haxtheweb · btopro · Jan 30, 2025 · Feb 10, 2025 · Feb 10, 2025 · Feb 11, 2025
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -0,0 +1,7 @@
+# Global ownership
+# Bryan Ollendyke (btopro) is the primary maintainer and creator of HAXTheWeb
+* @btopro
+
+# HAXTheWeb ecosystem is developed and maintained by:
+# Bryan Ollendyke (@btopro) - Penn State University
+# Copyright (c) 2015-2025 The Pennsylvania State University
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
@@ -0,0 +1,72 @@
+## Related Issue
+<!-- Link to the issue this PR addresses -->
+Closes [ISSUE #XXXX](https://github.com/haxtheweb/issues/issues/XXXX)
+
+## Figma Link
+<!-- If this PR relates to a design, provide the Figma link -->
+
+## Description of Changes
+<!-- Provide a clear and concise description of what this PR does -->
+
+### What changed:
+- 
+- 
+- 
+
+### Why this change was needed:
+<!-- Explain the problem this solves or the feature this adds -->
+
+## Type of Change
+<!-- Check the type of change your PR introduces -->
+- [ ] 🐛 Bug fix (non-breaking change which fixes an issue)
+- [ ] ✨ New feature (non-breaking change which adds functionality)
+- [ ] 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
+- [ ] 📚 Documentation update
+- [ ] 🎨 Style/formatting changes
+- [ ] ♻️ Code refactoring
+- [ ] 🔧 Configuration changes
+
+## Testing Checklist
+<!-- Check all that apply -->
+- [ ] I have tested this change locally
+- [ ] I have added/updated tests for my changes
+- [ ] All existing tests pass
+- [ ] I have tested on multiple browsers (if applicable)
+- [ ] I have tested on mobile devices (if applicable)
+- [ ] I have verified accessibility compliance
+- [ ] I have tested with screen readers (if applicable)
+
+## Quality Assurance
+<!-- Check all that apply -->
+- [ ] I have followed the project's coding conventions
+- [ ] I have updated documentation where necessary
+- [ ] I have added comments to complex code
+- [ ] My changes don't introduce console warnings/errors
+- [ ] I have checked for performance implications
+
+## Ways to Test This Change
+<!-- Provide step-by-step instructions for testing -->
+1. 
+2. 
+3. 
+
+## Screenshots/Recordings
+<!-- If applicable, add screenshots or recordings showing the changes -->
+
+### Before:
+<!-- Screenshot/recording of the current behavior -->
+
+### After:
+<!-- Screenshot/recording of the new behavior -->
+
+## Additional Notes
+<!-- Any additional context, decisions, or follow-up work -->
+
+## Checklist
+<!-- Final checklist before submitting -->
+- [ ] I have read the [contributing guidelines](../CONTRIBUTING.md)
+- [ ] My code follows the style guidelines of this project
+- [ ] I have performed a self-review of my own code
+- [ ] I have made corresponding changes to the documentation
+- [ ] My changes generate no new warnings
+- [ ] Any dependent changes have been merged and published
diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
@@ -0,0 +1,37 @@
+name: "CLA Assistant"
+on:
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, closed, synchronize]
+
+# explicitly configure permissions, in case your GITHUB_TOKEN workflow permissions are set to read-only in repository settings
+permissions:
+  actions: write
+  contents: write
+  pull-requests: write
+  statuses: write
+
+jobs:
+  CLAAssistant:
+    runs-on: ubuntu-latest
+    steps:
+      - name: "CLA Assistant"
+        if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
+        uses: contributor-assistant/[email protected]
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          path-to-signatures: 'signatures/version1/cla.json'
+          path-to-document: 'https://github.com/haxtheweb/webcomponents/blob/main/CLA.md'
+          # branch should not be protected
+          branch: 'main'
+          allowlist: 'btopro,*[bot]'
+          # the followings are the optional inputs - If the optional inputs are not given, then default values will be taken
+          remote-organization-name: ''
+          remote-repository-name: ''
+          create-file-commit-message: 'Creating file for storing CLA Signatures'
+          signed-commit-message: 'CLA signed by $contributorName'
+          custom-notsigned-prcomment: 'Thank you for your contribution! Before we can merge your PR, we need you to sign our Contributor License Agreement (CLA). Please comment **"I have read the CLA Document and I hereby sign the CLA"** to agree to the [CLA terms](https://github.com/haxtheweb/webcomponents/blob/main/CLA.md).'
