maintainer-defense-kit 1.1.0__tar.gz

maintainer_defense_kit-1.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Awesome Maintainer Defense contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

maintainer_defense_kit-1.1.0/MANIFEST.in

@@ -0,0 +1,12 @@
+include LICENSE
+include README.md
+include pyproject.toml
+include build_backend.py
+include auditor-rules.json
+include maintainer-defense-config.schema.json
+include generated/maintainer_defense_kit.py
+include scripts/build_standalone.py
+include scripts/install_kit.py
+recursive-include docs *.md
+recursive-include kits *.md *.yml *.tmpl
+recursive-include policies *.md

maintainer_defense_kit-1.1.0/PKG-INFO

@@ -0,0 +1,190 @@
+Metadata-Version: 2.4
+Name: maintainer-defense-kit
+Version: 1.1.0
+Summary: Offline auditor and reversible defense kit for repository governance and GitHub Actions risk
+Author: Thang Le
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/thangldw/awesome-maintainer-defense
+Project-URL: Documentation, https://github.com/thangldw/awesome-maintainer-defense/blob/v1.1.0/docs/AUDITOR.md
+Project-URL: Issues, https://github.com/thangldw/awesome-maintainer-defense/issues
+Project-URL: Source, https://github.com/thangldw/awesome-maintainer-defense
+Keywords: github-actions,governance,maintainer,security,sarif
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# Awesome Maintainer Defense
+
+[English](#english) · [Tiếng Việt](#tiếng-việt) · [日本語](#日本語)
+
+Offline repository-governance and GitHub Actions risk auditor with reversible defense profiles and an evidence-reviewed resource catalog.
+
+```mermaid
+%%{init: {"theme":"base","themeVariables":{"background":"#FFFFFF","fontFamily":"Arial, sans-serif","lineColor":"#667085","primaryTextColor":"#172B4D"}}}%%
+flowchart LR
+    R["Repository<br/>Repo / リポジトリ"]:::yellow
+    A["Read-only audit<br/>Chỉ đọc / 読取監査"]:::blue
+    F["Evidence findings<br/>Phát hiện / 所見"]:::pink
+    P["Reviewable patch<br/>Patch / パッチ"]:::purple
+    H["Human decision<br/>Con người / 人の判断"]:::green
+    R --> A --> F --> P --> H
+    classDef yellow fill:#FFF4A3,stroke:#C9A227,stroke-width:2px,color:#172B4D
+    classDef blue fill:#D9EAFD,stroke:#4C78A8,stroke-width:2px,color:#172B4D
+    classDef pink fill:#FFE1E6,stroke:#C96A7B,stroke-width:2px,color:#172B4D
+    classDef purple fill:#E9DDF7,stroke:#8064A2,stroke-width:2px,color:#172B4D
+    classDef green fill:#DDF5E3,stroke:#4F9D69,stroke-width:2px,color:#172B4D
+```
+
+## English
+
+The dependency-free Python CLI audits repository policy and workflow trust boundaries without a network connection or GitHub token. `fix` emits a unified diff; it never edits a repository, changes settings, commits or pushes. Findings are review inputs, not proof of authorship, intent or safety.
+
+<!-- auditor-output:start -->
+```text
+3 findings · 1 critical · 1 high · 1 medium
+
+CRITICAL MD-WF-005  Untrusted pull-request input can reach a privileged workflow with secrets or write authority.
+HIGH     MD-WF-004  Privileged event pull_request_target checks out an attacker-influenced revision.
+MEDIUM   MD-WF-006  Checkout may persist a write-capable token in the workspace.
+```
+<!-- auditor-output:end -->
+
+```bash
+python3 scripts/build_standalone.py
+python3 dist/maintainer-defense-kit.py audit .
+python3 dist/maintainer-defense-kit.py fix . --output recommended.patch
+python3 scripts/validate.py
+python3 scripts/test_auditor.py
+```
+
+## Verified v1.1.0 installs
+
+PyPI:
+
+```bash
+pipx install maintainer-defense-kit==1.1.0
+maintainer-defense audit .
+```
+
+Checksummed standalone on macOS/Linux:
+
+```bash
+curl -fLO https://github.com/thangldw/awesome-maintainer-defense/releases/download/v1.1.0/maintainer-defense-kit.py
+curl -fLO https://github.com/thangldw/awesome-maintainer-defense/releases/download/v1.1.0/maintainer-defense-kit.py.sha256
+shasum -a 256 -c maintainer-defense-kit.py.sha256
+python3 maintainer-defense-kit.py audit .
