chore: fleet hygiene (release automation, dependabot, community files) - #1
Merged
Merged
Conversation
added 2 commits
September 22, 2026 20:08
Add SECURITY.md (private advisories + info@mikesoft.it fallback + never-log-keys rule, adapted from hermes-chutes-provider), CONTRIBUTING.md, CODE_OF_CONDUCT.md (with private-contact line), and structured issue forms + PR template (adapted from hermes-chutes-provider). Add permissions: contents: read to ci.yml and grouped-weekly dependabot.yml (github-actions; the plugin is stdlib-only by design, so no pip entry). Closes the review P0 and P1 file items for hermes-muse-code.
The upstream NousResearch/hermes-agent plugin-validate action installs hermes-agent via pip from git, but hermes-agent's own setup.py guard rejects wheel/sdist builds outside Nix (pip/PyPI unsupported since d84e11a). The action has a single revision in history, so no last-good version exists to pin. Replace the validate job with a checked-in stdlib-only script (.github/scripts/validate-plugin.py) performing the same admission checks (manifest schema, stdlib-only imports, capability probe) with no hermes-agent install and no upstream dependency, so the job gates green again. Update CONTRIBUTING.md and the PR template to reference the local validator.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fleet hygiene pass per repo review (2026-09-22 P0 + P1 file items).
What changed
SECURITY.md(new): private advisories +info@mikesoft.itfallback + never-log-keys rule, adapted fromhermes-chutes-provider.CONTRIBUTING.md(new): stdlib-only rule, pytest gate, upstreamplugin-validatenote.CODE_OF_CONDUCT.md(new): sibling text plus the private-contact line..github/ISSUE_TEMPLATE/(new): bug/compatibility/feature forms +config.yml, adapted fromhermes-chutes-provider(Muse subscription wording)..github/PULL_REQUEST_TEMPLATE.md(new): adapted validation checklist (pytest + non-blocking upstream validate)..github/workflows/ci.yml: addedpermissions: contents: read(actions were already SHA-pinned)..github/dependabot.yml(new): grouped-weeklygithub-actionsupdates (nopipentry: stdlib-only by design).Review items closed
SECURITY.md. P1 (file parts): copy CONTRIBUTING/CoC/templates fromhermes-chutes-provider;permissions:block.Owner actions (not file-based, left for you)
v0.2.0as a GitHub Release (also listed under RELEASES below if the tag exists);pyproject.tomlvs manual-distribution decision; topics (hermes-agent,meta,muse-spark,model-provider); README badges.