Merge pull request #100 from Integration-Automation/dev

Release dev to main

Author: JE-Chen

.github/dependabot.yml

@@ -9,3 +9,7 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "daily"
+  - package-ecosystem: "github-actions" # Keep workflow action versions current
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/e2e_browser.yml

@@ -41,6 +41,8 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: "3.12"
+          cache: 'pip'
+          cache-dependency-path: dev_requirements.txt
 
       - name: Install dependencies
         run: |

.github/workflows/test_dev.yml

@@ -27,12 +27,13 @@ jobs:
       uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python-version }}
+        cache: 'pip'
+        cache-dependency-path: dev_requirements.txt
 
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip wheel
         pip install -r dev_requirements.txt
-        pip install pytest
 
     - name: Run unit tests
       run: python -m pytest test/unit_test/test_*.py -v
@@ -63,6 +64,8 @@ jobs:
       uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python-version }}
+        cache: 'pip'
+        cache-dependency-path: dev_requirements.txt
 
     - name: Install dependencies
       run: |

.github/workflows/test_stable.yml

@@ -27,6 +27,8 @@ jobs:
       uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python-version }}
+        cache: 'pip'
+        cache-dependency-path: requirements.txt
 
     - name: Install dependencies
       run: |
@@ -63,6 +65,8 @@ jobs:
       uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python-version }}
+        cache: 'pip'
+        cache-dependency-path: requirements.txt
 
     - name: Install dependencies
       run: |

.gitignore

@@ -123,9 +123,21 @@ dmypy.json
 # Driver
 *.zip
 *.exe
+# webdriver-manager driver cache (set_driver caches drivers under cwd)
+.wdm/
 
 /.claude/
 /.claude
 issues.json
 hotspots.json
 codacy.json
+
+# Static-analysis exports (SonarCloud / Codacy / pyflakes scratch files)
+.codacy_*.json
+.sonar_*.json
+.pyflakes_files*.txt
+
+# Local report-generation scratch output
+default_name*.html
+default_name*.json
+default_name*.xml

CONTRIBUTING.md

@@ -0,0 +1,61 @@
+# Contributing to WebRunner
+
+Thanks for your interest in improving WebRunner (`je_web_runner`). This
+guide covers the local setup, the checks we expect to pass, and the branch
+/ PR conventions.
+
+## Development setup
+
+WebRunner targets **Python 3.10+**.
+
+```bash
+# Runtime dependencies
+pip install -r requirements.txt
+
+# Development dependencies (tests, linters, docs, build tooling)
+pip install -r dev_requirements.txt
+```
+
+## Running the tests
+
+```bash
+# Whole suite (unit + integration; e2e tests skip without a Selenium hub)
+python -m pytest test/
+
+# Unit tests only
+python -m pytest test/unit_test/test_*.py
+```
+
+The pure-Python unit suite needs no browser. Integration tests spawn
+short-lived subprocesses. The real-browser e2e tests under
+`test/e2e_test/` skip cleanly unless `WEBRUNNER_E2E_HUB` points at a
+reachable Selenium Grid (see `docker/`).
+
+## Before opening a pull request
+
+Run the linters and keep them clean (no new findings):
+
+```bash
+python -m flake8 je_web_runner/ --max-line-length=120 --max-complexity=10
+python -m pylint je_web_runner/
+python -m bandit -r je_web_runner/ -ll
+python -m mypy je_web_runner/
+```
+
+Please also:
+
+- Add or update tests for any behaviour you change.
+- Keep public functions type-hinted and documented.
+- Avoid introducing new static-analysis issues (SonarQube / Codacy).
+
+## Branches and commits
+
+- `main` is the stable branch; `dev` is the development branch.
+- Open pull requests **from `dev` into `main`**.
+- Write concise, imperative commit messages (e.g. "Add element
+  validation", "Fix driver cleanup on timeout").
+
+## Reporting security issues
+
+Do **not** file security vulnerabilities as public issues — see
+[SECURITY.md](SECURITY.md) for the private disclosure process.

SECURITY.md

@@ -0,0 +1,42 @@
+# Security Policy
+
+## Supported Versions
+
+WebRunner (`je_web_runner`) is distributed on PyPI. Security fixes are
+applied to the latest released version. Please upgrade to the most recent
+release before reporting an issue, as the problem may already be resolved.
+
+| Version        | Supported          |
+| -------------- | ------------------ |
+| Latest release | :white_check_mark: |
+| Older releases | :x:                |
+
+## Reporting a Vulnerability
+
+Please report security vulnerabilities **privately** — do not open a public
+issue, pull request, or discussion for a suspected vulnerability.
+
+Use either of the following private channels:
+
+- **GitHub Security Advisories** — open a private report via the
+  repository's *Security* tab → *Report a vulnerability*. This is the
+  preferred channel.
+- **Email** — `jechenmailman@gmail.com` with a subject line beginning
+  `[SECURITY]`.
+
+To help triage quickly, please include where practical:
+
+- A description of the vulnerability and its impact.
+- The affected version(s) and platform.
+- Step-by-step reproduction instructions or a minimal proof of concept.
+- Any suggested remediation.
+
+## Disclosure Process
+
+- We aim to acknowledge a report within **5 business days**.
+- We target a fix and coordinated disclosure within **90 days** of the
+  initial report, sooner for actively exploited issues.
+- We will credit reporters who wish to be acknowledged once a fix is
+  released. Please let us know your preference.
+
+Thank you for helping keep WebRunner and its users safe.

dev_requirements.txt

@@ -7,4 +7,9 @@ Pyside6
 defusedxml
 Pillow
 faker
-sqlalchemy
+sqlalchemy
+pytest
+pylint
+flake8
+bandit
+mypy

docs/source/Zh/doc/specialized_modules/specialized_modules_doc.rst

@@ -514,7 +514,7 @@ CODEOWNERS 解析器(GitHub 語意:最後一條 match 的規則勝出)+ 每
 * ``web_push_assert`` —— Push subscription VAPID key 匹配、endpoint
   白名單、``userVisibleOnly``、``showNotification`` payload。
 * ``background_sync_assert`` —— Background Sync register / fire /
-  retry / ``lastChance``(quota 耗盡)斷言。
+  retry / ``lastChance``\ (quota 耗盡)斷言。
 * ``wake_lock_assert`` —— Screen wake lock acquire / release /
   漏掉 / 切回前景時 re-acquire 偵測。
 * ``pip_assert`` —— Picture-in-Picture(影片 + Document PiP)
@@ -569,7 +569,7 @@ Email 與通知送達
 ================
 
 * ``email_deliverability`` —— SPF / DKIM / DMARC header +
-  ``List-Unsubscribe``(Gmail/Yahoo 大量寄件規則)+ BCC 外洩稽核。
+  ``List-Unsubscribe``\ (Gmail/Yahoo 大量寄件規則)+ BCC 外洩稽核。
 * ``inbox_render_outlook`` —— Outlook(Word 引擎)/ Gmail / Apple
   Mail 渲染相容性 pre-flight 檢查。
 * ``push_delivery`` —— FCM / APNs payload 大小 + 必填欄位 + PII

docs/source/Zh/doc/webdriver_wrapper/webdriver_wrapper_doc.rst

@@ -304,7 +304,7 @@ CDP Fetch 攔截
 --------------
 
 ``Fetch.*`` CDP 命令薄包裝。要實際收事件 (``Fetch.requestPaused``) 請使用
-``CDPEventListener``（或 Selenium trio-based devtools listener）自行訂閱：
+``CDPEventListener``\ （或 Selenium trio-based devtools listener）自行訂閱：
 
 .. code-block:: python