diff --git a/CHANGELOG.md b/CHANGELOG.md index 3287360..0b822b2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -57,6 +57,8 @@ when releases begin. ### Changed +- Registered the verified Color Atlas and MD Porter Alpha releases in the + bilingual organization profile, settings policy, and release governance. - Documented dependency-update review gates: Dependabot is proposal-only, patch/minor groups use full checks, and coupled Rust major upgrades require a coordinated migration with dependency-graph and compatibility evidence. diff --git a/config/github-settings-policy.json b/config/github-settings-policy.json index 480b13e..451bf22 100644 --- a/config/github-settings-policy.json +++ b/config/github-settings-policy.json @@ -79,6 +79,16 @@ "rulesMinimum": {"applicability": "CURRENT", "value": 1}, "releases": {"applicability": "CURRENT", "value": 2} }, + "color_atlas": { + "sourcePublished": {"applicability": "CURRENT", "value": true}, + "topics": {"applicability": "CURRENT", "value": ["accessibility", "browser-tool", "color-converter", "color-tool", "contrast-checker", "palette-generator", "rust", "wasm", "wcag", "webassembly"]}, + "issues": {"applicability": "CURRENT", "value": true}, + "discussions": {"applicability": "CURRENT", "value": true}, + "projects": {"applicability": "CURRENT", "value": true}, + "codeScanning": {"applicability": "CURRENT", "value": "configured"}, + "rulesMinimum": {"applicability": "CURRENT", "value": 2}, + "releases": {"applicability": "CURRENT", "value": 1} + }, "cron_maker": { "sourcePublished": {"applicability": "CURRENT", "value": true}, "topics": {"applicability": "CURRENT", "value": ["cron", "cron-expression", "developer-tools", "privacy", "rust", "scheduling", "timezone", "tinkora", "webassembly"]}, @@ -215,6 +225,16 @@ "rulesMinimum": {"applicability": "CURRENT", "value": 1}, "releases": {"applicability": "CURRENT", "value": 1} }, + "md_porter": { + "sourcePublished": {"applicability": "CURRENT", "value": true}, + "topics": {"applicability": "CURRENT", "value": ["developer-tools", "markdown", "offline-first", "privacy", "rust", "tinkora", "wasm"]}, + "issues": {"applicability": "CURRENT", "value": true}, + "discussions": {"applicability": "CURRENT", "value": true}, + "projects": {"applicability": "CURRENT", "value": true}, + "codeScanning": {"applicability": "CURRENT", "value": "configured"}, + "rulesMinimum": {"applicability": "CURRENT", "value": 2}, + "releases": {"applicability": "CURRENT", "value": 1} + }, "qr_forge": { "sourcePublished": {"applicability": "CURRENT", "value": true}, "topics": {"applicability": "CURRENT", "value": ["barcode-generator", "developer-tools", "privacy-tools", "qr-code-generator", "rust", "webassembly"]}, diff --git a/docs/ACCESS_MODEL.md b/docs/ACCESS_MODEL.md index e460030..8f3dfab 100644 --- a/docs/ACCESS_MODEL.md +++ b/docs/ACCESS_MODEL.md @@ -39,7 +39,7 @@ must not be converted into current failures merely because they appear in a | Setting | Current | Target | Apply when | | --- | --- | --- | --- | | Release publishers | Only the organization owner may deliberately create a protected project release tag; no organization-wide or unattended publisher is authorized | Separate build verification from least-privilege release publication | A project reaches its documented release gate, the exact commit and hosted evidence are reviewed, and tag creation is separately authorized | -| High-privilege automation | `cert_viewer`, `cron_maker`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `json_yaml_swiss`, `jwt_inspector`, `mcp_doctor`, `qr_forge`, and `tool_call_trace` limit `contents: write` to their final tag-triggered publication jobs; their release Environments have no independent reviewer on GitHub Free | Require a protected Environment or appropriately scoped GitHub App with non-author approval | A