unisender-ruby 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5816a7b213b4919d38f81de3568187d4dd1a2f345413b529f3961c2fad33f187
-  data.tar.gz: 0c0dcea4ad0cb5f1e4a2f5d2a502562ff68d3edebe1fdc04c3c7e95675fc4a9f
+  metadata.gz: d06d19534449d52a259839973e260a8cd7e11cbc50c8136bf963b47c06f86624
+  data.tar.gz: b0de90f56f2838c27f6a1b3eea28654d45209cc4e3446b6f401ce6f31f005d35
 SHA512:
-  metadata.gz: 2d6e970aa069fb618f59335fc935ec897f4513af963ab60728c8379072a88bdf06eb08103e7b67a942d283e3e0b308c3a546aa91e26d0a26ee8c1089a158789b
-  data.tar.gz: '09e933af3af43cd61bb7c03a9a8c852813b24f22c766e4d1446008c1bddadb4c2d24d964a919272f489ab78c78ea73e40f5e598bb24570164b3f57b342f1b474'
+  metadata.gz: 44c26c949db6f70ef169a21b2e2c523640cb3ead8d4b551aa6412dea828bf3bee6c874e162b3cfb3292534721d14b4d1ec114bfd58c4433a07e99f5e496dddbd
+  data.tar.gz: 5d554001273bfd9562c6968fcffe3f1b98c6706093dae5bcfee8f890ad08fb75486cafb418956776c976af581c41ddd8cb7f9f4c2ae29502e17624923c468816

data/CHANGELOG.md

@@ -1,7 +1,15 @@
 # Changelog
 
+Unreleased collects changes for the next version. Dated sections list user-visible changes, newest first. GitHub release notes reproduce the corresponding section.
+
 ## Unreleased
 
+## 0.1.1 - 2026-10-25
+
+- Clarify installation, example destinations, contribution guidance, and maintainer policies.
+- Include security, conduct, and release verification documents in the gem.
+- Publish signed releases through an approval-gated workflow with an exact-file SPDX inventory and verifiable release assets.
+
 ## 0.1.0 - 2026-10-25
 
 - Publish as `unisender-ruby`; load with `require "unisender"` and use the `Unisender` namespace.

