Awesome Maintainer Defense

English · Tiếng Việt · 日本語

Offline repository-governance and GitHub Actions risk auditor with reversible defense profiles and an evidence-reviewed resource catalog.

%%{init: {"theme":"base","themeVariables":{"background":"#FFFFFF","fontFamily":"Arial, sans-serif","lineColor":"#667085","primaryTextColor":"#172B4D"}}}%%
flowchart LR
    R["Repository<br/>Repo / リポジトリ"]:::yellow
    A["Read-only audit<br/>Chỉ đọc / 読取監査"]:::blue
    F["Evidence findings<br/>Phát hiện / 所見"]:::pink
    P["Reviewable patch<br/>Patch / パッチ"]:::purple
    H["Human decision<br/>Con người / 人の判断"]:::green
    R --> A --> F --> P --> H
    classDef yellow fill:#FFF4A3,stroke:#C9A227,stroke-width:2px,color:#172B4D
    classDef blue fill:#D9EAFD,stroke:#4C78A8,stroke-width:2px,color:#172B4D
    classDef pink fill:#FFE1E6,stroke:#C96A7B,stroke-width:2px,color:#172B4D
    classDef purple fill:#E9DDF7,stroke:#8064A2,stroke-width:2px,color:#172B4D
    classDef green fill:#DDF5E3,stroke:#4F9D69,stroke-width:2px,color:#172B4D

Loading

English

The dependency-free Python CLI audits repository policy and workflow trust boundaries without a network connection or GitHub token. fix emits a unified diff; it never edits a repository, changes settings, commits or pushes. Findings are review inputs, not proof of authorship, intent or safety.

3 findings · 1 critical · 1 high · 1 medium

CRITICAL MD-WF-005  Untrusted pull-request input can reach a privileged workflow with secrets or write authority.
HIGH     MD-WF-004  Privileged event pull_request_target checks out an attacker-influenced revision.
MEDIUM   MD-WF-006  Checkout may persist a write-capable token in the workspace.

python3 scripts/build_standalone.py
python3 generated/maintainer-defense-kit.py audit .
python3 generated/maintainer-defense-kit.py fix . --output recommended.patch
python3 scripts/validate.py
python3 scripts/test_auditor.py

Tiếng Việt

CLI Python không dependency kiểm tra policy và ranh giới tin cậy của workflow mà không cần mạng hoặc GitHub token. Lệnh fix chỉ tạo unified diff; không sửa repo, đổi setting, commit hoặc push. Mỗi finding chỉ là bằng chứng cần con người xem xét, không phải kết luận về tác giả, ý định hay mức độ an toàn.

日本語

依存関係のない Python CLI は、ネットワークや GitHub トークンなしでリポジトリ方針とワークフローの信頼境界を監査します。fix は unified diff を出力するだけで、ファイル編集、設定変更、commit、push は行いません。所見は人が確認するための根拠であり、作者、意図、安全性の証明ではありません。

The deployable kit keeps example .github directories because those files are product assets; they do not execute in this repository.

The repository is also a local, skills-only plugin for ChatGPT, Codex, Claude Code and Cowork. It does not require a hosted connector. See the directory submission package, privacy policy, terms, and support guidance.

Evidence-reviewed catalog

Abuse Detection & Moderation

Detect, label, quarantine, or respond to spam, harassment, and low-quality automated contributions.

Resource	Type	License	Why it matters
Niubi Guard ⭐	tool	Apache-2.0	Repository abuse detection and response system for spam, harassment, and coordinated attacks.
Anti Slop ⭐	github-action	AGPL-3.0	Configurable GitHub Action that detects and can close low-quality or AI-slop pull requests.
GitHub AI Moderator	github-action	MIT	Model-powered Action that labels spam, link spam, and content it infers to be AI-generated.
AI Community Moderator	github-action	MIT	Moderates community interactions against a project's contributing guide and code of conduct.
AI Assessment Comment Labeler	github-action	MIT	Issue-intake Action that retrieves an AI assessment and applies configurable labels.

Contributor Trust & Admission

Use explicit vouches or contribution history to control access without closing a project to everyone.

Resource	Type	License	Why it matters
Fossier	tool	MIT	Vouch-compatible workflow and CLI for reducing unsolicited pull-request spam.
Vouch ⭐	tool	MIT	Community trust management based on explicit vouches before a participant can contribute.
Good Egg	github-action	MIT	Scores pull-request authors using their contribution history across GitHub.

Intake & Triage

Reduce review load with structured intake, labels, lifecycle automation, and emergency lockdowns.

Resource	Type	License	Why it matters
Labeler	github-action	MIT	Official Action for labeling pull requests from changed files and branch patterns.
Stale	github-action	MIT	Official Action for marking and optionally closing inactive issues and pull requests.
Lock Threads	github-action	MIT	Locks closed issues, pull requests, and discussions after a configurable period.
Repo Lockdown ⭐	github-action	MIT	Emergency Action that immediately closes and locks new issues or pull requests.
Issue Metrics	github-action	MIT	Measures issue, pull-request, and discussion response times and generates a Markdown report.

Repository Governance & Access

Keep security policies, branch protections, and repository settings consistent across projects.

Resource	Type	License	Why it matters
OpenSSF Allstar ⭐	github-app	Apache-2.0	Continuously checks and enforces security policies across GitHub organizations.
Safe Settings ⭐	github-app	ISC	Centrally manages repository settings, branch protections, and teams with pull-request dry runs.
Repository Settings App	github-app	ISC	Synchronizes repository settings from a version-controlled .github/settings.yml file.

Workflow & Supply-Chain Defense

Protect CI, dependencies, secrets, and merge paths from hostile or compromised contributions.

Resource	Type	License	Why it matters
Harden-Runner ⭐	github-action	Apache-2.0	Monitors network egress, file integrity, and processes on GitHub-hosted runners.
OpenSSF Scorecard ⭐	tool	Apache-2.0	Automated security-health checks for open-source projects and their dependencies.
zizmor ⭐	tool	MIT	Static analysis for security and correctness problems in GitHub Actions workflows.
pinact	tool	MIT	Pins GitHub Actions and reusable workflows to immutable commit hashes.
Dependency Review Action ⭐	github-action	MIT	Blocks pull requests that introduce vulnerable dependencies or disallowed licenses.
TruffleHog	tool	AGPL-3.0	Finds and verifies leaked credentials before they become a maintainer incident.
PRevent	github-app	MIT	Detects suspicious pull-request changes that may indicate malicious code.
OSV-Scanner ⭐	tool	Apache-2.0	Scans lockfiles, SBOMs, and source artifacts against the OSV vulnerability database.
Gitleaks ⭐	tool	MIT	Detects secrets in Git history, directories, files, and standard input.

Policies & Playbooks

Set expectations before problems arrive and respond consistently when they do.

Resource	Type	License	Why it matters
Open Source AI Contribution Policies ⭐	awesome-list	CC0-1.0	Comparative catalog of how open-source projects govern AI-generated contributions.
OpenSSF AI-Slop Best-Practices Work Item	working-group	N/A	Open work item developing practices for low-quality AI security reports and contributions; not a finalized standard.

Released under the MIT License. Separate Vietnamese and Japanese catalog views remain in README.vi.md and README.ja.md.