Add community bundle submission automation

.github/aw/actions-lock.json

@@ -1,10 +1,30 @@
 {
   "entries": {
+    "actions/checkout@v6.0.3": {
+      "repo": "actions/checkout",
+      "version": "v6.0.3",
+      "sha": "df4cb1c069e1874edd31b4311f1884172cec0e10"
+    },
+    "actions/download-artifact@v8.0.1": {
+      "repo": "actions/download-artifact",
+      "version": "v8.0.1",
+      "sha": "3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c"
+    },
     "actions/github-script@v9.0.0": {
       "repo": "actions/github-script",
       "version": "v9.0.0",
       "sha": "3a2844b7e9c422d3c10d287c895573f7108da1b3"
     },
+    "actions/setup-node@v6.4.0": {
+      "repo": "actions/setup-node",
+      "version": "v6.4.0",
+      "sha": "48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e"
+    },
+    "actions/upload-artifact@v7.0.1": {
+      "repo": "actions/upload-artifact",
+      "version": "v7.0.1",
+      "sha": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
+    },
     "github/gh-aw-actions/setup@v0.79.8": {
       "repo": "github/gh-aw-actions/setup",
       "version": "v0.79.8",

.github/workflows/add-community-bundle.md

@@ -0,0 +1,288 @@
+---
+description: "Process community bundle submission issues - validate, add to catalog, and open a PR for maintainer review"
+emoji: "📦"
+
+on:
+  issues:
+    types: [labeled]
+    names: [bundle-submission]
+  skip-bots: [github-actions, copilot, dependabot]
+
+tools:
+  edit:
+  bash: ["echo", "grep", "sort", "python3", "jq", "date"]
+  github:
+    toolsets: [issues, repos]
+    min-integrity: none
+  web-fetch:
+
+permissions:
+  contents: read
+  issues: read
+
+checkout:
+  fetch-depth: 0
+
+safe-outputs:
+  noop:
+    report-as-issue: false
+  create-pull-request:
+    title-prefix: "[bundle] "
+    labels: [bundle-submission, automated]
+    draft: true
+    max: 1
+    allowed-files:
+      - bundles/catalog.community.json
+      - docs/community/bundles.md
+    protected-files:
+      policy: blocked
+      exclude:
+        - README.md
+        - CHANGELOG.md
+  add-comment:
+    max: 2
+  add-labels:
+    allowed: [bundle-submission, validation-passed, validation-failed, needs-info]
+    max: 3
+  remove-labels:
+    allowed: [validation-passed, validation-failed, needs-info]
+---
+
+# Add Community Bundle from Issue Submission
+
+You are a catalog maintenance agent for the Spec Kit project. Process community
+bundle submission issues and create draft pull requests that add or update
+entries in the community bundle catalog.
+
+Community bundles are untrusted. Validate metadata and distribution evidence,
+but do not claim to audit, endorse, or support bundle code or the components it
+installs. Never register a submitted companion catalog automatically.
+
+## Triggering Conditions
+
+This workflow is triggered by an `issues: labeled` event and is gated to the
+`bundle-submission` label. Before processing, verify that the issue title starts
+with `[Bundle]:`. If it does not, stop without commenting.
+
+## Step 1 - Read and Parse the Issue
+
+Read issue #${{ github.event.issue.number }} and extract these issue-form fields:
+
+| Field | Issue Form ID | Required |
+|-------|---------------|----------|
+| Bundle ID | `bundle-id` | Yes |
+| Bundle Name | `bundle-name` | Yes |
+| Version | `version` | Yes |
+| Role or Team | `role` | Yes |
+| Description | `description` | Yes |
+| Author | `author` | Yes |
+| Repository URL | `repository` | Yes |
+| Download URL | `download-url` | Yes |
+| Documentation URL | `documentation` | Yes |
+| License | `license` | Yes |
+| Required Spec Kit Version | `speckit-version` | Yes |
+| Integration Target | `integration` | No |
+| Components Provided | `components-provided` | Yes |
+| Required Component Catalogs | `required-catalogs` | Yes |
+| Tags | `tags` | Yes |
+| Key Features | `features` | Yes |
+| Testing Details | `testing-details` | Yes |
+| Example Usage | `example-usage` | Yes |
+| Proposed Catalog Entry | `catalog-entry` | Yes |
+
+Issue-form values appear beneath headings matching their labels.
+
+## Step 2 - Validate the Submission
+
+Run every check and collect all failures before deciding the outcome.
+
+### 2a. Bundle ID and version
+
+- The bundle ID must match
+  `^[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?$`.
+- The version must be semantic version `X.Y.Z` with digits only and no `v`
+  prefix.
+
+### 2b. Repository and documentation
+
+- Restrict repository and documentation URLs to public GitHub URLs before
+  fetching them.
+- Confirm the repository exists and contains `bundle.yml`, `README.md`, and a
+  license file (`LICENSE`, `LICENSE.md`, or `LICENSE.txt`).
+- The documentation URL must resolve to a readable Markdown file that explains
+  the bundle's intended role, installed components, required catalogs, and
+  installation steps.
+- Confirm the repository's `bundle.yml` matches the submitted bundle ID,
+  version, role, author, license, Spec Kit requirement, integration target, and
+  component summary.
+
+### 2c. Release artifact
+
+- The download URL must be an HTTPS GitHub release asset URL under the submitted
+  repository:
+  `https://github.com/<owner>/<repo>/releases/download/<tag>/<asset>.zip`.
+- Confirm the release exists, its tag corresponds to the submitted version
+  (`vX.Y.Z` or `X.Y.Z`), and the exact ZIP asset is attached to that release.
+- Confirm the asset name is versioned and consistent with the submitted bundle
+  ID and version.
+
+Do not fetch arbitrary user-provided URLs. Do not claim the artifact was
+executed or audited; rely on the required submission attestations for build and
+installation evidence.
+
+### 2d. Catalog entry
+
