Add security policy

Author: KHiyowa

.github/workflows/build.yml

@@ -15,27 +15,6 @@ jobs:
       matrix:
         es-version:
           - 'es:8.18.3'
-          - 'es:8.17.8'
-          - 'es:8.16.6'
-          - 'es:8.15.2'
-          - 'es:8.14.3'
-          - 'es:8.13.4'
-          - 'es:8.12.2'
-          - 'es:8.11.4'
-          - 'es:8.10.4'
-          - 'os:2.18.0'
-          - 'os:2.17.1'
-          - 'os:2.16.0'
-          - 'os:2.15.0'
-          - 'os:2.14.0'
-          - 'os:2.13.0'
-          - 'os:2.12.0'
-          - 'os:2.11.1'
-          - 'os:2.10.0'
-          - 'os:2.9.0'
-          - 'os:2.8.0'
-          - 'os:2.7.0'
-          - 'os:2.6.0'
     env:
       mainJob: ${{ matrix.es-version == 'es:8.15.2' }}
       sudachiVersion: 20241021

build.gradle

@@ -86,6 +86,9 @@ def distZip = tasks.register('distZip', Zip) {
     dependsOn embedVersion, packageJars, packageSpiJars
     archiveBaseName.set("${esKind.engine.kind}-${esKind.version}-$archivesBaseName")
     from("build/package/${version}/${esKind.engine.kind}-${esKind.version}", 'LICENSE', 'README.md')
+    from('src/main/extras') {
+        include 'entitlement-policy.yaml'
+    }
 }
 
 artifacts {

src/main/extras/entitlement-policy.yaml

@@ -0,0 +1,6 @@
+ALL-UNNAMED:
+  - files:
+      - path: "<<plugin>>/..."
+        mode: read
+      - path: "<<config>>/sudachi/..."
+        mode: read

subplugin/build.gradle

@@ -38,6 +38,9 @@ def distZip = tasks.register('distZip', Zip) {
     dependsOn embedVersion, packageJars
     archiveBaseName.set("${esKind.engine.kind}-${esKind.version}-$archivesBaseName")
     from("build/package/${version}/${esKind.engine.kind}-${esKind.version}")
+    from('src/main/extras') {
+        include 'entitlement-policy.yaml'
+    }
 }
 
 spotless {

subplugin/src/main/extras/entitlement-policy.yaml

@@ -0,0 +1,6 @@
+ALL-UNNAMED:
+  - files:
+      - path: "<<plugin>>/..."
+        mode: read
+      - path: "<<config>>/sudachi/..."
+        mode: read

test-scripts/00-install-elasticsearch.sh

@@ -69,7 +69,7 @@ if [[ -d "$ES_DIR/plugins/analysis-sudachi" ]]; then
   "$ES_DIR/bin/$ES_PLUGIN_BIN" remove analysis-sudachi
 fi
 
-"$ES_DIR/bin/$ES_PLUGIN_BIN" install "$PLUGIN"
+"$ES_DIR/bin/$ES_PLUGIN_BIN" install --batch "$PLUGIN"
 
 if [[ "$SHOULD_RUN_TEST01" == "true" ]]; then
   TEST_PLUGIN_PATH="$(readlink -f "$TEST_PLUGIN_PATH")"
@@ -82,8 +82,8 @@ if [[ "$SHOULD_RUN_TEST01" == "true" ]]; then
     "$ES_DIR/bin/$ES_PLUGIN_BIN" remove analysis-sudachi-childtest
   fi
 
-  "$ES_DIR/bin/$ES_PLUGIN_BIN" install "analysis-icu"
-  "$ES_DIR/bin/$ES_PLUGIN_BIN" install "$TEST_PLUGIN"
+  "$ES_DIR/bin/$ES_PLUGIN_BIN" install --batch "analysis-icu"
+  "$ES_DIR/bin/$ES_PLUGIN_BIN" install --batch "$TEST_PLUGIN"
 fi