specify-cli 1.1.1__tar.gz → 1.1.3__tar.gz

specify_cli-1.1.3/.gitattributes

@@ -0,0 +1,9 @@
+* text=auto eol=lf
+
+.github/workflows/*.lock.yml linguist-generated=true merge=ours -whitespace
+# The project constitution is the one dogfooding artifact carried forward.
+# Keep it exempt from git's whitespace checks (git diff --check / CI) since its
+# generated formatting is not hand-edited.
+.specify/memory/constitution.md -whitespace
+
+.github/workflows/*.lock.yml linguist-generated=true

specify_cli-1.1.3/.github/ISSUE_TEMPLATE/bundle_submission.yml

@@ -0,0 +1,295 @@
+name: Bundle Submission
+description: Submit your bundle metadata for community catalog validation
+title: "[Bundle]: Add "
+labels: ["triage-must-have"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for contributing a bundle! This template captures metadata for maintainers to validate formatting, links, component resolution, and installation evidence. Maintainers do not audit, endorse, or support bundle code or installed components.
+
+        **Before submitting:**
+        - Review the [Bundles reference](https://github.com/github/spec-kit/blob/main/docs/reference/bundles.md)
+        - Ensure your bundle has a valid `bundle.yml` manifest
+        - Create a GitHub release with a versioned bundle artifact
+        - Test installation from a downloaded artifact: `specify bundle install ./your-bundle-1.0.0.zip`
+        - If you host a bundle catalog, test catalog installation with `specify bundle catalog add <catalog-url> --id <catalog-id> --policy install-allowed` and `specify bundle install <bundle-id>`
+        - If your bundle depends on components from non-default catalogs, document those catalog URLs and test installation from a clean project
+
+        **After submitting:** GitHub automatically applies the `triage-must-have` intake verdict. A maintainer separately applies the `bundle-submission` label during issue triage, which starts the automated catalog validation. You don't need to apply any label or ask for one.
+
+  - type: input
+    id: bundle-id
+    attributes:
+      label: Bundle ID
+      description: Unique bundle identifier; must start and end with a lowercase letter or digit and may contain lowercase letters, digits, dots, underscores, and hyphens between
+      placeholder: "e.g., security-governance-stack"
+    validations:
+      required: true
+
+  - type: input
+    id: bundle-name
+    attributes:
+      label: Bundle Name
+      description: Human-readable bundle name
+      placeholder: "e.g., Security Governance Stack"
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Semantic version number
+      placeholder: "e.g., 1.0.0"
+    validations:
+      required: true
+
+  - type: input
+    id: role
+    attributes:
+      label: Role or Team
+      description: Primary role, team, or persona this bundle provisions
+      placeholder: "e.g., security-engineer, product-manager, platform-team"
+    validations:
+      required: true
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: Brief description of the stack this bundle installs
+      placeholder: Installs a security governance stack with compliance presets, review commands, and evidence workflows
+    validations:
+      required: true
+
+  - type: input
+    id: author
+    attributes:
+      label: Author
+      description: Your name or organization
+      placeholder: "e.g., Jane Doe or Acme Corp"
+    validations:
+      required: true
+
+  - type: input
+    id: repository
+    attributes:
+      label: Repository URL
+      description: GitHub repository URL for your bundle source
+      placeholder: "https://github.com/your-org/spec-kit-bundle-your-bundle"
+    validations:
+      required: true
+
+  - type: input
+    id: download-url
+    attributes:
+      label: Download URL
+      description: URL to the versioned bundle artifact generated by `specify bundle build`
+      placeholder: "https://github.com/your-org/spec-kit-bundle-your-bundle/releases/download/v1.0.0/your-bundle-1.0.0.zip"
+    validations:
+      required: true
+
+  - type: input
+    id: documentation
+    attributes:
+      label: Documentation URL
+      description: Link to documentation that explains what the bundle installs and how to use it
+      placeholder: "https://github.com/your-org/spec-kit-bundle-your-bundle/blob/main/README.md"
+    validations:
+      required: true
+
+  - type: input
