repo-audit-tool 1.2.0

package/rules/categories/archive.yaml

@@ -0,0 +1,48 @@
+rules:
+  - id: SEC-001
+    title: "无硬编码密钥/凭证"
+    severity: critical
+    domain: security
+    applies_to: ["archive"]
+    check: grep
+    params:
+      patterns:
+        - "(?i)(password|secret|api.?key|token|credential)\\s*[=:]\s*['\"]?[^\\s'\"]{8,}"
+      exclude:
+        - ".git/"
+        - "node_modules/"
+        - ".scaffold/"
+        - "audit-report/"
+        - "templates/"
+        - "CHANGELOG.md"
+        - "HANDOFF.md"
+        - "HANDOFF-ARCHIVE/"
+        - ".agents/"
+      max_match: 0
+    description: "归档仓仍不应含硬编码密钥（安全底线，不因归档豁免）"
+    note: "归档仓仅保留安全/脱敏检查，其余工程规范不适用"
+
+  - id: SEC-003
+    title: "无本机绝对路径泄漏"
+    severity: minor
+    domain: security
+    applies_to: ["archive"]
+    check: grep
+    params:
+      patterns:
+        - "/home/[a-z]"
+        - "/Users/[a-z]"
+        - "/mnt/[a-z]"
+      exclude:
+        - ".git/"
+        - "node_modules/"
+        - ".scaffold/"
+        - "audit-report/"
+        - "templates/"
+        - "CHANGELOG.md"
+        - "HANDOFF.md"
+        - "HANDOFF-ARCHIVE/"
+        - ".agents/"
+      max_match: 0
+    description: "归档仓不应含本机绝对路径（脱敏底线）"
+    note: "severity=minor：描述性路径文本容忍"

package/rules/categories/content.yaml

@@ -0,0 +1,34 @@
+rules:
+  - id: CONTENT-001
+    title: "主文 Markdown 文件"
+    severity: minor
+    domain: docs
+    applies_to: ["content"]
+    check: glob_count
+    params:
+      pattern: "*.md"
+      min: 1
+    description: "内容仓库应至少有 1 个 Markdown 主文文件"
+
+  - id: CONTENT-002
+    title: "review 笔记分离结构"
+    severity: info
+    domain: docs
+    applies_to: ["content"]
+    check: file_exists
+    params:
+      paths: ["review.md", "revision-notes.md"]
+      anyOf: true
+    description: "内容仓库建议有 review.md 或 revision-notes.md（正文与评审分离）"
+    note: "推荐项，非硬性"
+
+  - id: CONTENT-003
+    title: "README 包含导航"
+    severity: minor
+    domain: docs
+    applies_to: ["content"]
+    check: file_contains
+    params:
+      path: "README.md"
+      patterns: ["# ", "## "]
+    description: "内容仓库 README 应包含标题结构"