second trusted owner is active, credentials and recovery are tested, and the exact automation is explicitly authorized | +| High-privilege automation | `cert_viewer`, `color_atlas`, `cron_maker`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `json_yaml_swiss`, `jwt_inspector`, `mcp_doctor`, `md_porter`, `qr_forge`, and `tool_call_trace` limit `contents: write` to their final tag-triggered publication jobs; their release Environments have no independent reviewer on GitHub Free | Require a protected Environment or appropriately scoped GitHub App with non-author approval | A second trusted owner is active, credentials and recovery are tested, and the exact automation is explicitly authorized | During the solo stage, a deliberate protected-tag push is an accountable owner authorization, not independent review. It is permitted only under diff --git a/docs/INCIDENT_RESPONSE.md b/docs/INCIDENT_RESPONSE.md index f99e72f..25f7f1e 100644 --- a/docs/INCIDENT_RESPONSE.md +++ b/docs/INCIDENT_RESPONSE.md @@ -20,7 +20,7 @@ public disclosure of sensitive evidence. | Setting | Current | Target | Apply when | | --- | --- | --- | --- | | Emergency access restriction | No standing incident-specific remote rule is claimed | Temporarily revoke or narrow compromised access with least privilege | An authorized owner verifies a credible active risk, identifies exact affected access, records recovery privately, and approves the action | -| Workflow or release pause | Project-specific protected-tag release automation exists for `cert_viewer`, `cron_maker`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `json_yaml_swiss`, `jwt_inspector`, `mcp_doctor`, `qr_forge`, and `tool_call_trace`; `data_toolbox` and `pe_version_info` currently produce candidate evidence without an unattended publication job, and organization release evidence remains read-only | Disable affected automation or publication while preserving evidence | A credible compromise could affect builds or releases, the incident lead records scope and rollback, and an authorized owner applies the pause | +| Workflow or release pause | Project-specific protected-tag release automation exists for `cert_viewer`, `color_atlas`, `cron_maker`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `json_yaml_swiss`, `jwt_inspector`, `mcp_doctor`, `md_porter`, `qr_forge`, and `tool_call_trace`; `data_toolbox` and `pe_version_info` currently produce candidate evidence without an unattended publication job, and organization release evidence remains read-only | Disable affected automation or publication while preserving evidence | A credible compromise could affect builds or releases, the incident lead records scope and rollback, and an authorized owner applies the pause | | Repository interaction limits | No incident restriction is pre-authorized | Temporarily limit interactions only when abuse or disclosure cannot be contained otherwise | The incident lead documents necessity and duration, an authorized owner approves it, and restoration criteria are defined | | Public advisory | No security advisory channel is claimed ready | Coordinate a minimal, accurate advisory and corrected release when appropriate | A private intake exists, affected scope and mitigation are understood, disclosure risk is reviewed, and publication is explicitly authorized | diff --git a/docs/RELEASE_POLICY.md b/docs/RELEASE_POLICY.md index d4eff59..95ab1d1 100644 --- a/docs/RELEASE_POLICY.md +++ b/docs/RELEASE_POLICY.md @@ -4,8 +4,8 @@ | Setting | Current | Target | Apply when | | --- | --- | --- | --- | -| Release automation | `cert_viewer`, `cron_maker`, `csv_sculptor`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `json_yaml_swiss`, `jwt_inspector`, `mcp_doctor`, `qr_forge`, and `tool_call_trace` have project-specific, tag-triggered publication workflows; `data_toolbox` and `pe_version_info` currently build candidates without an unattended publication job, and the organization reusable workflow remains read-only | Build and verify reproducibly, then publish from a protected tag with least privilege and project-owned verification | A project has stable hosted checks, immutable release inputs, a documented artifact contract, and explicit owner authorization | -| Versioning | Published releases are `developer_primitives` and `tool_call_trace` at `v0.2.0`; `cert_viewer`, `json_yaml_swiss`, and `jwt_inspector` at `v0.1.1`; `csv_sculptor`, `curl_builder`, and `pe_version_info` at `v0.1.0-alpha.1`; and `cron_maker`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `mcp_doctor`, and `qr_forge` at `v0.1.0` | Use Semantic Versioning for public versions and document pre-`1.0.0` instability | A project declares a public contract and its first release is authorized | +| Release automation | `cert_viewer`, `color_atlas`, `cron_maker`, `csv_sculptor`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `json_yaml_swiss`, `jwt_inspector`, `mcp_doctor`, `md_porter`, `qr_forge`, and `tool_call_trace` have project-specific, tag-triggered publication workflows; `data_toolbox` and `pe_version_info` currently build candidates without an unattended publication job, and the organization reusable workflow remains read-only | Build and verify reproducibly, then publish from a protected tag with least privilege and project-owned verification | A project has stable hosted checks, immutable release inputs, a documented artifact contract, and explicit owner authorization | +| Versioning | Published releases are `developer_primitives` and `tool_call_trace` at `v0.2.0`; `cert_viewer`, `json_yaml_swiss`, and `jwt_inspector` at `v0.1.1`; `csv_sculptor` at `v0.1.0-alpha.2`; `color_atlas`, `curl_builder`, `data_toolbox`, `md_porter`, and `pe_version_info` at `v0.1.0-alpha.1`; and `cron_maker`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `mcp_doctor`, and `qr_forge` at `v0.1.0` | Use Semantic Versioning for public versions and document pre-`1.0.0` instability | A project declares a public contract and its first release is authorized | | Changelog | This governance repository contains only an `Unreleased` section | Maintain Keep a Changelog categories and move entries to a dated version only during release | A reviewed release candidate is approved; do not create historical entries without release evidence | | Git tags | Every published release above has a `vMAJOR.MINOR.PATCH` tag; repository rules protect current release tags from deletion or mutation | Use protected, immutable `vMAJOR.MINOR.PATCH` tags that point to the reviewed release commit | Tag protection is verified, the release commit and version agree, and tag creation is explicitly authorized | | Artifacts | Release assets and verification material are project-specific; binary projects publish checksums, SBOMs, and attestations defined by their release contract | Publish platform artifacts with cryptographic checksums, an SBOM, and provenance appropriate to the build system | Artifact generation is reproducible, consumer verification instructions exist, and the release is approved | diff --git a/profile/README.md b/profile/README.md index 0e9f6e1..250863a 100644 --- a/profile/README.md +++ b/profile/README.md @@ -28,6 +28,10 @@ machine-readable contracts, and behavior that can be verified in CI. - [Cert Viewer](https://github.com/Tinkora/cert_viewer) inspects X.509 PEM and DER certificates locally, including extensions and fingerprints. [Open the tool](https://tinkora.github.io/cert_viewer/). +- [Color Atlas](https://github.com/Tinkora/color_atlas) converts colors, + extracts image palettes, checks WCAG contrast, previews color-vision + differences, and generates CSS without uploading source images. + [Open the