threatwright 0.1.0rc1__tar.gz

threatwright-0.1.0rc1/.dockerignore

@@ -0,0 +1,19 @@
+.git
+**/node_modules
+.venv
+build
+dist
+.claude
+.private
+.env
+.env.*
+*.pem
+*.key
+*.p12
+*.pfx
+secrets
+**/__pycache__
+.mypy_cache
+.ruff_cache
+.pytest_cache
+src/threatwright/web

threatwright-0.1.0rc1/.gitattributes

@@ -0,0 +1,6 @@
+* text=auto eol=lf
+*.docx binary
+*.odt binary
+*.xlsx binary
+*.png binary
+*.ico binary

threatwright-0.1.0rc1/.github/workflows/audit.yml

@@ -0,0 +1,52 @@
+name: audit
+
+# Known vulnerabilities in locked dependencies (SECURITY.md, docs/cra-self-assessment.md).
+
+on:
+  pull_request:
+  schedule:
+    - cron: "17 5 * * 1" # weekly, Monday
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  python:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - name: pip-audit (runtime dependencies from uv.lock)
+        run: |
+          uv export --frozen --no-dev --no-emit-project --format requirements-txt -o requirements.txt
+          uvx pip-audit==2.10.1 --disable-pip --require-hashes -r requirements.txt
+
+  npm:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: "24"
+      - name: npm audit (app/package-lock.json)
+        working-directory: app
+        run: npm audit --audit-level=moderate
+
+  osv:
+    # Second opinion over both lockfiles; informative only.
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: google/osv-scanner-action/osv-scanner-action@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0
+        with:
+          scan-args: |-
+            --lockfile=uv.lock
+            --lockfile=app/package-lock.json

threatwright-0.1.0rc1/.github/workflows/ci.yml

@@ -0,0 +1,58 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        python: ["3.12", "3.14"]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          python-version: ${{ matrix.python }}
+
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: "24"
+
+      - name: Frontend check and build
+        working-directory: app
+        run: |
+          npm ci --no-audit --no-fund
+          npm run check
+          npm run build
+
+      - run: uv sync --locked
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+      - run: uv run mypy
+      - run: uv run playwright install --with-deps chromium
+      - run: uv run pytest -q
+      - run: uv run threatwright validate tests/fixtures/project
+
+      - name: Fixture project survives a load/save roundtrip without diff
+        run: |
+          uv run python -c "from threatwright.model.store import Project; p = Project.load('tests/fixtures/project'); assert not p.issues, p.issues; p.save()"
+          git diff --exit-code
+
+  # One stable check name for branch protection; matrix job names change with the matrix.
+  ci-ok:
+    if: always()
+    needs: [test]
+    runs-on: ubuntu-latest
+    steps:
+      - run: test "${{ needs.test.result }}" = success

threatwright-0.1.0rc1/.github/workflows/leakcheck.yml

@@ -0,0 +1,26 @@
+name: leakcheck
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  leakcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0 # scan full history, not just HEAD
+          persist-credentials: false
+
+      - name: Forbidden files (AI tooling, local config, secrets)
+        run: python3 scripts/check_forbidden_files.py
+
+      - name: Secret scan (gitleaks, full history)
+        run: >
+          docker run --rm -v "$PWD:/repo" ghcr.io/gitleaks/gitleaks:v8.30.1
+          git /repo --redact --verbose --exit-code 1

