diff --git a/.github/workflows/devkit-sync.yml b/.github/workflows/devkit-sync.yml index d2a8497..bc11a0f 100644 --- a/.github/workflows/devkit-sync.yml +++ b/.github/workflows/devkit-sync.yml @@ -35,7 +35,7 @@ permissions: jobs: sync: - uses: agent-zero-plugins/agent-zero-plugin-development-testkit/.github/workflows/devkit-sync.yml@main + uses: agent-zero-plugins/agent-zero-plugin-development-testkit/.github/workflows/devkit-sync.yml@v2.1.6 with: devkit-submodule-path: "tests/_testkit" secrets: diff --git a/.github/workflows/plugin-e2e.yml b/.github/workflows/plugin-e2e.yml index d9c3f21..587c7c9 100644 --- a/.github/workflows/plugin-e2e.yml +++ b/.github/workflows/plugin-e2e.yml @@ -8,15 +8,30 @@ # (.devkit.yml `plugin_dir` → else canonical usr/plugins/), so this # template is identical across all repos. # -# Needs the shared sync-App secrets to clone the private devkit submodule, and -# (DEC-055) GHCR_PULL_TOKEN to pull the private fork image. `secrets: inherit` -# forwards all repo secrets, so new shared secrets need no caller change. +# Needs (DEC-055) GHCR_PULL_TOKEN to pull the private fork image; the sync-App +# pair is legacy/optional since the devkit went public (DEC-075). +# +# SECRETS ARE PASSED EXPLICITLY, not via `secrets: inherit` (DEC-081). +# `inherit` forwards EVERY repo- and org-level secret to the reusable workflow — +# including secrets added later and secrets the workflow never declares. The +# reusable workflow declares exactly the three below, all `required: false`, so +# this list is complete. Adding a shared secret later means editing this template +# and re-running `make link-workflows`, which is the same cadence as every other +# devkit asset (devkit-sync.caller.yml already pays exactly this cost). +# +# The `uses:` ref is pinned to a RELEASE TAG, not `@main`. With `@main`, every +# merge to the devkit went live in 24 consumers' CI immediately and unreviewed. name: plugin-e2e on: pull_request: branches: ["main", "master"] workflow_dispatch: + inputs: + capture_all_traces: + description: "Capture a Playwright trace for EVERY scenario (not just failures)" + type: boolean + default: false permissions: contents: read @@ -25,5 +40,10 @@ permissions: jobs: e2e: - uses: agent-zero-plugins/agent-zero-plugin-development-testkit/.github/workflows/plugin-e2e.yml@main - secrets: inherit + uses: agent-zero-plugins/agent-zero-plugin-development-testkit/.github/workflows/plugin-e2e.yml@v2.1.6 + secrets: + GHCR_PULL_TOKEN: ${{ secrets.GHCR_PULL_TOKEN }} + SKILLS_SYNC_APP_CLIENT_ID: ${{ secrets.SKILLS_SYNC_APP_CLIENT_ID }} + SKILLS_SYNC_APP_PRIVATE_KEY: ${{ secrets.SKILLS_SYNC_APP_PRIVATE_KEY }} + with: + capture-all-traces: ${{ inputs.capture_all_traces || false }} diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..cd77b98 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,87 @@ +# Contributor Covenant Code of Conduct + +## Our Pledge + +We as members, contributors, and leaders pledge to make participation in our +community a harassment-free experience for everyone, regardless of age, body +size, visible or invisible disability, ethnicity, sex characteristics, gender +identity and expression, level of experience, education, socio-economic status, +nationality, personal appearance, race, caste, color, religion, or sexual +identity and orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, +diverse, inclusive, and healthy community. + +## Our Standards + +Examples of behavior that contributes to a positive environment for our +community include: + +* Demonstrating empathy and kindness toward other people +* Being respectful of differing opinions, viewpoints, and experiences +* Giving and gracefully accepting constructive feedback +* Accepting responsibility and apologizing to those affected by our mistakes, + and learning from the experience +* Focusing on what is best not just for us as individuals, but for the overall + community + +Examples of unacceptable behavior include: + +* The use of sexualized language or imagery, and sexual attention or advances of + any kind +* Trolling, insulting or derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or email address, + without their explicit permission +* Other conduct which could reasonably be considered inappropriate in a + professional setting + +## Enforcement