diff --git a/.github/workflows/roadmap-drift.yml b/.github/workflows/roadmap-drift.yml index cd1dbc5..227c42c 100644 --- a/.github/workflows/roadmap-drift.yml +++ b/.github/workflows/roadmap-drift.yml @@ -23,7 +23,7 @@ jobs: # Roadmap contract v1 pin. CONTRACT_TAG is the human-readable handle; # CONTRACT_SHA is the immutable fetch target. The verify step fails # closed if the tag moves away from this SHA. See scripts/bump-contract.sh - # in tonythethompson/numan — never edit this in isolation. + # in numan-cli/numan — never edit this in isolation. CONTRACT_TAG: numan-roadmap-contract/v1 CONTRACT_SHA: 2cd6f5a4d5e831d1248d3fe3fd924944823510a1 steps: @@ -39,7 +39,7 @@ jobs: -H "Authorization: Bearer ${GITHUB_TOKEN}" \ -H "Accept: application/vnd.github+json" \ -H "User-Agent: numan-plugins-ci" \ - "https://api.github.com/repos/tonythethompson/numan/git/refs/tags/${CONTRACT_TAG}") + "https://api.github.com/repos/numan-cli/numan/git/refs/tags/${CONTRACT_TAG}") if [ "$status" = "404" ]; then echo "::warning::Tag $CONTRACT_TAG does not exist yet; skipping SHA resolution check." exit 0 @@ -69,7 +69,7 @@ jobs: run: | mkdir -p docs/plans curl --fail-with-body --silent --show-error --location \ - "https://raw.githubusercontent.com/tonythethompson/numan/${CONTRACT_SHA}/docs/plans/consolidated-multi-repo-roadmap.md" \ + "https://raw.githubusercontent.com/numan-cli/numan/${CONTRACT_SHA}/docs/plans/consolidated-multi-repo-roadmap.md" \ -o docs/plans/consolidated-multi-repo-roadmap.md # Sanity check: the file must not be empty AND must mention this # repo by path so we know we didn't grab a placeholder document. @@ -79,7 +79,7 @@ jobs: run: | mkdir -p scripts curl --fail-with-body --silent --show-error --location \ - "https://raw.githubusercontent.com/tonythethompson/numan/${CONTRACT_SHA}/scripts/check-roadmap-drift.py" \ + "https://raw.githubusercontent.com/numan-cli/numan/${CONTRACT_SHA}/scripts/check-roadmap-drift.py" \ -o scripts/check-roadmap-drift.py chmod +x scripts/check-roadmap-drift.py - name: Run drift check diff --git a/README.md b/README.md index 5cfe39b..5fa12c1 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@ # numan-plugins -CI build pipeline feeder for the [numan](https://github.com/tonythethompson/numan) +CI build pipeline feeder for the [numan](https://github.com/numan-cli/numan) official registry — implements the binary-delivery half of -[numan #30](https://github.com/tonythethompson/numan/issues/30). +[numan #30](https://github.com/numan-cli/numan/issues/30). **Default branch:** `main` (aligned with `numan-registry`; client stays on `master`). @@ -16,13 +16,13 @@ toolchain to install them. This repo closes that gap for selected plugins: it cross-compiles from immutable upstream commits (with tags retained for human-facing provenance), packages one archive per target, and publishes them as GitHub release assets. -[`numan-registry`](https://github.com/tonythethompson/numan-registry) +[`numan-registry`](https://github.com/numan-cli/numan-registry) then pins those URLs and signs the index with the official trust root. Plugins that already publish compliant upstream release assets can be ingested directly into `numan-registry` without a stop here. For the live catalog × Nu matrix, see -[`docs/catalog-compat.md`](https://github.com/tonythethompson/numan-registry/blob/main/docs/catalog-compat.md) +[`docs/catalog-compat.md`](https://github.com/numan-cli/numan-registry/blob/main/docs/catalog-compat.md) in the registry. For demand-ranked candidates **not yet** built, see [`docs/backlog.json`](docs/backlog.json) here. @@ -48,7 +48,7 @@ Vulnerability reporting and scope: [SECURITY.md](SECURITY.md). | `manifest.json` | `active[]` = plugins built now; build matrix + target→runner map | | `docs/backlog.json` | Demand-ranked