package/rules/categories/dsh-plugin.yaml

@@ -0,0 +1,79 @@
+rules:
+  - id: DSH-001
+    title: "package.json 含 dsh 字段"
+    severity: critical
+    domain: dsh
+    applies_to: ["dsh-plugin"]
+    check: json_field
+    params:
+      path: "package.json"
+      field: "dsh"
+    description: "dsh 插件应在 package.json 中包含 dsh 字段（bundle.patch/client.inject/platform）"
+    template_ref: "templates/repo-root/package.json"
+
+  - id: DSH-002
+    title: "@deepseek-ai/dsh-session 依赖声明"
+    severity: major
+    domain: dsh
+    applies_to: ["dsh-plugin"]
+    check: json_field
+    params:
+      path: "package.json"
+      field: "peerDependencies.@deepseek-ai/dsh-session"
+      fallback_field: "devDependencies.@deepseek-ai/dsh-session"
+    description: "dsh 插件应声明 @deepseek-ai/dsh-session 依赖（peerDependencies 或 devDependencies 均可）"
+
+  - id: DSH-003
+    title: "src/ 目录存在"
+    severity: major
+    domain: dsh
+    applies_to: ["dsh-plugin"]
+    check: directory_exists
+    params:
+      path: "src"
+    description: "dsh 插件应有 src/ 目录（host TypeScript + client bundle 结构）"
+
+  - id: DSH-004
+    title: "publish workflow 存在"
+    severity: major
+    domain: dsh
+    applies_to: ["dsh-plugin"]
+    check: file_exists
+    params:
+      paths: [".github/workflows/publish.yml"]
+    description: "dsh 插件应有 publish workflow"
+    template_ref: "templates/repo-root/.github/workflows/publish.yml"
+
+  - id: DSH-005
+    title: "verify.mjs 存在"
+    severity: major
+    domain: dsh
+    applies_to: ["dsh-plugin"]
+    check: file_exists
+    params:
+      paths: ["verify.mjs", "scripts/verify.mjs"]
+      anyOf: true
+    template_ref: "templates/repo-root/scripts/verify.mjs"
+
+  - id: DSH-006
+    title: "build.mjs 存在"
+    severity: major
+    domain: dsh
+    applies_to: ["dsh-plugin"]
+    check: file_exists
+    params:
+      paths: ["scripts/build.mjs"]
+    description: "build 链需有 build.mjs 探测包装"
+    template_ref: "templates/repo-root/scripts/build.mjs"
+
+  - id: DSH-007
+    title: "CONTRIBUTING.md 含 pre-commit 纪律"
+    severity: minor
+    domain: dsh
+    applies_to: ["dsh-plugin"]
+    check: file_contains
+    params:
+      path: "CONTRIBUTING.md"
+      patterns: ["pre-commit", "verify"]
+    description: "dsh 插件 CONTRIBUTING.md 应提及 pre-commit 验证链"
+    template_ref: "templates/common/CONTRIBUTING-core.md"

package/rules/categories/go-service.yaml

@@ -0,0 +1,67 @@
+rules:
+  - id: GO-001
+    title: "go.mod 存在且含 module 声明"
+    severity: critical
+    domain: go
+    applies_to: ["go-service"]
+    check: file_exists
+    params:
+      paths: ["go.mod"]
+    description: "Go 服务应有 go.mod"
+
+  - id: GO-002
+    title: "cmd/ 目录结构"
+    severity: major
+    domain: go
+    applies_to: ["go-service"]
+    check: directory_exists
+    params:
+      path: "cmd"
+    description: "Go 服务应有 cmd/ 目录（含服务入口 main.go）"
+
+  - id: GO-003
+    title: "Makefile 含 build/test"
+    severity: major
+    domain: go
+    applies_to: ["go-service"]
+    check: file_contains
+    params:
+      path: "Makefile"
+      patterns: ["build:", "test:"]
+      anyOf: false
+    description: "Go 服务 Makefile 应有 build 和 test target（lint 为推荐项，见 GO-003b）"
+    template_ref: "templates/categories/go-service/Makefile"
+
+  - id: GO-003b
+    title: "Makefile 含 lint target"
+    severity: minor
+    domain: go
+    applies_to: ["go-service"]
+    check: file_contains
+    params:
+      path: "Makefile"
+      patterns: ["lint:"]
+    description: "Go 服务 Makefile 建议含 lint target（go vet / gofmt）"
+    note: "个人/单作者项目豁免"
+
+  - id: GO-004
+    title: "CI workflow（go test/go vet）"
+    severity: minor
+    domain: go
+    applies_to: ["go-service"]
+    check: file_exists
+    params:
+      paths: [".github/workflows/ci.yml"]
+    description: "Go 服务建议有 CI workflow（与 QUA-002 重复检查，降级为 minor）"
+    template_ref: "templates/categories/go-service/.github/workflows/ci.yml"
+    note: "个人/单作者项目豁免；多人协作项目建议配置"
+
+  - id: GO-005
+    title: "release workflow"
+    severity: minor
+    domain: go
+    applies_to: ["go-service"]
+    check: file_exists
+    params:
+      paths: [".github/workflows/release.yml"]
+    description: "Go 服务建议有 release workflow（goreleaser）"