+    id: license
+    attributes:
+      label: License
+      description: Open source license type
+      placeholder: "e.g., MIT, Apache-2.0"
+    validations:
+      required: true
+
+  - type: input
+    id: speckit-version
+    attributes:
+      label: Required Spec Kit Version
+      description: Minimum Spec Kit version required by the bundle
+      placeholder: "e.g., >=0.9.0"
+    validations:
+      required: true
+
+  - type: input
+    id: integration
+    attributes:
+      label: Integration Target (optional)
+      description: Integration ID if the bundle pins one; leave empty if integration-agnostic
+      placeholder: "e.g., claude, copilot, gemini"
+
+  - type: textarea
+    id: components-provided
+    attributes:
+      label: Components Provided
+      description: List the extensions, presets, workflows, and steps this bundle installs
+      placeholder: |
+        - extensions: sicario-guard@0.5.1
+        - presets: sicario-core@0.5.1, sicario-ai-governance@0.5.1
+        - workflows: evidence-review@1.0.0
+        - steps: threat-model
+    validations:
+      required: true
+
+  - type: textarea
+    id: required-catalogs
+    attributes:
+      label: Required Component Catalogs
+      description: List any non-default catalogs users must add before this bundle can resolve its components; enter "None" if every component resolves from built-in or bundled catalogs
+      placeholder: |
+        - Presets: https://github.com/your-org/your-bundle/releases/download/v1.0.0/presets.json
+        - Extensions: https://github.com/your-org/your-bundle/releases/download/v1.0.0/extensions.json
+    validations:
+      required: true
+
+  - type: textarea
+    id: tags
+    attributes:
+      label: Tags
+      description: 2-5 relevant tags (lowercase, separated by commas)
+      placeholder: "security, governance, compliance"
+    validations:
+      required: true
+
+  - type: textarea
+    id: features
+    attributes:
+      label: Key Features
+      description: List the main capabilities this bundle provides
+      placeholder: |
+        - Installs evidence-first security governance templates
+        - Adds automated bundle verification commands
+        - Pins all components to release-tested versions
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: testing
+    attributes:
+      label: Testing Checklist
+      description: Confirm that your bundle has been tested
+      options:
+        - label: Validation succeeds with `specify bundle validate --path <bundle-directory>`
+          required: true
+        - label: Build succeeds with `specify bundle build --path <bundle-directory>` and produces the submitted artifact
+          required: true
+        - label: Bundle installs successfully from the built artifact
+          required: true
+        - label: The submitted distribution path was tested end to end, including bundle-ID installation from an install-allowed catalog when a catalog entry is proposed
+          required: true
+        - label: Installation was tested in a clean Spec Kit project
+          required: true
+        - label: Required component catalogs are documented and were included in testing, or no extra catalogs are required
+          required: true
+        - label: Documentation is complete and accurate
+          required: true
+
+  - type: checkboxes
+    id: requirements
+    attributes:
+      label: Submission Requirements
+      description: Verify your bundle meets all requirements
+      options:
+        - label: Valid `bundle.yml` manifest included
+          required: true
+        - label: README.md explains the bundle's intended role, installed components, and installation steps
+          required: true
+        - label: LICENSE file included
+          required: true
+        - label: GitHub release created with a version tag
+          required: true
+        - label: Bundle ID matches the manifest and follows naming conventions
+          required: true
+        - label: Every extension, preset, workflow, and step reference is pinned where the manifest requires a version
+          required: true
+
+  - type: textarea
+    id: testing-details
+    attributes:
+      label: Testing Details
+      description: Describe how you tested your bundle
+      placeholder: |
+        **Tested on:**
+        - macOS 15 with Spec Kit v0.9.0
+        - Ubuntu 24.04 with Spec Kit v0.9.0