data/CODE_OF_CONDUCT.md

@@ -0,0 +1,90 @@
+
+# Contributor Covenant 3.0 Code of Conduct
+
+## Our Pledge
+
+We pledge to make our community welcoming, safe, and equitable for all.
+
+We are committed to fostering an environment that respects and promotes the dignity, rights, and contributions of all individuals, regardless of characteristics including race, ethnicity, caste, color, age, physical characteristics, neurodiversity, disability, sex or gender, gender identity or expression, sexual orientation, language, philosophy or religion, national or social origin, socio-economic position, level of education, or other status. The same privileges of participation are extended to everyone who participates in good faith and in accordance with this Covenant.
+
+
+## Encouraged Behaviors
+
+While acknowledging differences in social norms, we all strive to meet our community's expectations for positive behavior. We also understand that our words and actions may be interpreted differently than we intend based on culture, background, or native language.
+
+With these considerations in mind, we agree to behave mindfully toward each other and act in ways that center our shared values, including:
+
+1. Respecting the **purpose of our community**, our activities, and our ways of gathering.
+2. Engaging **kindly and honestly** with others.
+3. Respecting **different viewpoints** and experiences.
+4. **Taking responsibility** for our actions and contributions.
+5. Gracefully giving and accepting **constructive feedback**.
+6. Committing to **repairing harm** when it occurs.
+7. Behaving in other ways that promote and sustain the **well-being of our community**.
+
+
+## Restricted Behaviors
+
+We agree to restrict the following behaviors in our community. Instances, threats, and promotion of these behaviors are violations of this Code of Conduct.
+
+1. **Harassment.** Violating explicitly expressed boundaries or engaging in unnecessary personal attention after any clear request to stop.
+2. **Character attacks.** Making insulting, demeaning, or pejorative comments directed at a community member or group of people.
+3. **Stereotyping or discrimination.** Characterizing anyone’s personality or behavior on the basis of immutable identities or traits.
+4. **Sexualization.** Behaving in a way that would generally be considered inappropriately intimate in the context or purpose of the community.
+5. **Violating confidentiality**. Sharing or acting on someone's personal or private information without their permission.
+6. **Endangerment.** Causing, encouraging, or threatening violence or other harm toward any person or group.
+7. Behaving in other ways that **threaten the well-being** of our community.
+
+### Other Restrictions
+
+1. **Misleading identity.** Impersonating someone else for any reason, or pretending to be someone else to evade enforcement actions.
+2. **Failing to credit sources.** Not properly crediting the sources of content you contribute.
+3. **Promotional materials**. Sharing marketing or other commercial content in a way that is outside the norms of the community.
+4. **Irresponsible communication.** Failing to responsibly present content which includes, links or describes any other restricted behaviors.
+
+
+## Reporting an Issue
+
+Tensions can occur between community members even when they are trying their best to collaborate. Not every conflict represents a code of conduct violation, and this Code of Conduct reinforces encouraged behaviors and norms that can help avoid conflicts and minimize harm.
+
+When an incident does occur, it is important to report it promptly. To report a possible violation, email [Leonid Svyatov](mailto:leonid@svyatov.com). Leonid moderates this community and will respond within seven days.
+
+Community Moderators take reports of violations seriously and will make every effort to respond in a timely manner. They will investigate all reports of code of conduct violations, reviewing messages, logs, and recordings, or interviewing witnesses and other participants. Community Moderators will keep investigation and enforcement actions as transparent as possible while prioritizing safety and confidentiality. In order to honor these values, enforcement actions are carried out in private with the involved parties, but communicating to the whole community may be part of a mutually agreed upon resolution.
+
+
+## Addressing and Repairing Harm
+
+If an investigation by the Community Moderators finds that this Code of Conduct has been violated, the following enforcement ladder may be used to determine how best to repair harm, based on the incident's impact on the individuals involved and the community as a whole. Depending on the severity of a violation, lower rungs on the ladder may be skipped.
+
+1) Warning
+   1) Event: A violation involving a single incident or series of incidents.
+   2) Consequence: A private, written warning from the Community Moderators.
+   3) Repair: Examples of repair include a private written apology, acknowledgement of responsibility, and seeking clarification on expectations.
+2) Temporarily Limited Activities
+   1) Event: A repeated incidence of a violation that previously resulted in a warning, or the first incidence of a more serious violation.
+   2) Consequence: A private, written warning with a time-limited cooldown period designed to underscore the seriousness of the situation and give the community members involved time to process the incident. The cooldown period may be limited to particular communication channels or interactions with particular community members.
+   3) Repair: Examples of repair may include making an apology, using the cooldown period to reflect on actions and impact, and being thoughtful about re-entering community spaces after the period is over.
+3) Temporary Suspension
+   1) Event: A pattern of repeated violation which the Community Moderators have tried to address with warnings, or a single serious violation.
+   2) Consequence: A private written warning with conditions for return from suspension. In general, temporary suspensions give the person being suspended time to reflect upon their behavior and possible corrective actions.
+   3) Repair: Examples of repair include respecting the spirit of the suspension, meeting the specified conditions for return, and being thoughtful about how to reintegrate with the community when the suspension is lifted.
+4) Permanent Ban
+   1) Event: A pattern of repeated code of conduct violations that other steps on the ladder have failed to resolve, or a violation so serious that the Community Moderators determine there is no way to keep the community safe with this person as a member.
+   2) Consequence: Access to all community spaces, tools, and communication channels is removed. In general, permanent bans should be rarely used, should have strong reasoning behind them, and should only be resorted to if working through other remedies has failed to change the behavior.
+   3) Repair: There is no possible repair in cases of this severity.
+
+This enforcement ladder is intended as a guideline. It does not limit the ability of Community Managers to use their discretion and judgment, in keeping with the best interests of our community.
+
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public or other spaces. Examples of representing our community include using an official email address, posting via an official social media account, or acting as an appointed representative at an online or offline event.
+
+
+## Attribution
+
+This Code of Conduct is adapted from the Contributor Covenant, version 3.0, permanently available at [https://www.contributor-covenant.org/version/3/0/](https://www.contributor-covenant.org/version/3/0/).
+
+Contributor Covenant is stewarded by the Organization for Ethical Source and licensed under CC BY-SA 4.0. To view a copy of this license, visit [https://creativecommons.org/licenses/by-sa/4.0/](https://creativecommons.org/licenses/by-sa/4.0/)
+
+For answers to common questions about Contributor Covenant, see the FAQ at [https://www.contributor-covenant.org/faq](https://www.contributor-covenant.org/faq). Translations are provided at [https://www.contributor-covenant.org/translations](https://www.contributor-covenant.org/translations). Additional enforcement and community guideline resources can be found at [https://www.contributor-covenant.org/resources](https://www.contributor-covenant.org/resources). The enforcement ladder was inspired by the work of [Mozilla’s code of conduct team](https://github.com/mozilla/inclusion).

