sharelint 0.1.0__tar.gz

sharelint-0.1.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,68 @@
+name: Bug report
+description: Report reproducible incorrect or unexpected behavior
+title: "[Bug]: "
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a bug. Use only synthetic examples and remove sensitive values, usernames, and local paths. If this may be a vulnerability, stop and follow SECURITY.md to report it privately.
+  - type: input
+    id: version
+    attributes:
+      label: ShareLint version
+      description: Output of `sharelint --version`, or the commit hash.
+      placeholder: 0.1.0
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: Operating system, architecture, Python version, and installation method.
+      placeholder: Ubuntu 24.04, x86_64, Python 3.12, editable install
+    validations:
+      required: true
+  - type: textarea
+    id: command
+    attributes:
+      label: Command and configuration
+      description: Provide the exact command and relevant policy settings, with private paths and values replaced.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Synthetic reproduction
+      description: Give the smallest reproducible steps or a link to a clearly synthetic fixture.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: Include sanitized output or a traceback if useful. Do not include matched values.
+    validations:
+      required: true
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional context
+      description: Add any other non-sensitive context, screenshots, or suspected regression range.
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Checklist
+      options:
+        - label: I searched existing issues for duplicates.
+          required: true
+        - label: This report contains no real secrets, personal information, or confidential documents.
+          required: true
+        - label: This is not a security vulnerability requiring private reporting.
+          required: true

sharelint-0.1.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/jasonzhang06-source/sharelint/security/advisories/new
+    about: Follow SECURITY.md and use this repository's private vulnerability reporting form.

sharelint-0.1.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,59 @@
+name: Feature request
+description: Propose a focused improvement to ShareLint
+title: "[Feature]: "
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Explain the sharing workflow and privacy surface, not just the proposed implementation. Use synthetic examples only. Roadmap items are not delivery commitments.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What disclosure risk or workflow limitation are you trying to address?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+      description: Describe inputs, outputs, expected findings, and fail-closed behavior.
+    validations:
+      required: true
+  - type: input
+    id: formats
+    attributes:
+      label: Formats or workflows
+      description: Which file types, embedded surfaces, platforms, or integrations are involved?
+      placeholder: PPTX speaker notes inside a ZIP handoff bundle
+  - type: textarea
+    id: safety
+    attributes:
+      label: Privacy and safety considerations
+      description: Note possible false positives, false negatives, resource limits, or sensitive output risks.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: What existing ShareLint behavior or external tool did you try?
+  - type: dropdown
+    id: contribution
+    attributes:
+      label: Contribution
+      options:
+        - I can submit a pull request
+        - I can help with synthetic fixtures or review
+        - I am proposing the idea only
+    validations:
+      required: true
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Checklist
+      options:
+        - label: I searched existing issues and the roadmap.
+          required: true
+        - label: Any examples in this request are synthetic and contain no confidential data.
+          required: true

sharelint-0.1.0/.github/ISSUE_TEMPLATE/question.yml

@@ -0,0 +1,46 @@
+name: Question or setup help
+description: Ask about installation, documented behavior, or a sharing workflow
+title: "[Question]: "
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Questions are welcome. Describe the workflow with synthetic names and values only. Never attach a real document, report, secret, personal identifier, or private local path. Possible vulnerabilities belong in the private reporting flow described by SECURITY.md.
+  - type: input
+    id: version
+    attributes:
+      label: ShareLint version
+      description: Output of `sharelint --version`, a commit hash, or `not installed` if setup failed.
+      placeholder: 0.1.0 / not installed
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: Operating system, Python version, and installation method.
+      placeholder: Ubuntu 24.04, Python 3.14, source checkout
+    validations:
+      required: true
+  - type: textarea
+    id: question
+    attributes:
+      label: Question
+      description: What are you trying to inspect or automate, and what is unclear?
+    validations:
+      required: true
+  - type: textarea
+    id: attempted
+    attributes:
+      label: What you tried
+      description: Include sanitized commands and output when useful.
+      render: shell
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Privacy checklist
+      options:
+        - label: This question contains only synthetic data and sanitized paths.
+          required: true
+        - label: This is not a suspected security vulnerability requiring private reporting.
+          required: true

