From 9354739e240b55f570c0d60514774798edd68b91 Mon Sep 17 00:00:00 2001 From: Omar Nahhas Sanchez Date: Wed, 5 Aug 2026 01:45:43 +0100 Subject: [PATCH] =?UTF-8?q?chore:=20open-source=20readiness=20=E2=80=94=20?= =?UTF-8?q?devkit=20v2.1.6,=20CoC,=20usage=20docs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Devkit bumped to v2.1.6, which brings the hardened caller (DEC-081): the reusable workflow ref is pinned to a release tag instead of @main, and secrets are passed explicitly instead of secrets: inherit. @main meant every merge to the devkit went live here immediately and unreviewed, and inherit forwarded every repo- and org-level secret to it. Neither is needed: the workflow declares exactly three secrets, all optional. CODE_OF_CONDUCT.md (Contributor Covenant) — the last missing governance file. README gains a Usage section written from the behaviours the BDD suite actually asserts, cross-linked to docs/BEHAVIOUR.md so a reader can see each one as a screenshot from a passing run. No claims that CI does not prove. Existing repo-specific issue templates are deliberately left alone — they are tailored to this plugin and better than the generic ones. --- .github/ISSUE_TEMPLATE/config.yml | 5 ++ .github/workflows/devkit-sync.yml | 2 +- .github/workflows/plugin-e2e.yml | 23 ++++++-- CODE_OF_CONDUCT.md | 87 +++++++++++++++++++++++++++++++ README.md | 38 ++++++++++++++ tests/_testkit | 2 +- 6 files changed, 150 insertions(+), 7 deletions(-) create mode 100644 .github/ISSUE_TEMPLATE/config.yml create mode 100644 CODE_OF_CONDUCT.md diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..d679930 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,5 @@ +blank_issues_enabled: true +contact_links: + - name: Security vulnerability + url: https://github.com/agent-zero-plugins/agent-zero-plugin-diff-visualizer/security/advisories/new + about: Please report security issues privately, not as public issues. diff --git a/.github/workflows/devkit-sync.yml b/.github/workflows/devkit-sync.yml index d2a8497..bc11a0f 100644 --- a/.github/workflows/devkit-sync.yml +++ b/.github/workflows/devkit-sync.yml @@ -35,7 +35,7 @@ permissions: jobs: sync: - uses: agent-zero-plugins/agent-zero-plugin-development-testkit/.github/workflows/devkit-sync.yml@main + uses: agent-zero-plugins/agent-zero-plugin-development-testkit/.github/workflows/devkit-sync.yml@v2.1.6 with: devkit-submodule-path: "tests/_testkit" secrets: diff --git a/.github/workflows/plugin-e2e.yml b/.github/workflows/plugin-e2e.yml index b1f7566..587c7c9 100644 --- a/.github/workflows/plugin-e2e.yml +++ b/.github/workflows/plugin-e2e.yml @@ -8,9 +8,19 @@ # (.devkit.yml `plugin_dir` → else canonical usr/plugins/), so this # template is identical across all repos. # -# Needs the shared sync-App secrets to clone the private devkit submodule, and -# (DEC-055) GHCR_PULL_TOKEN to pull the private fork image. `secrets: inherit` -# forwards all repo secrets, so new shared secrets need no caller change. +# Needs (DEC-055) GHCR_PULL_TOKEN to pull the private fork image; the sync-App +# pair is legacy/optional since the devkit went public (DEC-075). +# +# SECRETS ARE PASSED EXPLICITLY, not via `secrets: inherit` (DEC-081). +# `inherit` forwards EVERY repo- and org-level secret to the reusable workflow — +# including secrets added later and secrets the workflow never declares. The +# reusable workflow declares exactly the three below, all `required: false`, so +# this list is complete. Adding a shared secret later means editing this template +# and re-running `make link-workflows`, which is the same cadence as every other +# devkit asset (devkit-sync.caller.yml already pays exactly this cost). +# +# The `uses:` ref is pinned to a RELEASE TAG, not `@main`. With `@main`, every +# merge to the devkit went live in 24 consumers' CI immediately and unreviewed. name: plugin-e2e on: @@ -30,7 +40,10 @@ permissions: jobs: e2e: - uses: agent-zero-plugins/agent-zero-plugin-development-testkit/.github/workflows/plugin-e2e.yml@main - secrets: inherit + uses: agent-zero-plugins/agent-zero-plugin-development-testkit/.github/workflows/plugin-e2e.yml@v2.1.6 + secrets: + GHCR_PULL_TOKEN: ${{ secrets.GHCR_PULL_TOKEN }} + SKILLS_SYNC_APP_CLIENT_ID: ${{ secrets.SKILLS_SYNC_APP_CLIENT_ID }} + SKILLS_SYNC_APP_PRIVATE_KEY: ${{ secrets.SKILLS_SYNC_APP_PRIVATE_KEY }} with: capture-all-traces: ${{ inputs.capture_all_traces || false }} diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..cd77b98 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,87 @@ +# Contributor Covenant Code of Conduct + +## Our Pledge + +We as members, contributors, and leaders pledge to make participation in our +community a harassment-free experience for everyone, regardless of age, body +size, visible or invisible disability, ethnicity, sex characteristics, gender +identity and expression, level of experience, education, socio-economic status, +nationality, personal appearance, race, caste, color, religion, or sexual +identity and orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, +diverse, inclusive, and healthy community. + +## Our Standards + +Examples of behavior that contributes