day supply-chain quarantine, and .pre-commit-config.yaml hook revisions have drifted from the versions in pyproject.toml (the zaojun hook still points at 1.7.0). - CI jobs still run on shared Codeberg runners, install uv via curl | sh, and fetch the latest gitleaks release unpinned and without checksum verification. - README shows a retired Woodpecker CI badge, a retired CodeLimit badge, and links to the old codeberg.page docs address. - Project agent instructions live in CLAUDE.md only (a CLAUDE.md -> AGENTS.md rename was started locally but never committed), contain stale tool references, and duplicate rules that now live in the global instructions. - The release-notes workflow lacks the template-based reset and the fediverse-validate / fediverse-post recipes that feed2fedi and cang now use.

coding-agent-marvin8 commented

2026-07-19 04:51:23 +00:00

(Migrated from codeberg.org)

Findings from exploration:

pysentry: 1 vulnerability — click 8.3.1, PYSEC-2026-2132 (HIGH), fixable at 8.3.3. Not a declared dependency, so a [tool.uv] constraint-dependencies floor is the right fix (same as feed2fedi); no deptry ignore needed since click is not in [project.dependencies].
zaojun --min-age=7 passes these bumps: cyclopts 4.21.0, mkdocstrings 1.0.6, prek 0.4.9, ruff 0.15.21, ty 0.0.58, uv 0.11.28. httpx2 2.7.0 and mkdocs-material 9.7.7 are quarantined (too new) and stay put.
ci.yml already has the Release-Notes validation step and the deploy-docs version-tag guard from the issue-31 migration; still outstanding: zhuiri runners, astral-sh/setup-uv@v5, checksum-verified gitleaks pinned from .pre-commit-config.yaml. weekly-checks.yml needs setup-uv but keeps codeberg-small-lazy.
The working tree already contains an uncommitted CLAUDE.md -> AGENTS.md symlink; it will be committed as part of this work.
justfile release recipe already appends the Commits section; only the fediverse recipes and Release-Notes.md.template are missing.

Plan of attack (branch chore/issue-33-project-maintenance):

🔧 pin click floor, bump deps passing min-age=7, align pre-commit revs (incl. zaojun hook 1.7.1), uv lock + pylock regen
👷 overhaul CI: zhuiri runners, setup-uv action, checksum-verified gitleaks; setup-uv in weekly-checks
📝 fix README badges: Forgejo Actions CI badge, drop CodeLimit, docs links to zaojun.marvin8.zone
📝 consolidate agent instructions into AGENTS.md (CLAUDE.md symlink, # AGENTS.md heading, drop stale codelimit refs, open gitmoji set, ruff format --check in DoD, slim release-notes rules to template-based reset)
🔧 add Release-Notes.md.template + fediverse-validate / fediverse-post justfile recipes

Then PR targeting main with Closes #33.

Findings from exploration: - pysentry: 1 vulnerability — click 8.3.1, PYSEC-2026-2132 (HIGH), fixable at 8.3.3. Not a declared dependency, so a [tool.uv] constraint-dependencies floor is the right fix (same as feed2fedi); no deptry ignore needed since click is not in [project.dependencies]. - zaojun --min-age=7 passes these bumps: cyclopts 4.21.0, mkdocstrings 1.0.6, prek 0.4.9, ruff 0.15.21, ty 0.0.58, uv 0.11.28. httpx2 2.7.0 and mkdocs-material 9.7.7 are quarantined (too new) and stay put. - ci.yml already has the Release-Notes validation step and the deploy-docs version-tag guard from the issue-31 migration; still outstanding: zhuiri runners, astral-sh/setup-uv@v5, checksum-verified gitleaks pinned from .pre-commit-config.yaml. weekly-checks.yml needs setup-uv but keeps codeberg-small-lazy. - The working tree already contains an uncommitted CLAUDE.md -> AGENTS.md symlink; it will be committed as part of this work. - justfile release recipe already appends the Commits section; only the fediverse recipes and Release-Notes.md.template are missing. Plan of attack (branch chore/issue-33-project-maintenance): 1. :wrench: pin click floor, bump deps passing min-age=7, align pre-commit revs (incl. zaojun hook 1.7.1), uv lock + pylock regen 2. :construction_worker: overhaul CI: zhuiri runners, setup-uv action, checksum-verified gitleaks; setup-uv in weekly-checks 3. :memo: fix README badges: Forgejo Actions CI badge, drop CodeLimit, docs links to zaojun.marvin8.zone 4. :memo: consolidate agent instructions into AGENTS.md (CLAUDE.md symlink, # AGENTS.md heading, drop stale codelimit refs, open gitmoji set, ruff format --check in DoD, slim release-notes rules to template-based reset) 5. :wrench: add Release-Notes.md.template + fediverse-validate / fediverse-post justfile recipes Then PR targeting main with Closes #33.