Source-available health: CI, CONTRIBUTING, SECURITY

.github/workflows/ci.yml

@@ -0,0 +1,48 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  swift:
+    name: Swift tests (ShiftlyKit)
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Select latest Xcode
+        # Swift Testing (`import Testing`) ships with Xcode 16+; pick the
+        # newest Xcode installed on the runner.
+        run: sudo xcode-select -s "$(ls -d /Applications/Xcode*.app | sort -V | tail -1)/Contents/Developer"
+      - name: swift test
+        working-directory: ShiftlyApp
+        run: swift test
+
+  python-core:
+    name: Python schedule core
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Run core tests
+        # Pure stdlib — no dependencies to install.
+        run: python scripts/test_schedule_core.py
+
+  mcp-server:
+    name: MCP server
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: packages/mcp-server
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+      - name: Install
+        run: npm ci
+      - name: Syntax check
+        run: node --check index.js

CONTRIBUTING.md

@@ -0,0 +1,60 @@
+# Contributing to Shiftly
+
+Thanks for your interest in Shiftly! Bug reports, fixes, features, and docs are welcome.
+
+> 中文读者：贡献前请阅读下方「Contribution terms」一节。为保证再许可条款在法律上明确，该节以英文为准。
+
+## Project layout
+
+- `ShiftlyApp/` — the native macOS app (Swift Package: `ShiftlyKit` domain core + `ShiftlyApp` / `shiftly` executables + tests)
+- `scripts/` — the Python schedule/pay engine the app drives
+- `packages/mcp-server/` — the MCP server (Node)
+
+## Getting started
+
+```bash
+git clone https://github.com/TN019/shiftly.git && cd shiftly
+
+# Swift core (needs Xcode 16+ for the Testing framework)
+cd ShiftlyApp && swift test && cd ..
+
+# Python engine (stdlib only)
+python scripts/test_schedule_core.py
+```
+
+See [docs/SETUP.md](docs/SETUP.md) for building and running the app. Keep the test
+suites green and add tests for behavior you change; `ShiftlyKit` stays free of
+SwiftUI/AppKit so the core and CLI can reuse it.
+
+## Reporting bugs
+
+Open an issue with what you did, what you expected, what happened, and your macOS version.
+
+## Contribution terms (please read)
+
+Shiftly is released under the **PolyForm Noncommercial License 1.0.0** — free for
+noncommercial use; commercial use requires a separate license from the author.
+
+By submitting a contribution (a pull request, patch, or any other material) to this
+project, you represent and agree that:
+
+1. **You have the right to submit it.** The contribution is your own original work, or
+   you otherwise have the right to submit it under these terms.
+
+2. **License to the project and its users.** You license your contribution under the
+   project's current license (PolyForm Noncommercial 1.0.0) to the project and to
+   everyone who receives it.
+
+3. **Relicensing grant to the author.** You additionally grant the project's author /
+   maintainer a perpetual, worldwide, non-exclusive, royalty-free, irrevocable right to
+   use, reproduce, modify, prepare derivative works of, sublicense, and **relicense**
+   your contribution under any license terms — including **commercial or proprietary**
+   terms — as part of this project or any derivative of it, without further notice,
+   permission, or compensation.
+
+This keeps the source available today while preserving the author's ability to offer
+Shiftly (or a derivative) commercially in the future. If you do not agree to these
+terms, please do not submit a contribution.
+
+> These terms are a plain-language license grant, not legal advice. For anything
+> significant, consult a lawyer.

README.md

@@ -6,10 +6,7 @@
 
 **Your shifts, your pay, your work journal — living right inside Apple Calendar.**
 
-[![macOS](https://img.shields.io/badge/macOS-13%2B-blue)](docs/SETUP.md)
-[![Swift](https://img.shields.io/badge/Swift-5.9-orange)](docs/SETUP.md)
-[![License](https://img.shields.io/badge/license-PolyForm%20NC-lightgrey)](LICENSE)
-[![Release](https://img.shields.io/badge/release-v0.7.0-brightgreen)](https://github.com/TN019/shiftly/releases)
+💻 macOS 13+  ·  🦉 Swift 5.9  ·  📄 [PolyForm NC](LICENSE)  ·  🏷️ [Releases](https://github.com/TN019/shiftly/releases/latest)
 
 [English](README.md) · [简体中文](README.zh-Hans.md)
 

README.zh-Hans.md

@@ -6,10 +6,7 @@
 
 **排班、工资、工作日志——都住进你的 Apple 日历。**
 
-[![macOS](https://img.shields.io/badge/macOS-13%2B-blue)](docs/SETUP.md)
-[![Swift](https://img.shields.io/badge/Swift-5.9-orange)](docs/SETUP.md)
-[![License](https://img.shields.io/badge/license-PolyForm%20NC-lightgrey)](LICENSE)
-[![Release](https://img.shields.io/badge/release-v0.7.0-brightgreen)](https://github.com/TN019/shiftly/releases)
+💻 macOS 13+  ·  🦉 Swift 5.9  ·  📄 [PolyForm NC](LICENSE)  ·  🏷️ [发布版本](https://github.com/TN019/shiftly/releases/latest)
 
 [English](README.md) · [简体中文](README.zh-Hans.md)
 

SECURITY.md

@@ -0,0 +1,28 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please **do not** open a public issue for security problems.
+
+Report privately through GitHub's **"Report a vulnerability"** button under the
+repository's **Security** tab
+([Security Advisories](https://github.com/TN019/shiftly/security/advisories/new)).
+Include what you found, how to reproduce it, and the potential impact. You'll get a
+response as soon as reasonably possible.
+
+## Scope
+
+Shiftly runs entirely on your own Mac and makes no network calls of its own. The
+relevant security surface is local:
+
+- **Apple Calendar access** via EventKit (events Shiftly reads and writes),
+- **local data files** it reads and writes, and
+- the **schedule/pay scripts** it runs as subprocesses.
+
+Reports about calendar-data handling, file handling, or subprocess/script execution
+are especially welcome. The optional MCP server (`packages/mcp-server`) exposes Shiftly
+data to local AI tooling — issues there are in scope too.
+
+## Supported versions
+
+Fixes land on `main` and in the latest release. There is no long-term support branch.