+Parse the proposed JSON and require one entry under the submitted bundle ID.
+Confirm that:
+
+- `id`, `name`, `version`, `role`, `description`, `author`, `license`,
+  `download_url`, and `repository` match the submission and manifest.
+- `requires.speckit_version` matches the submission.
+- `provides` contains non-negative integer counts for `extensions`, `presets`,
+  `steps`, and `workflows`, matching the manifest.
+- `tags` contains 2-5 lowercase strings and matches the submitted tags.
+- `verified` is the boolean value `false`. Community entries must never be
+  marked verified.
+
+### 2e. Component resolution
+
+- `Required Component Catalogs` must explicitly say `None` or list every
+  non-default extension, preset, workflow, and step catalog needed by the
+  bundle.
+- Compare the manifest references, README, required-catalog field, testing
+  details, and example usage for consistency.
+- If non-default catalogs are required, ensure each URL is HTTPS, the README
+  documents the corresponding `catalog add` command, and the testing details
+  say those catalogs were registered in the clean-project test.
+- If the field says `None` but a component is not bundled and cannot be
+  installed from a default Spec Kit catalog, fail validation and ask the
+  submitter to list and document an install-allowed companion catalog.
+
+The community bundle catalog itself remains discovery-only. Companion catalog
+URLs are documentation and validation metadata, not catalogs this workflow
+should add to Spec Kit.
+
+### 2f. Checklists and testing evidence
+
+- Confirm every required checkbox in Testing Checklist and Submission
+  Requirements is checked (`[x]`).
+- Confirm Testing Details describe validation, build, artifact installation,
+  and clean-project testing.
+- Confirm Example Usage includes artifact installation and, when applicable,
+  all required catalog setup commands.
+
+### Validation outcome
+
+If any check fails:
+
+1. Comment once with every failed check and a specific correction.
+2. Remove `validation-passed`.
+3. Add `validation-failed`; add `needs-info` when submitter input is needed.
+4. Stop without editing files or creating a pull request.
+
+If all checks pass, remove `validation-failed` and `needs-info`, add
+`validation-passed`, and continue.
+
+## Step 3 - Determine Add or Update
+
+Search `bundles/catalog.community.json` for the bundle ID.
+
+- If absent, add a new entry.
+- If present, update the existing entry in place.
+
+Treat a submitted version lower than or equal to the existing catalog version
+as a validation failure unless the issue clearly documents a metadata-only
+correction at the same version.
+
+## Step 4 - Update the Community Catalog
+
+Edit `bundles/catalog.community.json`. Insert new entries alphabetically by
+bundle ID. The entry shape is:
+
+```json
+{
+  "<bundle-id>": {
+    "name": "<bundle-name>",
+    "id": "<bundle-id>",
+    "version": "<version>",
+    "role": "<role>",
+    "description": "<description>",
+    "author": "<author>",
+    "license": "<license>",
+    "download_url": "<download-url>",
+    "repository": "<repository>",
+    "requires": {
+      "speckit_version": "<speckit-version>"
+    },
+    "provides": {
+      "extensions": 0,
+      "presets": 0,
+      "steps": 0,
+      "workflows": 0
+    },
+    "tags": ["<tag>"],
+    "verified": false
+  }
+}
+```
+
+Use the validated proposed entry rather than inventing metadata. Keep
+`verified: false`. Update the top-level `updated_at` to today's UTC date at
+midnight and preserve the top-level `catalog_url`.
+
+Validate the complete file:
+
+```bash
+python3 -c "import json; json.load(open('bundles/catalog.community.json')); print('Valid JSON')"
+```
+
+## Step 5 - Update Community Documentation
+
+Add or update the bundle in `docs/community/bundles.md`. Keep rows alphabetical
+by bundle name:
+
+```text
+| <Name> | <Description> | `<role>` | <component counts> | <None or documented> | [<repo-name>](<repository>) |
+```
+
+Before rendering the row, convert every user-derived display value to
+single-line plain text: collapse CR/LF sequences to spaces, remove control
+characters, and backslash-escape `\`, `|`, backticks, `*`, `_`, `[`, `]`, `<`,
+and `>`. Use the validated HTTPS GitHub repository URL unchanged only as the
+Markdown link destination.
+
+Render component counts compactly, omitting zero-valued component types. Use
+`None` when no companion catalogs are needed and `Documented` otherwise; the
+repository README remains the source for the actual URLs.
+
+## Step 6 - Create a Draft Pull Request
+
+Create one draft pull request.
+
+- New entry branch:
+  `community/${{ github.event.issue.number }}-add-<bundle-id>-bundle`
+- Update branch:
+  `community/${{ github.event.issue.number }}-update-<bundle-id>-bundle`
+- New title: `Add <Bundle Name> bundle to community catalog`
+- Update title: `Update <Bundle Name> bundle to v<version>`
+
+The commit and PR description must summarize the catalog and documentation
+changes, list the validation results, include
+`Closes #${{ github.event.issue.number }}`, and mention the submitter with
+`cc @<issue-author>`.
+
+End the commit message with this authorship trailer:
+
+```text
+Assisted-by: GitHub Copilot (model: <name-if-known>, autonomous)
+```
+
+## Important Rules
+
+- Modify only `bundles/catalog.community.json` and
+  `docs/community/bundles.md`.
+- Keep JSON entries sorted by ID and documentation rows sorted by name.
+- Never set a community bundle's `verified` field to true.
+- Never add, enable, or change the policy of a submitted catalog.
+- Never describe validation as a security audit or endorsement.
+- Use `Closes`, not `Fixes`, for the submission issue.

