docs: attest OpenSSF best practices controls

.bestpractices.json

@@ -0,0 +1,88 @@
+{
+  "description_good_status": "Met",
+  "description_good_justification": "README.md describes efctl's purpose, users, and major capabilities.",
+  "interact_status": "Met",
+  "interact_justification": "The public issue tracker supports user and maintainer interaction: https://github.com/Scetrov/efctl/issues.",
+  "contribution_status": "Met",
+  "contribution_justification": "The contribution process is documented in CONTRIBUTING.md: https://github.com/Scetrov/efctl/blob/main/CONTRIBUTING.md.",
+  "floss_license_status": "Met",
+  "floss_license_justification": "The project is distributed under the OSI-approved MIT License.",
+  "license_location_status": "Met",
+  "license_location_justification": "The repository root contains the license text: https://github.com/Scetrov/efctl/blob/main/LICENSE.",
+  "documentation_basics_status": "Met",
+  "documentation_basics_justification": "README.md documents installation, usage, and project capabilities.",
+  "documentation_interface_status": "Met",
+  "documentation_interface_justification": "Generated CLI reference is maintained under docs/ and linked from README.md.",
+  "sites_https_status": "Met",
+  "sites_https_justification": "The public repository, documentation links, releases, and vulnerability reporting endpoint use HTTPS.",
+  "discussion_status": "Met",
+  "discussion_justification": "Public discussions and issue reports are retained in the repository issue tracker.",
+  "maintained_status": "Met",
+  "maintained_justification": "The repository has current releases, dependency updates, CI maintenance, and active source changes.",
+  "repo_public_status": "Met",
+  "repo_public_justification": "The complete source repository is publicly available on GitHub.",
+  "repo_track_status": "Met",
+  "repo_track_justification": "Git tracks the project history and published tags.",
+  "repo_interim_status": "Met",
+  "repo_interim_justification": "Changes are developed in Git branches and reviewed through GitHub pull requests before mainline integration.",
+  "version_unique_status": "Met",
+  "version_unique_justification": "Published releases use unique SemVer tags from v0.0.1 through v0.3.6.",
+  "release_notes_status": "Met",
+  "release_notes_justification": "Human-readable summaries for every published release are maintained in CHANGELOG.md: https://github.com/Scetrov/efctl/blob/main/CHANGELOG.md.",
+  "release_notes_vulns_status": "N/A",
+  "release_notes_vulns_justification": "No published efctl release fixed a publicly known efctl runtime vulnerability with a CVE or similar identifier.",
+  "report_process_status": "Met",
+  "report_process_justification": "Bug-report guidance is published in CONTRIBUTING.md: https://github.com/Scetrov/efctl/blob/main/CONTRIBUTING.md.",
+  "report_responses_status": "Met",
+  "report_responses_justification": "Maintainers respond to public reports through the repository issue tracker and pull-request workflow.",
+  "report_archive_status": "Met",
+  "report_archive_justification": "The public issue tracker preserves report history: https://github.com/Scetrov/efctl/issues.",
+  "vulnerability_report_process_status": "Met",
+  "vulnerability_report_process_justification": "SECURITY.md publishes the private vulnerability-reporting process: https://github.com/Scetrov/efctl/blob/main/SECURITY.md.",
+  "vulnerability_report_private_status": "Met",
+  "vulnerability_report_private_justification": "GitHub private vulnerability reporting is documented in SECURITY.md: https://github.com/Scetrov/efctl/security/advisories/new.",
+  "vulnerability_report_response_status": "N/A",
+  "vulnerability_report_response_justification": "No private vulnerability reports were received in the applicable six-month window.",
+  "build_status": "Met",
+  "build_justification": "The documented Go build and the release workflow build reproducible platform binaries.",
+  "test_status": "Met",
+  "test_justification": "The repository contains unit, integration, and E2E Go tests run by CI.",
+  "test_policy_status": "Met",
+  "test_policy_justification": "CONTRIBUTING.md requires automated tests for new functionality and bug fixes.",
+  "tests_are_added_status": "Met",
+  "tests_are_added_justification": "Contributor policy requires corresponding automated tests for production changes.",
+  "warnings_status": "Met",
+  "warnings_justification": "go vet runs in pre-commit and make vet, and CI runs the standard test workflow.",
+  "warnings_fixed_status": "Met",
+  "warnings_fixed_justification": "CONTRIBUTING.md requires all applicable formatting and warning checks to pass before review.",
+  "know_secure_design_status": "Met",
+  "know_secure_design_justification": "docs/threat-model.md documents the project's security considerations and boundaries.",
+  "know_common_errors_status": "Met",
+  "know_common_errors_justification": "Contributor guidance and pre-commit checks cover formatting, static analysis, secrets, and vulnerability scanning.",
+  "crypto_published_status": "N/A",
+  "crypto_published_justification": "efctl does not implement or select cryptographic protocols or algorithms as a project security mechanism.",
+  "crypto_floss_status": "N/A",
+  "crypto_floss_justification": "efctl has no cryptographic functionality requiring a non-FLOSS implementation.",
+  "crypto_keylength_status": "N/A",
+  "crypto_keylength_justification": "efctl does not define cryptographic key lengths as a security mechanism.",
+  "crypto_working_status": "N/A",
+  "crypto_working_justification": "efctl does not implement cryptographic algorithms whose correctness requires project-specific validation.",
+  "crypto_password_storage_status": "N/A",
+  "crypto_password_storage_justification": "efctl does not store user passwords.",
+  "crypto_random_status": "N/A",
+  "crypto_random_justification": "efctl does not generate security-sensitive random values as a project security mechanism.",
+  "delivery_mitm_status": "Met",
+  "delivery_mitm_justification": "Release artifacts are distributed through GitHub's HTTPS release service.",
+  "delivery_unsigned_status": "Met",
+  "delivery_unsigned_justification": "The release workflow signs binary artifacts with Cosign and publishes attestations.",
+  "vulnerabilities_fixed_60_days_status": "Met",
+  "vulnerabilities_fixed_60_days_justification": "SECURITY.md requires acknowledgement within seven days and coordinates remediation and disclosure.",
+  "no_leaked_credentials_status": "Met",
+  "no_leaked_credentials_justification": "gitleaks runs as a configured pre-commit secret-detection quality gate.",
+  "static_analysis_status": "Met",
+  "static_analysis_justification": "CodeQL, go vet, gosec, and govulncheck provide static analysis in CI and local quality gates.",
+  "static_analysis_fixed_status": "Met",
+  "static_analysis_fixed_justification": "Contributor policy requires applicable security and static-analysis checks to pass before acceptance.",
+  "dynamic_analysis_fixed_status": "N/A",
+  "dynamic_analysis_fixed_justification": "No dynamic-analysis finding is currently applicable; the project does not operate a dynamic-analysis tool that has reported an unresolved issue."
+}