data/CONTRIBUTING.md

@@ -1,6 +1,6 @@
 # Contributing
 
-This repository is private. Collaborators can use the [issue tracker](https://github.com/svyatov/unisender-ruby/issues). Include the Ruby and gem versions, a minimal example with fake values, expected behavior, and a redacted exception message. Do not post API keys, contact data, export links, or raw request/response bodies.
+Contributions and questions are welcome through the [issue tracker](https://github.com/svyatov/unisender-ruby/issues). Include the Ruby and gem versions, a minimal example with fake values, expected behavior, and a redacted exception message. Do not post API keys, contact data, export links, or raw request/response bodies.
 
 ## Set up
 
@@ -13,10 +13,16 @@ bundle exec rake check
 
 `bin/setup` installs development dependencies and Lefthook hooks. The complete check runs offline tests, RuboCop, RBS validation, Steep for the library and consumer examples, the dependency vulnerability audit, and the gem build. The audit updates its advisory database and needs network access.
 
+CI runs `bundle exec rake ci` for lint, tests, types, and the build. Dependency review blocks newly introduced vulnerabilities. A separate advisory job reports vulnerabilities across the lockfile without blocking unrelated changes.
+
 ## Make a change
 
 Use a branch such as `fix/error-context` or `feat/new-operation`. Read the official UniSender method documentation before changing a wire contract. Add a regression test with a deterministic transport, keep signatures in `sig/` synchronized, update the relevant docs, and add an entry under Unreleased in [CHANGELOG.md](CHANGELOG.md).
 
+Follow the repository requirements in [AGENTS.md](AGENTS.md) and the [code of conduct](CODE_OF_CONDUCT.md). New functionality must include tests.
+
+Fork the repository and create your branch from `main`. Push the branch to your fork, then open a pull request against `svyatov/unisender-ruby:main`. Describe the affected public interface and include the evidence needed to assess the change. Keep unrelated changes in separate pull requests. Maintainers use squash merges.
+
 | Command | Purpose |
 | --- | --- |
 | `bundle exec rake test` | Minitest with 100% line and branch coverage across `lib/` and `scripts/` |
@@ -35,9 +41,15 @@ Pre-commit hooks scan staged changes for secrets, apply and stage safe Ruby form
 
 ```sh
 bundle exec rake build
-gem install --local ./pkg/unisender-ruby-0.1.0.gem
+gem install --local ./pkg/unisender-ruby-0.1.1.gem
 ```
 
 From outside the checkout, run `ruby -runisender -e 'puts Unisender::VERSION'`. For an isolated check, use a temporary `GEM_HOME` and `GEM_PATH`, and run the examples with a fake transport. The gem includes examples and RBS signatures; development dependencies are not runtime dependencies.
 
 Routine verification must not call a live account, send messages, or change contacts. Live checks require explicit authorization and a designated test account. Publishing and releases are separate maintainer actions.
+
+## Maintainer decisions
+
+Leonid Svyatov is the sole maintainer and decides which changes merge and which versions are released. No successor is arranged if he stops maintaining the project.
+
+Report vulnerabilities privately using [SECURITY.md](SECURITY.md).

data/README.md

@@ -1,18 +1,39 @@
 # Unisender
 
-A Ruby client for the [UniSender marketing API](https://www.unisender.com/ru/support/category/api/). Ruby 3.3 or newer, no runtime gem dependencies. This client targets `api.unisender.com`, not UniSender Go.
+A Ruby client for applications using the [UniSender marketing API](https://www.unisender.com/ru/support/category/api/).
+
+Ruby 3.3 or newer, no runtime gem dependencies. This client targets `api.unisender.com`, not UniSender Go.
 
