plugin-scanner 2.0.7__tar.gz → 2.0.8__tar.gz

plugin_scanner-2.0.8/.github/workflows/scorecard.yml

@@ -0,0 +1,39 @@
+name: OpenSSF Scorecard
+on:
+  schedule:
+    - cron: '0 0 * * 0'
+  push:
+    branches: [main]
+permissions: read-all
+
+jobs:
+  scorecard:
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+      security-events: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
+      - name: Run analysis
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+      - name: Upload artifact
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+        if: always()
+      - name: Upload to code-scanning
+        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13
+        with:
+          sarif_file: results.sarif
+        if: always()

{plugin_scanner-2.0.7 → plugin_scanner-2.0.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.7
+Version: 2.0.8
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/ai-plugin-scanner
 Project-URL: Repository, https://github.com/hashgraph-online/ai-plugin-scanner
@@ -30,6 +30,7 @@ Requires-Dist: build>=1.2.2; extra == 'dev'
 Requires-Dist: jsonschema>=4.23.0; extra == 'dev'
 Requires-Dist: pytest-cov>=4.0; extra == 'dev'
 Requires-Dist: pytest>=7.0; extra == 'dev'
+Requires-Dist: pyyaml>=6.0; extra == 'dev'
 Requires-Dist: ruff>=0.4.0; extra == 'dev'
 Provides-Extra: publish
 Requires-Dist: twine>=6.1.0; extra == 'publish'

{plugin_scanner-2.0.7 → plugin_scanner-2.0.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.7"
+version = "2.0.8"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"
@@ -37,6 +37,7 @@ cisco = []
 dev = [
     "build>=1.2.2",
     "jsonschema>=4.23.0",
+    "pyyaml>=6.0",
     "pytest>=7.0",
     "pytest-cov>=4.0",
     "ruff>=0.4.0",

{plugin_scanner-2.0.7 → plugin_scanner-2.0.8}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.7"
+version = "2.0.8"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"
@@ -37,6 +37,7 @@ cisco = []
 dev = [
     "build>=1.2.2",
     "jsonschema>=4.23.0",
+    "pyyaml>=6.0",
     "pytest>=7.0",
     "pytest-cov>=4.0",
     "ruff>=0.4.0",

{plugin_scanner-2.0.7 → plugin_scanner-2.0.8}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.7"
+__version__ = "2.0.8"

{plugin_scanner-2.0.7 → plugin_scanner-2.0.8}/tests/test_action_bundle.py

@@ -2,6 +2,8 @@
 
 from pathlib import Path
 
+import yaml
+
 ROOT = Path(__file__).resolve().parent.parent
 
 
@@ -134,6 +136,32 @@ def test_ci_workflow_covers_cross_platform_runtime() -> None:
     assert "macos-latest" in workflow_text
 
 
+def test_scorecard_workflow_matches_official_install_pattern() -> None:
+    workflow_text = (ROOT / ".github" / "workflows" / "scorecard.yml").read_text(encoding="utf-8")
+    workflow = yaml.safe_load(workflow_text)
+
+    assert "name: OpenSSF Scorecard" in workflow_text
+    assert "permissions: read-all" in workflow_text
+    assert "branches: [main]" in workflow_text
+    assert workflow["jobs"]["scorecard"]["permissions"]["actions"] == "read"
+    assert workflow["jobs"]["scorecard"]["permissions"]["contents"] == "read"
+    assert "id-token: write" in workflow_text
+    assert "security-events: write" in workflow_text
+    assert 'uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' in workflow_text
+    assert 'uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a' in workflow_text
+    assert "results_file: results.sarif" in workflow_text
+    assert "results_format: sarif" in workflow_text
+    assert "publish_results: true" in workflow_text
+    assert 'uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' in workflow_text
+    assert "persist-credentials: false" in workflow_text
+    assert "path: results.sarif" in workflow_text
+    assert "retention-days: 5" in workflow_text
+    assert workflow_text.count("if: always()") == 2
+    assert 'uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13' in workflow_text
+    assert "sarif_file: results.sarif" in workflow_text
+    assert "if: always()" in workflow_text
+
+
 def test_harness_smoke_workflow_covers_nightly_self_hosted_release_gate() -> None:
     workflow_text = (ROOT / ".github" / "workflows" / "harness-smoke.yml").read_text(encoding="utf-8")
 

plugin_scanner-2.0.7/.github/workflows/scorecard.yml

@@ -1,27 +0,0 @@
-name: OpenSSF Scorecard
-on:
-  schedule:
-    - cron: '0 0 * * 0'
-  push:
-    branches: [main]
-permissions:
-  contents: read
-jobs:
-  scorecard:
-    runs-on: ubuntu-latest
-    permissions:
-      id-token: write
-      security-events: write
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
-        with:
-          persist-credentials: false
-      - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a
-        with:
-          results_file: results.sarif
-          results_format: sarif
-          publish_results: true
-      - uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13
-        with:
-          sarif_file: results.sarif
-        if: always()