Skip to content

docs: add SECURITY.md, dependabot.yml, .gitattributes (HOL scan remediation) - #388

Open
ranxianglei wants to merge 3 commits into
masterfrom
2026-09-11_scan-remediation
Open

docs: add SECURITY.md, dependabot.yml, .gitattributes (HOL scan remediation)#388
ranxianglei wants to merge 3 commits into
masterfrom
2026-09-11_scan-remediation

Conversation

@ranxianglei

@ranxianglei ranxianglei commented Sep 11, 2026

Copy link
Copy Markdown
Owner

Add security & dependency-hygiene files (HOL scan remediation)

Motivated by #387: the awesome-ai-plugins catalog's HOL scanner scored opencode-acp at 79/100, one point below the required ≥ 80. The gap came from missing best-practice artifacts, not plugin defects.

Changes

  • SECURITY.md — private vulnerability-reporting policy (GitHub Security Advisory + maintainer email), scoped to this plugin.
  • .github/dependabot.yml — weekly npm + GitHub Actions update PRs (dev-deps grouped).
  • .gitattributes — explicit binary-asset marking only (no global text rule, so existing files' line endings are untouched).

Notes

  • No changes under lib/, index.ts, or tests/; behavior is unchanged, so no code review is required. No version bump.
  • These files cannot affect typecheck / test / build (CI runs those gates).
  • Final HOL score confirmation requires a re-scan from the catalog maintainers (plugin-scanner verify . can't run in the agent sandbox). Optional follow-up if more margin is needed: pin CI actions to immutable SHAs.

@ranxianglei
docs: add SECURITY.md, dependabot.yml, .gitattributes (HOL scan remed…
bc4a51e 
…iation)

Addresses missing-artifact findings flagged by the awesome-ai-plugins HOL scanner (issue #387). No behavior change.
@github-actions

github-actions Bot commented Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown

📦 Built Plugin Artifact

Branch: 2026-09-11_scan-remediation (01eaa72)

Option A — Install from npm PR tag (recommended)

opencode plugin opencode-acp@pr-388 --global

Each push to this PR publishes a new version under the pr-388 npm tag.

Option B — Install from GitHub

opencode plugin "github:ranxianglei/opencode-acp#2026-09-11_scan-remediation" --global

Option C — Download artifact

  1. Download the artifact from the Actions run
  2. Extract the tarball and install:
tar xzf opencode-acp-pr388.tgz
cp -r package/dist ~/.cache/opencode/packages/opencode-acp@latest/node_modules/opencode-acp/dist
  1. Restart opencode to pick up changes.

This comment is automatically updated on each push.

@ranxianglei ranxianglei mentioned this pull request Sep 11, 2026
Closed
@ranxianglei

ranxianglei commented Sep 12, 2026

Copy link
Copy Markdown
Owner Author

复核这个

@ranxianglei

ranxianglei commented Sep 12, 2026

Copy link
Copy Markdown
Owner Author

🤖 Powered by ework · qwen3.8-27b

复核完成。结论:diff 干净、CI 全绿,但启用 dependabot 会踩中本仓自己的 pr-validation 门禁——建议修完再合并。

✅ 通过项

  • diff 整洁度:5 个新文件 / +148 行,纯新增,每一行都与 PR 目的相关;无 version bump、无锁文件、无跑题改动。
  • 规范符合性:分支名 2026-09-11_scan-remediation 符合 YYYY-MM-DD_short-title;devlog/2026-09-11_scan-remediation/ REQ.md + WORKLOG.md 齐全且目录名与分支名一致;无 lib/ 改动,按 §5.3 无需双 agent 代码审查(PR 描述的说法准确)。
  • CI:head bc4a51e 上全部绿 — pr-validation、test (22)、test (24)、build、e2e、build-artifact。
  • .gitattributes:只有显式 binary 标记、没有全局 text 规则,不会重排已有文件的换行(assets/ 下确实有 PNG,含一个带空格的 3.0 release.png,加它合理)。
  • dependabot.yml:YAML v2 schema 校验通过;dev-deps 合并成一个 PR、open-pull-requests-limit: 5 的配置合理。
  • 引用方式:正文引用 Add opencode-acp to awesome-ai-plugins? #387 而不用 "Fixes Add opencode-acp to awesome-ai-plugins? #387" 是正确的——Add opencode-acp to awesome-ai-plugins? #387 要等目录方重扫并合并 listing PR chore: remove orphaned old engine (dead code) (issue #42) #275 才算完成,自动关闭会错。

🔴 阻断项:dependabot 会永久卡死 pr-validation

本仓分支保护要求 pr-validation(即 scripts/ci/check-pr.sh)通过,而该脚本强制两条:

  1. scripts/ci/check-pr.sh:37 — 分支名必须匹配 ^\d{4}-\d{2}-\d{2}_[a-z0-9.-]+$
  2. scripts/ci/check-pr.sh:47-58 — 必须存在 devlog/<branch>/REQ.md + WORKLOG.md

Dependabot 的分支名形如 dependabot/npm_and_yarn/zod-4.x.x,两条同时违反。后果:本 PR 合并后,以后每个 dependabot PR 的 pr-validation 都会永久红,不手动 override 分支保护就合不了。这是仓库自身规范(AGENTS.md §5.1.2)与 dependabot 的直接冲突,属于本 PR 引入的运维陷阱。

建议修法(小改,在 check-pr.sh 开头加分支豁免):