+```
+
+Checksummed standalone on PowerShell:
+
+```powershell
+Invoke-WebRequest https://github.com/thangldw/awesome-maintainer-defense/releases/download/v1.1.0/maintainer-defense-kit.py -OutFile maintainer-defense-kit.py
+Invoke-WebRequest https://github.com/thangldw/awesome-maintainer-defense/releases/download/v1.1.0/maintainer-defense-kit.py.sha256 -OutFile maintainer-defense-kit.py.sha256
+$Expected = ((Get-Content maintainer-defense-kit.py.sha256 -Raw).Trim() -split '\s+')[0].ToLowerInvariant()
+$Actual = (Get-FileHash maintainer-defense-kit.py -Algorithm SHA256).Hash.ToLowerInvariant()
+if ($Actual -ne $Expected) { Write-Error "SHA-256 mismatch"; exit 1 }
+python maintainer-defense-kit.py audit .
+```
+
+`dist/awesome-maintainer-defense-openai-skills-v1.1.0.zip` is the deterministic skills-only upload bundle for the existing ChatGPT/Codex plugin listing. `dist/SHA256SUMS.txt` covers every public release asset.
+
+## Tiếng Việt
+
+CLI Python không dependency kiểm tra policy và ranh giới tin cậy của workflow mà không cần mạng hoặc GitHub token. Lệnh `fix` chỉ tạo unified diff; không sửa repo, đổi setting, commit hoặc push. Mỗi finding chỉ là bằng chứng cần con người xem xét, không phải kết luận về tác giả, ý định hay mức độ an toàn.
+
+## 日本語
+
+依存関係のない Python CLI は、ネットワークや GitHub トークンなしでリポジトリ方針とワークフローの信頼境界を監査します。`fix` は unified diff を出力するだけで、ファイル編集、設定変更、commit、push は行いません。所見は人が確認するための根拠であり、作者、意図、安全性の証明ではありません。
+
+The deployable kit keeps example `.github` directories because those files are product assets; they do not execute in this repository.
+
+The repository is also a local, skills-only plugin for ChatGPT, Codex, Claude Code and Cowork. It does not require a hosted connector. See the [published ChatGPT/Codex listing](https://chatgpt.com/plugins/plugins_6a6edab2886c81918be9c9772e4ca904), [directory submission package](docs/SUBMISSION.md), [privacy policy](PRIVACY.md), [terms](TERMS.md), and [support guidance](SUPPORT.md).
+
+## Evidence-reviewed catalog
+
+<!-- catalog:start -->
+
+### Abuse Detection & Moderation
+
+Detect, label, quarantine, or respond to spam, harassment, and low-quality automated contributions.
+
+| Resource | Type | License | Why it matters |
+| --- | --- | --- | --- |
+| [Niubi Guard](https://github.com/Albert-Weasker/niubi_guard) ⭐ | tool | Apache-2.0 | Repository abuse detection and response system for spam, harassment, and coordinated attacks. |
+| [Anti Slop](https://github.com/peakoss/anti-slop) ⭐ | github-action | AGPL-3.0 | Configurable GitHub Action that detects and can close low-quality or AI-slop pull requests. |
+| [GitHub AI Moderator](https://github.com/github/ai-moderator) | github-action | MIT | Model-powered Action that labels spam, link spam, and content it infers to be AI-generated. |
+| [AI Community Moderator](https://github.com/benbalter/ai-community-moderator) | github-action | MIT | Moderates community interactions against a project's contributing guide and code of conduct. |
+| [AI Assessment Comment Labeler](https://github.com/github/ai-assessment-comment-labeler) | github-action | MIT | Issue-intake Action that retrieves an AI assessment and applies configurable labels. |
+
+### Contributor Trust & Admission
+
+Use explicit vouches or contribution history to control access without closing a project to everyone.
+
+| Resource | Type | License | Why it matters |
+| --- | --- | --- | --- |
+| [Fossier](https://github.com/PThorpe92/fossier) | tool | MIT | Vouch-compatible workflow and CLI for reducing unsolicited pull-request spam. |
+| [Vouch](https://github.com/mitchellh/vouch) ⭐ | tool | MIT | Community trust management based on explicit vouches before a participant can contribute. |
+| [Good Egg](https://github.com/2ndSetAI/good-egg) | github-action | MIT | Scores pull-request authors using their contribution history across GitHub. |
+
+### Intake & Triage
+
+Reduce review load with structured intake, labels, lifecycle automation, and emergency lockdowns.
