diff --git a/CHANGELOG.md b/CHANGELOG.md index 1d2d884..fff9824 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -57,6 +57,9 @@ when releases begin. ### Changed +- Registered Data Toolbox and JSON YAML Swiss in the public settings policy, + synchronized PE Version Info's `v0.1.0-alpha.1` release, and enabled the + missing JSON YAML Swiss secret-scanning controls. - Synchronized the settings policy and release policy with CSV Sculptor's verified `v0.1.0-alpha.1` release and protected `main` branch. - Synchronized Developer Primitives `v0.2.0`, including its browser-local IANA diff --git a/config/github-settings-policy.json b/config/github-settings-policy.json index 9125383..480b13e 100644 --- a/config/github-settings-policy.json +++ b/config/github-settings-policy.json @@ -109,6 +109,16 @@ "rulesMinimum": {"applicability": "CURRENT", "value": 1}, "releases": {"applicability": "CURRENT", "value": 1} }, + "data_toolbox": { + "sourcePublished": {"applicability": "CURRENT", "value": true}, + "topics": {"applicability": "CURRENT", "value": ["ai-agents", "ai-tools", "cli", "csv", "data-quality", "data-validation", "developer-tools", "local-first", "privacy", "rust", "tinkora", "tsv", "webassembly"]}, + "issues": {"applicability": "CURRENT", "value": true}, + "discussions": {"applicability": "CURRENT", "value": true}, + "projects": {"applicability": "CURRENT", "value": true}, + "codeScanning": {"applicability": "CURRENT", "value": "configured"}, + "rulesMinimum": {"applicability": "CURRENT", "value": 2}, + "releases": {"applicability": "CURRENT", "value": 0} + }, "developer_primitives": { "sourcePublished": {"applicability": "CURRENT", "value": true}, "topics": {"applicability": "CURRENT", "value": ["ai-agents", "cli", "datetime", "developer-tools", "local-first", "rust", "timestamp", "timezone", "ulid", "uuid", "uuidv7", "webassembly"]}, @@ -168,6 +178,16 @@ "rulesMinimum": {"applicability": "CURRENT", "value": 1}, "releases": {"applicability": "CURRENT", "value": 1} }, + "json_yaml_swiss": { + "sourcePublished": {"applicability": "CURRENT", "value": true}, + "topics": {"applicability": "CURRENT", "value": ["configuration", "developer-tools", "json", "rust", "tinkora", "toml", "wasm", "yaml"]}, + "issues": {"applicability": "CURRENT", "value": true}, + "discussions": {"applicability": "CURRENT", "value": true}, + "projects": {"applicability": "CURRENT", "value": false}, + "codeScanning": {"applicability": "CURRENT", "value": "configured"}, + "rulesMinimum": {"applicability": "CURRENT", "value": 1}, + "releases": {"applicability": "CURRENT", "value": 1} + }, "pe_version_info": { "sourcePublished": {"applicability": "CURRENT", "value": true}, "topics": {"applicability": "CURRENT", "value": ["ai-agents", "developer-tools", "pe", "rust", "tinkora", "windows"]}, @@ -175,7 +195,7 @@ "discussions": {"applicability": "CURRENT", "value": true}, "codeScanning": {"applicability": "CURRENT", "value": "not-configured"}, "rulesMinimum": {"applicability": "FUTURE_GATE", "gate": "independentSecondOwner", "value": 1}, - "releases": {"applicability": "CURRENT", "value": 0} + "releases": {"applicability": "CURRENT", "value": 1} }, "jwt_inspector": { "sourcePublished": {"applicability": "CURRENT", "value": true}, diff --git a/docs/ACCESS_MODEL.md b/docs/ACCESS_MODEL.md index ddc50ad..e460030 100644 --- a/docs/ACCESS_MODEL.md +++ b/docs/ACCESS_MODEL.md @@ -39,7 +39,7 @@ must not be converted into current failures merely because they appear in a | Setting | Current | Target | Apply when | | --- | --- | --- | --- | | Release publishers | Only the organization owner may deliberately create a protected project release tag; no organization-wide or unattended publisher is authorized | Separate build verification from least-privilege release publication | A project reaches its documented release gate, the exact commit and hosted evidence are reviewed, and tag creation is separately authorized | -| High-privilege automation | `cert_viewer`, `cron_maker`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `jwt_inspector`, `mcp_doctor`, `qr_forge`, and `tool_call_trace` limit `contents: write` to their final tag-triggered