threatwright-0.1.0rc1/.github/workflows/release.yml

@@ -0,0 +1,185 @@
+name: release
+
+# Tag vX.Y.Z (must match the version in pyproject.toml) -> GitHub Release with sdist, wheel,
+# portable builds (Windows zip, Linux tar.gz), CycloneDX SBOMs, SHA256SUMS, Sigstore
+# provenance; PyPI via trusted publishing; container image on ghcr.io.
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions: {}
+
+jobs:
+  frontend:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: "24"
+      - name: Build bundle and npm SBOM
+        working-directory: app
+        run: |
+          npm ci --no-audit --no-fund
+          npm run build
+          # The bundle is compiled from devDependencies, so the SBOM includes them.
+          npm sbom --sbom-format cyclonedx > ../sbom-npm.cdx.json
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: web
+          path: src/threatwright/web/
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: release-sbom-npm
+          path: sbom-npm.cdx.json
+
+  python:
+    needs: frontend
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: web
+          path: src/threatwright/web
+      - name: Tag matches package version
+        run: test "$(uv version --short)" = "${GITHUB_REF_NAME#v}"
+      - run: uv build
+      - name: Python SBOM (runtime dependencies from uv.lock)
+        run: |
+          uv export --frozen --no-dev --no-emit-project --format requirements-txt -o requirements.txt
+          uvx --from cyclonedx-bom==7.5.0 cyclonedx-py requirements requirements.txt -o sbom-python.cdx.json
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: release-python
+          path: dist/
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: release-sbom-python
+          path: sbom-python.cdx.json
+
+  portable:
+    needs: frontend
+    strategy:
+      matrix:
+        os: [windows-latest, ubuntu-latest]
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          python-version: "3.13"
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: web
+          path: src/threatwright/web
+      - run: uv sync --locked
+      - run: uv run python packaging/build.py
+      - name: Smoke test
+        run: |
+          ./dist/threatwright/threatwright --version
+          ./dist/threatwright/threatwright validate tests/fixtures/project
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: release-portable-${{ matrix.os }}
+          path: |
+            dist/threatwright-*.zip
+            dist/threatwright-*.tar.gz
+
+  release:
+    needs: [frontend, python, portable]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # create the release
+      id-token: write # Sigstore signing via GitHub OIDC
+      attestations: write
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: release-*
+          path: assets
+          merge-multiple: true
+      - name: Checksums
+        working-directory: assets
+        run: sha256sum -- * > SHA256SUMS
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: assets/*
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - name: Sign checksums (keyless)
+        working-directory: assets
+        run: cosign sign-blob --yes --bundle SHA256SUMS.sigstore.json SHA256SUMS
+      - name: GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: >
+          gh release create "$GITHUB_REF_NAME" assets/*
+          --repo "$GITHUB_REPOSITORY" --verify-tag --generate-notes --title "$GITHUB_REF_NAME"
+
+  pypi:
+    needs: release
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write # trusted publishing
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: release-python
+          path: dist
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+
+  image:
+    needs: python
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Image name
+        id: meta
+        run: |
+          owner="$(echo "$GITHUB_REPOSITORY_OWNER" | tr '[:upper:]' '[:lower:]')"
+          echo "name=ghcr.io/$owner/threatwright" >> "$GITHUB_OUTPUT"
+          echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        id: build
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.name }}:${{ steps.meta.outputs.version }}
+          provenance: mode=max
+          sbom: true
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-name: ${{ steps.meta.outputs.name }}
+          subject-digest: ${{ steps.build.outputs.digest }}
+          push-to-registry: true

threatwright-0.1.0rc1/.gitignore

@@ -0,0 +1,72 @@
+# --- AI assistant / local tooling: never publish -------------------------
+.claude/
+CLAUDE.md
+CLAUDE.local.md
+**/CLAUDE.md
+**/CLAUDE.local.md
+.mcp.json
+graphify-out/
+.cursor/
+.aider*
+.continue/
+.copilot/
+AGENTS.md
+
+# --- Private notes (customer references, drafts): never publish -------------
+.private/
+
+# --- Secrets and local config ---------------------------------------------
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+*.pfx
+*.kdbx
+secrets/
+*.local.yaml
+*.local.yml
+
+# --- Python -----------------------------------------------------------------
+__pycache__/
+*.py[cod]
+*.egg-info/
+.venv/
+venv/
+.python-version
+.mypy_cache/
+.ruff_cache/
+.pytest_cache/
+.coverage
+.coverage.*
+htmlcov/
+.tox/
+.nox/
+
+# --- Node / frontend ----------------------------------------------------------
+node_modules/
+.svelte-kit/
+app/dist/
+src/threatwright/web/
+
+# --- Build artefacts ---------------------------------------------------------
+build/
+dist/
+*.spec.bak
+sbom*.json
+playwright-report/
+test-results/
+
+# --- Editors / OS ------------------------------------------------------------
+.idea/
+.vscode/
+*.swp
+*~
+.DS_Store
+Thumbs.db
+desktop.ini
+
+# --- Office lock files -------------------------------------------------------
+~$*
+.~lock.*#