+
+| Resource | Type | License | Why it matters |
+| --- | --- | --- | --- |
+| [Labeler](https://github.com/actions/labeler) | github-action | MIT | Official Action for labeling pull requests from changed files and branch patterns. |
+| [Stale](https://github.com/actions/stale) | github-action | MIT | Official Action for marking and optionally closing inactive issues and pull requests. |
+| [Lock Threads](https://github.com/dessant/lock-threads) | github-action | MIT | Locks closed issues, pull requests, and discussions after a configurable period. |
+| [Repo Lockdown](https://github.com/dessant/repo-lockdown) ⭐ | github-action | MIT | Emergency Action that immediately closes and locks new issues or pull requests. |
+| [Issue Metrics](https://github.com/github-community-projects/issue-metrics) | github-action | MIT | Measures issue, pull-request, and discussion response times and generates a Markdown report. |
+
+### Repository Governance & Access
+
+Keep security policies, branch protections, and repository settings consistent across projects.
+
+| Resource | Type | License | Why it matters |
+| --- | --- | --- | --- |
+| [OpenSSF Allstar](https://github.com/ossf/allstar) ⭐ | github-app | Apache-2.0 | Continuously checks and enforces security policies across GitHub organizations. |
+| [Safe Settings](https://github.com/github-community-projects/safe-settings) ⭐ | github-app | ISC | Centrally manages repository settings, branch protections, and teams with pull-request dry runs. |
+| [Repository Settings App](https://github.com/repository-settings/app) | github-app | ISC | Synchronizes repository settings from a version-controlled `.github/settings.yml` file. |
+
+### Workflow & Supply-Chain Defense
+
+Protect CI, dependencies, secrets, and merge paths from hostile or compromised contributions.
+
+| Resource | Type | License | Why it matters |
+| --- | --- | --- | --- |
+| [Harden-Runner](https://github.com/step-security/harden-runner) ⭐ | github-action | Apache-2.0 | Monitors network egress, file integrity, and processes on GitHub-hosted runners. |
+| [OpenSSF Scorecard](https://github.com/ossf/scorecard) ⭐ | tool | Apache-2.0 | Automated security-health checks for open-source projects and their dependencies. |
+| [zizmor](https://github.com/zizmorcore/zizmor) ⭐ | tool | MIT | Static analysis for security and correctness problems in GitHub Actions workflows. |
+| [pinact](https://github.com/suzuki-shunsuke/pinact) | tool | MIT | Pins GitHub Actions and reusable workflows to immutable commit hashes. |
+| [Dependency Review Action](https://github.com/actions/dependency-review-action) ⭐ | github-action | MIT | Blocks pull requests that introduce vulnerable dependencies or disallowed licenses. |
+| [TruffleHog](https://github.com/trufflesecurity/trufflehog) | tool | AGPL-3.0 | Finds and verifies leaked credentials before they become a maintainer incident. |
+| [PRevent](https://github.com/apiiro/PRevent) | github-app | MIT | Detects suspicious pull-request changes that may indicate malicious code. |
+| [OSV-Scanner](https://github.com/google/osv-scanner) ⭐ | tool | Apache-2.0 | Scans lockfiles, SBOMs, and source artifacts against the OSV vulnerability database. |
+| [Gitleaks](https://github.com/gitleaks/gitleaks) ⭐ | tool | MIT | Detects secrets in Git history, directories, files, and standard input. |
+
+### Policies & Playbooks
+
+Set expectations before problems arrive and respond consistently when they do.
+
+| Resource | Type | License | Why it matters |
+| --- | --- | --- | --- |
+| [Open Source AI Contribution Policies](https://github.com/melissawm/open-source-ai-contribution-policies) ⭐ | awesome-list | CC0-1.0 | Comparative catalog of how open-source projects govern AI-generated contributions. |
+| [OpenSSF AI-Slop Best-Practices Work Item](https://github.com/ossf/wg-vulnerability-disclosures/issues/178) | working-group | N/A | Open work item developing practices for low-quality AI security reports and contributions; not a finalized standard. |
+
+<!-- catalog:end -->
+
+Released under the [MIT License](LICENSE). Separate Vietnamese and Japanese catalog views remain in [README.vi.md](README.vi.md) and [README.ja.md](README.ja.md).

maintainer_defense_kit-1.1.0/README.md

@@ -0,0 +1,163 @@
+# Awesome Maintainer Defense
+
+[English](#english) · [Tiếng Việt](#tiếng-việt) · [日本語](#日本語)
+
+Offline repository-governance and GitHub Actions risk auditor with reversible defense profiles and an evidence-reviewed resource catalog.
