Dimidium Labs infrastructure

This repository contains executable development and release tasks shared by Dimidium Labs projects. GitHub Actions is only a runner for these tasks.

Projects include tasks/ with mise remote Git includes. By default, tasks are fetched directly from this public repository over HTTPS:

mise run signoff
mise run licenses

Consuming projects pin this repository by commit SHA.

Tool provisioning

Each project declares its toolchain and standalone CLI dependencies in mise.toml. A fresh checkout is provisioned with one command:

mise bootstrap

Shared tasks declare task-specific tools in their #MISE tools metadata, so mise run installs the same pinned versions on demand. System libraries that cannot be installed as portable tools belong in [bootstrap.packages].

Guardrails

Licensing policy

tasks/licenses runs a pinned REUSE version and verifies the repository's licensing metadata and canonical SPDX copyright headers. In Rust projects it also runs a pinned cargo deny check.

Sign-off policy

tasks/signoff verifies that:

• authors and co-authors with an email from config/signoff-approved-emails are trusted without a trailer;
• CLA.md declares exactly one version;
• every non-approved author and co-author has a Signed-off-by trailer exactly matching their commit identity;
• every commit with a non-approved author or co-author has exactly one CLA-Version trailer matching the version declared by CLA.md in that commit;
• commits listed in config/cla-unsupported-commits retain their Signed-off-by requirement but are explicitly not treated as covered by a versioned CLA;
• every non-approved author and committer email in the complete non-merge history is registered in .mailmap.

Approved emails and unsupported commits are maintained centrally so a pull request in a consuming repository cannot grant itself an exemption.

Contributing

We welcome your contributions, including code, bug reports, ideas, and success stories.

If you are making a contribution for the first time or from a new email, please add yourself to the .mailmap.

Signoff

To include your code, we ask that you read and agree to the CLA. To sign, add a CLA-Version: 1.0 and a Signed-off-by trailer to every commit (git commit -s --trailer "CLA-Version: 1.0"). Each commit in a pull request must carry a valid Signed-off-by line matching the commit author. Please use your real name. We cannot include code from anonymous contributors.

AI agents MUST NOT add Signed-off-by tags. Only humans can legally certify the Contributor License Agreement.

AI policy

You may use AI agents when writing code and documentation. AI is not allowed for media including images, videos, fonts at all. You must fully read, understand, and cleanup any code generated by the agent. We ask that you disclose the agent's use and indicate the tool, model, and extent of contribution.

Contributions should include an Assisted-by tag in the following format: Assisted-by: AGENT_NAME:MODEL_VERSION [TOOL1] [TOOL2], for example: Assisted-by: Claude:claude-4.6-opus coccinelle sparse

Remember, AI agents should make software better, not worse.

Licensing

Executable tasks and their configuration are licensed under 0BSD. Documentation is licensed under CC-BY-4.0.