Skip to content

📝 docs: write down the versioning rule, and restyle the footer #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
miccy merged 1 commit into from
Aug 23, 2026
Merged

📝 docs: write down the versioning rule, and restyle the footer #14

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 34 additions & 0 deletions README-cs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,7 +171,41 @@ Dědění je levnější:

Fork znamená opravit každou bezpečnostní vadu tolikrát, kolik máš kopií.

## Verzování

`main` je to, co dostane každý, kdo si nepinnul `github>ownctrl/supply-chain` —
ten má každý merge okamžitě. Tagy jsou pro ty, kdo pinnuli. Mergovat můžeš, jak
často chceš; tag řež, až má pinnutý konzument důvod se pohnout.

Není tu žádné API k verzování. Konzument z presetu dostává jedinou věc —
**co se sloučí, aniž se na to podívá** — a to je to, co číslo sleduje.

| | Význam | Příklad |
| --- | --- | --- |
| **MAJOR** | něco se nově slučuje samo, co dřív čekalo, nebo přestane fungovat existující config | přidání balíčku mezi důvěryhodné; přejmenování sub-presetu |
| **MINOR** | nové pokrytí, které nic neuvolňuje | nový ekosystém, nový sub-preset, další balíčky na watch listu |
| **PATCH** | o slučování se nemění nic | dokumentace, text v PR, náš vlastní pin nástrojů |

Ta asymetrie je záměrná. **Utažení je minor, uvolnění je major**, i když je diff
stejně velký. Když něco přestane automergovat, nejhorší následek je pár kliků
navíc. Když něco začne automergovat, obešel jsi důvod, proč si ten člověk pin
dal — pin je příslib, že se posture nezmění pod rukama.

Takže přidat jeden balíček mezi důvěryhodné je major, i kdyby to byl jeden
řádek.

## Odkazy

- 🔒 [Socket.dev](https://socket.dev) — skenování supply chain
- 📊 [Datadog IOC](https://github.com/DataDog/indicators-of-compromise/tree/main/shai-hulud-2.0) — oficiální IOC seznam

<div align="right">
<a href="#top"><img src="https://img.shields.io/badge/%E2%96%B2_Scroll-Top_%E2%96%B2-white?style=plastic&labelColor=black&color=white" alt="Scroll Top"/></a>
</div>

---

<div align="center">
<a href="https://github.com/miccy"><img src="https://img.shields.io/badge/%F0%9F%A9%B7_Maintained%20by-%40miccy-white?style=plastic&labelColor=black&color=white" alt="Maintained by @miccy"/></a>
<a href="https://github.com/ownctrl"><img src="https://img.shields.io/badge/%C2%A92026-ownCTRL%E2%84%A2-white?style=plastic&labelColor=black&color=white" alt="© 2026 ownCTRL™"/></a>
</div>
33 changes: 31 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -309,14 +309,43 @@ The full list lives in [`default.json`](./default.json). Affected version ranges

---

## Versioning

`main` is what an unpinned `github>ownctrl/supply-chain` resolves to, so every
merge reaches those consumers immediately. Tags exist for the people who pinned.
Merge as often as you like; cut a tag when a pinned consumer has a reason to
move.

There is no API here to version. What a consumer gets from this preset is one
thing — **what merges without them looking** — so that is what the number
tracks.

| | Meaning | Example |
| --- | --- | --- |
| **MAJOR** | something now merges unattended that did not before, or an existing config breaks | adding a package to the trusted list; renaming a sub-preset |
| **MINOR** | new coverage that loosens nothing | a new ecosystem group, a new sub-preset, more packages on the watch list |
| **PATCH** | nothing about what merges changes | documentation, PR body text, our own pinned tooling |

The asymmetry is deliberate. **Tightening is minor, loosening is major**, even
when the diff is the same size. If something stops automerging, the worst case
is a few more clicks. If something starts automerging, you have gone around the
reason someone pinned in the first place — a pin is a promise that the posture
will not shift underneath them.

So adding one package to the trusted list is a major, one line or not.

## Related Resources

- 🔒 [Socket.dev](https://socket.dev) — Supply chain security scanning
- 📊 [Datadog IOCs](https://github.com/DataDog/indicators-of-compromise/tree/main/shai-hulud-2.0) — Official IOC list

<div align="right">
<a href="#top"><img src="https://img.shields.io/badge/%E2%96%B2_Scroll-Top_%E2%96%B2-white?style=plastic&labelColor=black&color=white" alt="Scroll Top"/></a>
</div>

---

<div align="center">
<p>Maintained by <a href="https://github.com/ownctrl">ownctrl</a></p>
<p>© 2025–2026 <a href="https://github.com/miccy">Miccy</a> · MIT</p>
<a href="https://github.com/miccy"><img src="https://img.shields.io/badge/%F0%9F%A9%B7_Maintained%20by-%40miccy-white?style=plastic&labelColor=black&color=white" alt="Maintained by @miccy"/></a>
<a href="https://github.com/ownctrl"><img src="https://img.shields.io/badge/%C2%A92026-ownCTRL%E2%84%A2-white?style=plastic&labelColor=black&color=white" alt="© 2026 ownCTRL™"/></a>
</div>
Loading