diff --git a/.github/scripts/inject-footers-safe.js b/.github/scripts/inject-footers-safe.js index 001d065a9..e85df13e9 100644 --- a/.github/scripts/inject-footers-safe.js +++ b/.github/scripts/inject-footers-safe.js @@ -83,9 +83,9 @@ function extractFrontmatterSafely(content) { return { frontmatter: "", body: content }; } - // Find closing --- (search up to line 50 for safety) + // Find closing --- (can be anywhere, but typically within first 50 lines for reasonable YAML) let closingLineIndex = -1; - for (let i = 1; i < Math.min(lines.length, 50); i++) { + for (let i = 1; i < lines.length; i++) { if (lines[i].trim() === "---") { closingLineIndex = i; break; diff --git a/CHANGELOG.md b/CHANGELOG.md index 42e161638..ad6b63013 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -28,9 +28,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Removed -- **Remove WCEU 2026 assets** — Removed out-of-scope WCEU content. ([PR #1541](https://github.com/lightspeedwp/.github/pull/1541), [#1539](https://github.com/lightspeedwp/.github/issues/1539)) +- **Update validation script for Phase 1 restructuring** — Updated `.github/scripts/validate-footers.js` to skip validation of deleted `.github/agents/` files in `--changed-only` mode. Ensures validation scripts correctly handle agents consolidated to root per Phase 1 restructuring. ([PR #1537](https://github.com/lightspeedwp/.github/pull/1537), [#1510](https://github.com/lightspeedwp/.github/issues/1510)) -- **Consolidate agents folder** — Moved .github/agents (55 files) to root. ([PR #1533](https://github.com/lightspeedwp/.github/pull/1533), [#1510](https://github.com/lightspeedwp/.github/issues/1510)) +- **WCEU 2026 conference content** — Removed all WCEU-related assets and references across the repository: deleted `verify-wceu-readiness.js` scripts and tests from both `.github/scripts/` and `scripts/` folders, removed `website/src/lib/wceuSlides.ts` and WCEU conference pages (`website/src/pages/wceu-2026/`), deleted WCEU-specific image assets, and removed all WCEU slide references from website components. WCEU content was out of scope for this repository. ([PR #1541](https://github.com/lightspeedwp/.github/pull/1541), [#1539](https://github.com/lightspeedwp/.github/issues/1539)) - **Consolidate README workflows** — Merged 3 legacy workflows. Saves 449 lines. ([PR #1317](https://github.com/lightspeedwp/.github/pull/1317), [Epic #1227](https://github.com/lightspeedwp/.github/issues/1227)) @@ -40,7 +40,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed -- **Safe Footer Injection frontmatter detection** — Extended YAML frontmatter detection from 10-line to 50-line limit to support standard-length headers. Changed delimiter matching from `startsWith('---')` to exact match `trim() === '---'` to prevent false positives on YAML content lines. Fixes test failures blocking dependabot PR automation. ([PR #1632](https://github.com/lightspeedwp/.github/pull/1632)) +- **Resolve Phase 1 critical issues** — Fixed critical schema path references and unresolved merge conflicts from Phase 1 restructuring that prevented builds and asset discovery. ([PR #1502](https://github.com/lightspeedwp/.github/pull/1502), [#1290](https://github.com/lightspeedwp/.github/issues/1290)) + +- **Implement blocking logic enforcement for issue state validation** — Added validation logic to prevent invalid issue state transitions and enforce proper workflow compliance. ([PR #1503](https://github.com/lightspeedwp/.github/pull/1503)) + +- **Address PR #1514 review feedback and CI failures** — Resolved review comments and CI pipeline failures in project status documentation updates. ([PR #1527](https://github.com/lightspeedwp/.github/pull/1527)) + +- **Address review feedback and CI failures** — Fixed review feedback items and CI pipeline errors in active projects documentation. ([PR #1529](https://github.com/lightspeedwp/.github/pull/1529)) + +- **Fix 68 ESLint no-unused-vars violations** — Eliminated widespread unused variable errors across codebase improving code quality. ([PR #1536](https://github.com/lightspeedwp/.github/pull/1536)) + +- **Correct broken agent references in instruction files** — Fixed incorrect cross-references in portable instruction files pointing to agents. ([PR #1602](https://github.com/lightspeedwp/.github/pull/1602)) + +- **README frontmatter schema compliance (Phase 2B Skills Audit)** — Corrected frontmatter in `.github/projects/active/phase-2b-skills-audit/README.md` to comply with LightSpeed documentation schema: added required `file_type: readme` field, renamed `created` to `created_date`, updated `last_updated` and `version` fields, and removed non-schema fields (`name`, `related_issues`, `related_branches`). Resolves frontmatter validation failures and ensures project documentation adheres to canonical schema standards. ([PR #1540](https://github.com/lightspeedwp/.github/pull/1540), [#1375](https://github.com/lightspeedwp/.github/issues/1375)) + +- **Safe Footer Injection frontmatter detection** — Extended YAML frontmatter detection to support variable-length