From 77c705a64974f49ba0441c3a0fe6fd210fc40ec0 Mon Sep 17 00:00:00 2001 From: igor04091968 Date: Mon, 22 Jun 2026 21:42:43 +0300 Subject: [PATCH] docs(governance): add review process residual risks and issue plan --- .github/CODEOWNERS | 33 ++++++ .github/pull_request_template.md | 26 +++++ README.md | 20 ++++ docs/BRANCH_PROTECTION_POLICY_RU.md | 64 +++++++++++ docs/PROJECT_STATUS_RU.md | 15 +++ docs/PUBLIC_ISSUES_PLAN_RU.md | 30 ++--- docs/RESIDUAL_RISKS_RU.md | 27 +++-- docs/REVIEW_CHECKLIST_RU.md | 108 ++++++++++++++++++ .../REGISTRY_READINESS_CHANGELOG_RU.md | 37 ++++++ scripts/registry_readiness_check.sh | 60 +++++++++- 10 files changed, 397 insertions(+), 23 deletions(-) create mode 100644 docs/BRANCH_PROTECTION_POLICY_RU.md create mode 100644 docs/REVIEW_CHECKLIST_RU.md diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 63ade56..fe636cb 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1 +1,34 @@ +# AWatch-rus CODEOWNERS +# +# Ownership is used for review routing and engineering accountability. +# It does not certify security, legal readiness, performance or fitness for +# production use. Contributors remain responsible for the safety of their +# submissions. + +# Repository default owner. * @igor04091968 + +# Rust workspace and crates. +/adk-rust/ @igor04091968 +**/Cargo.toml @igor04091968 +**/Cargo.lock @igor04091968 +**/*.rs @igor04091968 + +# Operational scripts and automation. +/scripts/ @igor04091968 + +# Registry-readiness evidence and policy documents. +/docs/registry/ @igor04091968 + +# GitHub public mirror validation metadata. +/.github/workflows/ @igor04091968 +/.github/pull_request_template.md @igor04091968 +/.github/ISSUE_TEMPLATE/ @igor04091968 + +# Ansible deployment automation. +/ansible/ @igor04091968 + +# Security and contribution governance. +/SECURITY.md @igor04091968 +/CONTRIBUTING.md @igor04091968 +/deny.toml @igor04091968 diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 7632786..514a2d7 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -2,11 +2,37 @@ Describe what changed and why. +## Impact + +- Runtime impact: `none / changed / not applicable` +- API impact: `none / changed / not applicable` +- UI impact: `none / changed / not applicable` +- Documentation impact: `none / changed / not applicable` +- Rollback impact: `none / documented / not applicable` +- Evidence impact: `none / registry docs updated / release evidence required` + ## Validation List commands executed. Use `skipped: ` when a check requires a live stand or unavailable tool. +## Review Checklist + +- [ ] I checked that this PR does not publish secrets, tokens, passwords, + private keys, recovery codes or live credentials. +- [ ] I checked that this PR does not publish personal data, real employee data, + customer logs or customer infrastructure identifiers. +- [ ] I checked registry claims: no completed registry submission, no + FSTEC/FSB certification claim, no SIEM/DLP replacement claim. +- [ ] I ran relevant checks or documented why a check was skipped. +- [ ] I stated runtime/API/UI impact. +- [ ] I stated documentation impact. +- [ ] I stated smoke-test result or why smoke testing is not applicable. +- [ ] I stated rollback and evidence impact. +- [ ] I checked that GitHub Actions remains public mirror validation only. +- [ ] I checked that registry release evidence still requires the Russian + build-runner. + ## Registry / Public Mirror Scope - GitHub is public mirror validation only. diff --git a/README.md b/README.md index 792c569..1a5ac15 100755 --- a/README.md +++ b/README.md @@ -261,6 +261,22 @@ collectors. - Public issues plan: [docs/PUBLIC_ISSUES_PLAN_RU.md](docs/PUBLIC_ISSUES_PLAN_RU.md). +### Engineering governance and residual risks + +- Review checklist: + [docs/REVIEW_CHECKLIST_RU.md](docs/REVIEW_CHECKLIST_RU.md). +- Residual risks register: + [docs/RESIDUAL_RISKS_RU.md](docs/RESIDUAL_RISKS_RU.md). +- Public issues plan: + [docs/PUBLIC_ISSUES_PLAN_RU.md](docs/PUBLIC_ISSUES_PLAN_RU.md). +- Advisory branch protection policy: + [docs/BRANCH_PROTECTION_POLICY_RU.md](docs/BRANCH_PROTECTION_POLICY_RU.md). +- CODEOWNERS and PR template are maintained for review routing and public + change-control