+
+```mermaid
+%%{init: {"theme":"base","themeVariables":{"background":"#FFFFFF","fontFamily":"Arial, sans-serif","lineColor":"#667085","primaryTextColor":"#172B4D"}}}%%
+flowchart LR
+    R["Repository<br/>Repo / リポジトリ"]:::yellow
+    A["Read-only audit<br/>Chỉ đọc / 読取監査"]:::blue
+    F["Evidence findings<br/>Phát hiện / 所見"]:::pink
+    P["Reviewable patch<br/>Patch / パッチ"]:::purple
+    H["Human decision<br/>Con người / 人の判断"]:::green
+    R --> A --> F --> P --> H
+    classDef yellow fill:#FFF4A3,stroke:#C9A227,stroke-width:2px,color:#172B4D
+    classDef blue fill:#D9EAFD,stroke:#4C78A8,stroke-width:2px,color:#172B4D
+    classDef pink fill:#FFE1E6,stroke:#C96A7B,stroke-width:2px,color:#172B4D
+    classDef purple fill:#E9DDF7,stroke:#8064A2,stroke-width:2px,color:#172B4D
+    classDef green fill:#DDF5E3,stroke:#4F9D69,stroke-width:2px,color:#172B4D
+```
+
+## English
+
+The dependency-free Python CLI audits repository policy and workflow trust boundaries without a network connection or GitHub token. `fix` emits a unified diff; it never edits a repository, changes settings, commits or pushes. Findings are review inputs, not proof of authorship, intent or safety.
+
+<!-- auditor-output:start -->
+```text
+3 findings · 1 critical · 1 high · 1 medium
+
+CRITICAL MD-WF-005  Untrusted pull-request input can reach a privileged workflow with secrets or write authority.
+HIGH     MD-WF-004  Privileged event pull_request_target checks out an attacker-influenced revision.
+MEDIUM   MD-WF-006  Checkout may persist a write-capable token in the workspace.
+```
+<!-- auditor-output:end -->
+
+```bash
+python3 scripts/build_standalone.py
+python3 dist/maintainer-defense-kit.py audit .
+python3 dist/maintainer-defense-kit.py fix . --output recommended.patch
+python3 scripts/validate.py
+python3 scripts/test_auditor.py
+```
+
+## Verified v1.1.0 installs
+
+PyPI:
+
+```bash
+pipx install maintainer-defense-kit==1.1.0
+maintainer-defense audit .
+```
+
+Checksummed standalone on macOS/Linux:
+
+```bash
+curl -fLO https://github.com/thangldw/awesome-maintainer-defense/releases/download/v1.1.0/maintainer-defense-kit.py
+curl -fLO https://github.com/thangldw/awesome-maintainer-defense/releases/download/v1.1.0/maintainer-defense-kit.py.sha256
+shasum -a 256 -c maintainer-defense-kit.py.sha256
+python3 maintainer-defense-kit.py audit .
+```
+
+Checksummed standalone on PowerShell:
+
+```powershell
+Invoke-WebRequest https://github.com/thangldw/awesome-maintainer-defense/releases/download/v1.1.0/maintainer-defense-kit.py -OutFile maintainer-defense-kit.py
+Invoke-WebRequest https://github.com/thangldw/awesome-maintainer-defense/releases/download/v1.1.0/maintainer-defense-kit.py.sha256 -OutFile maintainer-defense-kit.py.sha256
+$Expected = ((Get-Content maintainer-defense-kit.py.sha256 -Raw).Trim() -split '\s+')[0].ToLowerInvariant()
+$Actual = (Get-FileHash maintainer-defense-kit.py -Algorithm SHA256).Hash.ToLowerInvariant()
+if ($Actual -ne $Expected) { Write-Error "SHA-256 mismatch"; exit 1 }
+python maintainer-defense-kit.py audit .
+```
+
+`dist/awesome-maintainer-defense-openai-skills-v1.1.0.zip` is the deterministic skills-only upload bundle for the existing ChatGPT/Codex plugin listing. `dist/SHA256SUMS.txt` covers every public release asset.
+
+## Tiếng Việt
+
+CLI Python không dependency kiểm tra policy và ranh giới tin cậy của workflow mà không cần mạng hoặc GitHub token. Lệnh `fix` chỉ tạo unified diff; không sửa repo, đổi setting, commit hoặc push. Mỗi finding chỉ là bằng chứng cần con người xem xét, không phải kết luận về tác giả, ý định hay mức độ an toàn.
+
+## 日本語
+
+依存関係のない Python CLI は、ネットワークや GitHub トークンなしでリポジトリ方針とワークフローの信頼境界を監査します。`fix` は unified diff を出力するだけで、ファイル編集、設定変更、commit、push は行いません。所見は人が確認するための根拠であり、作者、意図、安全性の証明ではありません。
+
+The deployable kit keeps example `.github` directories because those files are product assets; they do not execute in this repository.
+
+The repository is also a local, skills-only plugin for ChatGPT, Codex, Claude Code and Cowork. It does not require a hosted connector. See the [published ChatGPT/Codex listing](https://chatgpt.com/plugins/plugins_6a6edab2886c81918be9c9772e4ca904), [directory submission package](docs/SUBMISSION.md), [privacy policy](PRIVACY.md), [terms](TERMS.md), and [support guidance](SUPPORT.md).