headers by searching entire file instead of limited line count. Changed delimiter matching to exact match `trim() === '---'` to prevent false positives on YAML content lines. ([PR #1632](https://github.com/lightspeedwp/.github/pull/1632)) - **Phase 3 label validation enforcement — Validation script & workflow** — Pre-creation label validation script (`validate-labels-before-creation.cjs`) enforces canonical label prefixes and one-hot constraint per family. GitHub Actions workflow validates on issue/PR creation, editing, labeling, and PR synchronization. Prevents bare labels (e.g., `bug`, `feature`, `urgent`) and enforces required prefixes (e.g., `type:bug`, `priority:critical`). ([PR #1613](https://github.com/lightspeedwp/.github/pull/1613), [#1612](https://github.com/lightspeedwp/.github/issues/1612)) @@ -60,6 +74,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Added +- **Label prefix governance enforcement audit** — Comprehensive audit identifying 100+ label governance violations with structured 5-phase remediation strategy covering governance updates, validation enforcement, pre-creation scripts, documentation, and team training. ([PR #1591](https://github.com/lightspeedwp/.github/pull/1591), [#1592](https://github.com/lightspeedwp/.github/issues/1592)) + +- **Implement Phase 3 labeling automation for issue triage** — Implemented automated labeling rules and infrastructure for phase 3 of issue triage system with type assignment and status classification. ([PR #1505](https://github.com/lightspeedwp/.github/pull/1505)) + +- **Add status:needs-review audit report** — Generated comprehensive audit report identifying all issues requiring review using new status labeling system. ([PR #1506](https://github.com/lightspeedwp/.github/pull/1506)) + +- **Add pre-commit validation hook for PR template compliance** — Added pre-commit hook to enforce PR template compliance before commits preventing non-compliant PRs. ([PR #1508](https://github.com/lightspeedwp/.github/pull/1508)) + +- **Add AI feedback PR review validation workflow** — Implemented automated workflow to validate AI feedback in PRs with issue linking and decision tracking (addressed/deferred/rejected). ([PR #1526](https://github.com/lightspeedwp/.github/pull/1526)) + +- **Add Mermaid accessibility attributes repository-wide** — Added ARIA labels and accessibility attributes to all Mermaid diagrams across codebase improving accessibility compliance. ([PR #1530](https://github.com/lightspeedwp/.github/pull/1530)) + +- **Release Process V2 specification and OpenSpec analysis** — Defined Release Process V2 specification with comprehensive OpenSpec analysis for standardized release workflows and automation. ([PR #1545](https://github.com/lightspeedwp/.github/pull/1545)) + +- **Gitleaks secret scanning** — Added `gitleaks-reusable.yml`, an organisation-wide reusable workflow other repositories call via `workflow_call`, plus a `gitleaks.yml` caller running on pull requests into `develop`/`main`. Runs the open-source Gitleaks CLI directly (the `gitleaks-action` wrapper requires a paid licence for organisation repositories). Per-PR runs scan the working tree; `workflow_dispatch` accepts a `full-history` input for on-demand full-history rescans. A baseline full-history scan of this repository returned 50 hits, all verified as placeholder values in documentation and tests, allowlisted in `.gitleaks.toml`. ([PR #1444](https://github.com/lightspeedwp/.github/pull/1444)) + - **Phase 1–3 completion documentation** — Comprehensive project completion report documenting Phase 1 restructuring, Phase 2 label remediation, and Phase 3 validation enforcement. Includes audit findings, 5-phase remediation timeline, and governance architecture. ([PR #1624](https://github.com/lightspeedwp/.github/pull/1624)) - **Label creation governance in CLAUDE.md and AGENTS.md** — Added mandatory label prefix enforcement rules to organisation-wide governance documents. All labels must use canonical prefixes (type:, status:, priority:, area:, etc.) from `.github/labels.yml` (158 canonical labels). One-hot constraint per family except meta:, comp:, lang: which allow multiples. Prevents bare labels and enforces validation at issue/PR creation time. ([PR #1611](https://github.com/lightspeedwp/.github/pull/1611)) @@ -152,6 +182,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - **Branch cleanup automation** — Added reusable cleanup script, weekly scheduled workflow, and report generation for stale merged branches with safety guardrails. ([PR #1067](https://github.com/lightspeedwp/.github/pull/1067) — *Add scheduled branch cleanup automation and reporting*, [#1066](https://github.com/lightspeedwp/.github/issues/1066)) +### Changed + +- **Reorganize label-prefix audit to active projects** — Moved label-prefix audit project artifacts from reports directory to active projects following active work convention. ([PR #1625](https://github.com/lightspeedwp/.github/pull/1625)) + +- **Phase 3D - Reports Placement Enforcement** — Enforced reports placement in `.github/reports/` directory with validation to prevent misplaced artifacts following Phase 3D standards. ([PR #1581](https://github.com/lightspeedwp/.github/pull/1581), [#1290](https://github.com/lightspeedwp/.github/issues/1290)) + +- **Phase 3C - Agent Reorganization and Two-Tier Structure** — Completed Phase 3C restructuring establishing two-tier agent architecture with 19 spec-based (GitHub-native) agents in `.github/agents/` and 16 portable multi-file agents in root `agents/`. ([PR #1583](https://github.com/lightspeedwp/.github/pull/1583), [#1290](https://github.com/lightspeedwp/.github/issues/1290)) + +- **Phase 3A - Instructions Migration and Consolidation** — Migrated portable instruction files from `.github/instructions/` to root `instructions/` directory establishing clear portable/control-plane separation. ([PR #1582](https://github.com/lightspeedwp/.github/pull/1582), [#1290](https://github.com/lightspeedwp/.github/issues/1290)) + +- **Complete Phase 2B script migration (Batches 1-3)** — Migrated 117 portable scripts from `.github/scripts/` to root `scripts/` directory with full path reference updates (Batches 1-3 complete). ([PR #1528](https://github.com/lightspeedwp/.github/pull/1528)) + +- **Migrate agent utilities to portable location (Phase 2B Batch 2)** — Migrated shared agent utility functions and libraries to portable location under `agents/` directory following Phase 2B plan. ([PR #1518](https://github.com/lightspeedwp/.github/pull/1518)) + +- **Phase 2B Batch 1 — Move validation scripts to root** — Migrated validation scripts from `.github/scripts/validation/` to portable root `scripts/validation/` location with reference updates. ([PR #1504](https://github.com/lightspeedwp/.github/pull/1504)) + +- **Phase 2 governance updates with Phase 1 audit findings** — Updated governance documentation with comprehensive Phase 1 audit findings, consolidation status, and remediation paths for remaining phases. ([PR #1534](https://github.com/lightspeedwp/.github/pull/1534), [#1295](https://github.com/lightspeedwp/.github/issues/1295)) + +- **Post-merge governance refinements** — Applied governance refinements, corrected naming conventions, and updated standards documentation following Phase 2 major merges. ([PR #1516](https://github.com/lightspeedwp/.github/pull/1516), [#1515](https://github.com/lightspeedwp/.github/issues/1515)) + +- **Update active project statuses and phase progress** — Updated active project documentation reflecting completion of Phase 1-2 work and progress toward Phase 3 completion. ([PR #1514](https://github.com/lightspeedwp/.github/pull/1514)) + +- **Document ESLint fixes and footer automation issues** — Documented ESLint fixes applied during linting phase and identified footer automation issues for follow-up. ([PR #1519](https://github.com/lightspeedwp/.github/pull/1519), [#1486](https://github.com/lightspeedwp/.github/issues/1486)) + ### Removed - **Remove checksums.sha256 manifest** — Removed unverified checksum manifest. ([PR #1392](https://github.com/lightspeedwp/.github/pull/1392), [#1394](https://github.com/lightspeedwp/.github/issues/1394)) diff --git a/scripts/inject-footers-safe.js b/scripts/inject-footers-safe.js index 113a46327..39403fa09 100644 --- a/scripts/inject-footers-safe.js +++ b/scripts/inject-footers-safe.js @@ -69,7 +69,6 @@ const CONFIG = { /** * SAFE: Extract frontmatter by finding closing --- marker * Supports standard YAML frontmatter: --- YAML content --- - * SAFETY: Only extracts up to 50 lines of frontmatter to prevent abuse * Uses exact match (trim() === '---') to avoid false positives on content lines * * @param {string} content - File content @@ -83,27 +82,28 @@ function extractFrontmatterSafely(content) { return { frontmatter: "", body: content }; } - // Find closing --- marker (search up to line 50 for safety) - const maxFrontmatterLines = 50; - let closingIndex = -1; - - for (let i = 1; i < Math.min(lines.length, maxFrontmatterLines); i++) { + // Find closing --- (can be anywhere, but typically within first 50 lines) + let closingLineIndex = -1; + for (let i = 1; i < lines.length; i++) { if (lines[i].trim() === "---") { - closingIndex = i; + closingLineIndex = i; break; } } - // If closing --- found, extract frontmatter - if (closingIndex > 0) { - const frontmatterLines = lines.slice(0, closingIndex + 1); - const frontmatter = frontmatterLines.join("\n") + "\n"; - const body = lines.slice(closingIndex + 1).join("\n"); - return { frontmatter, body }; + if (closingLineIndex === -1) { + // No closing ---, treat as body + return { frontmatter: "", body: content }; } - // If closing --- not found, treat entire content as body (no frontmatter) - return { frontmatter: "", body: content }; + // Extract frontmatter (lines 0 to closingLineIndex inclusive, plus newline) + const frontmatterLines = lines.slice(0, closingLineIndex + 1); + const frontmatter = frontmatterLines.join("\n") + "\n"; + + // Extract body (everything after frontmatter) + const body = lines.slice(closingLineIndex + 1).join("\n"); + + return { frontmatter, body }; } /**