publication jobs; their release Environments have no independent reviewer on GitHub Free | Require a protected Environment or appropriately scoped GitHub App with non-author approval | A second trusted owner is active, credentials and recovery are tested, and the exact automation is explicitly authorized | +| High-privilege automation | `cert_viewer`, `cron_maker`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `json_yaml_swiss`, `jwt_inspector`, `mcp_doctor`, `qr_forge`, and `tool_call_trace` limit `contents: write` to their final tag-triggered publication jobs; their release Environments have no independent reviewer on GitHub Free | Require a protected Environment or appropriately scoped GitHub App with non-author approval | A second trusted owner is active, credentials and recovery are tested, and the exact automation is explicitly authorized | During the solo stage, a deliberate protected-tag push is an accountable owner authorization, not independent review. It is permitted only under diff --git a/docs/INCIDENT_RESPONSE.md b/docs/INCIDENT_RESPONSE.md index 9b7c0f6..f99e72f 100644 --- a/docs/INCIDENT_RESPONSE.md +++ b/docs/INCIDENT_RESPONSE.md @@ -20,7 +20,7 @@ public disclosure of sensitive evidence. | Setting | Current | Target | Apply when | | --- | --- | --- | --- | | Emergency access restriction | No standing incident-specific remote rule is claimed | Temporarily revoke or narrow compromised access with least privilege | An authorized owner verifies a credible active risk, identifies exact affected access, records recovery privately, and approves the action | -| Workflow or release pause | Project-specific protected-tag release automation exists for `cert_viewer`, `cron_maker`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `jwt_inspector`, `mcp_doctor`, `qr_forge`, and `tool_call_trace`; organization release evidence remains read-only | Disable affected automation or publication while preserving evidence | A credible compromise could affect builds or releases, the incident lead records scope and rollback, and an authorized owner applies the pause | +| Workflow or release pause | Project-specific protected-tag release automation exists for `cert_viewer`, `cron_maker`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `json_yaml_swiss`, `jwt_inspector`, `mcp_doctor`, `qr_forge`, and `tool_call_trace`; `data_toolbox` and `pe_version_info` currently produce candidate evidence without an unattended publication job, and organization release evidence remains read-only | Disable affected automation or publication while preserving evidence | A credible compromise could affect builds or releases, the incident lead records scope and rollback, and an authorized owner applies the pause | | Repository interaction limits | No incident restriction is pre-authorized | Temporarily limit interactions only when abuse or disclosure cannot be contained otherwise | The incident lead documents necessity and duration, an authorized owner approves it, and restoration criteria are defined | | Public advisory | No security advisory channel is claimed ready | Coordinate a minimal, accurate advisory and corrected release when appropriate | A private intake exists, affected scope and mitigation are understood, disclosure risk is reviewed, and publication is explicitly authorized | diff --git a/docs/RELEASE_POLICY.md b/docs/RELEASE_POLICY.md index 9c7049c..d4eff59 100644 --- a/docs/RELEASE_POLICY.md +++ b/docs/RELEASE_POLICY.md @@ -4,8 +4,8 @@ | Setting | Current | Target | Apply when | | --- | --- | --- | --- | -| Release automation | `cert_viewer`, `cron_maker`, `csv_sculptor`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `jwt_inspector`, `mcp_doctor`, `qr_forge`, and `tool_call_trace` have project-specific, tag-triggered workflows; the organization reusable workflow remains read-only | Build and verify reproducibly, then publish from a protected tag with least privilege and project-owned verification | A project has stable hosted checks, immutable release inputs, a documented artifact contract, and explicit owner authorization | -| Versioning | Published releases are `developer_primitives` and `tool_call_trace` at `v0.2.0`; `cert_viewer` and `jwt_inspector` at `v0.1.1`; `csv_sculptor` and `curl_builder` at `v0.1.0-alpha.1`; and `cron_maker`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `mcp_doctor`, and `qr_forge` at `v0.1.0` | Use Semantic Versioning for public versions and document pre-`1.0.0` instability | A project declares a public contract and its first release is authorized | +| Release automation | `cert_viewer`, `cron_maker`, `csv_sculptor`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `json_yaml_swiss`, `jwt_inspector`, `mcp_doctor`, `qr_forge`, and `tool_call_trace` have project-specific, tag-triggered publication workflows; `data_toolbox` and `pe_version_info` currently build candidates without an unattended publication job, and the organization reusable workflow remains read-only | Build and verify reproducibly, then publish from a protected tag with least privilege and project-owned verification | A project has stable hosted checks, immutable release inputs, a documented artifact contract, and explicit owner authorization | +| Versioning | Published releases are `developer_primitives` and `tool_call_trace` at `v0.2.0`; `cert_viewer`, `json_yaml_swiss`, and `jwt_inspector` at `v0.1.1`; `csv_sculptor`, `curl_builder`, and `pe_version_info` at `v0.1.0-alpha.1`; and `cron_maker`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `mcp_doctor`, and `qr_forge` at `v0.1.0` | Use Semantic Versioning for public versions and document pre-`1.0.0` instability | A project declares a public contract and its first release is authorized | | Changelog | This governance repository contains only an `Unreleased` section | Maintain Keep a Changelog categories and move entries to a dated version only during release | A reviewed release candidate is approved; do not create historical entries without release evidence | | Git tags | Every published release above has a `vMAJOR.MINOR.PATCH` tag; repository rules protect current release tags from deletion or mutation | Use protected, immutable `vMAJOR.MINOR.PATCH` tags that point to the reviewed release commit | Tag protection is verified, the release commit and version agree, and tag creation is explicitly authorized | | Artifacts | Release assets and verification material are project-specific; binary projects publish checksums, SBOMs, and attestations defined by their release contract | Publish platform artifacts with cryptographic checksums, an SBOM, and provenance appropriate to the build system | Artifact generation is reproducible, consumer verification instructions exist, and the release is approved | diff --git a/profile/README.md b/profile/README.md index 3c20414..0e9f6e1 100644 --- a/profile/README.md +++ b/profile/README.md @@ -32,6 +32,13 @@ machine-readable contracts, and behavior that can be verified in CI. locally and generates escaped cURL, Fetch, Python, Go, Rust, and Node.js snippets without executing the request. [Open the tool](https://tinkora.github.io/curl_builder/). +- [CSV Sculptor](https://github.com/Tinkora/csv_sculptor) inspects, filters, + sorts, and converts CSV/TSV data locally in the browser. + [Open the Alpha](https://tinkora.github.io/csv_sculptor/). +- [Data Toolbox](https://github.com/Tinkora/data_toolbox) reports CSV/TSV + shape, delimiter ambiguity, jagged rows, and spreadsheet-formula risks + without silently changing the input. + [Open the Draft](https://tinkora.github.io/data_toolbox/). - [Developer Primitives](https://github.com/Tinkora/developer_primitives) generates and inspects UUID/ULID values, converts explicit timestamps across IANA time zones, and exposes DST gaps and folds through a browser-local @@ -62,9 +69,17 @@ machine-readable contracts, and behavior that can be verified in CI. - [image_to_icns](https://github.com/Tinkora/image_to_icns) is a privacy-first macOS `.icns` generator with a browser editor and an MCP server. [Open the tool](https://tinkora.github.io/image_to_icns/). +- [JSON YAML Swiss](https://github.com/Tinkora/json_yaml_swiss) validates, + formats, and deliberately converts JSON, YAML, and TOML while reporting + lossy boundaries. + [Open the