+
+        **Test project:** [Link or description]
+
+        **Test scenarios:**
+        1. Added required catalogs
+        2. Validated bundle manifest
+        3. Built release artifact
+        4. Installed bundle in a clean project
+        5. Ran the installed commands or workflows
+    validations:
+      required: true
+
+  - type: textarea
+    id: example-usage
+    attributes:
+      label: Example Usage
+      description: Provide a simple example of installing and using your bundle
+      render: markdown
+      placeholder: |
+        ```bash
+        # Add any required component catalogs first
+        specify preset catalog add https://github.com/your-org/your-bundle/releases/download/v1.0.0/presets.json --name your-bundle --install-allowed
+        specify extension catalog add https://github.com/your-org/your-bundle/releases/download/v1.0.0/extensions.json --name your-bundle --install-allowed
+
+        # Install the downloaded bundle artifact
+        curl -L -o your-bundle-1.0.0.zip https://github.com/your-org/your-bundle/releases/download/v1.0.0/your-bundle-1.0.0.zip
+        specify bundle install ./your-bundle-1.0.0.zip
+
+        # Or test through an install-allowed bundle catalog
+        specify bundle catalog add https://github.com/your-org/your-bundle/releases/download/v1.0.0/bundles.json --id your-bundle-catalog --policy install-allowed
+        specify bundle install your-bundle
+        ```
+    validations:
+      required: true
+
+  - type: textarea
+    id: catalog-entry
+    attributes:
+      label: Proposed Catalog Entry
+      description: Provide the JSON entry that would appear under the top-level `bundles` object in a bundle catalog (helps reviewers)
+      render: json
+      placeholder: |
+        {
+          "your-bundle": {
+            "name": "Your Bundle",
+            "id": "your-bundle",
+            "version": "1.0.0",
+            "role": "security-engineer",
+            "description": "Brief description of the stack",
+            "author": "Your Name",
+            "license": "MIT",
+            "download_url": "https://github.com/your-org/your-bundle/releases/download/v1.0.0/your-bundle-1.0.0.zip",
+            "repository": "https://github.com/your-org/your-bundle",
+            "requires": {
+              "speckit_version": ">=0.9.0"
+            },
+            "provides": {
+              "extensions": 1,
+              "presets": 2,
+              "steps": 0,
+              "workflows": 1
+            },
+            "tags": ["security", "governance"],
+            "verified": false
+          }
+        }
+    validations:
+      required: true
+
+  - type: textarea
+    id: additional-context
+    attributes:
+      label: Additional Context
+      description: Any other information that would help reviewers
+      placeholder: Screenshots, demo videos, links to related projects, dependency-resolution notes, etc.

specify_cli-1.1.3/.github/ISSUE_TEMPLATE/workflow_step_submission.yml

@@ -0,0 +1,268 @@
+name: Workflow Step Type Submission
+description: Submit a custom workflow step package for community catalog intake
+title: "[Workflow Step]: Add "
+labels: ["triage-must-have"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for contributing a workflow step type! This form captures the package, release, and catalog metadata needed for community catalog review.
+
+        **Before submitting:**
+        - Review the [Community Workflow Step Types guide](https://github.com/github/spec-kit/blob/main/docs/community/workflow-steps.md)
+        - Publish a package containing root-level `step.yml` and `__init__.py` files
+        - Ensure `step.type_key`, the catalog ID, and the matching `StepBase.type_key` are identical
+        - Create a GitHub release with a versioned step package archive
+        - Provide version-pinned URLs and SHA-256 digests for every catalog-downloaded file
+        - Test the release artifact with `specify workflow step add <step-id> --from <download-url>`
+
+        **After submitting:** GitHub automatically applies only the `triage-must-have` intake verdict. A maintainer applies `workflow-step-submission` during triage to start automated metadata validation. Opening the form alone does not start validation. Successful validation proposes a draft catalog pull request for maintainer review; submitted Python is never reviewed or executed by this automation.
