From 6d596b7118a56628de3b79ca27e47e4786bebcbe Mon Sep 17 00:00:00 2001 From: Sander van Rossen Date: Mon, 26 Oct 2026 15:55:36 +0100 Subject: [PATCH 1/2] Security policy, sponsor button, PR template, Dependabot for actions - SECURITY: report privately through GitHub's vulnerability reporting. - FUNDING: the Sponsor button points at GitHub Sponsors for LogicalError. - A pull request template that follows CONTRIBUTING. - Dependabot keeps the workflow's actions up to date. - The checks workflow only gets a read token. - CONTRIBUTING: pull requests are squash-merged and keep their author. --- .github/FUNDING.yml | 1 + .github/dependabot.yml | 6 ++++++ .github/pull_request_template.md | 8 ++++++++ .github/workflows/checks.yml | 3 +++ CONTRIBUTING.md | 2 ++ SECURITY.md | 5 +++++ SECURITY.md.meta | 7 +++++++ 7 files changed, 32 insertions(+) create mode 100644 .github/FUNDING.yml create mode 100644 .github/dependabot.yml create mode 100644 .github/pull_request_template.md create mode 100644 SECURITY.md create mode 100644 SECURITY.md.meta diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml new file mode 100644 index 00000000..722d4995 --- /dev/null +++ b/.github/FUNDING.yml @@ -0,0 +1 @@ +github: [LogicalError] diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..3a626c3a --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: monthly diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 00000000..7d00a135 --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,8 @@ +**What this changes and why** + +**Fixes** # + +**How it was tested** (scene, steps, Unity version) + +- [ ] Compiles without warnings, in the editor and in a player build +- [ ] Tests added or updated, and the EditMode tests pass diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml index b911a12a..3e77defc 100644 --- a/.github/workflows/checks.yml +++ b/.github/workflows/checks.yml @@ -1,5 +1,8 @@ name: Checks +permissions: + contents: read + on: pull_request: push: diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 698043ea..674ce18a 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -47,6 +47,8 @@ almost always belongs in the CSG, not in a special case in the generator. * New features should work for any level someone builds by hand, not only for one kind of content, and be reachable from the editor's UI. +Pull requests are squash-merged into a single commit, which keeps you as its author. + ## Tests The tests are in `Core/Tests`, `Components/Tests` and `Editor/Tests`. With Chisel embedded in your project's diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..44780d29 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,5 @@ +# Security + +Please report security problems privately, through **Report a vulnerability** on the [Security tab](https://github.com/RadicalCSG/com.chisel/security) of this repository, rather than in a public issue. + +Fixes go into the newest version. diff --git a/SECURITY.md.meta b/SECURITY.md.meta new file mode 100644 index 00000000..19970795 --- /dev/null +++ b/SECURITY.md.meta @@ -0,0 +1,7 @@ +fileFormatVersion: 2 +guid: 634d0d5afa5142f7a2d13e8d8498c6e2 +TextScriptImporter: + externalObjects: {} + userData: + assetBundleName: + assetBundleVariant: From f318d753f430fc8aef344ce7641ff3e51fec6328 Mon Sep 17 00:00:00 2001 From: Sander van Rossen Date: Mon, 26 Oct 2026 15:56:27 +0100 Subject: [PATCH 2/2] Sponsor button: Patreon too --- .github/FUNDING.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml index 722d4995..66efc094 100644 --- a/.github/FUNDING.yml +++ b/.github/FUNDING.yml @@ -1 +1,2 @@ github: [LogicalError] +patreon: logicalerror