Pre-publication review: licensing, runtime hardening, CI, docs

.github/actions/setup-extension/action.yml

@@ -22,13 +22,13 @@ runs:
 
     - name: Setup Android dependencies
       if: inputs.platform == 'android'
-      uses: nttld/setup-ndk@v1
+      uses: nttld/setup-ndk@ed92fe6cadad69be94a966a7ee3271275e62f779 # v1
       with:
         ndk-version: r23c
         link-to-sdk: true
 
     - name: Setup Web dependencies
       if: inputs.platform == 'web'
-      uses: mymindstorm/setup-emsdk@v14
+      uses: mymindstorm/setup-emsdk@6ab9eb1bda2574c4ddb79809fc9247783eaf9021 # v14
       with:
         no-cache: true

.github/workflows/pr.yml

@@ -12,6 +12,9 @@ env:
   LC_ALL: en_US.UTF-8
   PYTHONIOENCODING: utf8
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-pr-${{ github.actor }}-${{ github.head_ref || github.run_number }}-${{ github.ref }}
   cancel-in-progress: true
@@ -36,18 +39,18 @@ jobs:
           submodules: recursive
 
       - name: clone Godot Cpp repository
-        uses: GuillaumeFalourd/clone-github-repo-action@v2.3
+        uses: GuillaumeFalourd/clone-github-repo-action@19817562c346ff60f9935158dede6c5ece8fd0ac # v2.3
         with:
           depth: 1
           branch: master
           owner: 'godotengine'
           repository: 'godot-cpp'
 
       - name: Setup Rust (Stable)
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
 
       - name: Setup Rust Cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: "ss_player/SpriteStudio-SDK"
 

.github/workflows/release.yml

@@ -30,6 +30,11 @@ env:
   KEYCHAIN_PATH: app-signing.keychain-db
   SCONS_CACHE: ~/.scons_cache
 
+# Least-privilege default token; the package job below elevates to
+# contents: write only to publish the GitHub Release.
+permissions:
+  contents: read
+
 concurrency:
   group: ci-scons-${{ github.actor }}-${{ github.head_ref || github.run_number }}-${{ github.ref }}
   cancel-in-progress: true
@@ -76,7 +81,7 @@ jobs:
         with:
           submodules: recursive
       - name: clone Godot Cpp repository
-        uses: GuillaumeFalourd/clone-github-repo-action@v2.3
+        uses: GuillaumeFalourd/clone-github-repo-action@19817562c346ff60f9935158dede6c5ece8fd0ac # v2.3
         with:
           depth: 1
           branch: master
@@ -206,8 +211,20 @@ jobs:
         run: |
           ./scripts/release-gdextension-web.sh api_version=${{ env.GODOT_VERSION }}
 
+      # Stage the runtime third-party license files (produced by the SDK
+      # download step) into the uploaded artifact so the packaging job can
+      # bundle them into the release zip, as required by the licenses of the
+      # statically-linked Rust crates. shell: bash so the Windows runner works.
+      - name: Stage third-party license files
+        shell: bash
+        run: |
+          mkdir -p bin/licenses
+          cp ss_player/runtime/THIRD-PARTY-LICENSES.ssruntime.md bin/licenses/
+          cp ss_player/runtime/THIRD-PARTY-LICENSES.ssconverter.md bin/licenses/
+          cp ss_player/runtime/LICENSE.md bin/licenses/runtime-LICENSE.md
+
       - id: commit
-        uses: pr-mpt/actions-commit-hash@v4
+        uses: pr-mpt/actions-commit-hash@9e673021a12f5b5506d4da77ffbb8446e8a37b4a # v4
 
       - name: Upload artifact
         uses: actions/upload-artifact@v7
@@ -219,6 +236,9 @@ jobs:
   package:
     needs: gdextension
     runs-on: ubuntu-latest
+    # Needs write access to publish the GitHub Release (softprops/action-gh-release).
+    permissions:
+      contents: write
 
     steps:
       - uses: actions/checkout@v7
@@ -230,7 +250,7 @@ jobs:
           path: artifacts
 
       - id: commit
-        uses: pr-mpt/actions-commit-hash@v4
+        uses: pr-mpt/actions-commit-hash@9e673021a12f5b5506d4da77ffbb8446e8a37b4a # v4
 
       - name: Zip all artifacts
         run: |
@@ -240,6 +260,17 @@ jobs:
           cp ../misc/spritestudio.gdextension addons/spritestudio/
           cp ../LICENSE.md addons/spritestudio/
 
