131868bdca
Major security, observability, and configuration improvements:
## Security Hardening
- Implemented configurable CORS (no more wildcards)
- Added comprehensive auth middleware for admin endpoints
- Enhanced webhook HMAC validation
- Added input validation and rate limiting
- Security headers and CSP policies
## Configuration Management
- Made N8N webhook URL configurable (WHOOSH_N8N_BASE_URL)
- Replaced all hardcoded endpoints with environment variables
- Added feature flags for LLM vs heuristic composition
- Gitea fetch hardening with EAGER_FILTER and FULL_RESCAN options
## API Completeness
- Implemented GetCouncilComposition function
- Added GET /api/v1/councils/{id} endpoint
- Council artifacts API (POST/GET /api/v1/councils/{id}/artifacts)
- /admin/health/details endpoint with component status
- Database lookup for repository URLs (no hardcoded fallbacks)
## Observability & Performance
- Added OpenTelemetry distributed tracing with goal/pulse correlation
- Performance optimization database indexes
- Comprehensive health monitoring
- Enhanced logging and error handling
## Infrastructure
- Production-ready P2P discovery (replaces mock implementation)
- Removed unused Redis configuration
- Enhanced Docker Swarm integration
- Added migration files for performance indexes
## Code Quality
- Comprehensive input validation
- Graceful error handling and failsafe fallbacks
- Backwards compatibility maintained
- Following security best practices
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
27 lines
956 B
Markdown
27 lines
956 B
Markdown
# How to contribute
|
|
|
|
We definitely welcome patches and contribution to this project!
|
|
|
|
### Tips
|
|
|
|
Commits must be formatted according to the [Conventional Commits Specification](https://www.conventionalcommits.org).
|
|
|
|
Always try to include a test case! If it is not possible or not necessary,
|
|
please explain why in the pull request description.
|
|
|
|
### Releasing
|
|
|
|
Commits that would precipitate a SemVer change, as described in the Conventional
|
|
Commits Specification, will trigger [`release-please`](https://github.com/google-github-actions/release-please-action)
|
|
to create a release candidate pull request. Once submitted, `release-please`
|
|
will create a release.
|
|
|
|
For tips on how to work with `release-please`, see its documentation.
|
|
|
|
### Legal requirements
|
|
|
|
In order to protect both you and ourselves, you will need to sign the
|
|
[Contributor License Agreement](https://cla.developers.google.com/clas).
|
|
|
|
You may have already signed it for other Google projects.
|