CHANGELOG.md

@@ -0,0 +1,103 @@
+# Changelog
+
+All notable user-visible and security-relevant changes to efctl are documented here. No historical release fixed a publicly known efctl runtime vulnerability with a CVE or similar identifier.
+
+## Unreleased
+
+- Add human-readable entries here for user-visible changes and security fixes. Identify any publicly known efctl runtime vulnerability fixed by the release.
+
+## v0.3.6
+
+- Remove a vulnerable `x/crypto` dependency and refresh project dependencies and contracts.
+
+## v0.3.5
+
+- Add remote development startup configuration and harden supply-chain workflows.
+
+## v0.3.4
+
+- Finalize the prior pnpm, esbuild, and mnemonic-leak remediation work.
+
+## v0.3.3
+
+- Guard Sui configuration loading and add pnpm diagnostics.
+
+## v0.3.2
+
+- Improve Sui configuration safety, pnpm diagnostics, and dependency security maintenance.
+
+## v0.3.1
+
+- Normalize `.env` line endings for Windows environments.
+
+## v0.3.0
+
+- Add extension build and test commands and improve package discovery.
+
+## v0.2.4
+
+- Improve extension publishing and assembly artifacts, validation, and AI-assisted initialization guidance.
+
+## v0.2.3
+
+- Add GraphQL endpoint information to environment summaries and dashboard output.
+
+## v0.2.2
+
+- Add faucet support and improve Windows script compatibility and test reliability.
+
+## v0.2.1
+
+- Improve doctor repository detection and resolve local quality-check issues.
+
+## v0.2.0
+
+- Add `efctl init` and `efctl doctor` commands.
+
+## v0.1.2
+
+- Avoid unnecessary SELinux relabeling when Docker does not require it.
+
+## v0.1.1
+
+- Allow extension deployment from additional folders.
+
+## v0.1.0
+
+- Add world-query functionality and improve container-runtime test resilience.
+
+## v0.0.9
+
+- Improve dashboard display and deployment-summary extraction.
+
+## v0.0.8
+
+- Upgrade to Go 1.26 and add release artifact attestations and SBOMs.
+
+## v0.0.7
+
+- Improve Windows support, configuration discovery, container lifecycle handling, and dashboard behavior.
+
+## v0.0.6
+
+- Deliver comprehensive dashboard usability and environment-information improvements.
+
+## v0.0.5
+
+- Add extension initialization and publishing commands and improve command output.
+
+## v0.0.4
+
+- Configure the Sui client and update project documentation.
+
+## v0.0.3
+
+- Refine terminal UI formatting, spinner spacing, and developer editor configuration.
+
+## v0.0.2
+
+- Add self-update and version commands and improve cross-platform installation instructions.
+
+## v0.0.1
+
+- Establish the initial efctl release with CI and project branding.

