From 3405bfe759ab7925a2bec590ca624cdd7e53b88e Mon Sep 17 00:00:00 2001 From: Nelson Spence Date: Mon, 25 May 2026 14:52:06 -0500 Subject: [PATCH 1/2] docs+ci: ROADMAP, GOVERNANCE, and coverage reporting (OpenSSF silver readiness) - ROADMAP.md: vision (edge-RAG / local-AI retrieval building block, NOT a standalone vector DB), non-goals, and direction (publish, C ABI, adapters incl. EdgeQuake, musllinux, 1.0). - GOVERNANCE.md: maintainer/code-owner roles, PR + review decision process, links to CONTRIBUTING/CoC/SECURITY. - coverage.yml + README badge: cargo-llvm-cov -> Codecov (tokenless, public repo; informational, non-blocking). Coverage is ~89% lines (measured with cargo llvm-cov --all-features; every file >= 80%). All actions SHA-pinned, persist-credentials: false, scoped permissions; zizmor + actionlint clean. --- .github/workflows/coverage.yml | 44 ++++++++++++++++++++++++ GOVERNANCE.md | 42 +++++++++++++++++++++++ README.md | 1 + ROADMAP.md | 61 ++++++++++++++++++++++++++++++++++ 4 files changed, 148 insertions(+) create mode 100644 .github/workflows/coverage.yml create mode 100644 GOVERNANCE.md create mode 100644 ROADMAP.md diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml new file mode 100644 index 00000000..92fc168c --- /dev/null +++ b/.github/workflows/coverage.yml @@ -0,0 +1,44 @@ +name: coverage + +# Measure test coverage with cargo-llvm-cov and upload to Codecov (README badge). +# Informational, not a required status check. Tokenless upload (supported for +# public repos); fail_ci_if_error is false so a failed/absent upload never blocks +# a PR. Activate the repo at https://codecov.io to surface the dashboard + badge. +on: + push: + branches: [main] + pull_request: + workflow_dispatch: + +concurrency: + group: coverage-${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + coverage: + name: coverage (cargo-llvm-cov) + runs-on: ubuntu-latest + steps: + - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + with: + egress-policy: audit + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable (2026-03-27) + with: + toolchain: stable + components: llvm-tools-preview + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + - name: Install cargo-llvm-cov (pinned) + run: cargo install cargo-llvm-cov --version 0.8.7 --locked + - name: Generate coverage (lcov) + run: cargo llvm-cov --all-features --lcov --output-path lcov.info + - name: Upload coverage to Codecov + uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1 + with: + files: lcov.info + fail_ci_if_error: false diff --git a/GOVERNANCE.md b/GOVERNANCE.md new file mode 100644 index 00000000..b90783f6 --- /dev/null +++ b/GOVERNANCE.md @@ -0,0 +1,42 @@ +# Governance + +ordvec is a small, actively maintained open-source project. This document +describes how it is run. + +## Roles + +- **Maintainer.** ordvec is currently maintained by Nelson Spence + ([@Fieldnote-Echo](https://github.com/Fieldnote-Echo)), the project lead and + final decision-maker on technical direction, releases, and scope. +- **Code owners.** Listed in [`.github/CODEOWNERS`](.github/CODEOWNERS); they + review and approve changes. + +## Decision-making + +- All changes land via **pull request** — direct pushes to `main` are blocked by + branch protection. +- Every PR requires **passing CI** and at least **one approving review from a + code owner other than the author**, with review conversations resolved before + merge. +- Routine changes are decided by maintainer / code-owner review. Larger, + direction-setting changes (scope, public API, dependencies) are discussed in + an issue or pull request first; the maintainer makes the final call, + consistent with the [roadmap](ROADMAP.md). +- Decisions favour the project's stated scope — ordvec is a retrieval + _primitive_ for edge / local AI retrieval, **not** a standalone vector + database (see [ROADMAP.md](ROADMAP.md)). + +## Becoming a code owner + +There is no formal membership process yet. Contributors who provide sustained, +high-quality contributions and reviews may be invited to become code owners. +The project is being opened specifically to grow this group — including +collaborators on the accompanying OrdVec / RankQuant paper. + +## Contributing, conduct, and security + +- **Contributing:** see [CONTRIBUTING.md](CONTRIBUTING.md). Contributions are + dual-licensed **MIT OR Apache-2.0**, matching the project license. +- **Code of conduct:** see [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) + (Contributor Covenant). +- **Security:** report vulnerabilities privately per [SECURITY.md](SECURITY.md). diff --git a/README.md b/README.md index 28bf4f4a..32e83ce2 100644 --- a/README.md +++ b/README.md @@ -5,6 +5,7 @@ [![MSRV](https://img.shields.io/badge/MSRV-1.89-blue.svg)](#minimum-supported-rust-version) [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Fieldnote-Echo/ordvec/badge)](https://scorecard.dev/viewer/?uri=github.com/Fieldnote-Echo/ordvec) [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/12977/badge)](https://www.bestpractices.dev/projects/12977) +[![codecov](https://codecov.io/gh/Fieldnote-Echo/ordvec/graph/badge.svg)](https://codecov.io/gh/Fieldnote-Echo/ordvec)