Alpha](https://tinkora.github.io/color_atlas/). - [Curl Builder](https://github.com/Tinkora/curl_builder) builds HTTP requests locally and generates escaped cURL, Fetch, Python, Go, Rust, and Node.js snippets without executing the request. @@ -73,6 +77,9 @@ machine-readable contracts, and behavior that can be verified in CI. formats, and deliberately converts JSON, YAML, and TOML while reporting lossy boundaries. [Open the Alpha](https://tinkora.github.io/json_yaml_swiss/). +- [MD Porter](https://github.com/Tinkora/md_porter) previews a bounded GFM + subset, checks YAML frontmatter, and exports safe self-contained HTML in the + browser. [Open the Alpha](https://tinkora.github.io/md_porter/). - [MCP Doctor](https://github.com/Tinkora/mcp_doctor) statically diagnoses local stdio MCP server configuration, paths, environment, and transport contracts. [View the release](https://github.com/Tinkora/mcp_doctor/releases/latest). diff --git a/profile/README.zh-CN.md b/profile/README.zh-CN.md index 4de3ae9..4431f87 100644 --- a/profile/README.zh-CN.md +++ b/profile/README.zh-CN.md @@ -27,6 +27,9 @@ Tinkora 为开发者和 AI Agent 构建聚焦、开源的实用工具。项目 - [Cert Viewer](https://github.com/Tinkora/cert_viewer) 在本地检查 X.509 PEM 和 DER 证书，包括扩展和指纹。 [打开工具](https://tinkora.github.io/cert_viewer/)。 +- [Color Atlas](https://github.com/Tinkora/color_atlas) 在不上传源图片的情况下 + 转换颜色、提取图片调色板、检查 WCAG 对比度、预览色觉差异并生成 CSS。 + [打开 Alpha](https://tinkora.github.io/color_atlas/)。 - [Curl Builder](https://github.com/Tinkora/curl_builder) 在本地构建 HTTP 请求， 生成经过转义的 cURL、Fetch、Python、Go、Rust 和 Node.js 代码片段，但不会执行请求。 [打开工具](https://tinkora.github.io/curl_builder/)。 @@ -62,6 +65,9 @@ Tinkora 为开发者和 AI Agent 构建聚焦、开源的实用工具。项目 - [JSON YAML Swiss](https://github.com/Tinkora/json_yaml_swiss) 校验、格式化并有意地 转换 JSON、YAML 和 TOML，同时明确报告有损边界。 [打开 Alpha](https://tinkora.github.io/json_yaml_swiss/)。 +- [MD Porter](https://github.com/Tinkora/md_porter) 在浏览器本地预览受限 GFM、 + 检查 YAML frontmatter，并导出安全的自包含 HTML。 + [打开 Alpha](https://tinkora.github.io/md_porter/)。 - [MCP Doctor](https://github.com/Tinkora/mcp_doctor) 静态诊断本地 stdio MCP server 的配置、路径、环境和传输契约。[查看版本](https://github.com/Tinkora/mcp_doctor/releases/latest)。 - [PE Version Info](https://github.com/Tinkora/pe_version_info) 提供跨平台 `pevi` CLI， diff --git a/scripts/check_github_settings_audit.rb b/scripts/check_github_settings_audit.rb index 0255e6b..80ef337 100644 --- a/scripts/check_github_settings_audit.rb +++ b/scripts/check_github_settings_audit.rb @@ -67,7 +67,7 @@ def validate_json(schema, document, errors) production_policy = GitHubSettingsAudit::Policy.load(ROOT.join("config/github-settings-policy.json")) errors << "production policy organization must be tinkora" unless production_policy.organization == "tinkora" errors << "production policy login must be tinkeragora" unless production_policy.expected_login == "tinkeragora" - expected_repositories = [".github", "cert_viewer", "cron_maker", "csv_sculptor", "curl_builder", "data_toolbox", "developer_primitives", "diff_viz", "dmg_background", "encoding_toolbox", "favicon_kit", "image_to_icns", "json_yaml_swiss", "pe_version_info", "jwt_inspector", "mcp_doctor", "qr_forge", "repo-template-rust-wasm", "tool_call_trace"] + expected_repositories = [".github", "cert_viewer", "color_atlas", "cron_maker", "csv_sculptor", "curl_builder", "data_toolbox", "developer_primitives", "diff_viz", "dmg_background", "encoding_toolbox", "favicon_kit", "image_to_icns", "json_yaml_swiss", "pe_version_info", "jwt_inspector", "mcp_doctor", "md_porter", "qr_forge", "repo-template-rust-wasm", "tool_call_trace"] errors << "production policy must manage the planned public repositories" unless production_policy.repositories == expected_repositories errors << "production policy stage must be solo-public" unless production_policy.stage == "solo-public" gates = production_policy.data.fetch("gates")