CONTRIBUTING.md

@@ -29,6 +29,30 @@ First off, thank you for considering contributing to `efctl`! It's people like y
 4. Push your branch and open a Pull Request.
 5. Please use the provided Pull Request template and fill it out completely.
 
+## Required Checks and Tests
+
+New functionality and bug fixes **must include automated tests** at the appropriate level: unit tests for isolated logic, integration tests for component interactions, and E2E tests for user workflows. Run the applicable checks before requesting review:
+
+```bash
+make fmt-check       # formatting
+make vet             # compiler and static-analysis warnings
+go test ./...        # unit tests, including repository invariants
+make test-integration # integration tests
+make test-e2e        # Docker-backed end-to-end tests
+make security        # gosec and govulncheck security checks
+pre-commit run --all-files # complete local quality gate
+```
+
+All applicable checks must pass. Regenerate CLI documentation with `make docs` when a command or its output changes.
+
+## Release Notes
+
+For every user-visible change or security fix, add a concise human-readable entry under the `Unreleased` section in [CHANGELOG.md](CHANGELOG.md). Do not use raw commit logs as release notes. If the change fixes a publicly known efctl runtime vulnerability (for example, one with a CVE), identify it in that entry.
+
+## Best Practices Badge Owner Workflow
+
+After this change merges to the default branch, an authorized bestpractices.dev editor must open [project 13754](https://www.bestpractices.dev/projects/13754), review the proposals imported from `.bestpractices.json`, save the reviewed answers, and verify both the project JSON endpoint and the live README badge. The repository file proposes answers only; it does not change the service assessment by itself. If an answer is inaccurate, correct it in the service and submit a repository follow-up; reverting this repository change does not roll back an already saved service answer.
+
 ## Bug Reports & Feature Requests
 
 If you encounter an issue or have a feature idea, please open an Issue on GitHub using the provided templates. Provide as much detail as possible (logs, reproduction steps, environment details) when reporting bugs.

README.md

@@ -2,6 +2,8 @@
 
 ![efctl Logo](https://raw.githubusercontent.com/Scetrov/efctl/refs/heads/main/assets/logo.png)
 
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/13754/badge)](https://www.bestpractices.dev/projects/13754)
+
 > [!IMPORTANT]
 > `efctl` is a high-performance CLI designed to automate the lifecycle of EVE Frontier local world contracts and smart gates.
 