Alpha](https://tinkora.github.io/json_yaml_swiss/). - [MCP Doctor](https://github.com/Tinkora/mcp_doctor) statically diagnoses local stdio MCP server configuration, paths, environment, and transport contracts. [View the release](https://github.com/Tinkora/mcp_doctor/releases/latest). +- [PE Version Info](https://github.com/Tinkora/pe_version_info) provides the + cross-platform `pevi` CLI for inspecting and safely updating Windows PE + `VERSIONINFO` resources and icons. + [Download the Alpha](https://github.com/Tinkora/pe_version_info/releases/tag/v0.1.0-alpha.1). - [QR Forge](https://github.com/Tinkora/qr_forge) is a browser-local QR, Code 128, and EAN-13 generator with SVG and PNG exports. [Open the tool](https://tinkora.github.io/qr_forge/). diff --git a/profile/README.zh-CN.md b/profile/README.zh-CN.md index 129b3a0..4de3ae9 100644 --- a/profile/README.zh-CN.md +++ b/profile/README.zh-CN.md @@ -30,6 +30,11 @@ Tinkora 为开发者和 AI Agent 构建聚焦、开源的实用工具。项目 - [Curl Builder](https://github.com/Tinkora/curl_builder) 在本地构建 HTTP 请求， 生成经过转义的 cURL、Fetch、Python、Go、Rust 和 Node.js 代码片段，但不会执行请求。 [打开工具](https://tinkora.github.io/curl_builder/)。 +- [CSV Sculptor](https://github.com/Tinkora/csv_sculptor) 在浏览器本地检查、筛选、 + 排序和转换 CSV/TSV 数据。[打开 Alpha](https://tinkora.github.io/csv_sculptor/)。 +- [Data Toolbox](https://github.com/Tinkora/data_toolbox) 检查 CSV/TSV 的结构、 + 分隔符歧义、行宽不一致和电子表格公式风险，并且不会静默修改输入。 + [打开 Draft](https://tinkora.github.io/data_toolbox/)。 - [Developer Primitives](https://github.com/Tinkora/developer_primitives) 通过 浏览器本地工作台和跨平台 `tinkora-id`、`tinkora-time` CLI 生成并检查 UUID/ULID、 转换显式时间戳，并明确显示 IANA 时区的 DST gap/fold。[打开工具](https://tinkora.github.io/developer_primitives/)或 @@ -54,8 +59,14 @@ Tinkora 为开发者和 AI Agent 构建聚焦、开源的实用工具。项目 - [image_to_icns](https://github.com/Tinkora/image_to_icns) 是一个隐私优先的 macOS `.icns` 生成器，提供浏览器编辑器和 MCP server。 [打开工具](https://tinkora.github.io/image_to_icns/)。 +- [JSON YAML Swiss](https://github.com/Tinkora/json_yaml_swiss) 校验、格式化并有意地 + 转换 JSON、YAML 和 TOML，同时明确报告有损边界。 + [打开 Alpha](https://tinkora.github.io/json_yaml_swiss/)。 - [MCP Doctor](https://github.com/Tinkora/mcp_doctor) 静态诊断本地 stdio MCP server 的配置、路径、环境和传输契约。[查看版本](https://github.com/Tinkora/mcp_doctor/releases/latest)。 +- [PE Version Info](https://github.com/Tinkora/pe_version_info) 提供跨平台 `pevi` CLI， + 用于检查并安全更新 Windows PE 的 `VERSIONINFO` 资源和图标。 + [下载 Alpha](https://github.com/Tinkora/pe_version_info/releases/tag/v0.1.0-alpha.1)。 - [QR Forge](https://github.com/Tinkora/qr_forge) 是一个在浏览器本地运行的 QR、 Code 128 与 EAN-13 生成器，支持导出 SVG 和 PNG。 [打开工具](https://tinkora.github.io/qr_forge/)。 diff --git a/scripts/check_github_settings_audit.rb b/scripts/check_github_settings_audit.rb index 2e23c68..0255e6b 100644 --- a/scripts/check_github_settings_audit.rb +++ b/scripts/check_github_settings_audit.rb @@ -67,7 +67,7 @@ def validate_json(schema, document, errors) production_policy = GitHubSettingsAudit::Policy.load(ROOT.join("config/github-settings-policy.json")) errors << "production policy organization must be tinkora" unless production_policy.organization == "tinkora" errors << "production policy login must be tinkeragora" unless production_policy.expected_login == "tinkeragora" - expected_repositories = [".github", "cert_viewer", "cron_maker", "csv_sculptor", "curl_builder", "developer_primitives", "diff_viz", "dmg_background", "encoding_toolbox", "favicon_kit", "image_to_icns", "pe_version_info", "jwt_inspector", "mcp_doctor", "qr_forge", "repo-template-rust-wasm", "tool_call_trace"] + expected_repositories = [".github", "cert_viewer", "cron_maker", "csv_sculptor", "curl_builder", "data_toolbox", "developer_primitives", "diff_viz", "dmg_background", "encoding_toolbox", "favicon_kit", "image_to_icns", "json_yaml_swiss", "pe_version_info", "jwt_inspector", "mcp_doctor", "qr_forge", "repo-template-rust-wasm", "tool_call_trace"] errors << "production policy must manage the planned public repositories" unless production_policy.repositories == expected_repositories errors << "production policy stage must be solo-public" unless production_policy.stage == "solo-public" gates = production_policy.data.fetch("gates") @@ -106,6 +106,16 @@ def validate_json(schema, document, errors) errors << "curl_builder topics must include code-generation" unless curl_targets.dig("topics", "value").include?