sharelint-0.1.0/.github/dependabot.yml

@@ -0,0 +1,24 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 5
+    groups:
+      python-tooling:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      github-actions:
+        patterns:
+          - "*"

sharelint-0.1.0/.github/pull_request_template.md

@@ -0,0 +1,36 @@
+## Summary
+
+<!-- What changed, and why is it needed? -->
+
+## Related issue
+
+<!-- Link an issue when applicable, for example: Closes #123 -->
+
+## Validation
+
+<!-- List the exact commands and results used to verify this change. -->
+
+```text
+python -m unittest discover -s tests -v
+PYTHONPATH=src python -m sharelint demo
+python -m compileall -q src tests
+ruff check .
+ruff format --check .
+mypy
+```
+
+## Privacy and maintenance checklist
+
+- [ ] Tests use only clearly synthetic data.
+- [ ] Normal reports, logs, errors, and snapshots do not expose matched values.
+- [ ] New or changed parsers have bounded input and explicit unknown/error behavior.
+- [ ] Originals remain untouched unless the behavior is explicit and documented.
+- [ ] No scanning-path network behavior was added.
+- [ ] User-facing behavior and known blind spots are documented.
+- [ ] English and Chinese user-facing docs were updated together, or the difference is explained above.
+- [ ] Tests and quality checks pass, or exceptions are explained above.
+- [ ] The change is focused enough to maintain over time.
+
+## Risk notes
+
+<!-- Describe compatibility, security, privacy, performance, or migration risks. -->

sharelint-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,94 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    name: Quality checks
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+      - name: Install development tools
+        run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]"
+      - name: Lint
+        run: ruff check .
+      - name: Check formatting
+        run: ruff format --check .
+      - name: Type check
+        run: mypy
+
+  tests:
+    name: Python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: pyproject.toml
+      - name: Install project and test tools
+        run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]"
+      - name: Run unittest contract
+        run: python -m unittest discover -s tests -v
+      - name: Run pytest suite
+        env:
+          PYTEST_DISABLE_PLUGIN_AUTOLOAD: "1"
+        run: pytest -p pytest_cov.plugin --cov=sharelint --cov-branch -q
+
+  wheel:
+    name: Build and install wheel
+    needs: [quality, tests]
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+      - name: Build distribution
+        run: python -m pip install --upgrade pip build && python -m build
+      - name: Install wheel
+        run: python -m pip install --no-deps --force-reinstall dist/*.whl
+      - name: Smoke-test installed commands
+        run: |
+          sharelint --version
+          sharelint rules > /dev/null
+          python -c "import sharelint; print(sharelint.__version__)"
+      - name: Upload distributions
+        uses: actions/upload-artifact@v4
+        with:
+          name: distributions
+          path: dist/
+          if-no-files-found: error
+          retention-days: 14

sharelint-0.1.0/.github/workflows/codeql.yml

@@ -0,0 +1,37 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "17 4 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze Python
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: python
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: /language:python