 Explicit keyword methods cover contacts, lists, messages, campaigns, statistics, templates, fields, notes, and Event Tracking. Responses preserve upstream JSON, warnings, and HTTP metadata. See the [API reference](docs/api.md) for the operation index, argument types, and result shapes.
 
 ## Install
 
-Add the gem to your application's Gemfile:
+Install the gem:
+
+```sh
+gem install unisender-ruby
+```
+
+Save this read-only example as `quickstart.rb`. It uses the key in `UNISENDER_API_KEY`:
+
+<!-- example: examples/quickstart.rb -->
+```ruby
+require "unisender"
+
+client = Unisender::Client.new(api_key: ENV.fetch("UNISENDER_API_KEY"))
+client.get_lists.result.each { |list| puts list.fetch("title") }
+# Example output for a list named News: News
+```
+
+Run `ruby quickstart.rb`. It prints one title per list, or nothing if the account has no lists. See [Make your first request](#make-your-first-request) for key setup.
+
+For a Bundler project, add the gem to your application's Gemfile:
 
 ```ruby
-gem "unisender-ruby", "~> 0.1.0", require: "unisender"
+gem "unisender-ruby", "~> 0.1.1", require: "unisender"
 ```
 
-Then run `bundle install`. To install it directly, run `gem install unisender-ruby`. The package is named `unisender-ruby`; load it with `require "unisender"`.
+Then run `bundle install`. The package is named `unisender-ruby`; load it with `require "unisender"`.
 
 ### Install from a checkout
 
@@ -39,22 +60,14 @@ bundle exec ruby examples/check_connection.rb
 
 The check prints only the HTTP status and list count, including zero for an empty account. Failures exit with status 1. It does not print list names or IDs. The gem itself reads neither environment variables nor `.env`; application code passes the key explicitly.
 
-This example only reads your lists. It does not create contacts or send messages:
-
-<!-- example: examples/quickstart.rb -->
-```ruby
-require "unisender"
-
-client = Unisender::Client.new(api_key: ENV.fetch("UNISENDER_API_KEY"))
-client.get_lists.result.each { |list| puts list.fetch("title") }
-```
-
-Save it as `quickstart.rb` and run `bundle exec ruby quickstart.rb`. It prints one title per list, or nothing if the account has no lists. A missing environment variable raises `KeyError` before any request. To try the client without an account or network access, run `bundle exec ruby examples/offline.rb` from this checkout.
+The `quickstart.rb` example above only reads lists. It does not create contacts or send messages. In a Bundler project, run it with `bundle exec ruby quickstart.rb`. A missing environment variable raises `KeyError` before any request. To try the client without an account or network access, run `bundle exec ruby examples/offline.rb` from this checkout.
 
 ## Subscribe a contact
 
 This operation changes your account and normally **sends a confirmation email**. Use an existing list ID from `get_lists`, and an address you control for a manual trial. Set `UNISENDER_LIST_ID` and `UNISENDER_CONTACT_EMAIL` before running it.
 
+Save the following example as `subscribe.rb`:
+
 <!-- example: examples/subscribe.rb -->
 ```ruby
 require "unisender"
@@ -90,6 +103,8 @@ Every operation returns `Unisender::Response`: `result`, `warnings`, `data` (the
 
 Named methods use snake_case and reject unknown keywords. Optional `nil` values are omitted, preserving server defaults. API messages default to English; use `Client.new(api_key: ..., language: :ru)` for Russian. Message-level `lang:` is a separate setting.
 
+Use this error handler in your application's `request.rb`:
+
 ```ruby
 begin
   client.get_lists
@@ -113,6 +128,8 @@ A successful envelope does not mean every recipient succeeded. Inspect `send_ema
 
