@githonllc/avouch 0.1.2 → 0.1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +9 -3
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -129,10 +129,12 @@ claude plugin install avouch@avouch
|
|
|
129
129
|
Inside a Claude Code session, the same two steps are `/plugin marketplace add githonllc/avouch` and `/plugin install avouch@avouch`.
|
|
130
130
|
|
|
131
131
|
The plugin has two skills:
|
|
132
|
-
- `avouch
|
|
133
|
-
- `
|
|
132
|
+
- `cli` (`/avouch:cli`): checks an ontology and runs `avouch query`.
|
|
133
|
+
- `scan` (`/avouch:scan [project-dir]`): drafts or updates a project's ontology from its design documents. The result is a candidate. `avouch check` must exit 0, and each source gap is listed with a proposed fix to the document.
|
|
134
134
|
|
|
135
|
-
|
|
135
|
+
Before 0.1.3 the two skills were named `avouch-cli` and `aquery-scan`.
|
|
136
|
+
|
|
137
|
+
The skills run the CLI with `npx -y @githonllc/avouch@<version>`, pinned to the version of this repository. Set `AVOUCH_CLI` to a built `dist/cli/avouch.js` to use a local build instead. The `prepare` script builds `dist/` when npm installs the package from git (`npx -y github:githonllc/avouch`). `skills/scan/fixture/` is the test project for the skill.
|
|
136
138
|
|
|
137
139
|
## Publishing
|
|
138
140
|
|
|
@@ -149,6 +151,10 @@ A release needs the explicit approval of the project owner. Releases are publish
|
|
|
149
151
|
|
|
150
152
|
Version 0.1.0 was published by hand, because npm accepts a trusted publisher only for a package that exists.
|
|
151
153
|
|
|
154
|
+
CI and the release workflow run `scripts/scan-private.mjs`. It scans the path and text of each tracked file, and the commit messages of a pull request, for private content: local paths, tokens, private keys, and the patterns in the repository secret `PRIVATE_PATTERNS`. A hit shows only the file and line (or commit) and a pattern label, never the text. Pull requests from forks do not get the secret, so they run with the built-in patterns only. Pushes to `main`, pull requests from this repository and releases fail if the secret is missing.
|
|
155
|
+
|
|
156
|
+
The secret is generated from a list kept in a private repository; maintainers never edit it by hand. After the list changes, a maintainer runs the generator, which prints a pattern count and a sha256 fingerprint, and re-sets the secret with `gh secret set PRIVATE_PATTERNS`. The scan prints `PRIVATE_PATTERNS: <n> patterns, sha256 <12 hex>` for the patterns it loaded (comment lines dropped, pattern lines joined by `\n`); the next CI run on `main` must show the same count and fingerprint as the generator.
|
|
157
|
+
|
|
152
158
|
## Versions and identifiers
|
|
153
159
|
|
|
154
160
|
The ontology file has `formatVersion: 1`. The schema `$id` is `https://w3id.org/avouch/v1/schema.json`. The version rules are in SPEC section 8.
|