sharelint-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,88 @@
+name: Publish release
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.event.release.tag_name }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build and verify distributions
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+      - name: Verify release tag matches package version
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          PACKAGE_VERSION="$(PYTHONPATH=src python -c 'import sharelint; print(sharelint.__version__)')"
+          test "$RELEASE_TAG" = "v$PACKAGE_VERSION"
+      - name: Install release verification tools
+        run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]" twine
+      - name: Run lint and format checks
+        run: |
+          ruff check .
+          ruff format --check .
+      - name: Run type checks
+        run: mypy src
+      - name: Run tests
+        env:
+          PYTEST_DISABLE_PLUGIN_AUTOLOAD: "1"
+        run: |
+          python -m unittest discover -s tests -v
+          pytest -p pytest_cov.plugin --cov=sharelint --cov-branch -q
+      - name: Build distributions
+        run: python -m build
+      - name: Check distribution metadata
+        run: python -m twine check dist/*
+      - name: Smoke-test the built wheel in a clean environment
+        run: |
+          python -m venv "$RUNNER_TEMP/sharelint-wheel-smoke"
+          "$RUNNER_TEMP/sharelint-wheel-smoke/bin/python" -m pip install --no-deps dist/*.whl
+          "$RUNNER_TEMP/sharelint-wheel-smoke/bin/sharelint" --version
+          "$RUNNER_TEMP/sharelint-wheel-smoke/bin/sharelint" rules > /dev/null
+      - name: Upload distributions
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-distributions
+          path: dist/
+          if-no-files-found: error
+          retention-days: 14
+
+  publish:
+    name: Publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    environment:
+      name: pypi
+      url: https://pypi.org/p/sharelint
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Download distributions
+        uses: actions/download-artifact@v4
+        with:
+          name: release-distributions
+          path: dist/
+      # This requires a matching PyPI Trusted Publisher and protected `pypi`
+      # environment to be configured before the first release.
+      - name: Publish distributions with Trusted Publishing
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/

sharelint-0.1.0/CHANGELOG.md

@@ -0,0 +1,25 @@
+# Changelog
+
+All notable changes to ShareLint will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0] - 2026-08-24
+
+### Added
+
+- Local-only scanning for directories, archives, Office documents, PDFs, images, and text.
+- Recursive provenance for findings in nested share bundles.
+- Privacy-preserving console, JSON, SARIF, and HTML reports.
+- Deterministic fail-closed packaging with hash-bound receipts.
+- Explicit coverage gaps and bounded handling of untrusted archives.
+- Synthetic demonstration bundle, contributor governance, and security documentation.
+- Continuous integration across Python 3.11, 3.12, 3.13, and 3.14.
+- A branch-aware 75% coverage floor enforced in CI and release verification.
+- CodeQL analysis, dependency update automation, and a Trusted Publishing release workflow.
+
+[Unreleased]: https://github.com/jasonzhang06-source/sharelint/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/jasonzhang06-source/sharelint/releases/tag/v0.1.0

sharelint-0.1.0/CODE_OF_CONDUCT.md

@@ -0,0 +1,36 @@
+# Code of Conduct
+
+## Our standard
+
+ShareLint is committed to a respectful, inclusive, and technically rigorous
+community. Participants are expected to:
+
+- communicate with empathy and assume good faith;
+- critique ideas and code rather than people;
+- welcome questions and differing levels of experience;
+- respect privacy, consent, and confidentiality;
+- accept maintainer decisions about scope and project sustainability.
+
+Unacceptable behavior includes harassment, discrimination, threats, sexualized
+attention, deliberate intimidation, publishing another person's private
+information, or sustained disruption of project spaces.
+
+## Scope
+
+This code applies in repository issues, pull requests, discussions, and other
+spaces where someone is representing the ShareLint project.
+
+## Enforcement
+
+The maintainer may edit or remove content, close or lock threads, reject
+contributions, or temporarily or permanently restrict participation when needed
+to protect the community.
+
+Use GitHub's report and block features for platform abuse. For a
+repository-specific incident, contact the maintainer through a private contact
+method published on the maintainer's GitHub profile, if available. If no private
+channel is available, contact GitHub Support. Do not post sensitive incident
+details publicly.
+
+Reports will be considered as privately as practical. Retaliation against a
+good-faith reporter is not tolerated.