+
+  - type: input
+    id: step-id
+    attributes:
+      label: Step Type ID
+      description: Exact catalog key and `step.type_key`; use lowercase letters, digits, and hyphens in one safe path component, avoiding built-in types and Windows device names such as con, aux, com1, and lpt1
+      placeholder: "e.g., deploy"
+    validations:
+      required: true
+
+  - type: input
+    id: step-name
+    attributes:
+      label: Step Type Name
+      description: Human-readable name declared in `step.yml`
+      placeholder: "e.g., Deploy"
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: PEP 440-compatible release version; it must match `step.version` in the submitted `step.yml`
+      placeholder: "e.g., 1.0.0"
+    validations:
+      required: true
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: Concise description of the workflow behavior this step type implements
+      placeholder: Deploys the current project to a configured environment and returns the deployment URL
+    validations:
+      required: true
+
+  - type: input
+    id: author
+    attributes:
+      label: Author
+      description: Name or organization declared for the package
+      placeholder: "e.g., Jane Doe or Acme Corp"
+    validations:
+      required: true
+
+  - type: input
+    id: repository
+    attributes:
+      label: Repository URL
+      description: Public source repository containing the submitted package
+      placeholder: "https://github.com/your-org/spec-kit-step-deploy"
+    validations:
+      required: true
+
+  - type: input
+    id: download-url
+    attributes:
+      label: Download URL
+      description: >-
+        URL to the versioned step package archive; GitHub-generated tag archives support `.zip` and `.tar.gz`,
+        while named release assets may also use `.tgz`. The URL path must match `^[A-Za-z0-9._~+!/-]+$`;
+        percent escapes, spaces, query strings, fragments, and dot/traversal segments are rejected.
+        Tags have no slashes; `+` and `!` support PEP 440 local versions and epochs.
+      placeholder: "https://github.com/your-org/spec-kit-step-deploy/releases/download/v1.0.0/deploy-1.0.0.zip"
+    validations:
+      required: true
+
+  - type: input
+    id: step-yml-url
+    attributes:
+      label: step.yml URL
+      description: >-
+        Exact tag-pinned raw GitHub HTTPS URL used as the catalog `step_yml_url` (or `url`).
+        The file path within the tag must match `^[A-Za-z0-9._~/-]+$`, without percent escapes or spaces;
+        tags may additionally contain `+` and `!`.
+      placeholder: "https://raw.githubusercontent.com/your-org/spec-kit-step-deploy/v1.0.0/step.yml"
+    validations:
+      required: true
+
+  - type: input
+    id: init-url
+    attributes:
+      label: __init__.py URL
+      description: >-
+        Exact tag-pinned raw GitHub HTTPS URL used as the catalog `init_url`.
+        The file path within the tag must match `^[A-Za-z0-9._~/-]+$`, without percent escapes or spaces;
+        tags may additionally contain `+` and `!`.
+      placeholder: "https://raw.githubusercontent.com/your-org/spec-kit-step-deploy/v1.0.0/__init__.py"
+    validations:
+      required: true
+
+  - type: textarea
+    id: extra-files
+    attributes:
+      label: Extra File URLs
+      description: >-
+        JSON mapping of every additional package-relative file path to its exact tag-pinned raw GitHub HTTPS URL.
+        Package-relative keys and file paths within the tag must match `^[A-Za-z0-9._~/-]+$`;
+        percent escapes, spaces, query strings, and fragments are rejected. Tags may additionally contain `+` and `!`.
+        Paths must use forward slashes, be relative and non-empty, contain no empty, `.` or `..` segments,
+        and must not case-insensitively alias `step.yml` or `__init__.py`, another file, or a package directory.
+        Case-insensitive aliases of `.git`, `__pycache__`, and `.DS_Store` are forbidden.
+        Enter `{}` when there are no extra files.
