From d76e3b0da74ad6b6fcebeb860779e47f551bfc61 Mon Sep 17 00:00:00 2001 From: TN019 Date: Mon, 20 Jul 2026 00:52:52 +1000 Subject: [PATCH 1/2] Add GitHub Actions CI running the fast test suite on push and pull requests. --- .github/workflows/ci.yml | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 .github/workflows/ci.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..dd0b0ba --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,27 @@ +name: CI + +on: + push: + branches: [main] + pull_request: + +jobs: + test: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Install uv + uses: astral-sh/setup-uv@v5 + with: + python-version: "3.12" + enable-cache: true + + - name: Sync dependencies + run: uv sync + + # Fast suite only: real-engine / Ollama smokes are gated behind + # SCRIPTO_ENGINE_SMOKE / SCRIPTO_OLLAMA_SMOKE and never run in CI + # (they download models and need a GPU / running Ollama). + - name: Run tests + run: uv run pytest -q From 7727bf369ff5ccdea8b9e6d00ae45d42dd9f3137 Mon Sep 17 00:00:00 2001 From: TN019 Date: Mon, 20 Jul 2026 00:58:50 +1000 Subject: [PATCH 2/2] Add CONTRIBUTING with a maintainer relicensing grant and a security policy. --- CONTRIBUTING.md | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ SECURITY.md | 27 +++++++++++++++++++++++++++ 2 files changed, 75 insertions(+) create mode 100644 CONTRIBUTING.md create mode 100644 SECURITY.md diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..51f55f5 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,48 @@ +# Contributing to Scripto + +Thanks for your interest in Scripto! Contributions — bug reports, fixes, features, docs — are welcome. + +> 中文读者：贡献前请阅读下方「Contribution terms」一节。为保证再许可条款在法律上明确，该节以英文为准。 + +## Getting started + +```bash +git clone https://github.com/TN019/scripto.git && cd scripto +uv sync +uv run pytest # fast suite must stay green +``` + +- Keep the fast test suite passing (`uv run pytest`). Add tests for behavior you change. +- Match the existing style; the `core/` layer must never import UI code. +- Real-engine / Ollama smokes are opt-in: `SCRIPTO_ENGINE_SMOKE=1` and `SCRIPTO_OLLAMA_SMOKE=1`. +- Open a pull request against `main` with a clear description of the problem and the change. + +## Reporting bugs + +Open an issue with: what you did, what you expected, what happened, your OS, and the output of `uv run scripto-cli doctor`. + +## Contribution terms (please read) + +By submitting a contribution (a pull request, patch, or any other material) to this +project, you represent and agree that: + +1. **You have the right to submit it.** The contribution is your own original work, or + you otherwise have the right to submit it under these terms. + +2. **License to the project and its users.** You license your contribution under the + MIT License — the project's current license — to the project and to everyone who + receives the project. + +3. **Relicensing grant to the maintainer.** You additionally grant the project's + maintainer(s) a perpetual, worldwide, non-exclusive, royalty-free, irrevocable + right to use, reproduce, modify, prepare derivative works of, sublicense, and + **relicense** your contribution under any license terms — including proprietary or + commercial terms — as part of this project or any derivative of it, without further + notice, permission, or compensation. + +This lets the maintainer keep the project open source today while preserving the option +to offer it (or a derivative) under different terms in the future. If you do not agree +to these terms, please do not submit a contribution. + +> These terms are a plain-language license grant, not legal advice. For anything +> significant, consult a lawyer. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..5f17dde --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,27 @@ +# Security Policy + +## Reporting a vulnerability + +Please **do not** open a public issue for security problems. + +Report privately through GitHub's **"Report a vulnerability"** button under the +repository's **Security** tab +([Security Advisories](https://github.com/TN019/scripto/security/advisories/new)). +Include what you found, how to reproduce it, and the potential impact. You'll get a +response as soon as reasonably possible. + +## Scope + +Scripto runs entirely on your own machine and performs no network calls of its own +beyond: + +- downloading Whisper models from Hugging Face (only when you choose to download one), and +- talking to a **local** Ollama instance for translation (only when you enable it). + +It uploads nothing and opens no listening ports. The most relevant security surface is +therefore local: handling of file paths, subprocess invocation (`ffmpeg`), and the +files Scripto reads and writes. Reports in these areas are especially welcome. + +## Supported versions + +Fixes land on `main` and in the latest release. There is no long-term support branch.