+          custom-pr-sign-comment: 'Thank you for signing the CLA! Your contribution will now be reviewed.'
+          custom-allsigned-prcomment: 'All contributors have signed the CLA. Thank you!'
diff --git a/.github/workflows/ossf_scorecard.yml b/.github/workflows/ossf_scorecard.yml
@@ -0,0 +1,63 @@
+---
+# This workflow uses actions that are not certified by GitHub. They are provided by a third-party and are governed by separate terms of service, privacy policy, and support documentation.
+name: OSSF Scorecard
+on:
+  # For Branch-Protection check. Only the default branch is supported. See https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection.
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained.
+  schedule:
+    - cron: "0 0 * * 1"
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+# Declare default permissions as read only.
+permissions: read-all
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-24.04
+    # Delete the conditional below if you are using the OSSF Scorecard on a public repository.
+    if: ${{ github.event.repository.private == false }}
+    permissions:
+      # Needed if using Code Scanning alerts.
+      security-events: write
+      # Needed for GitHub OIDC token if publish_results is true.
+      id-token: write
+      # Uncomment the permissions below if you are using the OSSF Scorecard on a private repository.
+      # contents: read
+      # actions: read
+      # issues: read # To allow GraphQL ListCommits to work
+      # pull-requests: read # To allow GraphQL ListCommits to work
+      # checks: read # To detect SAST tools
+    steps:
+      - name: Check out the codebase
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) fine-grained personal access token. Uncomment the `repo_token` line below if you want to enable the Branch-Protection or Webhooks check on a *private* repository.
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-fine-grained-pat-optional.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Publish the results for public repositories to enable scorecard badges. For more details, see https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories, `publish_results` will automatically be set to `false`, regardless of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF format to the repository Actions tab.
+      - name: Upload artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: Upload SARIF results to code scanning
+        uses: github/codeql-action/upload-sarif@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
+        with:
+          sarif_file: results.sarif
diff --git a/.gitignore b/.gitignore
@@ -16,6 +16,7 @@ yarn-error.log
 yarn.lock
 test/index.html
 component-gallery.html
+elements/video-player/demo/samples/ad/
 elements/haxcms-elements/demo/files/
 elements/grade-book/demo/psu/
 elements/elmsln-apps/lib/lrnapp-studio-instructor/demo/*

diff --git a/.wcflibcache.json b/.wcflibcache.json
@@ -20,9 +20,6 @@
   "devDependencies": {
     "web-animations-js": "2.3.2",
     "@haxtheweb/deduping-fix": "^9.0.0-alpha.0",
-    "@polymer/iron-demo-helpers": "3.1.0",
-    "@polymer/iron-component-page": "github:PolymerElements/iron-component-page",
-    "@webcomponents/webcomponentsjs": "^2.8.0",
     "gulp-babel": "8.0.0",
     "@web/dev-server": "0.4.6",
     "concurrently": "5.3.0",
@@ -54,13 +51,10 @@
     "lighthouse": "gulp lighthouse --gulpfile=gulpfile.cjs"
   },
   "dependencies": {
-    "lit": "^3.3.0"
+    "lit": "^3.3.1"
   },
   "devDependencies": {
     "@haxtheweb/deduping-fix": "^9.0.0-alpha.0",
-    "@polymer/iron-component-page": "github:PolymerElements/iron-component-page",
-    "@polymer/iron-demo-helpers": "3.1.0",
-    "@webcomponents/webcomponentsjs": "^2.8.0",
     "concurrently": "5.3.0",
     "gulp-babel": "8.0.0",
     "polymer-build": "3.1.4",

diff --git a/CLA-README.md b/CLA-README.md
@@ -0,0 +1,47 @@
+# Contributor License Agreement (CLA) Process
+
+## How it Works
+
+This repository uses an automated CLA (Contributor License Agreement) process to ensure legal compliance for all contributions. Here's how it works:
+
+### For New Contributors
+
+1. **Open a Pull Request**: When you submit your first pull request, the CLA bot will automatically post a comment asking you to sign the CLA.
