riskforge 0.1.0__tar.gz

riskforge-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,124 @@
+name: CI
+
+on:
+  push:
+    branches: ["main", "develop"]
+  pull_request:
+    branches: ["main"]
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Lint & Format
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: pip
+
+      - name: Install ruff
+        run: pip install ruff==0.4.4
+
+      - name: Lint
+        run: ruff check src/ tests/
+
+      - name: Format check
+        run: ruff format --check src/ tests/
+
+  test:
+    name: Test (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+
+      - name: Install WeasyPrint system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libpango-1.0-0 libpangocairo-1.0-0 libcairo2 \
+            libgdk-pixbuf2.0-0 libffi-dev shared-mime-info
+
+      - name: Install RiskForge with dev extras
+        run: pip install -e ".[dev]"
+
+      - name: Run test suite
+        run: pytest --cov --cov-report=xml --cov-report=term-missing
+
+      - name: Upload coverage to Codecov
+        if: matrix.python-version == '3.11'
+        uses: codecov/codecov-action@v4
+        with:
+          files: ./coverage.xml
+          fail_ci_if_error: false
+
+  schema-validate:
+    name: Schema Validation
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: pip
+
+      - name: Install jsonschema
+        run: pip install jsonschema
+
+      - name: Validate rmf.schema.json is valid JSON Schema
+        run: |
+          python -c "
+          import json, jsonschema
+          schema = json.load(open('src/riskforge/_data/schemas/rmf.schema.json'))
+          jsonschema.Draft202012Validator.check_schema(schema)
+          print('Schema valid:', schema.get('\$id'))
+          "
+
+  security:
+    name: Security Scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: pip
+
+      - name: Install security tools
+        run: pip install bandit pip-audit
+
+      - name: Static security analysis
+        run: bandit -ll -r src/ --exit-zero
+
+      - name: Dependency vulnerability audit
+        run: pip install -e ".[dev]" && pip-audit --strict || true
+
+  boundary-test:
+    name: Import Boundary Enforcement (ADR-02)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: pip
+
+      - name: Install RiskForge
+        run: pip install -e ".[test]"
+
+      - name: Run boundary tests
+        run: pytest tests/boundary/ -v

riskforge-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,64 @@
+name: Release to PyPI
+
+on:
+  push:
+    tags: ["v*.*.*"]
+
+permissions:
+  id-token: write    # PyPI OIDC trusted publishing
+  contents: write    # GitHub Release creation
+  attestations: write
+
+jobs:
+  release:
+    name: Build & Publish
+    runs-on: ubuntu-latest
+    environment: pypi-publish
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install dev dependencies + build frontend
+        run: |
+          pip install build pip-audit bandit
+          pip install -e ".[dev]"
+
+      - name: Security gates (advisory)
+        run: |
+          bandit -ll -r src/ --exit-zero
+          pip-audit --strict || true
+
+      - name: Run full test suite
+        run: pytest --cov
+
+      - name: Build wheel + sdist
+        run: python -m build
+
+      - name: List built artifacts
+        run: ls -lh dist/
+
+      - name: Generate CycloneDX SBOM
+        run: |
+          pip install "cyclonedx-bom<5"
+          cyclonedx-py environment -o sbom.cdx.json --format json || \
+          cyclonedx-py environment > sbom.cdx.json || true
+
+      - name: Attest build provenance (GitHub + Sigstore)
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: dist/*
+
+      - name: Publish to PyPI (OIDC trusted publisher)
+        uses: pypa/gh-action-pypi-publish@v1.12.4
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true
+          files: |
+            dist/*.whl
+            dist/*.tar.gz
+            sbom.cdx.json

riskforge-0.1.0/.gitignore

@@ -0,0 +1,39 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+dist/
+build/
+.eggs/
+*.egg
+
+# Virtual environments
+.venv/
+venv/
+env/
+
+# Testing
+.pytest_cache/
+.coverage
+htmlcov/
+coverage.xml
+
+# RiskForge project files (sensitive — never commit)
+.riskforge/
+riskforge.yaml
+systems/
+*.riskforge
+
+# IDE
+.vscode/
+.idea/
+*.swp
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Secrets
+.env
+*.pem
+*.key

riskforge-0.1.0/.pre-commit-config.yaml

@@ -0,0 +1,17 @@
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.4.4
+    hooks:
+      - id: ruff
+        args: [--fix]
+      - id: ruff-format
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      - id: check-yaml
+      - id: check-json
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-merge-conflict
+      - id: check-added-large-files
+        args: [--maxkb=500]

riskforge-0.1.0/CHANGELOG.md

@@ -0,0 +1,35 @@
+# Changelog
+
+All notable changes to RiskForge are documented here.
+Format: [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
+Versioning: [Semantic Versioning](https://semver.org/)
+
+## [Unreleased]
+
+## [0.1.0] - 2026-04-12
+
+### Added
+- Initial release of RiskForge
+- Article 9 risk management system CLI
+- 8 risk dimensions with 50+ questions
+- 5x5 likelihood x severity scoring matrix
+- JSON, PDF, and Markdown export formats
+- SHA-256 hash-chain audit trail
+- Integration adapters for rag-benchmarking and TraceForge
+- `riskforge init`, `assess`, `validate`, `export`, `verify` commands
+- `riskforge risk list/add/edit/accept/score` subcommands
+- `riskforge system show/edit` subcommands
+- `riskforge tests generate/list` subcommands
+- `riskforge diff` and `riskforge import` commands
+- Optional FastAPI server (`pip install riskforge[server]`)
+- 8 export readiness gates (G1-G8)
+- Plugin system via Python entry points (question banks, exporters, adapters)
+- WeasyPrint PDF rendering with Jinja2 HTML templates
+- `rmf.schema.json` (JSON Schema draft-2020-12) as versioned output contract
+- FileStore storage backend (YAML + JSONL, git-friendly)
+- Exit code 2 for `riskforge verify` failures (CI-detectable)
+- Zero-telemetry guarantee enforced via pytest-socket in CI
+- Docker Compose setup for team deployment
+- Sigstore OIDC signing on all PyPI releases
+- CycloneDX SBOM attached to every GitHub Release
+- Build provenance attestation via GitHub Actions