8000 Security policy, Codecov coverage and README status badges by rafatahmed · Pull Request #133 · rafatahmed/Flahax · GitHub
[go: up one dir, main page]

Skip to content

Security policy, Codecov coverage and README status badges - #133

Merged
rafatahmed merged 1 commit into
mainfrom
ci/coverage-badges-security
Oct 23, 2026
Merged

rafatahmed merged 1 commit into
mainfrom
ci/coverage-badges-security

Conversation

@rafatahmed
Copy link
Copy Markdown
Owner

What changes

  • SECURITY.md:
    • Supported versions: the latest PyPI release and main.
    • How to report privately: GitHub's private vulnerability reporting, or info@flaha.org with "FlahaX security" in the subject. Reports get an acknowledgement within 7 days.
    • What counts as a security problem: code execution or file access outside FlahaX's folders through its inputs, unbounded resource use, or a release artifact that does not match the source. A wrong recipe is a normal bug.
    • CONTRIBUTING links the policy.
  • Coverage on Codecov:
    • The Python 3.13 test job runs the same suite under coverage (installed in CI only, pinned 7.17.0; FlahaX keeps zero runtime dependencies).
    • It writes build/coverage.xml and uploads it with codecov/codecov-action, pinned to the v7.1.1 commit like every other action, using the CODECOV_TOKEN repository secret.
    • The upload does not fail CI if Codecov is unreachable.
    • codecov.yml makes Codecov's project and patch checks informational, so coverage reports never block a merge.
  • README badges: Tests (GitHub Actions), Documentation (Read the Docs) and Codecov, next to the existing PyPI, Python, License and Downloads badges.

Checks

  • Coverage run (locally, same commands): 540 tests OK under coverage, build/coverage.xml written, 90 % line coverage of src/flahax; the report file is git-ignored and outside the sdist.
  • Config files: the workflow and codecov.yml parse as YAML.
  • Style: ruff check passes, and every file uses LF line endings.
  • After merge: the Codecov badge fills in once main uploads its first report. Codecov's PR comments need the Codecov GitHub App installed on the repository.

SECURITY.md: supported versions, private reporting through GitHub or
info@flaha.org, and what counts as a security problem for FlahaX.

The Python 3.13 test job runs the suite under coverage (CI tool only,
pinned 7.17.0) and uploads build/coverage.xml with the pinned
codecov/codecov-action v7.1.1 and the CODECOV_TOKEN secret. codecov.yml
keeps Codecov's checks informational. The README gains Tests,
Documentation (Read the Docs) and Codecov badges.
@rafatahmed rafatahmed self-assigned this Oct 23, 2026
@read-the-docs-community
Copy link
Copy Markdown

Documentation build overview

📚 Flahax | 🛠️ Build #35358083 | 📁 Comparing a23a035 against latest (616c63b)

  🔍 Preview build  

1 file changed
± changelog.html

@codecov-commenter
Copy link
Copy Markdown

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️

@rafatahmed
rafatahmed merged commit 887846d into main Oct 23, 2026
8 checks passed
@rafatahmed
rafatahmed deleted the ci/coverage-badges-security branch October 23, 2026 15:32
rafatahmed added a commit that referenced this pull request Nov 7, 2026
Security policy, Codecov coverage and README status badges
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

0