Awesome Maintainer Defense

English · Tiếng Việt · 日本語

Offline repository-governance and GitHub Actions risk auditor with reversible defense profiles and an evidence-reviewed resource catalog.

%%{init: {"theme":"base","themeVariables":{"background":"#FFFFFF","fontFamily":"Arial, sans-serif","lineColor":"#667085","primaryTextColor":"#172B4D"}}}%%
flowchart LR
    R["Repository<br/>Repo / リポジトリ"]:::yellow
    A["Read-only audit<br/>Chỉ đọc / 読取監査"]:::blue
    F["Evidence findings<br/>Phát hiện / 所見"]:::pink
    P["Reviewable patch<br/>Patch / パッチ"]:::purple
    H["Human decision<br/>Con người / 人の判断"]:::green
    R --> A --> F --> P --> H
    classDef yellow fill:#FFF4A3,stroke:#C9A227,stroke-width:2px,color:#172B4D
    classDef blue fill:#D9EAFD,stroke:#4C78A8,stroke-width:2px,color:#172B4D
    classDef pink fill:#FFE1E6,stroke:#C96A7B,stroke-width:2px,color:#172B4D
    classDef purple fill:#E9DDF7,stroke:#8064A2,stroke-width:2px,color:#172B4D
    classDef green fill:#DDF5E3,stroke:#4F9D69,stroke-width:2px,color:#172B4D

English

The dependency-free Python CLI audits repository policy and workflow trust boundaries without a network connection or GitHub token. fix emits a unified diff; it never edits a repository, changes settings, commits or pushes. Findings are review inputs, not proof of authorship, intent or safety.

3 findings · 1 critical · 1 high · 1 medium

CRITICAL MD-WF-005  Untrusted pull-request input can reach a privileged workflow with secrets or write authority.
HIGH     MD-WF-004  Privileged event pull_request_target checks out an attacker-influenced revision.
MEDIUM   MD-WF-006  Checkout may persist a write-capable token in the workspace.

python3 scripts/build_standalone.py
python3 dist/maintainer-defense-kit.py audit .
python3 dist/maintainer-defense-kit.py fix . --output recommended.patch
python3 scripts/validate.py
python3 scripts/test_auditor.py

Verified v1.1.0 installs

PyPI:

pipx install maintainer-defense-kit==1.1.0
maintainer-defense audit .

Checksummed standalone on macOS/Linux:

curl -fLO https://github.com/thangldw/awesome-maintainer-defense/releases/download/v1.1.0/maintainer-defense-kit.py
curl -fLO https://github.com/thangldw/awesome-maintainer-defense/releases/download/v1.1.0/maintainer-defense-kit.py.sha256
shasum -a 256 -c maintainer-defense-kit.py.sha256
python3 maintainer-defense-kit.py audit .

Checksummed standalone on PowerShell:

Invoke-WebRequest https://github.com/thangldw/awesome-maintainer-defense/releases/download/v1.1.0/maintainer-defense-kit.py -OutFile maintainer-defense-kit.py
Invoke-WebRequest https://github.com/thangldw/awesome-maintainer-defense/releases/download/v1.1.0/maintainer-defense-kit.py.sha256 -OutFile maintainer-defense-kit.py.sha256
$Expected = ((Get-Content maintainer-defense-kit.py.sha256 -Raw).Trim() -split '\s+')[0].ToLowerInvariant()
$Actual = (Get-FileHash maintainer-defense-kit.py -Algorithm SHA256).Hash.ToLowerInvariant()
if ($Actual -ne $Expected) { Write-Error "SHA-256 mismatch"; exit 1 }
python maintainer-defense-kit.py audit .

dist/awesome-maintainer-defense-openai-skills-v1.1.0.zip is the deterministic skills-only upload bundle for the existing ChatGPT/Codex plugin listing. dist/SHA256SUMS.txt covers every public release asset.

Tiếng Việt

CLI Python không dependency kiểm tra policy và ranh giới tin cậy của workflow mà không cần mạng hoặc GitHub token. Lệnh fix chỉ tạo unified diff; không sửa repo, đổi setting, commit hoặc push. Mỗi finding chỉ là bằng chứng cần con người xem xét, không phải kết luận về tác giả, ý định hay mức độ an toàn.

日本語

依存関係のない Python CLI は、ネットワークや GitHub トークンなしでリポジトリ方針とワークフローの信頼境界を監査します。fix は unified diff を出力するだけで、ファイル編集、設定変更、commit、push は行いません。所見は人が確認するための根拠であり、作者、意図、安全性の証明ではありません。

The deployable kit keeps example .github directories because those files are product assets; they do not execute in this repository.

The repository is also a local, skills-only plugin for ChatGPT, Codex, Claude Code and Cowork. It does not require a hosted connector. See the published ChatGPT/Codex listing, directory submission package, privacy policy, terms, and support guidance.

Evidence-reviewed catalog

Abuse Detection & Moderation

Detect, label, quarantine, or respond to spam, harassment, and low-quality automated contributions.

Contributor Trust & Admission

Use explicit vouches or contribution history to control access without closing a project to everyone.

Intake & Triage

Reduce review load with structured intake, labels, lifecycle automation, and emergency lockdowns.

Repository Governance & Access

Keep security policies, branch protections, and repository settings consistent across projects.

Workflow & Supply-Chain Defense

Protect CI, dependencies, secrets, and merge paths from hostile or compromised contributions.

Policies & Playbooks

Set expectations before problems arrive and respond consistently when they do.

Released under the MIT License. Separate Vietnamese and Japanese catalog views remain in README.vi.md and README.ja.md.