plugin candidates (statuses, Nu deps per tag) | | `docs/roadmap.md` | Repo-local build/handoff plan (points at consolidated 1.0 roadmap) | -| Registry [`catalog-compat.md`](https://github.com/tonythethompson/numan-registry/blob/main/docs/catalog-compat.md) | Master list of **live** official packages × Nu constraints | +| Registry [`catalog-compat.md`](https://github.com/numan-cli/numan-registry/blob/main/docs/catalog-compat.md) | Master list of **live** official packages × Nu constraints | | `.github/workflows/build.yml` | manual matrix build → package → release → emit spec | | `.github/workflows/repo-safety.yml` | required manifest, test, archive, spec, and workflow checks | | `.pre-commit-config.yaml` | local JSON format + README/backlog consistency hooks | @@ -140,5 +140,5 @@ invariants, and the review checklist. See [SECURITY.md](SECURITY.md) for how to report issues in this build pipeline. Signed-index and client issues go to -[numan-registry](https://github.com/tonythethompson/numan-registry/blob/main/SECURITY.md) -and [numan](https://github.com/tonythethompson/numan/blob/main/SECURITY.md). +[numan-registry](https://github.com/numan-cli/numan-registry/blob/main/SECURITY.md) +and [numan](https://github.com/numan-cli/numan/blob/main/SECURITY.md). diff --git a/SECURITY.md b/SECURITY.md index 5d4ff22..f34dae4 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -7,9 +7,9 @@ hosts artifacts only. It never holds registry signing keys. Companion policies: - Signed index, yanks, and key incidents: - [tonythethompson/numan-registry SECURITY.md](https://github.com/tonythethompson/numan-registry/blob/main/SECURITY.md) + [numan-cli/numan-registry SECURITY.md](https://github.com/numan-cli/numan-registry/blob/main/SECURITY.md) - Numan CLI verification and install/activate behavior: - [tonythethompson/numan SECURITY.md](https://github.com/tonythethompson/numan/blob/main/SECURITY.md) + [numan-cli/numan SECURITY.md](https://github.com/numan-cli/numan/blob/main/SECURITY.md) ## Report a vulnerability @@ -17,7 +17,7 @@ Do not publish exploit details, credentials, or unverified malware samples in a public issue. Preferred: open a private GitHub security advisory at -. +. Fallback: open a public issue titled **Security contact request** with no technical details. The maintainer will establish a private channel before @@ -45,9 +45,9 @@ Helpful report contents: - A bad artifact that is already pinned and signed in the official index (including yank / user remediation): - [numan-registry](https://github.com/tonythethompson/numan-registry) + [numan-registry](https://github.com/numan-cli/numan-registry) - Client-side verification, path, or activation bugs: - [numan](https://github.com/tonythethompson/numan) + [numan](https://github.com/numan-cli/numan) - Security bugs in upstream plugin source (report upstream; open an issue here only if our pinned commit or rebuild process needs to change) - Registry private-key or signature issues (this repo does not sign indexes) @@ -79,4 +79,4 @@ intake or yank as appropriate. - Trust boundary overview: [README.md](README.md#trust-boundary) - Reviewer trust checklist: [REVIEW.md](REVIEW.md) - Registry incident procedures: - [numan-registry incident-response](https://github.com/tonythethompson/numan-registry/blob/main/docs/incident-response.md) + [numan-registry incident-response](https://github.com/numan-cli/numan-registry/blob/main/docs/incident-response.md) diff --git a/docs/roadmap.md b/docs/roadmap.md index 8a71059..2832da2 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -8,10 +8,10 @@ catalog intake, signing, plugin backfills, client compat, lifecycle evidence, and the active-plugin gate — lives in the consolidated cross-repo plan: -[**`numan/docs/plans/consolidated-multi-repo-roadmap.md`**](https://github.com/tonythethompson/numan/blob/master/docs/plans/consolidated-multi-repo-roadmap.md) +[**`numan/docs/plans/consolidated-multi-repo-roadmap.md`**](https://github.com/numan-cli/numan/blob/master/docs/plans/consolidated-multi-repo-roadmap.md) Repo-local roadmaps keep operational detail. The cross-repo drill is enforced by -[`scripts/check-roadmap-drift.py`](https://github.com/tonythethompson/numan/blob/master/scripts/check-roadmap-drift.py), +[`scripts/check-roadmap-drift.py`](https://github.com/numan-cli/numan/blob/master/scripts/check-roadmap-drift.py), which CI runs at `.github/workflows/roadmap-drift.yml` and which fails the workflow run if this page drifts from the consolidated truth. @@ -44,7 +44,7 @@ contract pins in this repo alone. - `docs/backlog.json` (schema v1) is the comprehensive **plugin candidate** list (not the live catalog). It tracks release versions per plugin with Nu minor compatibility via `versions[]` / `backfill_targets`. Live catalog × Nu overview: - [`numan-registry/docs/catalog-compat.md`](https://github.com/tonythethompson/numan-registry/blob/main/docs/catalog-compat.md). + [`numan-registry/docs/catalog-compat.md`](https://github.com/numan-cli/numan-registry/blob/main/docs/catalog-compat.md). Source: awesome-nu + manual discovery. - Wave 1 and Wave 2 CI-built plugins are on **`main`**, published, and intaken into the official registry. Wave 2 targets Nu 0.114; Wave 1 includes Nu @@ -111,9 +111,9 @@ occurred during the Wave 1 Nu 0.114 intake). - [x] `lizclipse/nu_plugin_ulid@0.23.0` - [x] `rhino-linux/nu_plugin_nutext@0.6.2` -Assets published ([build 30985049217](https://github.com/tonythethompson/numan-plugins/actions/runs/30985049217)); +Assets published ([build 30985049217](https://github.com/numan-cli/numan-plugins/actions/runs/30985049217)); registry intake complete; -production [30996546918](https://github.com/tonythethompson/numan-registry/actions/runs/30996546918); +production [30996546918](https://github.com/numan-cli/numan-registry/actions/runs/30996546918); lifecycle-prove OK Linux x86_64 and Windows x64 / Nu 0.114.1. ### Wave 2 Research diff --git a/manifest.json b/manifest.json index 780d186..32860bd 100644 --- a/manifest.json +++ b/manifest.json @@ -3,7 +3,7 @@ "note": "Build matrix for the numan#30 CI build+sign pipeline. Each active plugin is cross-compiled from its immutable upstream source_commit after its human-facing tag is verified to resolve to that commit, packaged per target (.tar.gz on Unix, .zip on Windows), and published once as a GitHub release asset on THIS repo. numan-registry then pins those asset URLs via scripts/add-package.py and signs the index with the trust root. This repo never holds signing keys.", "schema_notes": { "intake_mode": "Optional per-entry field, 'tagged' (default) or 'commit-snapshot'. 'tagged' entries must provide a non-empty 'tag' field and the tag is verified via git ls-remote against source_commit. 'commit-snapshot' entries may omit 'tag' or set it to null; the tag-to-commit ls-remote check is skipped and source_commit is confirmed fetchable upstream via a scoped shallow fetch and verified to be a commit object, not a tree/blob/tag. The workflow derives the version for commit-snapshot entries as 0.0.0-snapshot..