bestpractices_test.go

@@ -0,0 +1,129 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"runtime"
+	"sort"
+	"strings"
+	"testing"
+)
+
+var mandatoryPassingControls = []string{
+	"description_good", "interact", "contribution", "floss_license", "license_location",
+	"documentation_basics", "documentation_interface", "sites_https", "discussion", "maintained",
+	"repo_public", "repo_track", "repo_interim", "version_unique", "release_notes",
+	"release_notes_vulns", "report_process", "report_responses", "report_archive",
+	"vulnerability_report_process", "vulnerability_report_private", "vulnerability_report_response",
+	"build", "test", "test_policy", "tests_are_added", "warnings", "warnings_fixed",
+	"know_secure_design", "know_common_errors", "crypto_published", "crypto_floss", "crypto_keylength",
+	"crypto_working", "crypto_password_storage", "crypto_random", "delivery_mitm", "delivery_unsigned",
+	"vulnerabilities_fixed_60_days", "no_leaked_credentials", "static_analysis", "static_analysis_fixed",
+	"dynamic_analysis_fixed",
+}
+
+var urlRequiredControls = map[string]bool{
+	"contribution":                 true,
+	"license_location":             true,
+	"release_notes":                true,
+	"report_process":               true,
+	"report_archive":               true,
+	"vulnerability_report_process": true,
+	"vulnerability_report_private": true,
+}
+
+var auditedReleaseTags = []string{
+	"v0.0.1", "v0.0.2", "v0.0.3", "v0.0.4", "v0.0.5", "v0.0.6", "v0.0.7", "v0.0.8", "v0.0.9",
+	"v0.1.0", "v0.1.1", "v0.1.2", "v0.2.0", "v0.2.1", "v0.2.2", "v0.2.3", "v0.2.4", "v0.3.0",
+	"v0.3.1", "v0.3.2", "v0.3.3", "v0.3.4", "v0.3.5", "v0.3.6",
+}
+
+var httpsURL = regexp.MustCompile(`https://[^\s)]+`)
+var applicabilityExplanation = regexp.MustCompile(`(?i)\b(no|not applicable|does not|not used|without)\b`)
+
+func repositoryRoot(t *testing.T) string {
+	t.Helper()
+	_, file, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("runtime.Caller: cannot determine repository root")
+	}
+	return filepath.Dir(file)
+}
+
+func readBestPracticesManifest(t *testing.T) map[string]string {
+	t.Helper()
+	path := filepath.Join(repositoryRoot(t), ".bestpractices.json")
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read .bestpractices.json: %v", err)
+	}
+	var manifest map[string]string
+	if err := json.Unmarshal(data, &manifest); err != nil {
+		t.Fatalf("parse .bestpractices.json: %v", err)
+	}
+	return manifest
+}
+
+func TestBestPracticesMandatoryControlAttestation(t *testing.T) {
+	manifest := readBestPracticesManifest(t)
+	want := make(map[string]bool, len(mandatoryPassingControls))
+	for _, control := range mandatoryPassingControls {
+		want[control] = true
+		status, ok := manifest[control+"_status"]
+		if !ok {
+			t.Errorf("missing mandatory status for %q", control)
+			continue
+		}
+		if status != "Met" && status != "N/A" {
+			t.Errorf("%q has status %q; want Met or N/A", control, status)
+		}
+
+		justification := strings.TrimSpace(manifest[control+"_justification"])
+		if justification == "" {
+			t.Errorf("%q is missing a paired justification", control)
+			continue
+		}
+		if status == "N/A" && !applicabilityExplanation.MatchString(justification) {
+			t.Errorf("%q is N/A without an applicability explanation", control)
+		}
+		if urlRequiredControls[control] && status == "Met" && !httpsURL.MatchString(justification) {
+			t.Errorf("%q is Met but lacks required HTTPS evidence URL", control)
+		}
+	}
+
+	var unexpected []string
+	for key := range manifest {
+		if !strings.HasSuffix(key, "_status") {
+			continue
+		}
+		control := strings.TrimSuffix(key, "_status")
+		if !want[control] {
+			unexpected = append(unexpected, control)
+		}
+	}
+	sort.Strings(unexpected)
+	if len(unexpected) > 0 {
+		t.Errorf("unexpected non-mandatory status keys: %s", strings.Join(unexpected, ", "))
+	}
+}
+
+func TestBestPracticesReleaseHistory(t *testing.T) {
+	path := filepath.Join(repositoryRoot(t), "CHANGELOG.md")
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read CHANGELOG.md: %v", err)
+	}
+	content := string(data)
+	if !regexp.MustCompile(`(?m)^## Unreleased\s*$`).MatchString(content) {
+		t.Error("CHANGELOG.md must contain a level-two Unreleased heading")
+	}
+	for _, tag := range auditedReleaseTags {
+		heading := regexp.MustCompile(fmt.Sprintf(`(?m)^## \[?%s\]?\s*$`, regexp.QuoteMeta(tag)))
+		if !heading.MatchString(content) {
+			t.Errorf("CHANGELOG.md is missing a level-two heading for audited release %s", tag)
+		}
+	}
+}

openspec/changes/archive/2026-07-22-attest-best-practices-passing-controls/.openspec.yaml

@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-07-22