From 9744670a207b54733f5049e08d2b309635bf7668 Mon Sep 17 00:00:00 2001 From: ExeQue Date: Fri, 23 Oct 2026 23:05:34 +0200 Subject: [PATCH 1/5] Add a pull request template for plugin submissions --- .github/pull_request_template.md | 45 ++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 .github/pull_request_template.md diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 0000000..530d0cc --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,45 @@ + + +## Plugin + +- Repository: https://github.com// +- Commit: +- Previously approved commit: + +## What it does + + + +## What it adds to Lerd + + + +## What it reads, changes and sends + +- Reads: +- Changes: +- Sends over the network: + +## Requirements + + + +## Images + + + +## Checklist + +- [ ] The repository is public and has an open source license. +- [ ] The README says what the plugin adds, reads, changes and sends. +- [ ] `plugin.yaml` declares `lerd` as a lower bound, and `platforms` if it runs on only one. +- [ ] Everything it runs is readable source in the commit: no binaries, no minified code without its source, nothing downloaded and run. +- [ ] It asks for no privilege and writes only to its own folder, its data folder and the sites it is run against. +- [ ] Pages bundle their own assets; nothing loads from third-party servers. +- [ ] Any service image is pinned to a version tag and named in the README with its source. +- [ ] The images show the plugin itself, are mine to publish, and are PNG, JPEG or WebP under 1 MB and at most 2560 px wide. From d5e5e7bdc7b773684ce56248c9d1df825db3d73c Mon Sep 17 00:00:00 2001 From: ExeQue Date: Fri, 23 Oct 2026 23:10:19 +0200 Subject: [PATCH 2/5] Point submitters at the pull request template --- SUBMITTING.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SUBMITTING.md b/SUBMITTING.md index 0f1b74f..233e354 100644 --- a/SUBMITTING.md +++ b/SUBMITTING.md @@ -4,7 +4,7 @@ A plugin runs as the person who installs it, with their permissions, on the mach ## How approval works -You open a pull request adding your plugin's entry: its repository and the full 40-character commit you want listed. A maintainer reads the plugin at that commit and approves it or explains what stands in the way. Lerd installs that commit and nothing else, so every update is a new pull request with a new commit, and the maintainer reviews the difference from the last approved one. +You open a pull request adding your plugin's entry: its repository and the full 40-character commit you want listed. A maintainer reads the plugin at that commit and approves it or explains what stands in the way. Lerd installs that commit and nothing else, so every update is a new pull request with a new commit, and the maintainer reviews the difference from the last approved one. The pull request opens with a [template](.github/pull_request_template.md): fill in every section, since it is the first thing the maintainer reads. The entry is `plugins/.yaml`, named like the plugin: From f14ea3a990aeb31fe015ed39bc925f4cff19036e Mon Sep 17 00:00:00 2001 From: George Dumitrescu Date: Sat, 24 Oct 2026 00:32:27 +0300 Subject: [PATCH 3/5] docs: ask for a submission in prose rather than a checklist Submissions so far are a few short paragraphs on what the plugin does, reads, changes and sends, and that is what the maintainer reads first. The template now prompts for exactly that, in a comment that leaves only the repository and image lines behind. A checklist naming some of the terms read as if the rest did not count, so it points at SUBMITTING.md for all of them instead. --- .github/pull_request_template.md | 54 +++++++++++--------------------- SUBMITTING.md | 2 +- 2 files changed, 19 insertions(+), 37 deletions(-) diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 530d0cc..b9506d0 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,45 +1,27 @@ - -## Plugin - -- Repository: https://github.com// -- Commit: -- Previously approved commit: - -## What it does +Read SUBMITTING.md first. This pull request adds or updates one file, +plugins/.yaml, pinned to a full 40-character commit, and a maintainer reads +the plugin at that commit against every one of the terms there. - +Describe it in a few short paragraphs, the way lerd-env/plugins#2 does: -## What it adds to Lerd +What the plugin does, for someone deciding whether to install it, and what it +adds to Lerd: commands, site commands, hooks, MCP tools, API endpoints, a +dashboard page, site tabs, Overview cards, page scripts, services, frameworks. - +What it reads, what it changes, and what it sends over the network and to whom. +"Nothing leaves the machine" is a fine answer when it is true. If it reads a +site's .env, say why. -## What it reads, changes and sends +What it needs: commands beyond its interpreters, the oldest Lerd it runs on, and +its platforms if it does not run on both Linux and macOS. -- Reads: -- Changes: -- Sends over the network: +For an update, the previously approved commit and what changed since it. -## Requirements - - - -## Images - - +Then the repository, and an image for each page, site tab, Overview card or page +script, linked at the commit so the reviewer sees what will be listed. +--> -## Checklist +Repository: https://github.com// -- [ ] The repository is public and has an open source license. -- [ ] The README says what the plugin adds, reads, changes and sends. -- [ ] `plugin.yaml` declares `lerd` as a lower bound, and `platforms` if it runs on only one. -- [ ] Everything it runs is readable source in the commit: no binaries, no minified code without its source, nothing downloaded and run. -- [ ] It asks for no privilege and writes only to its own folder, its data folder and the sites it is run against. -- [ ] Pages bundle their own assets; nothing loads from third-party servers. -- [ ] Any service image is pinned to a version tag and named in the README with its source. -- [ ] The images show the plugin itself, are mine to publish, and are PNG, JPEG or WebP under 1 MB and at most 2560 px wide. +![What it shows](https://raw.githubusercontent.com////) diff --git a/SUBMITTING.md b/SUBMITTING.md index 233e354..4cfdce9 100644 --- a/SUBMITTING.md +++ b/SUBMITTING.md @@ -4,7 +4,7 @@ A plugin runs as the person who installs it, with their permissions, on the mach ## How approval works -You open a pull request adding your plugin's entry: its repository and the full 40-character commit you want listed. A maintainer reads the plugin at that commit and approves it or explains what stands in the way. Lerd installs that commit and nothing else, so every update is a new pull request with a new commit, and the maintainer reviews the difference from the last approved one. The pull request opens with a [template](.github/pull_request_template.md): fill in every section, since it is the first thing the maintainer reads. +You open a pull request adding your plugin's entry: its repository and the full 40-character commit you want listed. A maintainer reads the plugin at that commit and approves it or explains what stands in the way. Lerd installs that commit and nothing else, so every update is a new pull request with a new commit, and the maintainer reviews the difference from the last approved one. The pull request opens with a [template](.github/pull_request_template.md) asking for the description the maintainer reads first. The entry is `plugins/.yaml`, named like the plugin: From 4409abc9fb684957cf45763d77772253c2bc7ccd Mon Sep 17 00:00:00 2001 From: George Dumitrescu Date: Sat, 24 Oct 2026 00:34:14 +0300 Subject: [PATCH 4/5] docs: bring back the template's sections and cover every term in its checklist The previous commit cut the sections and the checklist down to a prompt. They are back as submitted, and the checklist now covers every term a submitter answers for, adding the ones it left out: no PHP, secrets and .env, the token, hooks, analytics and opt-in, page script reach, reused names, honest descriptions, the image count and the security response. --- .github/pull_request_template.md | 61 ++++++++++++++++++++++---------- SUBMITTING.md | 2 +- 2 files changed, 44 insertions(+), 19 deletions(-) diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index b9506d0..d3cb16e 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,27 +1,52 @@ -Describe it in a few short paragraphs, the way lerd-env/plugins#2 does: +## Plugin -What the plugin does, for someone deciding whether to install it, and what it -adds to Lerd: commands, site commands, hooks, MCP tools, API endpoints, a -dashboard page, site tabs, Overview cards, page scripts, services, frameworks. +- Repository: https://github.com// +- Commit: +- Previously approved commit: -What it reads, what it changes, and what it sends over the network and to whom. -"Nothing leaves the machine" is a fine answer when it is true. If it reads a -site's .env, say why. +## What it does -What it needs: commands beyond its interpreters, the oldest Lerd it runs on, and -its platforms if it does not run on both Linux and macOS. + -For an update, the previously approved commit and what changed since it. +## What it adds to Lerd -Then the repository, and an image for each page, site tab, Overview card or page -script, linked at the commit so the reviewer sees what will be listed. ---> + + +## What it reads, changes and sends + +- Reads: +- Changes: +- Sends over the network: + +## Requirements + + + +## Images + + -Repository: https://github.com// +## Checklist -![What it