+
+## Evidence-reviewed catalog
+
+<!-- catalog:start -->
+
+### Abuse Detection & Moderation
+
+Detect, label, quarantine, or respond to spam, harassment, and low-quality automated contributions.
+
+| Resource | Type | License | Why it matters |
+| --- | --- | --- | --- |
+| [Niubi Guard](https://github.com/Albert-Weasker/niubi_guard) ⭐ | tool | Apache-2.0 | Repository abuse detection and response system for spam, harassment, and coordinated attacks. |
+| [Anti Slop](https://github.com/peakoss/anti-slop) ⭐ | github-action | AGPL-3.0 | Configurable GitHub Action that detects and can close low-quality or AI-slop pull requests. |
+| [GitHub AI Moderator](https://github.com/github/ai-moderator) | github-action | MIT | Model-powered Action that labels spam, link spam, and content it infers to be AI-generated. |
+| [AI Community Moderator](https://github.com/benbalter/ai-community-moderator) | github-action | MIT | Moderates community interactions against a project's contributing guide and code of conduct. |
+| [AI Assessment Comment Labeler](https://github.com/github/ai-assessment-comment-labeler) | github-action | MIT | Issue-intake Action that retrieves an AI assessment and applies configurable labels. |
+
+### Contributor Trust & Admission
+
+Use explicit vouches or contribution history to control access without closing a project to everyone.
+
+| Resource | Type | License | Why it matters |
+| --- | --- | --- | --- |
+| [Fossier](https://github.com/PThorpe92/fossier) | tool | MIT | Vouch-compatible workflow and CLI for reducing unsolicited pull-request spam. |
+| [Vouch](https://github.com/mitchellh/vouch) ⭐ | tool | MIT | Community trust management based on explicit vouches before a participant can contribute. |
+| [Good Egg](https://github.com/2ndSetAI/good-egg) | github-action | MIT | Scores pull-request authors using their contribution history across GitHub. |
+
+### Intake & Triage
+
+Reduce review load with structured intake, labels, lifecycle automation, and emergency lockdowns.
+
+| Resource | Type | License | Why it matters |
+| --- | --- | --- | --- |
+| [Labeler](https://github.com/actions/labeler) | github-action | MIT | Official Action for labeling pull requests from changed files and branch patterns. |
+| [Stale](https://github.com/actions/stale) | github-action | MIT | Official Action for marking and optionally closing inactive issues and pull requests. |
+| [Lock Threads](https://github.com/dessant/lock-threads) | github-action | MIT | Locks closed issues, pull requests, and discussions after a configurable period. |
+| [Repo Lockdown](https://github.com/dessant/repo-lockdown) ⭐ | github-action | MIT | Emergency Action that immediately closes and locks new issues or pull requests. |
+| [Issue Metrics](https://github.com/github-community-projects/issue-metrics) | github-action | MIT | Measures issue, pull-request, and discussion response times and generates a Markdown report. |
+
+### Repository Governance & Access
+
+Keep security policies, branch protections, and repository settings consistent across projects.
+
+| Resource | Type | License | Why it matters |
+| --- | --- | --- | --- |
+| [OpenSSF Allstar](https://github.com/ossf/allstar) ⭐ | github-app | Apache-2.0 | Continuously checks and enforces security policies across GitHub organizations. |
+| [Safe Settings](https://github.com/github-community-projects/safe-settings) ⭐ | github-app | ISC | Centrally manages repository settings, branch protections, and teams with pull-request dry runs. |
+| [Repository Settings App](https://github.com/repository-settings/app) | github-app | ISC | Synchronizes repository settings from a version-controlled `.github/settings.yml` file. |
+
+### Workflow & Supply-Chain Defense
+
+Protect CI, dependencies, secrets, and merge paths from hostile or compromised contributions.