.github/workflows/catalog-assign.yml

@@ -9,11 +9,13 @@ jobs:
     if: >
       (github.event.action == 'opened' && (
         contains(github.event.issue.labels.*.name, 'extension-submission') ||
-        contains(github.event.issue.labels.*.name, 'preset-submission')
+        contains(github.event.issue.labels.*.name, 'preset-submission') ||
+        contains(github.event.issue.labels.*.name, 'bundle-submission')
       )) ||
       (github.event.action == 'labeled' && (
         github.event.label.name == 'extension-submission' ||
-        github.event.label.name == 'preset-submission'
+        github.event.label.name == 'preset-submission' ||
+        github.event.label.name == 'bundle-submission'
       ))
     runs-on: ubuntu-latest
     permissions:

bundles/catalog.community.json

@@ -0,0 +1,6 @@
+{
+  "schema_version": "1.0",
+  "updated_at": "2026-07-15T00:00:00Z",
+  "catalog_url": "https://raw.githubusercontent.com/github/spec-kit/main/bundles/catalog.community.json",
+  "bundles": {}
+}

docs/community/bundles.md

@@ -5,7 +5,10 @@
 
 Bundles compose existing Spec Kit components — extensions, presets, workflows, and steps — into a single role or team stack. They are useful when a user should be able to install a tested set of components together instead of following several separate install commands.
 
-Accepted community bundle entries will be listed here once a community bundle catalog is available. To submit a bundle for review, file a [Bundle Submission](https://github.com/github/spec-kit/issues/new?template=bundle_submission.yml) issue.
+Accepted community bundle entries are published in [`bundles/catalog.community.json`](https://github.com/github/spec-kit/blob/main/bundles/catalog.community.json) and listed below. The built-in community source is discovery-only: `specify bundle search` and `specify bundle info` can inspect entries, but installing by ID requires explicitly adding an install-allowed catalog. Explicit catalogs use a higher default precedence than the built-in community source. To submit a bundle for review, file a [Bundle Submission](https://github.com/github/spec-kit/issues/new?template=bundle_submission.yml) issue.
+
+| Bundle | Purpose | Role or team | Provides | Required catalogs | URL |
+|--------|---------|--------------|----------|-------------------|-----|
 
 ## What to Submit
 

pyproject.toml

@@ -47,6 +47,8 @@ packages = ["src/specify_cli"]
 "workflows/speckit" = "specify_cli/core_pack/workflows/speckit"
 # Bundled presets (installable via `specify preset add <name>` or `specify init --preset <name>`)
 "presets/lean" = "specify_cli/core_pack/presets/lean"
+# Community bundle catalog snapshot (used for offline discovery)
+"bundles/catalog.community.json" = "specify_cli/core_pack/bundles/catalog.community.json"
 
 [project.optional-dependencies]
 test = [

src/specify_cli/bundler/models/catalog.py

@@ -43,7 +43,7 @@ class Scope(str, Enum):
 BUILTIN_DEFAULT_STACK: tuple[dict[str, Any], ...] = (
     {"id": "default", "url": "builtin://default", "priority": 1,
      "install_policy": InstallPolicy.INSTALL_ALLOWED.value},
-    {"id": "community", "url": "builtin://community", "priority": 2,
+    {"id": "community", "url": "builtin://community", "priority": 20,
      "install_policy": InstallPolicy.DISCOVERY_ONLY.value},
 )