Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[P0][v0.7] Export a verified publication ZIP with previews, assets and provenance

Open
  • Is something wrong?
#86 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
json, python
Domain
full-stack, security

Research direction

Start by reading the linked dependency issues #85, #78, #84, #51, #54, and #56 to understand which campaign artifacts and metadata already exist. Then map the current pipeline and export entry points; the issue does not name files or tests. Done means producing a verified offline ZIP with accurate manifest and hashes, rejecting unsafe or mismatched contents, and marking incomplete artifacts PARTIAL or BLOCKED.

Written by the indexing model from the issue text.

Description

enhancement

User outcome

One click Download Full Publication Pack after generated content passes checks. No manually assembling posts, videos, GIFs, captions, credits and release notes. A pack is a real, offline-openable directory/ZIP with all required files or an honest PARTIAL manifest.

Proposed portable structure

patchpitch-<project>-<release>-<campaign>/
  README_START_HERE.md            # how to post manually, channel order/blocks
  campaign-manifest.json          # schema, project/ref, SHA256, status per artifact
  REVIEW.md                       # missing facts, unresolved media, author approvals
  facts/public-approved.json      # only publishable claims and source refs
  copy/x-single.txt
  copy/x-thread.md
  copy/bluesky.txt
  copy/mastodon.txt
  copy/dev-article.md
  copy/itch-devlog.en.md
  copy/itch-devlog.ru.md
  copy/github-release.md
  copy/metadata.json              # platform tags/CTA/disclosure/ALT, N/A where irrelevant
  scripts/storyboard.json
  scripts/narration.md
  media/video/landscape.mp4
  media/video/vertical.mp4        # if selected/supported
  media/gif/feature-01.gif
  media/captions/demo.vtt
  media/approved/<owner-assets>
  licenses/attribution.md
  preview/index.html              # inert local preview, no network/local model calls

Placeholders above are example structure: exclude irrelevant targets, make missing required artifacts a machine-readable blocking status rather than empty files or invented assets.

Security/provenance

  • Manifest schema version, exact source facts digest, model & voice pack identity, rights/visibility (PUBLIC/PRIVATE/LOCAL_ONLY), source/target revision, media hashes/duration/resolution, render template version, generated/raw-vs-edited selection, per-file status (READY / REVIEW_REQUIRED / BLOCKED / N/A), verification date and SHA-256; deterministic filename sorting/safe relative paths.
  • Archive includes only explicitly public-cleared inputs/assets. No DSN, account tokens, private corpus, local absolute paths, unreleased game measurements, browser cookies, hidden chat messages or model prompt logs in public bundle. Offer separate local diagnostic/private evidence archive only after opt-in.
  • Stop path traversal/symlink/executable content injection, zip bombs/huge archives, unlicensed media, missing or modified expected files. Compare actual bytes against manifest immediately before export, independently reopen ZIP and verify set/hashes.
  • Per-channel preview shows actual edited copy, selected tags, images, captions and CTA; user can reject any part and download PARTIAL for review, but cannot label incomplete pack READY automatically.
  • Zip pack does not publish anything. Explicit local confirmation for save and a separate owner action for uploading to sites.

Acceptance

  • Same approved IdleShop campaign yields human-readable package with at least X/itch copy, one MP4, one GIF, captions, actual media credits and verifiable manifest.
  • Second OSS campaign yields X/DEV/GitHub Release draft and a labelled demo/explainer MP4/GIF or explicit missing-capture status.
  • Test corrupt video, expired URL, unlicensed asset, private source, malformed relative path, incomplete workflow, edit after render and missing fonts/audio. Result is correctly rejected or PARTIAL.
  • Files copy/paste accurately, public preview opens offline, ZIP checksum stable for same frozen inputs, no inference call in packaging stage.

Dependencies: #85 local pipeline, #78 channel metadata, #84 Copy Board, #51 rights manifest, #54 agent handoff format, #56 manual publication receipts. No social scheduling/paid services.

Dominant language
Python
Stars
1
Forks
0
Avg merge
25m
Merged PRs (30d)
5

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from drevendev/PatchPitch

All issues in drevendev/PatchPitch

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.