chore: make the repo safe and clear to fork - #170
Merged
Conversation
The repository picked up its first fork. Three things a forker would hit: * deploy-pages, notify-engine and bump-engine publish the site or talk to TechEngine. In a fork they have no secrets and no Pages, so they can only fail. Their entry jobs now run only in GetTechAPI/TechAPI; deploy-pages' `deploy` job needs `build` and is skipped with it. * The data license lived only in a README sentence, while the repo's sole LICENSE file is the MIT one for the code — so GitHub, and anyone reusing the data, sees "MIT". data/LICENSE.md restates the existing CC BY-SA 4.0 declaration where the data actually sits, and points to ../LICENSE for the code. No licensing terms change. * The contributing section listed five categories as needing `source_urls`; the validator enforces it for all thirteen. The PR template also gains a "targets develop" check. The two secret-bearing triggers were reviewed and need no change: pr-metadata runs on pull_request_target but never checks out the PR, and its only event-derived expression (html_url) is passed through env; verify-command only accepts OWNER/MEMBER/COLLABORATOR. Refs #1
github-actions
Bot
added
data
Member
🔎 Data verification — Tier 0 (offline existence/trust)Scored by Changed records in this PR98 record(s) scored. %%{init: {"theme":"base","themeVariables":{"pie1":"#3fb950","pie2":"#d29922","pie3":"#f85149","pieStrokeWidth":"0px","pieOpacity":"1"}}}%%
pie showData
title Verification bands — all records
"Green" : 78
"Yellow" : 20
"Red" : 0
Full-dataset baseline105758 record(s) scored. %%{init: {"theme":"base","themeVariables":{"pie1":"#3fb950","pie2":"#d29922","pie3":"#f85149","pieStrokeWidth":"0px","pieOpacity":"1"}}}%%
pie showData
title Verification bands — all records
"Green" : 21388
"Yellow" : 83169
"Red" : 1201
Hard violations (forced red):
green = authoritative source + complete + consistent · yellow = plausible, needs confirmation · red = sparse/weak source or a hard contradiction. Promotion to |
Member
TechEngine change review: PASS
Changed data
Changed record examplescpu added
cpu modified
Heuristic review
|
Member
TechEngine validation stats: PASS
Data summary
Warning Tracked verified coverage is below 50% for watch 4.2% (18/433), tablet 6.3% (218/3455), soc 6.9% (146/2104), brand 11.6% (24/207), smartphone 18.6% (17384/93396), all 20.2% (21369/105758), gpu 39.9% (809/2030), pda 47.1% (66/140). Validation notes
Key output:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The repository picked up its first fork (
BJR-developer/TechAPI, an unmodified copy ofdevelop). This makes the repo safe and clear for whoever forks it next.1. Org-only jobs no longer run in forks
deploy-pages,notify-engineandbump-enginepublish the site or talk to TechEngine. In a fork they have no secrets and no Pages, so they can only fail. Their entry jobs now carrydeploy-pages'deployjob hasneeds: build, so it is skipped along with it. Behaviour in this repository is unchanged.2. The data license is stated where the data lives
The only LICENSE file is the MIT one for the code, so GitHub — and anyone reusing the data — sees "MIT". The CC BY-SA 4.0 declaration existed only as a README sentence.
data/LICENSE.mdrestates it next to the data, links the canonical CC page, and points to../LICENSEfor the code. No licensing terms change; the README now links to the new file.3. Contributing docs match what the validator enforces
The README listed five categories as needing
source_urls.app/validate.pycalls_check_source_urlsfor all thirteen, so the sentence now says every record. The PR template gains a "targetsdevelop" check;developis also the default branch, so a fork's PR already targets it.Reviewed, no change needed
Both secret-bearing triggers were checked for the fork-PR "pwn request" pattern:
pr-metadataruns onpull_request_targetwithPROJECT_TOKEN/ENGINE_TOKEN, but it never checks out the PR. Its only event-derived expression isgithub.event.pull_request.html_url, passed throughenvrather than inlined into shell, and generated by GitHub. The fork-controlled branch name appears only inside a JS template string.verify-commandruns onissue_comment, and only forOWNER/MEMBER/COLLABORATORauthors.The fork itself has 0 workflow runs, so none of this is causing noise today — the guards are preventive.
Closes #1