From 03c7b67d8419f67dff584fd441a56a829926db10 Mon Sep 17 00:00:00 2001 From: randypanding <66171646@users.noreply.github.com> Date: Wed, 19 Aug 2026 04:33:15 +0000 Subject: [PATCH 1/3] =?UTF-8?q?chore:=20scorecard=20=E5=A7=BF=E6=80=81?= =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E2=80=94=E2=80=94pyyaml=20=E9=92=89=E7=89=88?= =?UTF-8?q?/LICENSE/dependabot/=E5=AE=89=E5=85=A8=E7=AD=96=E7=95=A5?= =?UTF-8?q?=E9=93=BE=E6=8E=A5=EF=BC=88ADR-0011=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ADR-0011「版本钉死另行处理」遗留项 + scorecard 四项告警落地： - gate.yml：pip install pyyaml==6.0.3（PinnedDependencies——此前未钉版本） - LICENSE：补 MIT（License——与 template-service 同许可） - .github/dependabot.yml：github-actions 生态周检（DependencyUpdateTool） - SECURITY.md：报告渠道补文档链接（SecurityPolicy "no linked content found"） --- .github/dependabot.yml | 9 +++++++++ .github/workflows/gate.yml | 2 +- LICENSE | 21 +++++++++++++++++++++ SECURITY.md | 2 +- 4 files changed, 32 insertions(+), 2 deletions(-) create mode 100644 .github/dependabot.yml create mode 100644 LICENSE diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..a83f58b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,9 @@ +version: 2 +# 依赖更新工具（scorecard DependencyUpdateTool；ADR-0011 安全姿态基线遗留项）： +# 本仓唯一第三方依赖面是 workflows 里的 actions（全部 SHA 锚定+版本注释）—— +# dependabot github-actions 生态可对 SHA 锚定引用提更新 PR。 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly diff --git a/.github/workflows/gate.yml b/.github/workflows/gate.yml index 076d2cd..3b04162 100644 --- a/.github/workflows/gate.yml +++ b/.github/workflows/gate.yml @@ -26,7 +26,7 @@ jobs: python-version: "3.12" - name: YAML 全量解析（governance + standards） run: | - pip install pyyaml -q + pip install pyyaml==6.0.3 -q # 版本钉死（scorecard PinnedDependencies；ADR-0011 版本钉死遗留项） python3 - <<'EOF' import glob, sys, yaml files = glob.glob("governance/**/*.yaml", recursive=True) + glob.glob("standards/**/*.yaml", recursive=True) diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..5ef822c --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 Cloudbird Software + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/SECURITY.md b/SECURITY.md index 479b543..d46a1af 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,7 +2,7 @@ ## 报告漏洞 -请通过仓库 **Security → Report a vulnerability** 提交（Private vulnerability reporting 已开启）。不要在 Issue/PR/讨论中公开披露。 +请通过仓库 **Security → Report a vulnerability** 提交（Private vulnerability reporting 已开启，[报告入口文档](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities#privately-reporting-a-vulnerability)）。不要在 Issue/PR/讨论中公开披露。 ## 响应时限（红队修复：此前无 SLA） From be208151f15ba3cd7f34ffeadb753352db383fc1 Mon Sep 17 00:00:00 2001 From: randypanding <66171646@users.noreply.github.com> Date: Wed, 19 Aug 2026 04:34:46 +0000 Subject: [PATCH 2/3] =?UTF-8?q?fix:=20dependabot=20=E8=A1=A5=20cooldown?= =?UTF-8?q?=EF=BC=88zizmor=20dependabot-cooldown=EF=BC=9A=E6=96=B0?= =?UTF-8?q?=E7=89=88=E6=9C=AC=E5=86=B7=E5=8D=B4=207=20=E5=A4=A9=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/dependabot.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index a83f58b..1825111 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,3 +7,5 @@ updates: directory: / schedule: interval: weekly + cooldown: # zizmor dependabot-cooldown：新版本冷却 7 天再提 PR（供应链缓冲） + default-days: 7 From 6f1ccb5273068dfad55f28f0cff0ce0d227ed44d Mon Sep 17 00:00:00 2001 From: randypanding <66171646@users.noreply.github.com> Date: Wed, 19 Aug 2026 04:42:36 +0000 Subject: [PATCH 3/3] =?UTF-8?q?fix:=20dependabot=20=E6=B3=A8=E9=87=8A?= =?UTF-8?q?=E8=8C=83=E5=9B=B4=E4=BF=AE=E6=AD=A3=20+=20SECURITY.md=20?= =?UTF-8?q?=E7=9B=B4=E9=93=BE=EF=BC=88review=20=E4=BF=AE=E5=A4=8D=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 1. coderabbit/qodo：注释曾表述"本仓唯一第三方依赖面是 actions"——gate.yml 的 pyyaml 亦为第三方依赖。明确仅管理 github-actions；pyyaml 不纳入 dependabot 的原因写实：.github/ 属 C1 路径，依赖升级 PR 须引用 ADR （adr-required），自动 PR 无法自携，升级走显式人工 PR。 2. coderabbit：报告文档链接换直链（原链接重定向到公告编写页）。 --- .github/dependabot.yml | 6 ++++-- SECURITY.md | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1825111..6f361d0 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,7 +1,9 @@ version: 2 # 依赖更新工具（scorecard DependencyUpdateTool；ADR-0011 安全姿态基线遗留项）： -# 本仓唯一第三方依赖面是 workflows 里的 actions（全部 SHA 锚定+版本注释）—— -# dependabot github-actions 生态可对 SHA 锚定引用提更新 PR。 +# 仅管理 workflows 里的 github-actions 引用（SHA 锚定+版本注释，dependabot 可提更新 PR）。 +# gate.yml 的 pyyaml==6.0.3 为运行时一次性安装（无 Python manifest）——不纳入 dependabot： +# 本仓 .github/ 属 C1 路径，依赖升级 PR 须引用 ADR（adr-required），自动 PR 无法自携， +# 升级走显式人工 PR（评审项：避免注释误读为已覆盖全部第三方依赖）。 updates: - package-ecosystem: github-actions directory: / diff --git a/SECURITY.md b/SECURITY.md index d46a1af..e694a23 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,7 +2,7 @@ ## 报告漏洞 -请通过仓库 **Security → Report a vulnerability** 提交（Private vulnerability reporting 已开启，[报告入口文档](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities#privately-reporting-a-vulnerability)）。不要在 Issue/PR/讨论中公开披露。 +请通过仓库 **Security → Report a vulnerability** 提交（Private vulnerability reporting 已开启，[报告入口文档](https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/report-privately)）。不要在 Issue/PR/讨论中公开披露。 ## 响应时限（红队修复：此前无 SLA）