+
+| Resource | Type | License | Why it matters |
+| --- | --- | --- | --- |
+| [Harden-Runner](https://github.com/step-security/harden-runner) ⭐ | github-action | Apache-2.0 | Monitors network egress, file integrity, and processes on GitHub-hosted runners. |
+| [OpenSSF Scorecard](https://github.com/ossf/scorecard) ⭐ | tool | Apache-2.0 | Automated security-health checks for open-source projects and their dependencies. |
+| [zizmor](https://github.com/zizmorcore/zizmor) ⭐ | tool | MIT | Static analysis for security and correctness problems in GitHub Actions workflows. |
+| [pinact](https://github.com/suzuki-shunsuke/pinact) | tool | MIT | Pins GitHub Actions and reusable workflows to immutable commit hashes. |
+| [Dependency Review Action](https://github.com/actions/dependency-review-action) ⭐ | github-action | MIT | Blocks pull requests that introduce vulnerable dependencies or disallowed licenses. |
+| [TruffleHog](https://github.com/trufflesecurity/trufflehog) | tool | AGPL-3.0 | Finds and verifies leaked credentials before they become a maintainer incident. |
+| [PRevent](https://github.com/apiiro/PRevent) | github-app | MIT | Detects suspicious pull-request changes that may indicate malicious code. |
+| [OSV-Scanner](https://github.com/google/osv-scanner) ⭐ | tool | Apache-2.0 | Scans lockfiles, SBOMs, and source artifacts against the OSV vulnerability database. |
+| [Gitleaks](https://github.com/gitleaks/gitleaks) ⭐ | tool | MIT | Detects secrets in Git history, directories, files, and standard input. |
+
+### Policies & Playbooks
+
+Set expectations before problems arrive and respond consistently when they do.
+
+| Resource | Type | License | Why it matters |
+| --- | --- | --- | --- |
+| [Open Source AI Contribution Policies](https://github.com/melissawm/open-source-ai-contribution-policies) ⭐ | awesome-list | CC0-1.0 | Comparative catalog of how open-source projects govern AI-generated contributions. |
+| [OpenSSF AI-Slop Best-Practices Work Item](https://github.com/ossf/wg-vulnerability-disclosures/issues/178) | working-group | N/A | Open work item developing practices for low-quality AI security reports and contributions; not a finalized standard. |
+
+<!-- catalog:end -->
+
+Released under the [MIT License](LICENSE). Separate Vietnamese and Japanese catalog views remain in [README.vi.md](README.vi.md) and [README.ja.md](README.ja.md).

maintainer_defense_kit-1.1.0/auditor-rules.json

@@ -0,0 +1,191 @@
+{
+  "schema_version": 1,
+  "rules": [
+    {
+      "id": "MD-GOV-001",
+      "title": "Repository security policy is missing",
+      "default_severity": "medium",
+      "description": "Reporters may disclose vulnerabilities publicly or abandon reports when no supported private route is documented.",
+      "safe_remediation": "Add SECURITY.md with supported versions, a private reporting route, response expectations, and a warning not to disclose secrets publicly.",
+      "help_anchor": "md-gov-001",
+      "mappings": [
+        {"framework": "OpenSSF Scorecard", "id": "Security-Policy", "url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#security-policy"}
+      ]
+    },
+    {
+      "id": "MD-GOV-002",
+      "title": "CODEOWNERS boundary is missing",
+      "default_severity": "medium",
+      "description": "Repository control-plane files can be changed without an explicit ownership boundary.",
+      "safe_remediation": "Add real owners for workflows, issue templates, the security policy, and CODEOWNERS itself, then enforce owner review separately where appropriate.",
+      "help_anchor": "md-gov-002",
+      "mappings": [
+        {"framework": "OpenSSF Scorecard", "id": "Code-Review", "url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#code-review"},
+        {"framework": "OpenSSF Scorecard", "id": "Branch-Protection", "url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection"}
+      ]
+    },
+    {
+      "id": "MD-GOV-003",
+      "title": "CODEOWNERS does not explicitly cover .github",
+      "default_severity": "medium",
+      "description": "A broad ownership rule can be weakened without an explicit review boundary for workflows and repository automation.",
+      "safe_remediation": "Add a specific /.github/ ownership rule naming an eligible, active owner and verify that repository rules enforce the intended review.",
+      "help_anchor": "md-gov-003",
+      "mappings": [
+        {"framework": "OpenSSF Scorecard", "id": "Code-Review", "url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#code-review"}
+      ]
+    },
+    {
+      "id": "MD-GOV-004",
+      "title": "Structured issue form is missing",
+      "default_severity": "low",
+      "description": "Unstructured reports can omit reproduction evidence and increase maintainer triage cost.",
+      "safe_remediation": "Add a non-destructive YAML issue form requesting reproduction steps, expected behavior, and relevant versions, and route vulnerabilities privately.",
+      "help_anchor": "md-gov-004",
+      "mappings": []
+    },
+    {
+      "id": "MD-GOV-005",
+      "title": "Machine-readable dependency update policy is missing",
+      "default_severity": "low",
+      "description": "Pinned Actions and packages can remain on vulnerable versions when no update mechanism or review cadence is configured.",
