dsh-hazplan-check 0.2.1 → 0.2.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +29 -0
- package/SECURITY.md +39 -0
- package/package.json +5 -3
package/CHANGELOG.md
ADDED
|
@@ -0,0 +1,29 @@
|
|
|
1
|
+
# Changelog
|
|
2
|
+
|
|
3
|
+
## 0.2.2
|
|
4
|
+
|
|
5
|
+
- Ship `CHANGELOG.md` and `SECURITY.md` inside the package. `files` is an
|
|
6
|
+
allowlist and neither was on it, so no release note had ever reached anyone
|
|
7
|
+
who installed this package, and npm had no changelog section to show.
|
|
8
|
+
## 0.2.1
|
|
9
|
+
|
|
10
|
+
- Citation pass: every `excerpt` was checked against this repository's own
|
|
11
|
+
`rules/evidence/` record, and the record was completed for the clauses the
|
|
12
|
+
rules quote.
|
|
13
|
+
- The source moved from a commercial document site to the national standards platform record for AQ/T 3049—2013, with its authoritative version facts.
|
|
14
|
+
- Adds `rules/citations-baseline.json`, which the `check:citations` gate reads:
|
|
15
|
+
it lists any excerpt not yet traceable to the evidence, and that list can
|
|
16
|
+
only shrink.
|
|
17
|
+
## 0.2.0
|
|
18
|
+
|
|
19
|
+
- Release infrastructure brought to the family standard: `verify:self-contained`,
|
|
20
|
+
`check:lockfile`, `check:readmes` and `check:citations` gates, a `prepublishOnly` that
|
|
21
|
+
re-runs the whole chain, SECURITY.md, dependabot, and the OpenSSF Scorecard workflow.
|
|
22
|
+
- `check:citations` enforces the rule this pack's own header states: every `excerpt`
|
|
23
|
+
must be a verbatim quotation, findable in `rules/evidence/`. Rules that are not
|
|
24
|
+
traceable yet are listed in `rules/citations-baseline.json`, and that file can only
|
|
25
|
+
shrink - anything new has to be sourced before it can land.
|
|
26
|
+
- The README install command now names the published package instead of a local tarball.
|
|
27
|
+
- Five-language READMEs hold the same section count and the same configuration keys.
|
|
28
|
+
- Rule pack: 7 rules across HZ-001..HZ-007.
|
|
29
|
+
- Licensed Apache-2.0.
|
package/SECURITY.md
ADDED
|
@@ -0,0 +1,39 @@
|
|
|
1
|
+
# Security Policy
|
|
2
|
+
|
|
3
|
+
## Reporting a vulnerability
|
|
4
|
+
|
|
5
|
+
Please report security vulnerabilities **privately** through GitHub's private
|
|
6
|
+
vulnerability reporting:
|
|
7
|
+
|
|
8
|
+
**Security → Report a vulnerability** at
|
|
9
|
+
https://github.com/PerryLink/dsh-hazplan-check/security/advisories/new
|
|
10
|
+
|
|
11
|
+
Do **not** open a public issue for security findings.
|
|
12
|
+
|
|
13
|
+
Before reporting, **sanitize everything you paste**: remove tokens, API keys,
|
|
14
|
+
credentials, authorization headers, session contents, and personal data. Logs
|
|
15
|
+
without secrets only.
|
|
16
|
+
|
|
17
|
+
## Scope note
|
|
18
|
+
|
|
19
|
+
This plugin is an offline checker. It reads the material you hand it and
|
|
20
|
+
compares it against a versioned rule pack; it makes no network calls and no
|
|
21
|
+
model calls, and it stores nothing.
|
|
22
|
+
|
|
23
|
+
## What to include
|
|
24
|
+
|
|
25
|
+
- affected package version (and DeepSeek Harness runtime version)
|
|
26
|
+
- a minimal reproduction
|
|
27
|
+
- your impact assessment
|
|
28
|
+
|
|
29
|
+
## Response expectations
|
|
30
|
+
|
|
31
|
+
- acknowledgement within **7 days**
|
|
32
|
+
- status updates at least every **14 days** until resolution
|
|
33
|
+
- coordinated disclosure: the fix and advisory are prepared first; the finding
|
|
34
|
+
is disclosed publicly after the fix ships
|
|
35
|
+
|
|
36
|
+
## Credits and disclosure
|
|
37
|
+
|
|
38
|
+
- reporters are credited in the advisory and CHANGELOG unless they ask to stay anonymous
|
|
39
|
+
- advisories follow GitHub's advisory workflow and are published together with the fix
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "dsh-hazplan-check",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.2",
|
|
4
4
|
"description": "HAZOP 分析表要素齐备性与偏差推导一致性核对（依据公开的危险与可操作性分析标准，仅提示差异，不作出定性结论）",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "lib/index.mjs",
|
|
@@ -23,7 +23,9 @@
|
|
|
23
23
|
"README-hi.md",
|
|
24
24
|
"locale/*.json",
|
|
25
25
|
"icon.svg",
|
|
26
|
-
"rules"
|
|
26
|
+
"rules",
|
|
27
|
+
"CHANGELOG.md",
|
|
28
|
+
"SECURITY.md"
|
|
27
29
|
],
|
|
28
30
|
"scripts": {
|
|
29
31
|
"build": "tsdown",
|
|
@@ -32,7 +34,7 @@
|
|
|
32
34
|
"verify:self-contained": "node scripts/verify-self-contained.mjs",
|
|
33
35
|
"check:lockfile": "node scripts/check-lockfile-drift.mjs",
|
|
34
36
|
"check:readmes": "node scripts/check-readme-sync.mjs",
|
|
35
|
-
"prepublishOnly": "pnpm run typecheck && pnpm test && pnpm run build && pnpm run verify:self-contained && pnpm run check:readmes && pnpm run check:citations",
|
|
37
|
+
"prepublishOnly": "pnpm run typecheck && pnpm test && pnpm run build && pnpm run verify:self-contained && pnpm run check:lockfile && pnpm run check:readmes && pnpm run check:citations",
|
|
36
38
|
"prepare": "tsdown",
|
|
37
39
|
"check:citations": "node scripts/check-citations.mjs"
|
|
38
40
|
},
|