package/rules/categories/product-oss.yaml

@@ -0,0 +1,75 @@
+rules:
+  - id: OSS-001
+    title: "CHANGELOG.md 存在"
+    severity: critical
+    domain: oss
+    applies_to: ["product-oss"]
+    check: file_exists
+    params:
+      paths: ["CHANGELOG.md"]
+    description: "产品 OSS 仓库必须有 CHANGELOG.md（Keep a Changelog 格式，overlay 标准）"
+    template_ref: "templates/categories/product-oss/CHANGELOG.md"
+
+  - id: OSS-002
+    title: "CODEOWNERS 存在"
+    severity: major
+    domain: oss
+    applies_to: ["product-oss"]
+    check: file_exists
+    params:
+      paths: [".github/CODEOWNERS"]
+    description: "多人协作仓库应有 CODEOWNERS 定义评审责任人"
+    template_ref: "templates/categories/product-oss/.github/CODEOWNERS"
+
+  - id: OSS-003
+    title: "dependabot 配置"
+    severity: major
+    domain: oss
+    applies_to: ["product-oss"]
+    check: file_exists
+    params:
+      paths: [".github/dependabot.yml"]
+    description: "产品 OSS 仓库应有 dependabot 自动升级配置"
+    template_ref: "templates/categories/product-oss/.github/dependabot.yml"
+
+  - id: OSS-004
+    title: "issue forms 配置"
+    severity: minor
+    domain: oss
+    applies_to: ["product-oss"]
+    check: file_exists
+    params:
+      paths: [".github/ISSUE_TEMPLATE/bug_report.yml"]
+    description: "产品 OSS 仓库建议配置 issue forms"
+
+  - id: OSS-005
+    title: "PR template 存在"
+    severity: minor
+    domain: oss
+    applies_to: ["product-oss"]
+    check: file_exists
+    params:
+      paths: [".github/PULL_REQUEST_TEMPLATE.md"]
+    description: "产品 OSS 仓库应有 PR template"
+    template_ref: "templates/categories/product-oss/PULL_REQUEST_TEMPLATE.md"
+
+  - id: OSS-006
+    title: "release-please 配置"
+    severity: major
+    domain: oss
+    applies_to: ["product-oss"]
+    check: file_exists
+    params:
+      paths: ["release-please-config.json"]
+    description: "产品 OSS 仓库应有 release-please 自动化发版配置"
+    template_ref: "templates/categories/product-oss/release-please-config.json"
+
+  - id: OSS-007
+    title: "SUPPORT.md 存在"
+    severity: minor
+    domain: oss
+    applies_to: ["product-oss"]
+    check: file_exists
+    params:
+      paths: ["SUPPORT.md"]
+    description: "产品 OSS 仓库应有 SUPPORT.md（协作流/发布节奏说明）"