+
+2. **Sign the CLA**: To sign the CLA, simply comment on your pull request with:
+   ```
+   I have read the CLA Document and I hereby sign the CLA
+   ```
+
+3. **Automatic Processing**: Once you sign, the bot will:
+   - Record your signature in the repository
+   - Update the pull request status
+   - Allow your PR to proceed with the review process
+
+### For Returning Contributors
+
+If you've already signed the CLA for this repository, you don't need to sign it again for future pull requests. The bot will automatically recognize you as a signed contributor.
+
+### Important Notes
+
+- **Exact Comment Required**: You must use the exact comment text: `I have read the CLA Document and I hereby sign the CLA`
+- **Read the CLA**: Please read the [full CLA document](./CLA.md) before signing
+- **One-Time Process**: You only need to sign once per repository
+- **Bot Users**: Automated bot users are automatically allowlisted and don't need to sign
+
+### Troubleshooting
+
+If you're having issues with the CLA process:
+
+1. **Re-check Status**: Comment `recheck` on your pull request to have the bot re-evaluate your CLA status
+2. **Contact Maintainers**: If problems persist, mention a maintainer in your pull request
+
+### Technical Details
+
+- CLA signatures are stored in `signatures/version1/cla.json` in this repository
+- The CLA bot is implemented using the [contributor-assistant/github-action](https://github.com/contributor-assistant/github-action)
+- No third-party services are used; everything is handled within GitHub
+
+---
+
+**Questions?** Feel free to open an issue or ask in your pull request if you need help with the CLA process.
diff --git a/CLA.md b/CLA.md
@@ -0,0 +1,40 @@
+# Contributor License Agreement
+
+## HAXtheWeb Webcomponents Project
+
+Thank you for your interest in contributing to the HAXtheWeb Webcomponents project owned by Penn State University ("We" or "Us").
+
+This Contributor License Agreement ("Agreement") documents the rights granted by contributors to Us. To make this document effective, please sign it and send it to Us.
+
+### 1. Definitions
+
+**"You"** (or **"Your"**) shall mean the copyright owner or legal entity authorized by the copyright owner that is making this Agreement with Us.
+
+**"Contribution"** shall mean any original work of authorship, including any modifications or additions to an existing work, that is intentionally submitted by You to Us for inclusion in, or documentation of, any of the products owned or managed by Us (the "Work").
+
+### 2. Grant of Rights
+
+#### Copyright License
+Subject to the terms and conditions of this Agreement, You hereby grant to Us and to recipients of software distributed by Us a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Work, and to permit persons to whom the Work is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Work.
+
+#### Patent License
+Subject to the terms and conditions of this Agreement, You hereby grant to Us and to recipients of software distributed by Us a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work.
+
+### 3. Representations
+
+You represent that:
+
+1. You are legally entitled to grant the above license.
+2. If your employer(s) has rights to intellectual property that you create that includes your Contributions, you have received permission to make Contributions on behalf of that employer, or your employer has waived such rights for your Contributions to Us.
+3. Each of Your Contributions is Your original creation.
+4. Your Contribution submissions include complete details of any third-party license or other restriction (including, but not limited to, related patents and trademarks) of which you are personally aware and which are associated with any part of Your Contributions.