("code-generation") errors << "curl_builder code scanning must be configured" unless curl_targets.dig("codeScanning", "value") == "configured" errors << "curl_builder must protect its main branch" unless curl_targets.dig("rulesMinimum", "value") == 1 + data_targets = production_policy.repository_targets("data_toolbox") + errors << "data_toolbox source must be published" unless data_targets.dig("sourcePublished", "value") == true + errors << "data_toolbox Issues must be enabled" unless data_targets.dig("issues", "value") == true + errors << "data_toolbox Discussions must be enabled" unless data_targets.dig("discussions", "value") == true + errors << "data_toolbox Projects must be enabled" unless data_targets.dig("projects", "value") == true + errors << "data_toolbox must remain release-free" unless data_targets.dig("releases", "value") == 0 + errors << "data_toolbox topics must include ai-agents" unless data_targets.dig("topics", "value").include?("ai-agents") + errors << "data_toolbox topics must include tinkora" unless data_targets.dig("topics", "value").include?("tinkora") + errors << "data_toolbox code scanning must be configured" unless data_targets.dig("codeScanning", "value") == "configured" + errors << "data_toolbox must protect its main branch and release tags" unless data_targets.dig("rulesMinimum", "value") == 2 primitives_targets = production_policy.repository_targets("developer_primitives") errors << "developer_primitives source must be published" unless primitives_targets.dig("sourcePublished", "value") == true errors << "developer_primitives Issues must be enabled" unless primitives_targets.dig("issues", "value") == true @@ -166,11 +176,20 @@ def validate_json(schema, document, errors) errors << "image_to_icns Discussions must be enabled" unless image_targets.dig("discussions", "value") == true errors << "image_to_icns must require its first immutable release" unless image_targets.dig("releases", "value") == 1 errors << "image_to_icns topics must include icns" unless image_targets.dig("topics", "value").include?("icns") + json_yaml_targets = production_policy.repository_targets("json_yaml_swiss") + errors << "json_yaml_swiss source must be published" unless json_yaml_targets.dig("sourcePublished", "value") == true + errors << "json_yaml_swiss Issues must be enabled" unless json_yaml_targets.dig("issues", "value") == true + errors << "json_yaml_swiss Discussions must be enabled" unless json_yaml_targets.dig("discussions", "value") == true + errors << "json_yaml_swiss Projects must remain disabled" unless json_yaml_targets.dig("projects", "value") == false + errors << "json_yaml_swiss must have its first release" unless json_yaml_targets.dig("releases", "value") == 1 + errors << "json_yaml_swiss topics must include tinkora" unless json_yaml_targets.dig("topics", "value").include?("tinkora") + errors << "json_yaml_swiss code scanning must be configured" unless json_yaml_targets.dig("codeScanning", "value") == "configured" + errors << "json_yaml_swiss must protect its main branch" unless json_yaml_targets.dig("rulesMinimum", "value") == 1 pe_targets = production_policy.repository_targets("pe_version_info") errors << "pe_version_info source must be published" unless pe_targets.dig("sourcePublished", "value") == true errors << "pe_version_info Issues must be enabled" unless pe_targets.dig("issues", "value") == true errors << "pe_version_info Discussions must be enabled" unless pe_targets.dig("discussions", "value") == true - errors << "pe_version_info must remain release-free" unless pe_targets.dig("releases", "value") == 0 + errors << "pe_version_info must have its alpha release" unless pe_targets.dig("releases", "value") == 1 errors << "pe_version_info topics must include PE" unless pe_targets.dig("topics", "value").include?("pe") errors << "pe_version_info code scanning status must be explicit" unless pe_targets.dig("codeScanning", "value") == "not-configured" jwt_targets = production_policy.repository_targets("jwt_inspector")