+          # Bundle third-party license notices next to the statically-linked
+          # native binaries: FlatBuffers (Apache-2.0), godot-cpp (MIT), and the
+          # Rust runtime crates. The runtime crate licenses were staged into
+          # each platform artifact's licenses/ dir and are identical across
+          # platforms, so copy them from the linux artifact.
+          mkdir -p addons/spritestudio/licenses
+          cp ../LICENSE.md addons/spritestudio/licenses/
+          cp ../THIRD_PARTY_NOTICES.md addons/spritestudio/licenses/
+          cp ../licenses/Apache-2.0.txt addons/spritestudio/licenses/
+          cp extension-${{ env.GODOT_VERSION }}-linux-${{ steps.commit.outputs.short }}/licenses/* addons/spritestudio/licenses/
+
           mv extension-${{ env.GODOT_VERSION }}-android-${{ steps.commit.outputs.short }}/android addons/spritestudio/bin/
           mv extension-${{ env.GODOT_VERSION }}-ios-${{ steps.commit.outputs.short }}/ios addons/spritestudio/bin/
           mv extension-${{ env.GODOT_VERSION }}-macos-${{ steps.commit.outputs.short }}/macos addons/spritestudio/bin/
@@ -270,7 +301,7 @@ jobs:
       # upload_release=true を付けた明示的な dispatch のみ。v* タグ上に限る。
       - name: Create GitHub Release
         if: startsWith(github.ref, 'refs/tags/v') && inputs.upload_release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
         with:
           files: |
             output/ssplayer-godot-extension-${{ env.GODOT_VERSION }}.zip

.github/workflows/weekly.yml

@@ -12,6 +12,9 @@ env:
   KEYCHAIN_PATH: app-signing.keychain-db
   SCONS_CACHE: ~/.scons_cache
 
+permissions:
+  contents: read
+
 jobs:
   gdextension:
     name: ${{ matrix.name }}
@@ -55,7 +58,7 @@ jobs:
           submodules: recursive
 
       - name: clone Godot Cpp repository
-        uses: GuillaumeFalourd/clone-github-repo-action@v2.3
+        uses: GuillaumeFalourd/clone-github-repo-action@19817562c346ff60f9935158dede6c5ece8fd0ac # v2.3
         with:
           depth: 1
           branch: master
@@ -69,10 +72,10 @@ jobs:
           os: ${{ matrix.os }}
 
       - name: Setup Rust (Stable)
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
 
       - name: Setup Rust Cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: "ss_player/SpriteStudio-SDK"
           key: ${{ matrix.platform }}

CHANGELOG.md

@@ -5,7 +5,7 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [7.0.0-beta.1] - 2026-0X-XX
+## [7.0.0-beta.1] - Unreleased
 
 ### Added
 - **Initial Public Release**: SpriteStudio 7 SDK (`ssconverter-cli` + `Godot Plugin`).

CONTRIBUTING.md

@@ -41,6 +41,11 @@ If you find a bug, please use the provided Issue Templates. Include:
 - Godot Engine 4.x
 - A C++ compiler (GCC, Clang, or MSVC)
 - Python 3 and SCons
+- A Rust toolchain (required to build the `libssruntime` runtime)
+- zsh (the build scripts use a `#!/usr/bin/env zsh` shebang)
+- The `godot-cpp` submodule, cloned via `git submodule update --init --recursive`
+
+For the complete build guide, see [docs/en/setup/build.md](./docs/en/setup/build.md).
 
 ### Build the Plugin
 To compile the Godot Extension, you must first build the Rust runtime from the SDK, and then compile the C++ extension using the provided build scripts:
@@ -85,10 +90,10 @@ By contributing to this project, you agree that your contributions will be licen
 SSPlayerForGodot にご関心をお寄せいただき、ありがとうございます！ バグ報告、機能提案、ドキュメントの改善、コードの提供など、あらゆる形での貢献を歓迎します。
 
 ## 目次
-- [行動規範](#行動規範-1)
-- [貢献する方法](#貢献する方法-1)
-- [開発環境のセットアップ](#開発環境のセットアップ-1)
-- [コーディング規約](#コーディング規約-1)
+- [行動規範](#行動規範)
+- [貢献する方法](#貢献する方法)
+- [開発環境のセットアップ](#開発環境のセットアップ)
+- [コーディング規約](#コーディング規約)
 
 ## 行動規範
 [CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md) を参照してください。
@@ -123,6 +128,11 @@ Godot Engineとのネイティブな統合と高いパフォーマンスを維
 - Godot Engine 4.x
 - C++ コンパイラ (GCC, Clang, MSVC のいずれか)
 - Python 3 および SCons
+- Rust ツールチェイン (`libssruntime` ランタイムのビルドに必要です)
+- zsh (ビルドスクリプトは `#!/usr/bin/env zsh` を使用しています)
+- `godot-cpp` サブモジュール (`git submodule update --init --recursive` で取得してください)
+
+完全なビルド手順については、[docs/ja/setup/build.md](./docs/ja/setup/build.md) を参照してください。
 