+      render: json
+      placeholder: |
+        {
+          "helpers.py": "https://raw.githubusercontent.com/your-org/spec-kit-step-deploy/v1.0.0/helpers.py"
+        }
+    validations:
+      required: true
+
+  - type: textarea
+    id: file-sha256
+    attributes:
+      label: Per-file SHA-256 Digests
+      description: JSON mapping containing exactly `step.yml`, `__init__.py`, and every Extra File URL path, each with a 64-character hexadecimal SHA-256 digest
+      render: json
+      placeholder: |
+        {
+          "step.yml": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "__init__.py": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+          "helpers.py": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+        }
+    validations:
+      required: true
+
+  - type: input
+    id: license
+    attributes:
+      label: License
+      description: SPDX license identifier for the package; the repository must include the corresponding license text
+      placeholder: "e.g., MIT or Apache-2.0"
+    validations:
+      required: true
+
+  - type: input
+    id: speckit-compatibility
+    attributes:
+      label: Spec Kit Compatibility
+      description: Spec Kit version constraint tested with this release; the current step catalog does not yet enforce this constraint
+      placeholder: "e.g., >=0.11.0"
+    validations:
+      required: true
+
+  - type: textarea
+    id: runtime-dependencies
+    attributes:
+      label: Runtime and Tool Dependencies
+      description: List required Python packages, executables, services, environment variables, or platform constraints; enter `None` when the package has no external dependencies
+      placeholder: |
+        - Python package: requests>=2.32
+        - Executable: kubectl>=1.30
+        - Environment variable: KUBECONFIG
+    validations:
+      required: true
+
+  - type: dropdown
+    id: step-type-count
+    attributes:
+      label: Number of Provided Step Types
+      description: One installed package currently registers exactly one `step.type_key`
+      options:
+        - "1"
+    validations:
+      required: true
+
+  - type: textarea
+    id: step-types-provided
+    attributes:
+      label: Step Type Provided
+      description: Name the single `StepBase` subclass and its exact `type_key`
+      placeholder: "DeployStep — deploy"
+    validations:
+      required: true
+
+  - type: input
+    id: documentation
+    attributes:
+      label: Documentation URL
+      description: Tag-pinned Markdown documentation (`.md`) covering configuration, outputs, failure behavior, side effects, and an example workflow; README.md is not required
+      placeholder: "https://github.com/your-org/spec-kit-step-deploy/blob/v1.0.0/README.md"
+    validations:
+      required: true
+
+  - type: input
+    id: changelog
+    attributes:
+      label: Changelog URL
+      description: Tag-pinned changelog for this release; leave empty only for an initial release with no prior versions
+      placeholder: "https://github.com/your-org/spec-kit-step-deploy/blob/v1.0.0/CHANGELOG.md"
+
+  - type: textarea
+    id: testing-details
+    attributes:
+      label: Testing Details
+      description: Describe positive and negative configuration tests, execution/status/output tests, and any resume, nested, or concurrent behavior that applies
+      placeholder: |
+        **Tested with:** Spec Kit 0.11.0 on macOS and Ubuntu
+
+        **Evidence:**
+        - Valid configuration completes with the documented outputs
+        - Invalid configuration returns a failed result with an actionable error
+        - Release artifact installs with `specify workflow step add deploy --from ...`
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: attestations
+    attributes:
+      label: Required Attestations
+      description: Confirm the submitted release satisfies the current external step-package contract
+      options:
+        - label: The release artifact contains regular, non-symlink `step.yml` and `__init__.py` files at the package root or under exactly one top-level directory
+          required: true
+        - label: The catalog ID, `step.type_key`, and the matching `StepBase.type_key` are identical and do not collide with a built-in step type
+          required: true
+        - label: The submitted version matches `step.version`, the download URL identifies that versioned release, and every catalog file URL is version-pinned
+          required: true
+        - label: The SHA-256 mapping covers exactly every file the catalog installer downloads
+          required: true
+        - label: The release artifact installs successfully with `specify workflow step add <step-id> --from <download-url>`
+          required: true
+        - label: Runtime and tool dependencies, side effects, configuration, outputs, and failure behavior are documented
+          required: true
+        - label: The repository includes the submitted license and complete source for the released package
+          required: true
+        - label: I understand that custom workflow steps execute Python with the user's privileges and that a community catalog listing is not a code audit, endorsement, or support commitment
+          required: true
+
+  - type: textarea
+    id: additional-context
+    attributes:
+      label: Additional Context
+      description: Optional links or notes that help maintainers verify the submitted metadata
+      placeholder: Release notes, compatibility notes, or related issue links
+
+  - type: textarea
+    id: ai-disclosure
+    attributes:
+      label: AI Disclosure
+      description: >-
+        Per our [Contributing guidelines](https://github.com/github/spec-kit/blob/main/CONTRIBUTING.md#ai-contributions-in-spec-kit),
+        any AI assistance used to create this issue must be disclosed. If you used AI, name the agent/tool, model(s),
+        settings/mode (reasoning effort; autonomous vs. human-supervised), and extent. Otherwise leave this as "N/A".
+        This does not change how your issue is handled — it just gives maintainers visibility into model/agent usage.
+      value: "N/A"
+    validations:
+      required: true