to a positive environment for our +community include: + +* Demonstrating empathy and kindness toward other people +* Being respectful of differing opinions, viewpoints, and experiences +* Giving and gracefully accepting constructive feedback +* Accepting responsibility and apologizing to those affected by our mistakes, + and learning from the experience +* Focusing on what is best not just for us as individuals, but for the overall + community + +Examples of unacceptable behavior include: + +* The use of sexualized language or imagery, and sexual attention or advances of + any kind +* Trolling, insulting or derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or email address, + without their explicit permission +* Other conduct which could reasonably be considered inappropriate in a + professional setting + +## Enforcement Responsibilities + +Community leaders are responsible for clarifying and enforcing our standards of +acceptable behavior and will take appropriate and fair corrective action in +response to any behavior that they deem inappropriate, threatening, offensive, +or harmful. + +Community leaders have the right and responsibility to remove, edit, or reject +comments, commits, code, wiki edits, issues, and other contributions that are +not aligned to this Code of Conduct, and will communicate reasons for moderation +decisions when appropriate. + +## Scope + +This Code of Conduct applies within all community spaces, and also applies when +an individual is officially representing the community in public spaces. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported to the community leaders responsible for enforcement by opening a +report via the repository's +[private vulnerability reporting form](https://github.com/agent-zero-plugins/agent-zero-plugin-development-testkit/security/advisories/new) +(also used for conduct reports) or by contacting the repository maintainers. +All complaints will be reviewed and investigated promptly and fairly. + +All community leaders are obligated to respect the privacy and security of the +reporter of any incident. + +## Enforcement Guidelines + +Community leaders will follow these Community Impact Guidelines in determining +the consequences for any action they deem in violation of this Code of Conduct: + +1. **Correction** — private, written warning, with clarity around the violation. +2. **Warning** — a warning with consequences for continued behavior. +3. **Temporary Ban** — temporary ban from any sort of interaction or public + communication with the community. +4. **Permanent Ban** — permanent ban from any sort of public interaction within + the community. + +## Attribution + +This Code of Conduct is adapted from the [Contributor Covenant][homepage], +version 2.1, available at +[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1]. + +[homepage]: https://www.contributor-covenant.org +[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html diff --git a/README.md b/README.md index 492098c..325fe6f 100644 --- a/README.md +++ b/README.md @@ -60,6 +60,44 @@ flowchart TD D[(diff2html 3.4.51\njsDelivr CDN, lazy + memoised)] --> R ``` +## Usage + +Every behaviour below is covered by a BDD scenario in [`tests/e2e/features/`](tests/e2e/features/), +and [`docs/BEHAVIOUR.md`](docs/BEHAVIOUR.md) shows each one as a screenshot captured from a passing +run — so what you read here is what CI proves on every push. + +### Nothing to drive + +There is no button to press and no mode to switch on. Whenever a message contains a fenced +` ```diff ` block, it is replaced in place with a side-by-side visual diff. Ask the agent for a diff, +paste one in yourself, or have a tool emit one — it renders either way. + +Multi-file diffs render as one visual diff containing both files, so a patch that touches several +files reads as a single reviewable unit rather than fragments. + +### Reviewing a large diff + +Hover a rendered diff for its toolbar: + +- **Maximize** opens a single fullscreen overlay for reading a long patch without the chat column + squeezing it. Close it with the ✕, a backdrop click, or **Escape** — all three are asserted, and so + is the fact that the inline diff survives the overlay closing. +- **Copy** puts the **raw diff text** on the clipboard, not the rendered HTML. You can paste it + straight into `git apply`. + +### When the input is not a clean diff + +Two failure modes are handled deliberately, because silently mangling text is worse than not +rendering it: + +- **Malformed diff text** falls back to the readable plain code block. You still see the content. +- **A non-diff code fence is left completely untouched.** A ` ```python ` block stays a Python block. + The plugin only claims fences it can actually render. + +Both are asserted scenarios rather than intentions. + +--- + ## Install **Plugin Hub (recommended):** open *Settings → Plugins* in Agent Zero, find diff --git a/tests/_testkit b/tests/_testkit index 5212c09..c77ed9b 160000 --- a/tests/_testkit +++ b/tests/_testkit @@ -1 +1 @@ -Subproject commit 5212c09ede8dd843f88f1648d5c97afd4b06bc37 +Subproject commit c77ed9bd7ccb675b656caffabcf5c1e7aad77c91