 ### ビルド方法
 提供されているスクリプトを使用して、まずSDKからRustランタイムをビルドし、次にGDExtensionをコンパイルします。

README.ja.md

@@ -4,7 +4,7 @@
 
 **Godot のゲームに、プロフェッショナルな2Dアニメーションを。直感的な使いやすさと、極限のパフォーマンスを両立するプラグイン。**
 
-> **注意:** 本 `develop` ブランチは現在開発中のバージョンです。安定版は [main ブランチ](https://github.com/SpriteStudio/SSPlayerForGodot/tree/main) または [Releases](https://github.com/SpriteStudio/SSPlayerForGodot/releases) から取得してください。本ブランチで扱う API・ワークフローは予告なく変更される可能性があり、いかなる保証もサポートも提供しません（リクエストやバグ報告への返信もできません）。
+> **注意:** 本 `develop` ブランチは現在開発中のバージョンです。安定版は [main ブランチ](https://github.com/cri-middleware/SSPlayerForGodot/tree/main) または [Releases](https://github.com/cri-middleware/SSPlayerForGodot/releases) から取得してください。本ブランチで扱う API・ワークフローは予告なく変更される可能性があり、いかなる保証もサポートも提供しません（リクエストやバグ報告への返信もできません）。
 
 **[OPTPiX SpriteStudio 7](https://www.webtech.co.jp/spritestudio/)** のアニメーション (`.ssab`) を [Godot Engine](https://godotengine.org/) 上で再生するためのハイパフォーマンスな拡張プラグイン（GDExtension / カスタムモジュール）です。Godot の強力な機能と、専用アニメーションツールの表現力を組み合わせることで、リッチな2Dゲーム開発をサポートします。
 
@@ -45,7 +45,7 @@
 ### 1. サンプルで動作確認する
 
 1. **Godot Engine の準備**: [公式サイト](https://godotengine.org/download/) から 4.6 系のエディタをダウンロードします。
-2. **GDExtension の取得**: [Releases](https://github.com/SpriteStudio/SSPlayerForGodot/releases) から最新パッケージをダウンロードし、展開します。
+2. **GDExtension の取得**: [Releases](https://github.com/cri-middleware/SSPlayerForGodot/releases) から最新パッケージをダウンロードし、展開します。
 3. **サンプルの準備**: 取得した `addons` フォルダを、本リポジトリの [examples/Ringo](./examples/Ringo) フォルダ内にコピーします。
 4. **確認**: Godot Engine で [examples/Ringo](./examples/Ringo) プロジェクトを開き、`Ringo.tscn` を開くことですぐにアニメーションの動作を確認できます。
 

README.md

@@ -4,7 +4,7 @@
 
 **Professional 2D animations for your Godot games. A plugin that balances intuitive usability with extreme performance.**
 
-> **Note:** This `develop` branch is a work-in-progress version. The stable version can be obtained from the [main branch](https://github.com/SpriteStudio/SSPlayerForGodot/tree/main) or from [Releases](https://github.com/SpriteStudio/SSPlayerForGodot/releases). The APIs and workflows in this branch may change without notice, and no warranty or support is provided (we cannot respond to feature requests or bug reports).
+> **Note:** This `develop` branch is a work-in-progress version. The stable version can be obtained from the [main branch](https://github.com/cri-middleware/SSPlayerForGodot/tree/main) or from [Releases](https://github.com/cri-middleware/SSPlayerForGodot/releases). The APIs and workflows in this branch may change without notice, and no warranty or support is provided (we cannot respond to feature requests or bug reports).
 
 A high-performance extension plugin (GDExtension / Custom Module) for playing animations (`.ssab`) created with **[OPTPiX SpriteStudio 7](https://www.webtech.co.jp/spritestudio/)** on [Godot Engine](https://godotengine.org/). By combining Godot's powerful features with the expressive capabilities of a dedicated animation tool, it fully supports the development of rich 2D games.
 
@@ -45,7 +45,7 @@ We provide two Quick Starts: one for quickly checking the operation using a samp
 ### 1. Check Operation with Sample
 
 1. **Get Godot Engine**: Download a 4.6-series editor from the [official site](https://godotengine.org/download/).
-2. **Download GDExtension**: Get the latest package from [Releases](https://github.com/SpriteStudio/SSPlayerForGodot/releases) and extract it.
+2. **Download GDExtension**: Get the latest package from [Releases](https://github.com/cri-middleware/SSPlayerForGodot/releases) and extract it.
 3. **Prepare Sample**: Copy the extracted `addons` folder into the [examples/Ringo](./examples/Ringo) folder of this repository.
 4. **Check**: Open the [examples/Ringo](./examples/Ringo) project in Godot Engine and open `Ringo.tscn` to immediately see the animation working.
 

