Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Configure one-time repository settings: Pages source, private vulnerability reporting and branch protection

Open
  • Is something wrong?
#19 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
20/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Active
Tech stack
github, github-actions, typescript
Domain
ci-cd, devops, release, security

Research direction

Read README.md's Deployment section, SECURITY.md, CONTRIBUTING.md, and the four workflows under .github/workflows; inspect .github/labels.json and .github/milestones.json for the sync requirements. Configure the repository settings and validate CI, Pages, vulnerability reporting, branch protection, and the release workflow as listed in the acceptance criteria. It is done when every listed check and repository setting succeeds.

Written by the indexing model from the issue text.

Description

area: infra priority: high type: chore

Context

Some settings cannot be configured from files in the repository. Without the Pages source, pages.yml cannot deploy; without private vulnerability reporting, the reporting path in SECURITY.md and the "Report a security vulnerability" link in the issue chooser lead nowhere; without branch protection, the review rule in CONTRIBUTING.md (one approval and green CI) is not enforced. The workflow hardening of v0.1 (SHA pins, read-only tokens) was checked only by parsing the YAML, so the first real runs of CI, Pages and Release need checking too.

Scope

A maintainer with admin rights:

  1. Settings, Pages, Build and deployment: Source = GitHub Actions.
  2. Settings, Code security: Private vulnerability reporting = enabled.
  3. A branch protection rule or ruleset for main: pull requests required, one approving review, the CI checks (build, end-to-end tests, prompt kit) required.
  4. On the v0.1 pull request: check that the three CI jobs pass on GitHub's runners.
  5. After the merge: run the Repo sync workflow if labels or milestones are missing, check the first Pages deployment, and push a pre-release tag (for example v0.1.0-rc.1) to test the release workflow.

Acceptance criteria

  • CI passes on GitHub for the v0.1 pull request (build, end-to-end tests, prompt kit).
  • The Pages workflow on main succeeds and https://nullthrone.github.io/lexvm/ serves the player.
  • https://nullthrone.github.io/lexvm/lexvm-offline.html downloads the single-file build.
  • A pre-release tag runs release.yml and publishes lexvm-offline.html, the compiled packs and SHA256SUMS.txt.
  • Private vulnerability reporting is enabled; the security link in the issue chooser opens the advisory form.
  • A direct push to main is refused, and a pull request cannot be merged with failing CI or without an approval.
  • All labels from .github/labels.json and milestones from .github/milestones.json exist.

References

  • README.md (Deployment)
  • SECURITY.md
  • CONTRIBUTING.md (Review process)
  • .github/workflows/ci.yml
  • .github/workflows/pages.yml
  • .github/workflows/release.yml
  • .github/workflows/repo-sync.yml
  • .github/ISSUE_TEMPLATE/config.yml
  • docs/adr/0006-offline-first-pwa-on-github-pages.md
Dominant language
TypeScript
Stars
0
Forks
0
Avg merge
28m
Merged PRs (30d)
2

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from nullthrone/lexvm

All issues in nullthrone/lexvm

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.