Close three source analysis gaps and pin the rules with a corpus

rules/README.md → .github/rules/README.md

@@ -6,12 +6,12 @@ you do not need to touch anything here to add a plugin — that is one file in
 
 | File | What it is |
 |---|---|
-| `plugin.schema.json` | JSON Schema for `plugins/<id>.json`. The single source of truth for the fields, read by `scripts/analyze.py` and by `scripts/validate.py`, so the rules can never drift from the documentation. |
+| `plugin.schema.json` | JSON Schema for `plugins/<id>.json`. The single source of truth for the fields, read by `../scripts/analyze.py` and by `../scripts/validate.py`, so the rules can never drift from the documentation. |
 | `reserved.json` | Plugin ids and PHP class names already used by Bludit core. A plugin colliding with one of these cannot be installed: a duplicate directory would clash with the bundled plugin, and a duplicate class name is a fatal error PHP cannot recover from. |
 
 `reserved.json` is generated, do not edit it by hand. Regenerate it whenever
 Bludit adds, removes or renames a bundled plugin:
 
 ```bash
-python3 scripts/refresh_reserved.py ~/github/bludit
+python3 .github/scripts/refresh_reserved.py ~/github/bludit
 ```

.github/rules/plugin.schema.json

@@ -0,0 +1,86 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://raw.githubusercontent.com/bludit/plugins/main/.github/rules/plugin.schema.json",
+  "title": "Bludit plugin submission",
+  "description": "One file per plugin inside plugins/. The filename is the id, it is the directory Bludit creates inside bl-plugins. Nothing here is read from the zip, this file is the record. Fields derived by CI (id, sha256, size) must not be present.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["name", "description", "author", "website", "license", "compatible", "version"],
+  "properties": {
+    "name": {
+      "type": "string",
+      "minLength": 2,
+      "maxLength": 60,
+      "description": "Shown in the plugin directory of the admin panel."
+    },
+    "description": {
+      "type": "object",
+      "description": "One line per language, the key is a Bludit language code such as en, es or pt_BR. English is required and is the fallback when the admin panel runs in a language the plugin does not provide.",
+      "required": ["en"],
+      "additionalProperties": false,
+      "maxProperties": 40,
+      "patternProperties": {
+        "^[a-z]{2,3}(_[A-Z]{2})?$": {
+          "type": "string",
+          "minLength": 10,
+          "maxLength": 300,
+          "pattern": "^[^\\n\\r]+$"
+        }
+      }
+    },
+    "author": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 60
+    },
+    "website": {
+      "type": "string",
+      "format": "uri",
+      "pattern": "^https://",
+      "maxLength": 300,
+      "description": "Where a user reads about the plugin. Linked from the author name in the admin panel."
+    },
+    "license": {
+      "type": "string",
+      "minLength": 2,
+      "maxLength": 40,
+      "description": "SPDX identifier, for example MIT or GPL-3.0-or-later. Use PROPRIETARY for a closed licence."
+    },
+    "compatible": {
+      "type": "string",
+      "pattern": "^[0-9]+\\.[0-9]+(,[0-9]+\\.[0-9]+)*$",
+      "description": "Comma separated list of major.minor Bludit versions, for example 4.0 or 4.0,4.1. Bludit only offers a plugin that names the version the site is running."
+    },
+    "version": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 20,
+      "description": "The version this submission lists. Bump it in a new pull request to publish a new release."
+    },
+    "download": {
+      "type": "string",
+      "format": "uri",
+      "pattern": "^https://github\\.com/[^/]+/[^/]+/releases/download/[^/]+/[^/]+\\.zip$",
+      "description": "GitHub release asset. Archives generated by GitHub (/archive/*.zip) are not accepted, their bytes are not stable and the checksum recorded for the plugin would stop matching. Required for a free plugin, and must be absent when price_in_usd is set."
+    },
+    "price_in_usd": {
+      "type": "number",
+      "exclusiveMinimum": 0,
+      "maximum": 100000,
+      "description": "Leave it out for a free plugin. A priced plugin is a listing only: Bludit cannot install an asset it has to pay for, so it is hidden from the plugin directory in the admin panel and its source is never analyzed. Sell it from your website."
+    },
+    "type": {
+      "type": "string",
+      "enum": ["", "editor", "theme"],
+      "description": "Leave empty for a regular plugin. Same vocabulary used by the metadata.json of the plugin."
+    },
+    "tags": {
+      "type": "array",
+      "maxItems": 8,
+      "items": {
+        "type": "string",
+        "pattern": "^[a-z0-9][a-z0-9-]{1,24}$"
+      }
+    }
+  }
+}