threatwright-0.1.0rc1/.pre-commit-config.yaml

@@ -0,0 +1,13 @@
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.1
+    hooks:
+      - id: gitleaks
+  - repo: local
+    hooks:
+      - id: forbidden-files
+        name: forbidden files
+        entry: python scripts/check_forbidden_files.py
+        language: system
+        pass_filenames: false
+        always_run: true

threatwright-0.1.0rc1/.pre-commit-hooks.yaml

@@ -0,0 +1,9 @@
+# Hooks offered to other repositories (docs/ci.md). Pass the project folder via `args`,
+# e.g. `args: [--strict, threatmodel]`; default is the repository root.
+- id: threatwright-validate
+  name: threatwright validate
+  description: Check a Threatwright project (schema, references, rules).
+  entry: threatwright validate
+  language: python
+  files: \.ya?ml$
+  pass_filenames: false

threatwright-0.1.0rc1/Dockerfile

@@ -0,0 +1,37 @@
+# CI runtime image (ADR-0009): threatwright CLI + LibreOffice Writer for PDF, no GUI.
+# Base images pinned by digest (multi-arch index), looked up 2026-10-19; bump deliberately.
+
+# --- 1: frontend bundle ------------------------------------------------------------
+FROM node:24-slim@sha256:a5f4366e834695d5f363b920c104953a535d3a9864d1bdf74566a0ebe01daee5 AS frontend
+WORKDIR /src/app
+COPY app/package.json app/package-lock.json ./
+RUN npm ci --no-audit --no-fund
+COPY app/ ./
+# vite writes to ../src/threatwright/web
+RUN mkdir -p /src/src/threatwright && npm run build
+
+# --- 2: wheel + locked requirements ----------------------------------------------
+FROM python:3.13-slim@sha256:70729b46c69b4f1e97c4822c1af3df53a1476cf5ddc6c087c0c10bc3a5678c2f AS wheel
+COPY --from=ghcr.io/astral-sh/uv:0.13.1@sha256:4a1f3666816dafadd20ceb71eac9a7d56d7ef30279f7d64048519ab901ada336 /uv /usr/local/bin/uv
+WORKDIR /src
+COPY pyproject.toml uv.lock README.md LICENSE ./
+COPY src/ src/
+COPY --from=frontend /src/src/threatwright/web src/threatwright/web
+RUN uv build --wheel --out-dir /dist \
+ && uv export --frozen --no-dev --no-emit-project --format requirements-txt -o /dist/requirements.txt
+
+# --- 3: runtime --------------------------------------------------------------------
+FROM python:3.13-slim@sha256:70729b46c69b4f1e97c4822c1af3df53a1476cf5ddc6c087c0c10bc3a5678c2f
+# git: diff against tags in CI. LibreOffice Writer (headless) for PDF output.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends git libreoffice-writer-nogui fonts-dejavu-core \
+ && rm -rf /var/lib/apt/lists/*
+COPY --from=wheel /dist /tmp/dist
+RUN pip install --no-cache-dir --require-hashes -r /tmp/dist/requirements.txt \
+ && pip install --no-cache-dir --no-deps /tmp/dist/*.whl \
+ && rm -rf /tmp/dist
+RUN useradd --create-home --uid 10001 threatwright
+USER threatwright
+WORKDIR /work
+ENTRYPOINT ["threatwright"]
+CMD ["--help"]