+      "safe_remediation": "Configure Dependabot or Renovate for the repository's real ecosystems and review update pull requests before merging.",
+      "help_anchor": "md-gov-005",
+      "mappings": [
+        {"framework": "OpenSSF Scorecard", "id": "Dependency-Update-Tool", "url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#dependency-update-tool"}
+      ]
+    },
+    {
+      "id": "MD-GOV-006",
+      "title": "Branch-protection expectations are not documented locally",
+      "default_severity": "note",
+      "description": "Maintainers cannot compare the intended review and merge boundary with the external repository configuration.",
+      "safe_remediation": "Document expected reviews, checks, force-push restrictions, bypass owners, and emergency procedure, then verify actual settings with read-only API access.",
+      "help_anchor": "md-gov-006",
+      "mappings": [
+        {"framework": "OpenSSF Scorecard", "id": "Branch-Protection", "url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection"}
+      ]
+    },
+    {
+      "id": "MD-WF-001",
+      "title": "Workflow has no top-level token boundary",
+      "default_severity": "medium",
+      "description": "A future job can inherit broader repository-default GITHUB_TOKEN permissions than intended.",
+      "safe_remediation": "Add permissions: {} at workflow level and grant only required permissions per job, then test the workflow before merging.",
+      "help_anchor": "md-wf-001",
+      "mappings": [
+        {"framework": "OpenSSF Scorecard", "id": "Token-Permissions", "url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions"},
+        {"framework": "CWE", "id": "CWE-269", "url": "https://cwe.mitre.org/data/definitions/269.html"}
+      ]
+    },
+    {
+      "id": "MD-WF-002",
+      "title": "Workflow grants write-all token permissions",
+      "default_severity": "high",
+      "description": "A compromised Action or command can use unnecessary write authority to modify sensitive repository resources.",
+      "safe_remediation": "Replace write-all with an empty default and enumerate only the exact job-level write permissions required.",
+      "help_anchor": "md-wf-002",
+      "mappings": [
+        {"framework": "OpenSSF Scorecard", "id": "Token-Permissions", "url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions"},
+        {"framework": "CWE", "id": "CWE-269", "url": "https://cwe.mitre.org/data/definitions/269.html"}
+      ]
+    },
+    {
+      "id": "MD-WF-003",
+      "title": "GitHub Action is not pinned to a full commit SHA",
+      "default_severity": "medium",
+      "description": "A mutable tag or branch can move to compromised code without a reviewed workflow change.",
+      "safe_remediation": "Resolve the reviewed release to a full commit SHA, retain the release tag in a comment, verify provenance, and automate reviewed updates.",
+      "help_anchor": "md-wf-003",
+      "mappings": [
+        {"framework": "OpenSSF Scorecard", "id": "Pinned-Dependencies", "url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies"},
+        {"framework": "CWE", "id": "CWE-829", "url": "https://cwe.mitre.org/data/definitions/829.html"}
+      ]
+    },
+    {
+      "id": "MD-WF-004",
+      "title": "Privileged event checks out attacker-influenced code",
+      "default_severity": "high",
+      "description": "A fork or attacker-controlled event can influence code executed in a context with base-repository authority.",
+      "safe_remediation": "Separate metadata handling from code execution and run contributor code only under pull_request with read-only permissions and no secrets.",
+      "help_anchor": "md-wf-004",
+      "mappings": [
+        {"framework": "OpenSSF Scorecard", "id": "Dangerous-Workflow", "url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#dangerous-workflow"},
+        {"framework": "CWE", "id": "CWE-829", "url": "https://cwe.mitre.org/data/definitions/829.html"}
+      ]
+    },
+    {
+      "id": "MD-WF-005",
+      "title": "Untrusted input can reach secrets or write authority",
+      "default_severity": "critical",
+      "description": "Attacker-controlled pull-request content can plausibly reach credentials or repository-changing authority.",
+      "safe_remediation": "Remove secrets and writes from the untrusted path, isolate contributor-code execution, and pass only validated artifacts or metadata to privileged stages.",
+      "help_anchor": "md-wf-005",
+      "mappings": [
+        {"framework": "OpenSSF Scorecard", "id": "Dangerous-Workflow", "url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#dangerous-workflow"},
+        {"framework": "CWE", "id": "CWE-829", "url": "https://cwe.mitre.org/data/definitions/829.html"}
+      ]
+    },
+    {
+      "id": "MD-WF-006",
+      "title": "Checkout may persist a write-capable token",
+      "default_severity": "medium",
+      "description": "A later command or compromised build step can recover a persisted credential and use its repository authority.",
+      "safe_remediation": "Set persist-credentials: false unless authenticated Git is required, then isolate that operation in a narrow least-privilege job.",
+      "help_anchor": "md-wf-006",