THIRD_PARTY_NOTICES.md

@@ -24,6 +24,38 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 
+The complete Apache License 2.0 text is included in `licenses/Apache-2.0.txt`,
+and is bundled with binary releases under `addons/spritestudio/licenses/`.
+
+---
+
+## godot-cpp
+
+The C++ bindings are built on godot-cpp, which is statically linked into the
+compiled plugin binaries.
+
+MIT License
+
+Copyright (c) 2017-present Godot Engine contributors.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
 ---
 
 ## SpriteStudio-SDK
@@ -40,7 +72,7 @@ Copyright (c) CRI Middleware Co., Ltd. All rights reserved.
 
 **License Location:**
 Because the runtime binaries are generated artifacts and not checked into this repository, the corresponding license documents for the Rust dependencies are generated or downloaded during the build/setup process.
-You can find these third-party licenses inside the `ss_player/runtime/` directory (specifically, `THIRD-PARTY-LICENSES.ssruntime.md` and `LICENSE.md`) after running the setup scripts.
+You can find these third-party licenses inside the `ss_player/runtime/` directory (specifically, `THIRD-PARTY-LICENSES.ssruntime.md`, `THIRD-PARTY-LICENSES.ssconverter.md`, and `LICENSE.md`) after running the setup scripts.
 
 **Distribution Note:**
-If you distribute compiled Godot binaries or GDExtension packages that include `libssruntime`, please ensure you also bundle and distribute the license files (`THIRD-PARTY-LICENSES.ssruntime.md` and `LICENSE.md`) located in `ss_player/runtime/` to comply with the open-source licenses of the underlying Rust crates.
+Official release packages already bundle these third-party license files under `addons/spritestudio/licenses/` (`THIRD-PARTY-LICENSES.ssruntime.md`, `THIRD-PARTY-LICENSES.ssconverter.md`, and the runtime `LICENSE.md`). If you redistribute compiled Godot binaries or GDExtension packages that include `libssruntime`, keep those files alongside your distribution to comply with the open-source licenses of the underlying Rust crates.

docs/en/index.md

@@ -1,7 +1,7 @@
 # SpriteStudioPlayer for Godot
 
 This `develop` branch is a work-in-progress version.  
-The stable version can be obtained from the [main branch](https://github.com/SpriteStudio/SSPlayerForGodot/tree/main) or from [Releases](https://github.com/SpriteStudio/SSPlayerForGodot/releases).  
+The stable version can be obtained from the [main branch](https://github.com/cri-middleware/SSPlayerForGodot/tree/main) or from [Releases](https://github.com/cri-middleware/SSPlayerForGodot/releases).  
 No warranty or support is provided for this branch, and we cannot respond to feature requests or bug reports.  
 Interfaces may change without notice.  
 
@@ -85,12 +85,12 @@ Build and execution have been verified on Windows / macOS.
 
 Sample projects based on SDK test projects are available under the `examples/` folder in the repository.
 
-- [Ringo](../../examples/Ringo) — Test for Ringo
-- [allAttributeV7](../../examples/allAttributeV7) — Functional test for all attributes
-- [allPartsV7](../../examples/allPartsV7) — Functional test for all part types
-- [overall](../../examples/overall) — Comprehensive functional test
-- [overall_gdextension](../../examples/overall_gdextension) — Comprehensive test for GDExtension
-- [ParticleEffect](../../examples/ParticleEffect) — Test for effect features
+- [Ringo](https://github.com/cri-middleware/SSPlayerForGodot/tree/main/examples/Ringo) — Test for Ringo
+- [allAttributeV7](https://github.com/cri-middleware/SSPlayerForGodot/tree/main/examples/allAttributeV7) — Functional test for all attributes
+- [allPartsV7](https://github.com/cri-middleware/SSPlayerForGodot/tree/main/examples/allPartsV7) — Functional test for all part types
+- [overall](https://github.com/cri-middleware/SSPlayerForGodot/tree/main/examples/overall) — Comprehensive functional test
+- [overall_gdextension](https://github.com/cri-middleware/SSPlayerForGodot/tree/main/examples/overall_gdextension) — Comprehensive test for GDExtension
+- [ParticleEffect](https://github.com/cri-middleware/SSPlayerForGodot/tree/main/examples/ParticleEffect) — Test for effect features
 
 ## Related Repositories
 

docs/en/setup/build.md

@@ -14,7 +14,7 @@ The flow for producing Godot binaries from this repository is as follows:
 Clone this repository, and clone Godot Engine / godot-cpp depending on your build target.
 
 ```bash
-git clone https://github.com/SpriteStudio/SSPlayerForGodot.git
+git clone https://github.com/cri-middleware/SSPlayerForGodot.git
 cd SSPlayerForGodot
 git clone https://github.com/godotengine/godot.git -b 4.6
 git clone https://github.com/godotengine/godot-cpp.git -b master