package/rules/categories/python-app.yaml

@@ -0,0 +1,60 @@
+rules:
+  - id: PY-001
+    title: "pyproject.toml 含 project.name"
+    severity: critical
+    domain: python
+    applies_to: ["python-app"]
+    check: toml_field
+    params:
+      path: "pyproject.toml"
+      field: "project.name"
+    description: "Python 项目应有符合 PEP 621 的 pyproject.toml 且含 project.name"
+    template_ref: "templates/categories/python-app/pyproject.toml"
+
+  - id: PY-002
+    title: "tests/ 目录存在"
+    severity: major
+    domain: python
+    applies_to: ["python-app"]
+    check: directory_exists
+    params:
+      path: "tests"
+    description: "Python 项目应有 tests/ 目录"
+
+  - id: PY-003
+    title: "pytest 配置存在"
+    severity: major
+    domain: python
+    applies_to: ["python-app"]
+    check: toml_field
+    params:
+      path: "pyproject.toml"
+      field: "tool.pytest.ini_options"
+      expect_table: true
+    description: "Python 项目应有 pytest 配置（[tool.pytest.ini_options] 表存在）"
+    note: "pytest.ini 或 setup.cfg 中也接受"
+
+  - id: PY-004
+    title: "PyPI publish workflow"
+    severity: major
+    domain: python
+    applies_to: ["python-app"]
+    check: file_exists
+    params:
+      paths: [".github/workflows/publish.yml"]
+      skip_if_no_file: ".github/workflows/publish.yml"
+    description: "已发布 PyPI 的 Python 项目应有 publish workflow（未发布仓豁免）"
+    template_ref: "templates/categories/python-app/.github/workflows/publish.yml"
+    note: "未发布仓库可豁免"
+
+  - id: PY-005
+    title: "ruff 依赖声明"
+    severity: minor
+    domain: python
+    applies_to: ["python-app"]
+    check: toml_field
+    params:
+      path: "pyproject.toml"
+      field: "dependency-groups.test"
+    description: "pyproject.toml 应有 test dependency-group（ruff + pytest）"
+    note: "dev-dependencies 形式也接受"

package/rules/categories/sandbox.yaml

@@ -0,0 +1,33 @@
+rules:
+  - id: SANDBOX-001
+    title: "最小集：README+AGENTS"
+    severity: minor
+    domain: docs
+    applies_to: ["sandbox"]
+    check: file_exists
+    params:
+      paths: ["README.md", "AGENTS.md"]
+    description: "沙盒仓库至少应有 README.md 和 AGENTS.md（最小集设计）"
+    template_ref: "templates/categories/sandbox/"
+
+  - id: SANDBOX-002
+    title: "无 CI workflow"
+    severity: info
+    domain: quality
+    applies_to: ["sandbox"]
+    check: not_exists
+    params:
+      paths: [".github/workflows/"]
+    description: "沙盒仓库不应有 CI workflow（生命周期短，无发布面）"
+    note: "符合为 pass；如有属用户自选，不视为问题"
+
+  - id: SANDBOX-003
+    title: "无 publish workflow"
+    severity: info
+    domain: quality
+    applies_to: ["sandbox"]
+    check: not_exists
+    params:
+      paths: [".github/workflows/publish.yml"]
+    description: "沙盒仓库不应有 publish workflow"
+    note: "符合为 pass"