# Bot-managed branches (dependabot) cannot follow human branch/devlog conventions
case "$BRANCH" in
    dependabot/*)
        echo "ℹ '$BRANCH' is a bot branch — skipping branch-name & devlog checks"
        exit 0
        ;;
esac

同时在 AGENTS.md §5.1.2 补一句豁免说明。这动了 CI 门禁语义,由你拍板:① 加豁免(推荐,否则 dependabot 形同虚设);② 或者干脆去掉 dependabot.yml。你点头我就直接在 PR 分支上补 commit。

🟡 SECURITY.md 两处措辞问题

  1. "Email the maintainer: see the author field in package.json" — 但 package.json 的 author 只是 "ranxianglei",没有邮箱,这条上报渠道实际不可用。要么在 package.json author 里补邮箱,要么改成指向 GitHub profile。
  2. Supported Versions 只写了 opencode-acp@latest — 但 README 安装指引是 @stable,npm 上两个 tag 并存(stable=1.14.26,latest=1.17.0)。照 README 装的用户按政策拿不到安全修复。建议措辞改为覆盖 stable 和 latest 两条线。

🟢 合并前准备

一句话中文摘要:diff 干净、CI 全绿,但启用 dependabot 会让今后所有 bot PR 被本仓自己的 pr-validation(分支命名 + devlog 检查)永久卡红,建议先在 check-pr.sh 加 bot 分支豁免再合并;另请顺手修掉 SECURITY.md 两处措辞(邮箱渠道缺失、@stable 用户不在支持范围内)。

@ranxianglei

ranxianglei commented Sep 12, 2026

Copy link
Copy Markdown
Owner Author

小问题直接修复

@ranxianglei
fix: address review findings (dependabot pr-validation exemption, SEC…
c8799bc 
…URITY.md wording)

- check-pr.sh: exempt dependabot/* branches from checks 1-3 (branch name + devlog); they cannot follow human conventions and would otherwise fail the required pr-validation check on every bot PR. Check 4 (changelog/version) still applies.

- AGENTS.md §5.1.2: document the bot-branch exemption.

- SECURITY.md: support both @stable and @latest release lines (README installs @stable); maintainer contact now points at GitHub profile instead of a package.json author field that contains no email.
@ranxianglei
merge: sync master into PR #388
01eaa72
@ranxianglei

ranxianglei commented Sep 12, 2026

Copy link
Copy Markdown
Owner Author

🤖 Powered by ework · qwen3.8-27b

已按"小问题直接修复"处理完毕。两个新 commit 已推到 2026-09-11_scan-remediation,CI 全绿。

修复内容(commit c8799bc)

1. 🔴 dependabot vs pr-validation 冲突(阻断项)

  • scripts/ci/check-pr.sh:新增 BOT_BRANCH 检测,dependabot/* 分支跳过检查 1–3(分支命名 + devlog),检查 4(changelog/version)仍然生效。脚本头部注释同步更新。
  • AGENTS.md §5.1.2:补了 bot 分支豁免说明,与脚本行为对齐。
  • 本地验证了两个方向:dependabot/npm_and_yarn/example-1.0.0 → PASS(带 warning);bad-branch-name → 照旧 FAIL(3 项错误)。人类分支的门禁强度未变。

2. 🟡 SECURITY.md — supported versions

  • 从只覆盖 @latest 改为同时覆盖 @stable(README 的安装指引)+ @latest,两个 dist-tag 都在政策范围内。

3. 🟡 SECURITY.md — 维护者联系方式

  • package.json 的 author 只有 "ranxianglei" 没有邮箱,原写法是死链。改为指向 GitHub profile:ranxianglei。

4. devlog:WORKLOG.md 增加 "Review round 1" 一节,记录上述发现与修复及复验结果。

另外把 master 合入了分支(merge commit 01eaa72,仓库惯用的 sync 方式),PR 不再 behind。

验证

  • 本地:check-pr.sh 双向测试通过;改动文件过 prettier 3.9.5(lock 版本)--check 干净——我的编辑没有引入任何新的格式违规。
  • CI(head 01eaa72)6 项全绿:pr-validation ✓、test (22) ✓、test (24) ✓、build ✓、e2e ✓、build-artifact ✓。pr-388 npm tag 也已用新代码重新发布。

顺带发现(仅报告,未动)

  • AGENTS.md 本身在 master 上就不通过 npm run format:check(prettier 3.9.5 对若干表格的列宽有意见,约 114 行 diff),属存量问题且 CI 不跑该门禁。为避免污染本 PR diff 没有顺手重排——如果要修,建议单独开一个格式化 PR。

剩余事项

  • 最终 HOL 分数仍需 awesome-list 维护者重扫确认(沙箱内无法跑 plugin-scanner verify .)。
  • dependabot 豁免属于 CI 门禁语义变更,已在 AGENTS.md 留痕;按规范这算"分析中发现并已修复的问题",我判断其影响面(仅影响未来 bot PR、且合并前就被拦截)按"报告即可"处理并记录在 WORKLOG,如你认为需要单独开 issue 留痕,说一声我就补。

一句话中文摘要:三处 review 问题已直接在 PR 分支修掉(dependabot 分支豁免 pr-validation 的命名/devlog 检查并在 AGENTS.md 留痕、SECURITY.md 覆盖 @stable+@latest、维护者联系方式改指 GitHub profile),master 已同步,CI 六项全绿,可以合并。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ranxianglei