release: v1.6.11 open-source delivery and audit fixes

2026-10-18 18:45:03 +08:00
parent 65f89bffb3
commit 67ef6b8dce
12 changed files with 106 additions and 17 deletions
@@ -0,0 +1,22 @@
+name: Verify
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  test:
+    # Fork code may run on GitHub-hosted runners, never the trusted Gitea runner.
+    if: github.server_url == 'https://github.com' || github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: '3.13'
+      - run: python -m unittest discover -s tests -v
+      - run: git diff --check
@@ -3,3 +3,5 @@ __pycache__/
 dist/
 .DS_Store
 .data/
+.pytest_cache/
+.ruff_cache/
@@ -0,0 +1,9 @@
+# 贡献指南 / Contributing
+
+安装和运行步骤见项目首页；使用 Python 3.13 或 3.14，修改保持小而集中。运行 `python3 -m unittest discover -s tests -v`，Shell 脚本使用 `bash -n`，提交前运行 `git diff --check`。
+
+测试只能使用临时目录、模拟服务和设备桩；不得访问真实设备、执行生产写入或提交密钥、令牌、数据库、照片及部署回执。真实设备验证由维护者另行执行。
+
+请通过仓库 Pull Request 提交，说明问题、行为变化和验证结果。行为修复应覆盖对应回归风险。新增代码按本项目 MIT 许可证提供，保留第三方许可及来源。
+
+See README.md for installation. Keep changes focused, test with mocks, and submit a pull request describing the behavior and checks. Never include credentials or production data. Contributions use the MIT license; preserve third-party notices.
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 PIGWay
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
@@ -16,17 +16,17 @@ Build the ZIP below, upload it under Machine management and enable it. Register
 - Disk discovery runs only from Storage settings → Scan disks. Known disk capacity continues to refresh; display order, names and visibility use the shared Console settings.
 - The adapter retains existing API and service identifiers, including `pigway-pi-control`; a repository rename does not change those interfaces. Other Linux platforms are outside its support claim.

-Install only trusted plugins: frontend code shares the page JavaScript environment, and the backend process is not a security sandbox. The ZIP contains the manifest, worker and UI, not Console internals or Git metadata.
+Install only trusted plugins: frontend code shares the page JavaScript environment, and the backend process is not a security sandbox. The ZIP contains the manifest, worker, UI and LICENSE, not Console internals or Git metadata.

 See [storage behavior](docs/STORAGE.md), [release notes](RELEASE_NOTES.md), and the [Console UI semantics](https://tea.pigway.com/way/pigway-device-console/src/branch/main/docs/UI_SEMANTICS.md). Dated deployment records describe historical validation, not a fresh online check.

 ## Build

-Current adapter version: **1.6.10**.
+Current adapter version: **1.6.11**.

 ```sh
 mkdir -p dist
-python3 package.py plugin dist/pigway-agent-1.6.10.zip
+python3 package.py plugin dist/pigway-agent-1.6.11.zip
 ```

 [Documentation](docs/README.md)
@@ -4,7 +4,7 @@

 磁盘呈现统一版本已上线，需要 Console v2.7.0：默认按设备返回顺序，同组支持上移/下移、显示名称及隐藏，所有显示偏好保存到 Console，首页与配置页共用。Agent 的名称和隐藏定义继续作为设备默认值保留。扫描仍只由配置页按钮触发。

-当前 v1.6.10 支持统一磁盘显示设置与手动扫描，需要 Console v2.7.0、Agent v3.11.1；新磁盘仅手动发现，已知磁盘容量继续刷新。见 [磁盘发现说明](docs/STORAGE.md)。
+当前 v1.6.11 支持统一磁盘显示设置与手动扫描，需要 Console v2.7.0、Agent v3.11.1；新磁盘仅手动发现，已知磁盘容量继续刷新。见 [磁盘发现说明](docs/STORAGE.md)。