 ## Timeouts, retries, and pagination
 
+In `quickstart.rb`, replace the client construction with:
+
 ```ruby
 client = Unisender::Client.new(
   api_key: ENV.fetch("UNISENDER_API_KEY"),
@@ -135,6 +152,9 @@ RBS signatures ship with the gem. `Response[Result]` describes a named operation
 
 - [Contributing, local checks, and package verification](CONTRIBUTING.md)
 - [Changes and compatibility policy](CHANGELOG.md)
+- [Release verification](docs/releases.md)
 - [Source repository](https://github.com/svyatov/unisender-ruby) and [issue reports](https://github.com/svyatov/unisender-ruby/issues)
 
-The repository is currently private; its GitHub links require access. Tests use fake credentials and deterministic responses. They do not establish compatibility with a live account. Released under the [MIT License](LICENSE.txt).
+This project is maintained by Leonid Svyatov. Use the public [issue tracker](https://github.com/svyatov/unisender-ruby/issues) for questions and defect reports. Report vulnerabilities privately through [SECURITY.md](SECURITY.md).
+
+Tests use fake credentials and deterministic responses. They do not establish compatibility with a live account. Released under the [MIT License](LICENSE.txt).

data/SECURITY.md

@@ -0,0 +1,13 @@
+# Security policy
+
+## Supported versions
+
+Security fixes target the latest published release. Upgrade to that release before reporting a problem when possible.
+
+## Report a vulnerability
+
+Email [Leonid Svyatov](mailto:leonid@svyatov.com) privately. Expect an initial response within seven days.
+
+Include the affected gem and Ruby versions, the security impact, and a minimal reproduction using fake credentials and contact data. Do not include live API keys, recipient data, or account exports. Do not disclose the vulnerability in a public issue before a fix or coordinated disclosure date is agreed.
+
+The maintainer will assess the report and coordinate a fix and disclosure with you.

data/docs/releases.md

@@ -0,0 +1,22 @@
+# Release verification
+
+Version tags trigger `.github/workflows/release.yml`. Tests run before the build. The `release` environment requires maintainer approval before publication.
+
+The workflow publishes through RubyGems trusted publishing. Its signing client is isolated in `.github/release/Gemfile.lock`. Runtime dependencies are defined only by `unisender.gemspec`.
+
+Starting with 0.1.1, GitHub releases include the gem, an SPDX inventory of its packaged files, and SHA-256 checksums. The workflow attests all three assets. The inventory generator stops if runtime dependencies need additional inventory support.
+
+Download and verify a release in your terminal:
+
+```sh
+gh release download v0.1.1 --repo svyatov/unisender-ruby --dir release
+cd release
+gh attestation verify unisender-ruby.gem --repo svyatov/unisender-ruby --signer-workflow svyatov/unisender-ruby/.github/workflows/release.yml --source-ref refs/tags/v0.1.1
+gh attestation verify sbom.spdx.json --repo svyatov/unisender-ruby --signer-workflow svyatov/unisender-ruby/.github/workflows/release.yml --source-ref refs/tags/v0.1.1
+gh attestation verify SHA256SUMS --repo svyatov/unisender-ruby --signer-workflow svyatov/unisender-ruby/.github/workflows/release.yml --source-ref refs/tags/v0.1.1
+shasum -a 256 -c SHA256SUMS
+```
+
+RubyGems also serves the signing bundle for each published gem through its [attestation API](https://guides.rubygems.org/rubygems-org-api/#get---apiv1attestationsgem-name-versionjson). Compare the bundle with the exact gem version and the `release.yml` workflow identity.
+
+The 0.1.0 tag and assets predate this workflow and remain unchanged. Its release notes follow the complete 0.1.0 changelog section.

data/examples/quickstart.rb

@@ -4,3 +4,4 @@ require "unisender"
 
 client = Unisender::Client.new(api_key: ENV.fetch("UNISENDER_API_KEY"))
 client.get_lists.result.each { |list| puts list.fetch("title") }
+# Example output for a list named News: News

data/lib/unisender/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Unisender
-  VERSION = "0.1.0"
+  VERSION = "0.1.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: unisender-ruby
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Leonid Svyatov
@@ -17,10 +17,13 @@ extensions: []
 extra_rdoc_files: []
 files:
 - CHANGELOG.md
+- CODE_OF_CONDUCT.md
 - CONTRIBUTING.md
 - LICENSE.txt
 - README.md
+- SECURITY.md
 - docs/api.md
+- docs/releases.md
 - examples/campaign.rb
 - examples/check_connection.rb
 - examples/events.rb
@@ -81,7 +84,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.23
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Ruby client for the UniSender API.
 test_files: []