From 22d75f96746a656ffed9af0baeca997419af70d6 Mon Sep 17 00:00:00 2001 From: Seungpyo1007 Date: Fri, 11 Sep 2026 11:50:51 +0900 Subject: [PATCH] chore: make the repo safe and clear to fork MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The repository picked up its first fork. Three things a forker would hit: * deploy-pages, notify-engine and bump-engine publish the site or talk to TechEngine. In a fork they have no secrets and no Pages, so they can only fail. Their entry jobs now run only in GetTechAPI/TechAPI; deploy-pages' `deploy` job needs `build` and is skipped with it. * The data license lived only in a README sentence, while the repo's sole LICENSE file is the MIT one for the code — so GitHub, and anyone reusing the data, sees "MIT". data/LICENSE.md restates the existing CC BY-SA 4.0 declaration where the data actually sits, and points to ../LICENSE for the code. No licensing terms change. * The contributing section listed five categories as needing `source_urls`; the validator enforces it for all thirteen. The PR template also gains a "targets develop" check. The two secret-bearing triggers were reviewed and need no change: pr-metadata runs on pull_request_target but never checks out the PR, and its only event-derived expression (html_url) is passed through env; verify-command only accepts OWNER/MEMBER/COLLABORATOR. Refs #1 --- .github/pull_request_template.md | 1 + .github/workflows/bump-engine.yml | 3 +++ .github/workflows/deploy-pages.yml | 3 +++ .github/workflows/notify-engine.yml | 3 +++ README.md | 12 +++++++----- data/LICENSE.md | 15 +++++++++++++++ 6 files changed, 32 insertions(+), 5 deletions(-) create mode 100644 data/LICENSE.md diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index f09031696395..c57a76da94fb 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -10,6 +10,7 @@ ## Checklist +- [ ] The PR targets `develop` (`main` only moves through release PRs) - [ ] `python -m app.validate` passes locally - [ ] Files live at the correct `data//<...>/.json` path - [ ] Slugs are kebab-case and unique within the category diff --git a/.github/workflows/bump-engine.yml b/.github/workflows/bump-engine.yml index b2beb8d0c3c7..aa06e4a97ef7 100644 --- a/.github/workflows/bump-engine.yml +++ b/.github/workflows/bump-engine.yml @@ -20,6 +20,9 @@ concurrency: jobs: bump: + # Org-only: this job publishes the site or talks to TechEngine. In a fork + # it can only fail (no secrets, no Pages), so it does not run there. + if: github.repository == 'GetTechAPI/TechAPI' runs-on: ubuntu-latest env: ENGINE_TOKEN: ${{ secrets.ENGINE_TOKEN }} diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml index 07c1cea2d04c..c258e4bad898 100644 --- a/.github/workflows/deploy-pages.yml +++ b/.github/workflows/deploy-pages.yml @@ -21,6 +21,9 @@ concurrency: jobs: build: + # Org-only: this job publishes the site or talks to TechEngine. In a fork + # it can only fail (no secrets, no Pages), so it does not run there. + if: github.repository == 'GetTechAPI/TechAPI' runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/notify-engine.yml b/.github/workflows/notify-engine.yml index 07af296c1eef..e810378aafde 100644 --- a/.github/workflows/notify-engine.yml +++ b/.github/workflows/notify-engine.yml @@ -27,6 +27,9 @@ permissions: jobs: notify: + # Org-only: this job publishes the site or talks to TechEngine. In a fork + # it can only fail (no secrets, no Pages), so it does not run there. + if: github.repository == 'GetTechAPI/TechAPI' runs-on: ubuntu-latest env: ENGINE_TOKEN: ${{ secrets.ENGINE_TOKEN }} diff --git a/README.md b/README.md index 912c8354c25d..2d6e04f0b261 100644 --- a/README.md +++ b/README.md @@ -62,12 +62,14 @@ submodule bump and the verified-promotion bot both land on `develop`. ## Contributing -Open a PR **against `develop`** with the new/updated JSON file. The PR template -walks through what to include. The validator must pass. All records (`brand`, -`soc`, `smartphone`, `gpu`, and `cpu`) must include `source_urls` with at least -one canonical reference (vendor product page, Wikipedia infobox, datasheet). +Open a PR **against `develop`** with the new/updated JSON file — that is also +the default branch, so a PR from a fork targets it automatically. The PR +template walks through what to include, and the validator must pass. Every +record, in every category, must include `source_urls` with at least one +canonical reference (vendor product page, Wikipedia infobox, datasheet). ## License -Data is licensed **CC-BY-SA 4.0**; attribute "Data from TechAPI" and share alike. +Data is licensed **CC-BY-SA 4.0**; attribute "Data from TechAPI" and share alike +(see [`data/LICENSE.md`](data/LICENSE.md)). The bundled validator code is [MIT](LICENSE). diff --git a/data/LICENSE.md b/data/LICENSE.md new file mode 100644 index 000000000000..b34b068f0eb1 --- /dev/null +++ b/data/LICENSE.md @@ -0,0 +1,15 @@ +# Data license + +The dataset in this directory (`data/**`), and the static JSON API generated +from it (`site/public/v1/**`), are licensed under **Creative Commons +Attribution-ShareAlike 4.0 International (CC BY-SA 4.0)**: + + +When you reuse the data, attribute it as "Data from TechAPI" with a link to +, and release derived datasets under the +same license. Each record also lists the sources it was compiled from in its +`source_urls` field. + +This notice restates the license declared in the top-level `README.md`. The +code in this repository — the validator, the site and the workflows — is +licensed separately under MIT; see [`../LICENSE`](../LICENSE).