package/rules/domains/docs.yaml

@@ -0,0 +1,105 @@
+rules:
+  - id: DOC-001
+    title: "README.md 存在且非空"
+    severity: critical
+    domain: docs
+    applies_to: ["*"]
+    check: file_exists
+    params:
+      paths: ["README.md"]
+    description: "每个仓库必须有 README.md；结构应符合 templates/common/README-core.md"
+    template_ref: "templates/common/README-core.md"
+    fix_hint: "参考 templates/common/README-core.md"
+
+  - id: DOC-002
+    title: "双语 README 标配"
+    severity: minor
+    domain: docs
+    applies_to: ["dsh-plugin", "python-app", "go-service", "javascript", "npm-package"]
+    check: file_exists
+    params:
+      paths: ["README.en.md"]
+    description: "工程类仓库应有英文镜像 README.en.md（README-core 双语策略）"
+    note: "sandbox/content 类不设硬性要求"
+
+  - id: DOC-003
+    title: "LICENSE 存在且许可声明一致"
+    severity: critical
+    domain: docs
+    applies_to: ["*"]
+    check: file_exists
+    params:
+      paths: ["LICENSE", "LICENSE.txt", "LICENSE.md"]
+    description: "开源仓库必须有 LICENSE 文件；许可类型（MIT/Apache-2.0/GPL/BSD 等）均为合规"
+    template_ref: "templates/repo-root/LICENSE"
+
+  - id: DOC-003b
+    title: "package.json license 字段与 LICENSE 文件一致"
+    severity: minor
+    domain: docs
+    applies_to: ["javascript", "npm-package"]
+    check: json_field
+    params:
+      path: "package.json"
+      field: "license"
+      fallback_field: ["dependencies", "peerDependencies", "devDependencies"]
+    description: "package.json 应有 license 字段（SPDX 标识）"
+    note: "仅对含 package.json 的 JS 项目检查"
+
+  - id: DOC-004
+    title: "AGENTS.md 存在且含 AI 协作守则"
+    severity: major
+    domain: docs
+    applies_to: ["dsh-plugin", "python-app", "product-oss"]
+    check: file_contains
+    params:
+      path: "AGENTS.md"
+      patterns: ["AI 协作守则", "完成的定义"]
+    description: "AI 协作仓库应有 AGENTS.md，且含 AI 协作守则（templates/common/AGENTS-core.md）"
+    template_ref: "templates/common/AGENTS-core.md"
+    note: "无 AI 协作需求的个人/solo 项目豁免"
+
+  - id: DOC-005
+    title: "CONTRIBUTING.md 存在"
+    severity: minor
+    domain: docs
+    applies_to: ["dsh-plugin", "python-app", "go-service", "product-oss", "javascript", "npm-package"]
+    check: file_exists
+    params:
+      paths: ["CONTRIBUTING.md"]
+    description: "工程仓库应有贡献指南"
+    template_ref: "templates/common/CONTRIBUTING-core.md"
+
+  - id: DOC-006
+    title: "DEVELOPMENT.md 存在（工程类）"
+    severity: minor
+    domain: docs
+    applies_to: ["dsh-plugin", "python-app", "go-service", "javascript", "npm-package"]
+    check: file_exists
+    params:
+      paths: ["DEVELOPMENT.md"]
+    description: "工程仓库应有开发流程文档"
+    template_ref: "templates/common/DEVELOPMENT-core.md"
+    note: "sandbox/content 豁免"
+
+  - id: DOC-007
+    title: "PUBLISHING.md 存在（有发布面）"
+    severity: minor
+    domain: docs
+    applies_to: ["dsh-plugin", "python-app", "go-service"]
+    check: file_exists
+    params:
+      paths: ["PUBLISHING.md"]
+    description: "有发布流程的仓库应有发布文档"
+    template_ref: "templates/common/PUBLISHING-core.md"
+
+  - id: DOC-008
+    title: "SECURITY.md 存在"
+    severity: minor
+    domain: docs
+    applies_to: ["dsh-plugin", "python-app", "go-service", "javascript", "npm-package"]
+    check: file_exists
+    params:
+      paths: ["SECURITY.md"]
+    description: "有安全关注的仓库应有漏洞报告渠道"
+    template_ref: "templates/common/SECURITY-core.md"

package/rules/domains/git.yaml

@@ -0,0 +1,52 @@
+rules:
+  - id: GIT-001
+    title: "Conventional Commits 规范"
+    severity: major
+    domain: git
+    applies_to: ["*"]
+    check: regex
+    params:
+      command: "git log --format=%s -20"
+      pattern: "^(feat|fix|docs|refactor|test|chore|style|perf|build|ci|revert)(\\(.+\\))?: .+"
+    description: "最近 20 条提交应符合 Conventional Commits 规范（AGENTS-core 提交规范节）"
+    fix_hint: "使用 standard-version 或手动 reword；参考 templates/common/AGENTS-core.md"
+
+  - id: GIT-002
+    title: ".gitignore 含机密防护段"
+    severity: major
+    domain: git
+    applies_to: ["dsh-plugin", "javascript", "npm-package"]
+    check: file_contains
+    params:
+      path: ".gitignore"
+      patterns: ["node_modules/", "*.log"]
+    description: ".gitignore 应排除构建产物和日志（gitignore-core 通用段）"
+    template_ref: "templates/common/gitignore-core.md"
+    note: "仅对 JS/TS 类仓库适用；Python/Go 等分类豁免"
+
+  - id: GIT-003
+    title: "至少有一个有效提交"
+    severity: major
+    domain: git
+    applies_to: ["*"]
+    check: command_result
+    params:
+      command: "git rev-list --count HEAD"
+      min: 1
+      skip_if_zero: true
+    description: "仓库必须有至少一个提交（零提交仓自动豁免）"
+    fix_hint: "git add -A && git commit -m 'chore: initial commit'"
+    note: "scaffold 生成后未初始化提交时豁免"
+
+  - id: GIT-004
+    title: ".scaffold/lock 存在"
+    severity: info
+    domain: git
+    applies_to: ["*"]
+    check: file_exists
+    params:
+      paths: [".scaffold/lock/manifest.json"]
+      anyOf: false
+      skip_if_no_parent: ".scaffold"
+    description: "经 scaffold --update 的仓库应有 .scaffold/lock/manifest.json（非 scaffold 管理仓自然 pass）"
+    note: "仅对 adopt/update 过的仓库有意义；从未接管的仓视为 pass"

