mirror of
https://github.com/github/awesome-copilot.git
synced 2026-08-01 23:12:29 +00:00
Aaron Powell
be7a1cf734
* Harden external plugin validation: semver, SPDX, email, unknown fields Extend the canonical external-plugin validator with Open-Plugins-aligned rules, reusing the shared validation functions rather than duplicating checks: - version: enforce Semantic Versioning (allows prerelease/build metadata) - license: validate SPDX identifiers/expressions; warn (not error) on well-formed-but-unrecognized ids so existing entries like SSAL-1.0 pass - author.email: validate format when present - unknown-field detection: warn on typo'd top-level/author/source keys - immutable locator: marketplace warns when source lacks ref/sha; publicSubmission keeps the existing hard error Add eng/external-plugin-validation.test.mjs (node:test) covering each rule plus a regression that committed external.json passes marketplace policy with zero errors. Update CONTRIBUTING.md accordingly. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: eaa5eed6-5b65-4b28-9904-24f380d26728 * Make license non-SPDX a warning and share license check with local plugins The agent-plugins-spec schema does not enforce SPDX, and plugins may use proprietary/non-OSS licenses. Relax license validation so any non-empty license string that isn't a recognized SPDX identifier/expression produces a warning rather than an error. Extract the license check into a reusable validateLicenseField() and apply it to both external plugins and local plugin.json manifests via eng/validate-plugins.mjs, so licenses are validated consistently in one place. Update tests and CONTRIBUTING.md accordingly. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: eaa5eed6-5b65-4b28-9904-24f380d26728 * Extract shared license validation into eng/lib/license.mjs Move the SPDX constants and license validation (validateLicenseField, isRecognizedSpdxExpression) out of external-plugin-validation.mjs into a dedicated eng/lib/license.mjs module. Both the external plugin catalog validator and the local plugin.json validator now import license logic from this neutral shared module instead of one validator importing from the other. Behavior is unchanged; tests import from the new home. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: eaa5eed6-5b65-4b28-9904-24f380d26728 * Fix SPDX license parsing correctness and warning-message injection Rewrite isRecognizedSpdxExpression as a recursive-descent SPDX license expression parser to address PR review feedback: - Validate LicenseRef-/DocumentRef- grammar (non-empty idstring; DocumentRef requires the ":LicenseRef-<id>" suffix) instead of accepting any token with that prefix. - Parse parentheses with balance and placement checks rather than stripping them, so malformed groupings like "(MIT", "MIT)", and "MIT OR (Apache-2.0))" are no longer silently treated as valid. - Treat WITH as a distinct operator whose right operand must be a known SPDX license exception, so "MIT WITH Apache-2.0" and "GPL-2.0-only WITH MIT" are rejected while "GPL-2.0-only WITH Classpath-exception-2.0" is recognized. - Sanitize the untrusted license value in the non-SPDX warning (collapse whitespace, truncate, escape backticks, wrap as inline code) since the warning is rendered verbatim into a Markdown bot comment during intake. Malformed SPDX stays a warning (never an error) so proprietary and non-OSS license strings remain allowed. Adds targeted grammar and sanitization tests. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: eaa5eed6-5b65-4b28-9904-24f380d26728 * Complete backslash escaping and run source unknown-field check for all sources Address two PR review findings: - eng/lib/license.mjs: sanitizeForMessage now escapes backslashes before backticks so the inline-code warning value is fully escaped, resolving a CodeQL "incomplete string escaping" alert. A raw backslash in a license value is now doubled rather than left to combine with a following escaped backtick. - eng/external-plugin-validation.mjs: move the source unknown-field check out of validateGitHubSource into the outer source-object branch so it runs for every object source and then dispatch by source.source. A typo in the source discriminator (e.g. "soruce") or an unsupported source type now still surfaces the unknown-field warning instead of being silently skipped. Adds regression tests for both behaviors. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: eaa5eed6-5b65-4b28-9904-24f380d26728 * Harden Markdown safety of validation warnings via inlineCode helper External-plugin validation warnings are rendered verbatim as Markdown list items in the intake bot comment, so untrusted values interpolated into them are an injection vector. Add eng/lib/markdown.mjs exporting inlineCode(), which wraps a value in a code span fenced with more backticks than any run in the content (and pads leading/trailing backticks). This cannot be broken out of, unlike the previous backslash escaping, which does not work inside code spans. - lib/license.mjs: replace sanitizeForMessage with inlineCode for the non-SPDX license warning. - external-plugin-validation.mjs: wrap unknown-field keys (attacker controlled JSON object keys) with inlineCode so newlines/Markdown in a key can no longer inject a new list item. - Add inlineCode unit tests and injection-neutralization tests for both the license value and unknown-field key paths. Addresses PR review comments 3679379606 and 3679434134. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: eaa5eed6-5b65-4b28-9904-24f380d26728 * Fixing codespell --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: eaa5eed6-5b65-4b28-9904-24f380d26728
Contributor Reporting (Maintainers) 🚧
This directory contains build scripts and utilities for maintaining the repository.
Build Scripts
update-readme.mjs
Generates the main README.md and documentation files from the repository content (agents, prompts, instructions, skills, hooks, collections).
generate-marketplace.mjs
Automatically generates .github/plugin/marketplace.json from all plugin directories in the plugins/ folder. This file is used by the GitHub Copilot CLI to discover and install plugins from this repository.
How it works:
- Scans all directories in
plugins/ - Reads each plugin's
.github/plugin/plugin.jsonfor metadata - Generates a consolidated
marketplace.jsonwith all available plugins - Runs automatically as part of
npm run build
To run manually:
npm run plugin:generate-marketplace
generate-website-data.mjs
Generates JSON data files for the website from repository content.
Contributor Tools
contributor-report.mjs— generates a markdown report of merged PRs for missing contributors (includes shared helpers).add-missing-contributors.mjs— on-demand maintainer script to automatically add missing contributors to.all-contributorsrc(infers contribution types from merged PR files, then runs the all-contributors CLI).
Key notes for maintainers
- Reports are generated on-demand and output to
reports/contributor-report.mdfor human review. - The report output is intentionally minimal: a single list of affected PRs and one command to add missing contributor(s).
- This repository requires full git history for accurate analysis. In CI, set
fetch-depth: 0. - Link: all-contributors CLI documentation
On-demand scripts (not CI)
These are maintainer utilities. They are intentionally on-demand only (but could be wired into CI later).
add-missing-contributors.mjs
- Purpose: detect missing contributors, infer contribution types from their merged PR files, and run
npx all-contributors add ...to update.all-contributorsrc. - Requirements:
- GitHub CLI (
gh) available (used to query merged PRs). .all-contributorsrcexists.- Auth token set to avoid the anonymous GitHub rate limits:
- Set
GITHUB_TOKEN(preferred), orGH_TOKENfor theghCLI. - If you use
PRIVATE_TOKENlocally,contributor-report.mjswill map it toGITHUB_TOKEN.
- Set
- GitHub CLI (
Graceful shutdown
contributor-report.mjscallssetupGracefulShutdown('script-name')fromeng/utils/graceful-shutdown.mjsearly in the file to attach signal/exception handlers.
Testing & maintenance
- Helper functions have small, deterministic behavior and include JSDoc comments.
- The
getMissingContributorsfunction incontributor-report.mjsis the single source of truth for detecting missing contributors fromall-contributors checkoutput.