 独立维护的树莓派接入插件：连接现有 PIGWay Raspberry Pi Agent，不在树莓派安装新进程。设备 API、状态转换、配置字段、服务/进程监控、硬件界面及其翻译均由本仓库维护。

@@ -14,12 +14,12 @@

 ```sh
 mkdir -p dist
-python3 package.py plugin dist/pigway-agent-1.6.10.zip
+python3 package.py plugin dist/pigway-agent-1.6.11.zip
 ```

 在控制中心的机器管理页面安装 ZIP，再启用。开发时可用 `PIGWAY_ADAPTER_PATH=/absolute/path/pigway-console-adapter-raspberry-pi/plugin` 加载源码；Docker 推荐使用持久化数据卷中的安装包。

-包根目录只有 manifest、worker 与 ui；打包工具、文档和 Git 元数据不进入插件包。前端扩展通过 Console 的共享状态、请求、翻译与基础显示函数接入，不注入额外安装步骤。只应安装可信插件：前端模块与主页面共享 JavaScript 执行环境，加载失败、同步异常及 Promise 拒绝可降级，但不能隔离死循环或恶意代码；后端独立进程的隔离也不是安全沙箱。
+包根目录包含 manifest、worker、ui 与 LICENSE；打包工具、文档和 Git 元数据不进入插件包。前端扩展通过 Console 的共享状态、请求、翻译与基础显示函数接入，不注入额外安装步骤。只应安装可信插件：前端模块与主页面共享 JavaScript 执行环境，加载失败、同步异常及 Promise 拒绝可降级，但不能隔离死循环或恶意代码；后端独立进程的隔离也不是安全沙箱。

 正式仓库：https://tea.pigway.com/way/pigway-console-adapter-raspberry-pi 。首次独立版本为 v1.0.0，需要 Console v2.0.0。与 Console 的集成回归使用后者 tests 下的模拟 Agent，不操作真实设备。

@@ -1,5 +1,5 @@
-# PIGWay Raspberry Pi Adapter v1.6.10
+# pigway-console-adapter-raspberry-pi v1.6.11

-主要告警保留 OLED/RGB 内容和硬件名称，正常时不显示冗余状态；仅离线、未确认、未接入时显示提示。系统配置插件管理入口保留。
+统一开源许可证、贡献和安全反馈入口；完善当前版本的文档导航、源码分发和校验和。插件 ZIP 携带许可证。运行功能边界保持项目首页所述。

