Repository navigation
Rework README, add contributing guide, Scorecard and coverage - #147
Merged
Merged
Conversation
Describe the fork as the maintained continuation of lz4/lz4-java, add Gradle coordinates and supported native platforms, recommend the safe decompressor and frame streams, modernize the examples, and add security, build and license sections. The version is omitted in favor of a Maven Central badge so it doesn't go stale. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Document how to report bugs, request features and contribute, including the requirements for acceptable contributions, as required by the OpenSSF Best Practices criteria. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Run OpenSSF Scorecard weekly and on pushes to main, publishing results for the README badge. Record JaCoCo coverage in a new coverage profile on the Linux amd64 test job and upload it to Codecov via OIDC. Add the Codecov, OpenSSF Best Practices and Scorecard badges to the README. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This repository is itself a GitHub fork, so head.repo.fork is always true and OIDC was never used. Compare the head repository instead, and only upload the JaCoCo report. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Welcome to Codecov 🎉Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests. Thanks for integrating Codecov - We've got you covered ☂️ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The README still read like a one-off CVE patch fork of the old upstream project. This rewrite brings it up to date with the current state of the library.
Changes
net.jpountz.*packages, new coordinates).org.lz4:lz4-java, Java 7 minimum,Automatic-Module-Name/OSGi, the bundled native platforms (taken frombuild-all-and-publish.yml) and the JDK 24+--enable-native-accesswarning.VERSIONplaceholder, so the README won't go stale.*WithLength, raw blocks and xxHash. It notes that block streams use an lz4-java-specific format.safeDecompressor(), explains thatfastDecompressor()now always uses the safe Java code, and warns about the*InsecureInstance()factories. Also notes that the LZ4unsafeInstance()currently aliases the safe instance.readAllBytes). Adds a length-prefixed example with the 64 MiB default limit and its system property, and one-shot plus streaming xxHash.Contributing guidelines, Scorecard and coverage
CONTRIBUTING.md: how to report bugs and vulnerabilities, and the requirements for contributions. It is based on.clinerules/coding.mdand linked from a new README section. This covers the OpenSSF Best Practices criteria for feedback and contribution information..github/workflows/scorecard.yml: runs OpenSSF Scorecard weekly, on pushes tomainand on branch protection changes. It publishes results for the badge and uploads SARIF to code scanning. The actions are pinned by digest, like the rest of the repo.coverageMaven profile runs JaCoCo. Theubuntu-24.04test job enables it and uploadsjacoco.xmlto Codecov, using OIDC and falling back to tokenless upload for PRs from forks. Upload failures don't fail CI. Locally it measures about 91% line coverage of the Java code. The C code in the JNI bindings is not measured.test.ymlnow has explicit least-privilegepermissions, which Scorecard checks for.Notes for reviewers
main. All round-trips succeed and the native factory loads.🤖 Generated with Claude Code