Open-source health: CI, CONTRIBUTING, and SECURITY

.github/workflows/ci.yml

@@ -0,0 +1,27 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+          enable-cache: true
+
+      - name: Sync dependencies
+        run: uv sync
+
+      # Fast suite only: real-engine / Ollama smokes are gated behind
+      # SCRIPTO_ENGINE_SMOKE / SCRIPTO_OLLAMA_SMOKE and never run in CI
+      # (they download models and need a GPU / running Ollama).
+      - name: Run tests
+        run: uv run pytest -q

CONTRIBUTING.md

@@ -0,0 +1,48 @@
+# Contributing to Scripto
+
+Thanks for your interest in Scripto! Contributions — bug reports, fixes, features, docs — are welcome.
+
+> 中文读者：贡献前请阅读下方「Contribution terms」一节。为保证再许可条款在法律上明确，该节以英文为准。
+
+## Getting started
+
+```bash
+git clone https://github.com/TN019/scripto.git && cd scripto
+uv sync
+uv run pytest          # fast suite must stay green
+```
+
+- Keep the fast test suite passing (`uv run pytest`). Add tests for behavior you change.
+- Match the existing style; the `core/` layer must never import UI code.
+- Real-engine / Ollama smokes are opt-in: `SCRIPTO_ENGINE_SMOKE=1` and `SCRIPTO_OLLAMA_SMOKE=1`.
+- Open a pull request against `main` with a clear description of the problem and the change.
+
+## Reporting bugs
+
+Open an issue with: what you did, what you expected, what happened, your OS, and the output of `uv run scripto-cli doctor`.
+
+## Contribution terms (please read)
+
+By submitting a contribution (a pull request, patch, or any other material) to this
+project, you represent and agree that:
+
+1. **You have the right to submit it.** The contribution is your own original work, or
+   you otherwise have the right to submit it under these terms.
+
+2. **License to the project and its users.** You license your contribution under the
+   MIT License — the project's current license — to the project and to everyone who
+   receives the project.
+
+3. **Relicensing grant to the maintainer.** You additionally grant the project's
+   maintainer(s) a perpetual, worldwide, non-exclusive, royalty-free, irrevocable
+   right to use, reproduce, modify, prepare derivative works of, sublicense, and
+   **relicense** your contribution under any license terms — including proprietary or
+   commercial terms — as part of this project or any derivative of it, without further
+   notice, permission, or compensation.
+
+This lets the maintainer keep the project open source today while preserving the option
+to offer it (or a derivative) under different terms in the future. If you do not agree
+to these terms, please do not submit a contribution.
+
+> These terms are a plain-language license grant, not legal advice. For anything
+> significant, consult a lawyer.

SECURITY.md

@@ -0,0 +1,27 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please **do not** open a public issue for security problems.
+
+Report privately through GitHub's **"Report a vulnerability"** button under the
+repository's **Security** tab
+([Security Advisories](https://github.com/TN019/scripto/security/advisories/new)).
+Include what you found, how to reproduce it, and the potential impact. You'll get a
+response as soon as reasonably possible.
+
+## Scope
+
+Scripto runs entirely on your own machine and performs no network calls of its own
+beyond:
+
+- downloading Whisper models from Hugging Face (only when you choose to download one), and
+- talking to a **local** Ollama instance for translation (only when you enable it).
+
+It uploads nothing and opens no listening ports. The most relevant security surface is
+therefore local: handling of file paths, subprocess invocation (`ffmpeg`), and the
+files Scripto reads and writes. Reports in these areas are especially welcome.
+
+## Supported versions
+
+Fixes land on `main` and in the latest release. There is no long-term support branch.