-桌面、平板、手机及中英文、在线/离线/未接入浏览器验证通过。未修改设备 Agent 或硬件行为。
+本轮 4 项 Python 测试通过。源码语法、文档入口、打包和校验和检查通过；生产运行状态以实际部署验收为准。
@@ -0,0 +1,7 @@
+# 安全反馈 / Security
+
+仅支持当前发布版本。请勿在公开 Issue 中发布密钥、令牌、个人数据或可直接利用的完整漏洞细节。
+
+请通过仓库维护者 [way](https://tea.pigway.com/way) 的私有联系渠道报告，包含受影响版本、复现条件、影响和最小化示例。若尚未建立私有渠道，先在 Issue 请求私下联系，不附敏感细节。
+
+Only the current release is supported. Contact the maintainer privately before disclosing exploit details; include the version, impact and a minimal reproduction. Do not attach credentials or private data to public issues.
@@ -1,8 +1,16 @@
-3cfd361f7663a9a9c93b507d17bb1c7e98003d61316826f0a4ba4a93594f72d4  .gitignore
-fe269ddd32b6ae068cbff1b9697934933d415162978537769275bdeab661a5c2  README.md
-291ec4f06dcf990843d8403a0c431a1346f9ab430ebcdaccef4b4b08a76a3c40  RELEASE_NOTES.md
+1db9d786fdc6c2ae84b7d317e981b23e303a5bc0b72704d43558b29373d97ade  .github/workflows/verify.yml
+5b30f5e166b59ce8e59437ebdd753a417e0c6c6776b19bb073832aa2ccc72faa  .gitignore
+79f34290cfa1a6f0928162909848e6597d46183d0de6b213bf52b12546f5fc33  CONTRIBUTING.md
+6eb7728e6e73f9568ca6fd5ad6383d13ffc638f2870fefa2d86f72f39685c0fc  LICENSE
+54a252d3512c4b4120103ac600364907d014a10c215f61afd281381bbf89c0c4  README.md
+4f3992613b137b83994941d740cb986e3176b78f319bdc2a4e1cc94b0d32b829  README.zh-CN.md
+8951d1ad1fdaed9312d4367f5bb4d7adfdab5af4c2dad9231796598e05c60f1e  RELEASE_NOTES.md
+6cead6c1378cd840f655adc3d467e2cd6fd3ab368d7200a3afbfe85d9ed159be  SECURITY.md
+1f4df7c43b0f6d138ac40c130511646d6ee9f7f1d9010505479acc7fee2f0e63  docs/README.md
+45b7bfb3d8f414e28d50c1f160aee2af8e4150dcd24b815569d48765b1eb413f  docs/STORAGE.md
 d081c599d821149853368b1a8637c57a16995344406ff5ec9d7619b66e0479b3  package.py
-97cb3cd8119147da93a73c5ad82faedd99daab5093a1aa0fb6b855d1df1c65a4  plugin/manifest.json
+6eb7728e6e73f9568ca6fd5ad6383d13ffc638f2870fefa2d86f72f39685c0fc  plugin/LICENSE
+17893ebf3fa8f8e0e3b875c1ea214aa006cbd06dcf9b20678029f184599df5d9  plugin/manifest.json
 d6a342605426357da7d2e65daa435e99d7234549cffa52e1a9229ef5bc36f33c  plugin/ui/config.js
 c98f34119436e3020ef20b325f91617943aefe662119cf76738e0226c2e91cbb  plugin/ui/device.js
 89b9d7994e7477e18c3f43e6f0975e04d5106056ba581b2964db0f39183d6f8a  plugin/ui/hardware.js
@@ -17,6 +25,3 @@ d5b22366a2c7b375e6f3e35cefb9f95da0ea3b8390b3ec4d1000492f00128f6e  plugin/worker.
 494c90f6d154edc64aad3169653cc08c7f5fd4a6613341b4c0ff10dd7e0e1cb5  tests/browser_alert_semantics.cjs
 40c038aa7689c127c0d90ddf390674f534a2bdee8fd3c344d09f8fb6d4bb3964  tests/test_metrics.py
 40d10555aef08f8132f576976b7205b3e1c16d330196a11c6cc1c5cbc167c670  tests/test_storage_metrics.py
-08042c91cea87e2ee9a55533e307a09741143615c7fcabfa602c7303cc3004da  README.zh-CN.md
-bd422976fbf034b10413479d483353eb7719fb90357c20f535441c9d60880536  docs/README.md
-45b7bfb3d8f414e28d50c1f160aee2af8e4150dcd24b815569d48765b1eb413f  docs/STORAGE.md
@@ -3,3 +3,5 @@
 安装、连接及日常使用从[中文首页](../README.zh-CN.md)或[英文首页](../README.md)开始。本目录收录仍适用的功能、配置与开发说明；版本变化见[版本记录](../RELEASE_NOTES.md)。

 - [磁盘发现、刷新与显示](STORAGE.md)
+
+[贡献指南](../CONTRIBUTING.md) · [安全反馈](../SECURITY.md) · [许可证](../LICENSE)
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 PIGWay
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
@@ -1,7 +1,7 @@
 {
  "id": "pigway-agent",
  "name": "PIGWay Raspberry Pi Agent",
-  "version": "1.6.10",
+  "version": "1.6.11",
  "protocol_version": 1,
  "entrypoint": "worker.py",
  "runtime": "python3",