<7-char-sha> once per run (date = intake date) and uses it consistently for packaging, the release tag, and the generated spec, instead of the manifest 'version' field. gen_spec.py emits 'provenance': 'commit-snapshot' at the top level of the generated spec.", - "upstream_repo": "Optional per-entry field, 'owner/name' of the ORIGINAL upstream repo. Only set on numan-maintained fork entries: 'repo'/'owner'/'source_commit' point at the fork (owner must be exactly 'numan-maintained'), 'upstream_repo' preserves the original author's identity. gen_spec.py emits it as source.upstream in the generated spec and appends a fork-attribution note to the description. See https://github.com/tonythethompson/numan/blob/master/docs/adr/0001-ecosystem-trust-upstream-contribution-fork-stewardship.md for the full fork-eligibility and stewardship requirements that must be satisfied before an entry like this is added -- this field only records identity, it doesn't grant eligibility." + "upstream_repo": "Optional per-entry field, 'owner/name' of the ORIGINAL upstream repo. Only set on numan-maintained fork entries: 'repo'/'owner'/'source_commit' point at the fork (owner must be exactly 'numan-maintained'), 'upstream_repo' preserves the original author's identity. gen_spec.py emits it as source.upstream in the generated spec and appends a fork-attribution note to the description. See https://github.com/numan-cli/numan/blob/master/docs/adr/0001-ecosystem-trust-upstream-contribution-fork-stewardship.md for the full fork-eligibility and stewardship requirements that must be satisfied before an entry like this is added -- this field only records identity, it doesn't grant eligibility." }, "default_targets": [ "x86_64-unknown-linux-gnu", diff --git a/scripts/test_check_repo_consistency.py b/scripts/test_check_repo_consistency.py index 82405dc..8ea8594 100644 --- a/scripts/test_check_repo_consistency.py +++ b/scripts/test_check_repo_consistency.py @@ -117,7 +117,7 @@ def test_pr_url_in_roadmap_fails(self): roadmap = root / "docs" / "roadmap.md" roadmap.parent.mkdir() roadmap.write_text( - "See [intake](https://github.com/tonythethompson/numan-registry/pull/45).\n", + "See [intake](https://github.com/numan-cli/numan-registry/pull/45).\n", encoding="utf-8", ) found = self.mod.check_no_pr_refs(roadmap) diff --git a/scripts/test_gen_spec_source.py b/scripts/test_gen_spec_source.py index 5f9e97a..4c178d9 100644 --- a/scripts/test_gen_spec_source.py +++ b/scripts/test_gen_spec_source.py @@ -53,7 +53,7 @@ def test_emits_source_from_manifest_entry(self): out = self.gs.build_spec( entry, rows, - "https://github.com/tonythethompson/numan-plugins/releases/download/nu_plugin_highlight-1.4.15", + "https://github.com/numan-cli/numan-plugins/releases/download/nu_plugin_highlight-1.4.15", ["x86_64-unknown-linux-gnu"], ) self.assertEqual( @@ -98,7 +98,7 @@ def test_commit_snapshot_entry_emits_derived_version_and_provenance(self): out = self.gs.build_spec( entry, rows, - "https://github.com/tonythethompson/numan-plugins/releases/download/nu_plugin_plot-snapshot", + "https://github.com/numan-cli/numan-plugins/releases/download/nu_plugin_plot-snapshot", ["x86_64-unknown-linux-gnu"], snapshot_date="20260809", ) @@ -150,7 +150,7 @@ def test_fork_entry_emits_source_upstream_and_description_note(self): out = self.gs.build_spec( entry, rows, - "https://github.com/tonythethompson/numan-plugins/releases/download/nu_plugin_clipboard-0.110.0", + "https://github.com/numan-cli/numan-plugins/releases/download/nu_plugin_clipboard-0.110.0", ["x86_64-unknown-linux-gnu"], ) self.assertEqual( @@ -184,7 +184,7 @@ def test_numan_maintained_requires_upstream_repo(self): self.gs.build_spec( entry, rows, - "https://github.com/tonythethompson/numan-plugins/releases/download/nu_plugin_clipboard-0.110.0", + "https://github.com/numan-cli/numan-plugins/releases/download/nu_plugin_clipboard-0.110.0", ["x86_64-unknown-linux-gnu"], ) def test_rejects_self_referential_upstream_repo(self): @@ -214,7 +214,7 @@ def test_rejects_self_referential_upstream_repo(self): self.gs.build_spec( entry, rows, - "https://github.com/tonythethompson/numan-plugins/releases/download/nu_plugin_clipboard-0.110.0", + "https://github.com/numan-cli/numan-plugins/releases/download/nu_plugin_clipboard-0.110.0", ["x86_64-unknown-linux-gnu"], )