+      "mappings": [
+        {"framework": "OpenSSF Scorecard", "id": "Token-Permissions", "url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions"}
+      ]
+    },
+    {
+      "id": "MD-WF-007",
+      "title": "Untrusted event data is interpolated into a shell command",
+      "default_severity": "high",
+      "description": "Attacker-controlled event text can alter the generated shell program and execute unintended commands in the job.",
+      "safe_remediation": "Assign the expression to an environment variable or pass it as a reviewed action input, then quote the shell variable for the selected shell.",
+      "help_anchor": "md-wf-007",
+      "mappings": [
+        {"framework": "CWE", "id": "CWE-78", "url": "https://cwe.mitre.org/data/definitions/78.html"}
+      ]
+    },
+    {
+      "id": "MD-WF-008",
+      "title": "Privileged workflow executes a pull-request artifact",
+      "default_severity": "critical",
+      "description": "A workflow_run consumer can execute content produced by untrusted pull-request code while holding secrets or write authority.",
+      "safe_remediation": "Verify and parse the artifact as untrusted data, or rebuild it from trusted source inside the privileged workflow; never execute the downloaded artifact.",
+      "help_anchor": "md-wf-008",
+      "mappings": [
+        {"framework": "OpenSSF Scorecard", "id": "Dangerous-Workflow", "url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#dangerous-workflow"},
+        {"framework": "CWE", "id": "CWE-829", "url": "https://cwe.mitre.org/data/definitions/829.html"}
+      ]
+    },
+    {
+      "id": "MD-MOD-001",
+      "title": "Destructive moderation is enabled",
+      "default_severity": "high",
+      "description": "A false positive or configuration mistake can close, lock, or delete legitimate contributor work without human review.",
+      "safe_remediation": "Switch to report-only mode, require human review, measure false positives, and publish an appeal path before enabling enforcement.",
+      "help_anchor": "md-mod-001",
+      "mappings": []
+    },
+    {
+      "id": "MD-MOD-002",
+      "title": "Identity or history proxy is used for contributor risk",
+      "default_severity": "medium",
+      "description": "A legitimate newcomer can be penalized for identity or history characteristics unrelated to the submitted change.",
+      "safe_remediation": "Disable the proxy and evaluate reproducibility, scope, tests, policy compliance, and contributor responsiveness instead.",
+      "help_anchor": "md-mod-002",
+      "mappings": []
+    },
+    {
+      "id": "MD-MOD-003",
+      "title": "Destructive moderation has no discoverable appeal path",
+      "default_severity": "medium",
+      "description": "A moderation false positive can become permanent when contributors have no documented route to human reconsideration.",
+      "safe_remediation": "Document the appeal channel, human owner, response expectation, reopening process, and emergency disable path.",
+      "help_anchor": "md-mod-003",
+      "mappings": []
+    }
+  ]
+}

maintainer_defense_kit-1.1.0/build_backend.py

@@ -0,0 +1,65 @@
+"""PEP 517 backend that generates the embedded CLI module before packaging."""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+from pathlib import Path
+
+from setuptools import build_meta as _setuptools
+
+ROOT = Path(__file__).resolve().parent
+
+
+def _prepare() -> None:
+    module = ROOT / "generated/maintainer_defense_kit.py"
+    builder = ROOT / "scripts/build_standalone.py"
+    if builder.is_file():
+        subprocess.run([sys.executable, str(builder)], cwd=ROOT, check=True)
+    elif not module.is_file():
+        raise RuntimeError("source distribution is missing the generated CLI module")
+
+
+def build_wheel(wheel_directory, config_settings=None, metadata_directory=None):
+    _prepare()
+    return _setuptools.build_wheel(wheel_directory, config_settings, metadata_directory)
+
+
+def build_sdist(sdist_directory, config_settings=None):
+    _prepare()
+    return _setuptools.build_sdist(sdist_directory, config_settings)
+
+
+def prepare_metadata_for_build_wheel(metadata_directory, config_settings=None):
+    _prepare()
+    return _setuptools.prepare_metadata_for_build_wheel(metadata_directory, config_settings)
+
+
+def get_requires_for_build_wheel(config_settings=None):
+    _prepare()
+    return _setuptools.get_requires_for_build_wheel(config_settings)
+
+
+def get_requires_for_build_sdist(config_settings=None):
+    _prepare()
+    return _setuptools.get_requires_for_build_sdist(config_settings)
+
+
+if hasattr(_setuptools, "build_editable"):
+    def build_editable(wheel_directory, config_settings=None, metadata_directory=None):
+        _prepare()
+        return _setuptools.build_editable(
+            wheel_directory, config_settings, metadata_directory
+        )
+
+
+    def get_requires_for_build_editable(config_settings=None):
+        _prepare()
+        return _setuptools.get_requires_for_build_editable(config_settings)
+
+
+    def prepare_metadata_for_build_editable(metadata_directory, config_settings=None):
+        _prepare()
+        return _setuptools.prepare_metadata_for_build_editable(
+            metadata_directory, config_settings
+        )