sharelint-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,79 @@
+# Contributing to ShareLint
+
+Thanks for helping make ShareLint more useful and trustworthy. Small, focused
+changes with tests are easiest to review and maintain.
+
+## Before opening an issue
+
+- Search existing issues and the roadmap for related work.
+- Use a minimal synthetic example. Never upload real credentials, personal
+  information, client documents, or other confidential material.
+- Report possible vulnerabilities privately as described in
+  [SECURITY.md](SECURITY.md), not in a public issue.
+
+## Development workflow
+
+1. Fork the repository and create a branch from `main`.
+2. Create a virtual environment and install the development dependencies:
+
+   ```bash
+   python -m venv .venv
+   source .venv/bin/activate
+   python -m pip install -e ".[dev]"
+   ```
+
+3. Make one coherent change and add or update tests.
+4. Run the required repository checks:
+
+   ```bash
+   python -m unittest discover -s tests -v
+   PYTHONPATH=src python -m sharelint demo
+   python -m compileall -q src tests
+   ```
+
+   When the development extras are installed, also run:
+
+   ```bash
+   ruff check .
+   ruff format --check .
+   mypy
+   PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 pytest -p pytest_cov.plugin --cov=sharelint --cov-branch -q
+   ```
+
+5. Open a pull request using the repository template.
+
+If a command is not available on the branch you are contributing to, explain
+what you ran instead in the pull request.
+
+## Privacy and safety expectations
+
+ShareLint operates on potentially sensitive files. Contributions must:
+
+- keep test fixtures synthetic and clearly fictional;
+- hide matched values in normal reports, logs, exceptions, and snapshots;
+- treat unknown, encrypted, truncated, or unscanned content explicitly rather
+  than silently declaring it clean;
+- bound recursion, decompression, file sizes, and other attacker-controlled
+  work;
+- preserve originals unless an explicitly documented command says otherwise;
+- never send scanned content, findings, filenames, or telemetry over a
+  network;
+- describe results as policy and coverage findings, not as a guarantee that a
+  file is anonymous or safe.
+
+New scanners should document supported surfaces, known blind spots, resource
+limits, and stable finding identifiers. Include nominal, malformed-input, and
+false-positive regression tests where practical.
+
+Rule changes should also follow the checklist in
+[Adding or changing a rule](docs/rules.md#adding-or-changing-a-rule).
+
+## Pull request review
+
+The maintainer may ask for changes to scope, tests, privacy behavior, or public
+interfaces. A pull request can be declined when its ongoing maintenance cost is
+too high, even if the implementation works. Decisions and material tradeoffs
+should remain visible in the issue or pull request.
+
+By contributing, you agree that your contribution is licensed under the
+project's MIT License.

sharelint-0.1.0/GOVERNANCE.md

@@ -0,0 +1,47 @@
+# Governance
+
+ShareLint is a maintainer-led open source project. This lightweight model keeps
+decision-making clear and sustainable for a project currently maintained by one
+person.
+
+## Roles
+
+- **Maintainer:** sets scope, merges changes, publishes releases, handles
+  security reports, and moderates project spaces.
+- **Contributors:** propose changes through issues and pull requests, review
+  work, and help improve documentation and tests.
+
+The maintainer has final responsibility for decisions. Significant choices
+should be explained in the relevant issue, pull request, or decision record so
+the reasoning remains reviewable.
+
+## Decision principles
+
+Changes are prioritized by user impact, privacy and security risk,
+reproducibility, compatibility, and ongoing maintenance cost. Rough consensus is
+preferred, but lack of consensus does not require the project to accept or
+indefinitely delay a change.
+
+Roadmap items are intentions, not commitments or deadlines. Issues and pull
+requests may be closed when they are out of scope, inactive, duplicated, or too
+costly to maintain.
+
+## Releases
+
+Releases follow semantic versioning where practical. Security fixes may be
+released without waiting for unrelated roadmap work. Only the maintainer, or a
+delegate explicitly granted release access, may publish official artifacts.
+The repeatable release procedure is documented in [docs/releasing.md](docs/releasing.md).
+
+## Adding maintainers
+
+Additional maintainers may be invited after sustained, constructive
+contributions and demonstrated care with privacy-sensitive changes. Access is
+granted gradually and may be removed when it is no longer needed.
+
+If the project becomes inactive, the MIT License permits the community to fork
+and continue the work. Any successor project must not imply that it publishes
+official ShareLint releases without authorization.
+
+Community behavior is governed by [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md), and
+vulnerabilities follow [SECURITY.md](SECURITY.md).

sharelint-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ShareLint contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.