package/rules/domains/quality.yaml

@@ -0,0 +1,69 @@
+rules:
+  - id: QUA-001
+    title: "验证链存在"
+    severity: major
+    domain: quality
+    applies_to: ["dsh-plugin", "python-app", "go-service", "javascript", "npm-package"]
+    check: file_exists
+    params:
+      paths:
+        - "verify.mjs"
+        - "scripts/verify.mjs"
+        - "scripts/verify.py"
+        - "Makefile"
+      anyOf: true
+      fallback_paths: ["package.json"]
+      fallback_field: "scripts.test"
+    description: "工程仓库应有验证链（verify.mjs / Makefile / npm scripts.test 任一形态）"
+    template_ref: "templates/repo-root/scripts/verify.mjs"
+
+  - id: QUA-002
+    title: "CI workflow 存在"
+    severity: major
+    domain: quality
+    applies_to: ["dsh-plugin", "python-app", "go-service", "javascript", "npm-package"]
+    check: regex
+    params:
+      command: "ls .github/workflows/ 2>/dev/null | grep -cE '\\.(yml|yaml)$'"
+      patterns: ["[1-9]"]
+    description: "工程仓库应有 CI workflow（任意 .github/workflows/*.yml|yaml，命名不绑定 ci.yml）"
+    note: "glob_count 无法遍历隐藏目录（E4），改用 regex+command 方案"
+
+  - id: QUA-003
+    title: "pre-commit 钩子配置"
+    severity: minor
+    domain: quality
+    applies_to: ["dsh-plugin", "python-app", "go-service", "javascript", "npm-package"]
+    check: file_exists
+    params:
+      paths: [".githooks/pre-commit", ".husky/pre-commit", "lefthook.yml"]
+    description: "工程仓库应有 pre-commit 钩子（AGENTS-core 部署纪律）"
+    template_ref: "templates/repo-root/.githooks/pre-commit"
+    note: "sandbox/content 豁免"
+
+  - id: QUA-004
+    title: "锁文件入库"
+    severity: major
+    domain: quality
+    applies_to: ["dsh-plugin", "python-app", "go-service", "javascript", "npm-package"]
+    check: file_exists
+    params:
+      paths:
+        - "package-lock.json"
+        - "poetry.lock"
+        - "go.sum"
+        - "requirements.lock"
+      anyOf: true
+    description: "锁文件应入库以确保可复现构建（BEST-PRACTICES §5.4 验证链）"
+    note: "无包管理的仓库豁免"
+
+  - id: QUA-005
+    title: "CLAUDE.md 桥接"
+    severity: info
+    domain: quality
+    applies_to: ["*"]
+    check: file_exists
+    params:
+      paths: ["CLAUDE.md"]
+    description: "仓库有 CLAUDE.md 则 Claude Code 用户可直接读取 AGENTS.md"
+    note: "推荐项，非硬性要求"