Responsibilities + +Community leaders are responsible for clarifying and enforcing our standards of +acceptable behavior and will take appropriate and fair corrective action in +response to any behavior that they deem inappropriate, threatening, offensive, +or harmful. + +Community leaders have the right and responsibility to remove, edit, or reject +comments, commits, code, wiki edits, issues, and other contributions that are +not aligned to this Code of Conduct, and will communicate reasons for moderation +decisions when appropriate. + +## Scope + +This Code of Conduct applies within all community spaces, and also applies when +an individual is officially representing the community in public spaces. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported to the community leaders responsible for enforcement by opening a +report via the repository's +[private vulnerability reporting form](https://github.com/agent-zero-plugins/agent-zero-plugin-development-testkit/security/advisories/new) +(also used for conduct reports) or by contacting the repository maintainers. +All complaints will be reviewed and investigated promptly and fairly. + +All community leaders are obligated to respect the privacy and security of the +reporter of any incident. + +## Enforcement Guidelines + +Community leaders will follow these Community Impact Guidelines in determining +the consequences for any action they deem in violation of this Code of Conduct: + +1. **Correction** — private, written warning, with clarity around the violation. +2. **Warning** — a warning with consequences for continued behavior. +3. **Temporary Ban** — temporary ban from any sort of interaction or public + communication with the community. +4. **Permanent Ban** — permanent ban from any sort of public interaction within + the community. + +## Attribution + +This Code of Conduct is adapted from the [Contributor Covenant][homepage], +version 2.1, available at +[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1]. + +[homepage]: https://www.contributor-covenant.org +[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html diff --git a/README.md b/README.md index 1076a92..24bdc25 100644 --- a/README.md +++ b/README.md @@ -58,6 +58,43 @@ The deep link is **not** a public share page and grants **no access by itself**: See [SECURITY.md](SECURITY.md) for the full threat model. +## Usage + +Every behaviour below is covered by a BDD scenario in [`tests/e2e/features/`](tests/e2e/features/), +and [`docs/BEHAVIOUR.md`](docs/BEHAVIOUR.md) shows each one as a screenshot captured from a passing +run — so what you read here is what CI proves on every push. + +### Share the chat you are looking at + +Click the share control in the chat toolbar. The link to the current chat goes straight to your +clipboard, and the button confirms with a green *"Link copied!"* that reverts after ~2 seconds — so +you know it worked without a dialog to dismiss. + +Paste it to a teammate, or to yourself on another device, and they land on **that** conversation +rather than hunting the sidebar for "the one about the deploy". + +### What the link actually is + +``` +/?ctxid= +``` + +Composed entirely client-side. **Nothing is stored, published, proxied, or sent anywhere** — there is +no backend, no state and no token. The link is only as reachable as your A0 instance already is: if +the recipient cannot reach your origin, or is not authenticated to it, the link does nothing for them. + +That is the deliberate trade-off. This plugin is a fast hand-off *within* an environment people +already share, not a publishing tool. If you need a chat readable by someone with no access to your +instance, this is the wrong plugin — export it instead. + +### Scope, stated honestly + +The suite asserts three scenarios: the control is present, sharing copies a link to *this* chat, and +the copy is confirmed. That is the whole feature — it is small on purpose, and the coverage matches +the surface rather than being padded to look thorough. + +--- + ## Install ### From the Plugin Hub diff --git a/tests/_testkit b/tests/_testkit index 5212c09..c77ed9b 160000 --- a/tests/_testkit +++ b/tests/_testkit @@ -1 +1 @@ -Subproject commit 5212c09ede8dd843f88f1648d5c97afd4b06bc37 +Subproject commit c77ed9bd7ccb675b656caffabcf5c1e7aad77c91