shows](https://raw.githubusercontent.com////) +- [ ] The repository is public and has an open source license. +- [ ] The README says what the plugin adds, reads, changes and sends. +- [ ] `plugin.yaml` declares `lerd` as a lower bound, and `platforms` if it runs on only one. +- [ ] Everything it runs is readable source in the commit, in shell, Python, Node or similar but not PHP: no binaries, no minified code without its source, nothing downloaded and run. +- [ ] It asks for no privilege and writes only to its own folder, its data folder and the sites it is run against, changing Lerd only through its API. +- [ ] It reads no secrets it has no stated need for, and a site's `.env` only when the README says why. +- [ ] Lerd's token never leaves the machine and is never written outside the plugin's data folder. +- [ ] Hooks finish quickly and fail without leaving a site, service or database half changed. +- [ ] Nothing leaves the machine without an opt-in the user turns on, and there are no analytics, tracking, ads or mining. +- [ ] Pages bundle their own assets, nothing loads from third-party servers, and page scripts talk only to the plugin's own endpoints. +- [ ] Any service image comes from a public registry, is pinned to a version tag, and is named in the README with its source. +- [ ] No service or framework reuses a name Lerd, its stores or another plugin already has. +- [ ] The name, description and images describe what it actually does. +- [ ] The images show the plugin itself, are mine to publish, and are at most 6, each a PNG, JPEG or WebP under 1 MB and at most 2560 px wide. +- [ ] I will acknowledge a reported security problem within 7 days and fix or answer it within 30. diff --git a/SUBMITTING.md b/SUBMITTING.md index 4cfdce9..233e354 100644 --- a/SUBMITTING.md +++ b/SUBMITTING.md @@ -4,7 +4,7 @@ A plugin runs as the person who installs it, with their permissions, on the mach ## How approval works -You open a pull request adding your plugin's entry: its repository and the full 40-character commit you want listed. A maintainer reads the plugin at that commit and approves it or explains what stands in the way. Lerd installs that commit and nothing else, so every update is a new pull request with a new commit, and the maintainer reviews the difference from the last approved one. The pull request opens with a [template](.github/pull_request_template.md) asking for the description the maintainer reads first. +You open a pull request adding your plugin's entry: its repository and the full 40-character commit you want listed. A maintainer reads the plugin at that commit and approves it or explains what stands in the way. Lerd installs that commit and nothing else, so every update is a new pull request with a new commit, and the maintainer reviews the difference from the last approved one. The pull request opens with a [template](.github/pull_request_template.md): fill in every section, since it is the first thing the maintainer reads. The entry is `plugins/.yaml`, named like the plugin: From 6fbaa23265fc3534945f6c28e5b8d4b873f15f2f Mon Sep 17 00:00:00 2001 From: George Dumitrescu Date: Sat, 24 Oct 2026 00:35:47 +0300 Subject: [PATCH 5/5] docs: name provides jobs and digest pins in the submission template A plugin can take over a job from Lerd under provides, which belongs among what it adds, and an image pinned to a digest is accepted as well as a version tag, as SUBMITTING.md prefers. --- .github/pull_request_template.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index d3cb16e..5fd2d0f 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -16,7 +16,7 @@ Fill in every section; "nothing" is a fine answer where it is true. ## What it adds to Lerd - + ## What it reads, changes and sends @@ -45,7 +45,7 @@ Fill in every section; "nothing" is a fine answer where it is true. - [ ] Hooks finish quickly and fail without leaving a site, service or database half changed. - [ ] Nothing leaves the machine without an opt-in the user turns on, and there are no analytics, tracking, ads or mining. - [ ] Pages bundle their own assets, nothing loads from third-party servers, and page scripts talk only to the plugin's own endpoints. -- [ ] Any service image comes from a public registry, is pinned to a version tag, and is named in the README with its source. +- [ ] Any service image comes from a public registry, is pinned to a version tag or a digest, never `latest`, and is named in the README with its source. - [ ] No service or framework reuses a name Lerd, its stores or another plugin already has. - [ ] The name, description and images describe what it actually does. - [ ] The images show the plugin itself, are mine to publish, and are at most 6, each a PNG, JPEG or WebP under 1 MB and at most 2560 px wide.