ramascene-explorer

There are no installed older versions to maintain. The published page is always the latest build from main, and links from the first version still open their run (CHANGELOG 0.1.0). URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/CHANGELOG.md

I track issues in GitHub issues. URL: https://github.com/simonvanlierde/ramascene-explorer/issues

No vulnerability reports have been resolved in the last 12 months. SECURITY.md promises credit unless the reporter prefers not to be named. URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/.github/SECURITY.md

.github/SECURITY.md documents it: private advisory, acknowledgement within 14 days, then a reproduction answer and an expected fix date. A fix ships in a tagged release and the advisory is published after it. URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/.github/SECURITY.md

The standards are the configs: ruff select = ["ALL"] with Google docstrings and a 120-character line in pyproject.toml, and biome with tabs and a 120-character line in biome.json. CONTRIBUTING.md requires the checks to pass. URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/pyproject.toml and https://github.com/simonvanlierde/ramascene-explorer/blob/main/biome.json

CI runs ruff check, ruff format --check, ty check and biome ci, and fails on a finding. The same checks run as git hooks. URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/.github/workflows/ci.yml

The build produces no native binaries.

There are no native binaries or install step that strips debug information.

One Vite build with one config. No recursive sub-builds. brightway-check/ is a separate uv project outside the build. URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/vite.config.js

Two builds of the same commit from two fresh checkouts at different paths (pnpm install --frozen-lockfile, vite build) give byte-identical dist/ trees (diff -r empty, checked 2026-10-27 on 9dbe295). The lockfile and the pinned packageManager fix every dependency version, and the build embeds no timestamp or path. URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/pnpm-lock.yaml

There is nothing to install: people open the page. To self-host, copy dist/ to any static host that answers range requests (README, "View"). URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/README.md

No installation system.

CONTRIBUTING.md "Set up": uv tool install prek, prek install, pnpm install, gh release download data-2011 ..., then pnpm dev. Dependencies come from the lockfiles. URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/CONTRIBUTING.md

package.json and pnpm-lock.yaml for the page, pyproject.toml and uv.lock for Python (plus brightway-check/uv.lock). URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/package.json

Renovate watches the dependencies (config in renovate.json5; its dependency dashboard, issue #7, was last updated 2026-10-25). GitHub's Dependabot alerts show none open. A dependency-review job fails a pull request that adds a vulnerable dependency. Both advisories so far (#23, #29) were fixed within days. Dependabot security updates are on, so an advisory gets a fix pull request without waiting for Renovate's monthly schedule. URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/renovate.json5

Every reused component is a package in a lockfile, so one version bump updates it. The one copied file, geo/countries-110m.topo.json, is Natural Earth data with its source in docs/page.md. URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/pnpm-lock.yaml

It uses current releases: Node 24, Svelte 5, Vite 8, Vitest 5. Django is held below 6 on purpose, because the RaMa-Scene engine runs on Django 5 (renovate.json5). URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/package.json

CI runs the pytest, node and Playwright suites on every push to main and every pull request, and reports pass or fail as GitHub checks. URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/.github/workflows/ci.yml

Of the 38 fix commits since the first commit (2026-09-26), not counting dependency updates, 26 (68%) add or change a test in the same commit. Most of the other 12 are wording, layout and CI fixes with no logic to test. URL: https://github.com/simonvanlierde/ramascene-explorer/commits/main

CI fails below 80% line coverage. On main (2026-10-27) pytest covers 83% of precompute.py and compare_data.py, and node --test covers 100% of the lines (96% of the branches) of the page's JavaScript modules, where the flow maths, parsing and input checks live. The browser tests cover 92.1% of the Svelte components' lines in Chromium (pnpm measure-coverage, 2026-10-27). URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/.github/workflows/ci.yml

CONTRIBUTING.md says: "New behaviour comes with a test, and a bug fix with a test that fails without it", and names where each kind of test goes (#27). URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/CONTRIBUTING.md

Same sentence as test_policy. URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/CONTRIBUTING.md

ruff selects every rule. Each ignore is listed with a reason in pyproject.toml. biome runs on all JavaScript, and ty checks the Python types. URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/pyproject.toml

The assurance case gives the threat model, trust boundaries and design principles. The page checks its two inputs (?api=, ?data=) against allow-lists, sets a Content-Security-Policy (script-src 'self', object-src 'none', base-uri 'none', form-action 'none'), renders data as text, and the Pages workflow publishes only from main, only data marked exiobase-v3, with the Parquet checked against its SHA-256. Every workflow defaults to contents: read. URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/docs/assurance-case.md

The explorer's security mechanisms use no cryptography.

No cryptographic algorithms to switch.

It never processes credentials or private keys.

The page fetches only from its own origin over HTTPS. The optional ?api= accepts an https origin, or http only on loopback (127.0.0.1 or localhost); apiUrl in live.js refuses everything else, and tests/live.test.js covers it. URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/live.js

The page implements no TLS. The browser and GitHub Pages negotiate it.

The browser verifies certificates; the page cannot turn that off.

The page sends no private information, cookies or credentials.

Each v* release from v0.4.0 on carries the built page as a tarball with SHA256SUMS and a Sigstore build provenance attestation from release.yml, and embodied.parquet on data-2011 has one too (both verified with gh attestation verify, 2026-10-27). Releases v0.1.0 to v0.3.1 have no assets. The verification steps are in docs/publishing.md, "Check a release file". URL: https://github.com/simonvanlierde/ramascene-explorer/releases

From v0.4.0 on, each release tag is signed (git tag -s) with an SSH key GitHub verifies; v0.4.0 shows as Verified. docs/publishing.md, "Tags", says how to check one with git verify-tag. The older tags (v0.1.0 to v0.3.1) stay unsigned. URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/docs/publishing.md#tags

dataUrl accepts a relative .json path only, with no ... apiUrl accepts a bare https or loopback-http origin, with no credentials, path, query or fragment. scenarioBody accepts integer ids and a finite number and throws otherwise. parseView falls back to defaults for any value out of range. Unit tests cover each. URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/live.js

A Content-Security-Policy in index.html (script-src 'self', no inline script, object-src 'none', base-uri 'none', form-action 'none'), no innerHTML or {@html} in the sources, and read-only workflow tokens with actions pinned by digest. URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/index.html

The attestation branch (#31) adds docs/assurance-case.md with the threat model, trust boundaries, secure design and common weaknesses sections (2026-10-26). It must hold the threat model, the trust boundaries (the page, ?data=, ?api=, the release asset, the Pages deploy), the secure-design argument and the argument against common weaknesses. docs/security.md in #27 supplies much of the material. URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/docs/assurance-case.md

CodeQL runs on every pull request for JavaScript/TypeScript, Python and GitHub Actions, and zizmor checks the workflows. URL: https://github.com/simonvanlierde/ramascene-explorer/blob/main/.github/workflows/hygiene.yml

No memory-unsafe language in the project.