wehub-resource-sync
45 lines
1.9 KiB
Markdown
45 lines
1.9 KiB
Markdown
<!--
|
|
Use this template for a PR that adds or updates ONE plugins-registry/<id>.json file.
|
|
Select it by appending ?template=plugin-registry.md to the PR-compare URL, or
|
|
the plugin template's release workflow opens it for you on a release tag.
|
|
ONE plugin per PR. Change ONLY that plugin's entry.
|
|
-->
|
|
|
|
## Plugin registry change
|
|
|
|
Home issue: #____
|
|
|
|
Paste the registry entry (one object), pinned to the exact reviewed commit:
|
|
|
|
```json
|
|
{
|
|
"name": "career-ops-plugin-<name>",
|
|
"id": "<name>",
|
|
"repo": "https://github.com/<you>/career-ops-plugin-<name>",
|
|
"author": "<you>",
|
|
"hooks": ["provider"],
|
|
"description": "Mission-framed one-liner.",
|
|
"requiredEnv": [],
|
|
"allowedHosts": ["api.example.com"],
|
|
"skill": true,
|
|
"license": "MIT",
|
|
"version": "1.0.0",
|
|
"sha": "<40-hex-commit>"
|
|
}
|
|
```
|
|
|
|
### Maintainer review checklist
|
|
|
|
- [ ] Naming `career-ops-plugin-<name>`; `id` == name minus the prefix
|
|
- [ ] Minimum files present (manifest.json, index.mjs, README.md, LICENSE)
|
|
- [ ] Manifest valid: apiVersion 1, `humanInTheLoop: true`, hooks ⊆ {provider, ingest, search, notify, export} — **no apply/submit**
|
|
- [ ] MIT-compatible LICENSE; no personal data in the repo
|
|
- [ ] Egress: `allowedHosts` are real public hosts; no IP literals / metadata / `*.internal`; no localhost without `allowsLocalhost` + a reason
|
|
- [ ] Static audit clean: no `child_process`/`playwright`/raw sockets/global `fetch`/`eval`/bare-dependency imports (egress only via `ctx.fetch`)
|
|
- [ ] No core-owned secrets in `requiredEnv`
|
|
- [ ] Reads PUBLIC data or the user's OWN account only — no centralized infrastructure, no auto-submit, no blind-apply
|
|
- [ ] No commercial / hosted-service / monetization wording (the project is free and local-first)
|
|
- [ ] If it ships a skill: domain-scoped — does not instruct the agent to edit core files, change scoring, reveal secrets, or act outside its hooks
|
|
- [ ] `sha` is pinned to the exact reviewed commit
|
|
- [ ] CI (`plugin-registry-validate`) is green
|