4 Commits

Author SHA1 Message Date
Tao Xin b523997b54 docs: enforce responsible AI usage (#1037)
* docs: enforce responsible AI usage

- add the development-assistance rules to AGENTS.md and CONTRIBUTING.md in every locale
- state the AI policy in SECURITY.md
- require AI/LLM disclosure in the issue and pull request templates
- keep the local-reproduction checkbox out of the AI disclosure group
- forbid AI co-author trailers in the commit command
- keep CONTRIBUTING.ko-KR.md and the Korean docs page identical
- import AGENTS.md from CLAUDE.md so Claude Code actually loads the rules

* docs: rewrite AI-usage policy text in original wording

The AI-Assisted Development section (CONTRIBUTING + docs, all locales) and
the SECURITY.md AI Policy were adapted closely from third-party sources
(Kazumi, GPL-3.0; Homebrew, unlicensed). Rewrite the borrowed prose in our
own words with the same meaning, and drop the unrelated Local Reproduction
checkbox from the bug-report template.

---------

Co-authored-by: kite <lizhengfeng.lzf@alibaba-inc.com>
2026-09-10 22:11:31 +08:00
kite e1a6a404ba feat(ci): add Sigstore attestation for release artifacts
Add build provenance attestation to the release workflow using
actions/attest-build-provenance with OIDC keyless signing.
Document release signature verification in SECURITY.md.
2026-06-26 22:18:03 +08:00
kite 410cabf488 docs: add GOVERNANCE.md, CODE_OF_CONDUCT.md and clean up SECURITY.md
- Rewrite GOVERNANCE.md with expanded structure: goals, scope, project
  values, detailed roles, decision-making process, merge expectations,
  maintainer lifecycle, and continuity sections.
- Add CODE_OF_CONDUCT.md covering expected behavior, unacceptable
  behavior, scope, reporting, and enforcement.
- Remove fictitious email address from SECURITY.md, keeping only
  GitHub Private Vulnerability Reporting as the reporting channel.
2026-06-26 19:38:37 +08:00
kite 10a02c8508 docs: add SECURITY.md for OpenSSF Best Practices badge compliance
Add security policy covering vulnerability reporting channels
(GitHub Private Vulnerability Reporting + email), response timeline,
and scope definition to meet OpenSSF Best Practices Reporting criteria.
2026-06-22 16:17:58 +08:00