+
+### 4. You are not expected to provide support
+
+You are not expected to provide support for Your Contributions, except to the extent You desire to provide support. You may provide support for free, for a fee, or not at all. Unless required by applicable law or agreed to in writing, You provide Your Contributions on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE.
+
+---
+
+**By commenting "I have read the CLA Document and I hereby sign the CLA" on a Pull Request, you are agreeing to the terms of this Contributor License Agreement.**
diff --git a/README.md b/README.md
@@ -1,4 +1,9 @@
+[![Project Status: Active – The project has reached a stable, usable state and is being actively developed.](https://www.repostatus.org/badges/latest/active.svg)](https://www.repostatus.org/#active)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/haxtheweb/webcomponents/badge)](https://securityscorecards.dev/viewer/?uri=github.com/haxtheweb/webcomponents)
+[![Community Support](https://badgen.net/badge/support/community/cyan?icon=awesome)](/SUPPORT.md)
 [![License: Apache 2.0](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
+[![Contributor Covenant](https://img.shields.io/badge/Contributor%20Covenant-2.1-4baaaa.svg)](/CODE_OF_CONDUCT.md)
+[![Discord](https://badgen.net/badge/icon/discord?icon=discord&label)](https://discord.gg/EKYJAjqGhf)
 [![lerna](https://img.shields.io/badge/maintained%20with-lerna-cc00ff.svg)](https://lerna.js.org/)
 [![Lit](https://img.shields.io/badge/-Lit-324fff?style=flat&logo=data:image/svg%2bxml;base64,PHN2ZyBmaWxsPSIjZmZmIiB2aWV3Qm94PSIwIDAgMTYwIDIwMCIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj48cGF0aCBkPSJtMTYwIDgwdjgwbC00MC00MHptLTQwIDQwdjgwbDQwLTQwem0wLTgwdjgwbC00MC00MHptLTQwIDQwdjgwbDQwLTQwem0tNDAtNDB2ODBsNDAtNDB6bTQwLTQwdjgwbC00MC00MHptLTQwIDEyMHY4MGwtNDAtNDB6bS00MC00MHY4MGw0MC00MHoiLz48L3N2Zz4%3D)](https://lit.dev/)
 [![#HAXTheWeb](https://img.shields.io/badge/-HAXTheWeb-999999FF?style=flat&logo=data:image/svg%2bxml;base64,PHN2ZyBpZD0iZmVhMTExZTAtMjEwZC00Y2QwLWJhMWQtZGZmOTQyODc0Njg1IiBkYXRhLW5hbWU9IkxheWVyIDEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgdmlld0JveD0iMCAwIDE4NC40IDEzNS45NyI+PGRlZnM+PHN0eWxlPi5lMWJjMjAyNS0xODAwLTRkYzItODc4NS1jNDZlZDEwM2Y0OTJ7ZmlsbDojMjMxZjIwO308L3N0eWxlPjwvZGVmcz48cGF0aCBjbGFzcz0iZTFiYzIwMjUtMTgwMC00ZGMyLTg3ODUtYzQ2ZWQxMDNmNDkyIiBkPSJNNzguMDcsODMuNDVWNTVIODYuMnY4LjEzaDE2LjI2djQuMDdoNC4wN1Y4My40NUg5OC40VjY3LjE5SDg2LjJWODMuNDVaIi8+PHBvbHlnb24gcG9pbnRzPSIxNTMuMTMgNjMuNyAxNTMuMTMgNTEuMzkgMTQwLjU0IDUxLjM5IDE0MC41NCAzOS4wOSAxMjcuOTUgMzkuMDkgMTI3Ljk1IDI2Ljc5IDEwMi43OCAyNi43OSAxMDIuNzggMzkuMDkgMTE1LjM2IDM5LjA5IDExNS4zNiA1MS4zOSAxMjcuOTUgNTEuMzkgMTI3Ljk1IDYzLjcgMTQwLjU0IDYzLjcgMTQwLjU0IDc2IDEyNy4zNiA3NiAxMjcuMzYgODguMyAxMTQuNzggODguMyAxMTQuNzggMTAwLjYxIDEwMi4xOSAxMDAuNjEgMTAyLjE5IDExMi45MSAxMjcuMzYgMTEyLjkxIDEyNy4zNiAxMDAuNjEgMTM5Ljk1IDEwMC42MSAxMzkuOTUgODguMyAxNTIuNTQgODguMyAxNTIuNTQgNzYgMTY1LjcyIDc2IDE2NS43MiA2My43IDE1My4xMyA2My43Ii8+PHBvbHlnb24gcG9pbnRzPSIzMy4xMyA2My43IDMzLjEzIDUxLjM5IDQ1LjcyIDUxLjM5IDQ1LjcyIDM5LjA5IDU4LjMxIDM5LjA5IDU4LjMxIDI2Ljc5IDgzLjQ4IDI2Ljc5IDgzLjQ4IDM5LjA5IDcwLjg5IDM5LjA5IDcwLjg5IDUxLjM5IDU4LjMxIDUxLjM5IDU4LjMxIDYzLjcgNDUuNzIgNjMuNyA0NS43MiA3NiA1OC44OSA3NiA1OC44OSA4OC4zIDcxLjQ4IDg4LjMgNzEuNDggMTAwLjYxIDg0LjA3IDEwMC42MSA4NC4wNyAxMTIuOTEgNTguODkgMTEyLjkxIDU4Ljg5IDEwMC42MSA0Ni4zMSAxMDAuNjEgNDYuMzEgODguMyAzMy43MiA4OC4zIDMzLjcyIDc2IDIwLjU0IDc2IDIwLjU0IDYzLjcgMzMuMTMgNjMuNyIvPjwvc3ZnPg==)](https://haxtheweb.org/)

diff --git a/SUPPORT.md b/SUPPORT.md
@@ -0,0 +1,31 @@
+# Support
+
+## Getting Help
+
+If you need help with this project, please use the following resources:
+
+### Community Support
+
+- **Discord**: Join our community Discord server for real-time help and discussion: [HAXTheWeb Discord](https://discord.gg/EKYJAjqGhf)
+- **Documentation**: Visit our comprehensive documentation: [HAXTheWeb Docs](https://haxtheweb.org/documentation)
+- **Issues**: For bug reports and feature requests, please use our unified issue queue: [HAXTheWeb Issues](https://github.com/haxtheweb/issues/issues)
+
+### Getting Started
+
+- Check out our [documentation](https://haxtheweb.org/documentation) for guides and tutorials
+- Explore and play with HAX components: [HAX Magic Script Playground](https://hax.cloud/magicscript.html)
+- Join the discussion on [Discord](https://discord.gg/EKYJAjqGhf) to connect with other developers
+
+### Before Opening an Issue
+
+Before creating a new issue, please:
+
+1. Search existing issues in our [unified issue queue](https://github.com/haxtheweb/issues/issues)
+2. Check our [documentation](https://haxtheweb.org/documentation)
+3. Ask for help on [Discord](https://discord.gg/EKYJAjqGhf)
+
+This helps keep our issue queue focused on actual bugs and feature requests.
+
+## Contributing
+
+We welcome contributions! Please see our [Contributing Guidelines](CONTRIBUTING.md) for details on how to get involved.
diff --git a/api/package.json b/api/package.json
@@ -6,9 +6,9 @@
   },
   "dependencies": {
     "patch-package": "^8.0.0",
-    "lit-html": "3.3.0",
+    "lit-html": "3.3.1",
     "@lit-labs/ssr": "^3.3.1",
-    "lit": "3.3.0",
+    "lit": "3.3.1",
     "node-html-parser": "^6.1.13",
     "@haxtheweb/course-design": "^11.0.5",
     "@haxtheweb/lrn-math": "^11.0.5",