visibility. +- Visible external code review is still pending until public reviewed PRs exist. +- Branch protection policy is documented as advisory; it is not claimed as + enabled here. + - [Позиционирование для реестра российского ПО](docs/RUSSIAN_SOFTWARE_REGISTRY_POSITIONING_RU.md) - [Сведения для подачи в реестр](REGISTER_RU_SOFTWARE.md) - [Registry product passport](docs/REGISTRY_PRODUCT_PASSPORT_RU.md) @@ -550,6 +566,9 @@ detmir-dlp --json ✅ ROADMAP.md ✅ Issue templates ✅ PR template +✅ CODEOWNERS +✅ Review checklist +✅ Branch protection policy documented ✅ Registry docs ✅ Russian Gitea contour ✅ GitHub public mirror validation @@ -760,6 +779,7 @@ PILOT V1 SCOPE (ГОТОВО): - Низкая community adoption - Gitea restore test еще не выполнен - Российский build-runner пока planned + - Branch protection policy documented, but enablement not yet verified 5. 🚀 TIMELINE К PRODUCTION: - Pilot v1 freeze: готовится (freeze readiness doc) diff --git a/docs/BRANCH_PROTECTION_POLICY_RU.md b/docs/BRANCH_PROTECTION_POLICY_RU.md new file mode 100644 index 0000000..01fcd9d --- /dev/null +++ b/docs/BRANCH_PROTECTION_POLICY_RU.md @@ -0,0 +1,64 @@ +# AWatch-rus: advisory branch protection policy + +Дата: 2026-06-22 + +Статус: recommended policy. Этот документ описывает целевую настройку GitHub +branch protection для публичного зеркала. Он не утверждает, что branch +protection уже включен. + +GitHub остается public mirror validation surface. Primary registry-readiness +contour остается Russian Gitea plus Russian build-runner release evidence. + +## Scope + +- Branch: `main`. +- Platform: GitHub public mirror. +- Purpose: visible review discipline, status-check discipline and public + engineering maturity signal. +- Registry release evidence: out of scope for GitHub Actions. + +## Recommended rules + +- Require pull request before merge. +- Require at least one approving review for non-emergency changes. +- Require status checks before merge. +- Require `CI` workflow. +- Require `Security` workflow. +- Require `Coverage` workflow as baseline visibility; no coverage threshold is + enforced yet. +- Require conversation resolution before merge. +- Restrict force push. +- Restrict branch deletion. +- Require linear history if compatible with the maintainer workflow. +- Administrator bypass should be emergency-only and documented after the fact. + +## Review expectations + +- CODEOWNERS routes changes to the current maintainer. +- External visible peer review is still pending and should be introduced through + public pull requests. +- Review approval is not a warranty of security, fitness for production or + legal readiness. +- Contributors remain responsible for the safety and accuracy of their changes. + +## Registry and security guardrails + +- Do not claim FSTEC/FSB certification. +- Do not claim completed Russian software registry submission. +- Do not claim SIEM/DLP replacement. +- Do not publish secrets, personal data, employee data or customer + infrastructure identifiers. +- Do not claim Gitea restore test completed until evidence exists. +- Do not claim Russian build-runner ready until provisioning evidence exists. + +## Emergency bypass + +Emergency administrator bypass may be used only for urgent repository recovery, +blocked release hygiene or security containment. The follow-up record should +state: + +- reason for bypass; +- commits affected; +- checks run after bypass; +- rollback or follow-up action; +- whether registry-readiness claims changed. diff --git a/docs/PROJECT_STATUS_RU.md b/docs/PROJECT_STATUS_RU.md index 76691c9..6208017 100644 --- a/docs/PROJECT_STATUS_RU.md +++ b/docs/PROJECT_STATUS_RU.md @@ -32,6 +32,10 @@ backup, registry-readiness документации, плана российск `docs/RESIDUAL_RISKS_RU.md`. - План публичных GitHub issues: `docs/PUBLIC_ISSUES_PLAN_RU.md`. +- Review checklist: + `docs/REVIEW_CHECKLIST_RU.md`. +- Advisory branch protection policy: + `docs/BRANCH_PROTECTION_POLICY_RU.md`. ## Что готово @@ -60,6 +64,12 @@ backup, registry-readiness документации, плана российск по контурам `CI`, `Coverage` и `Security`. - Добавлены `SECURITY.md`, `CONTRIBUTING.md`, `ROADMAP.md`, issue templates и pull request template. +- Добавлен `.github/CODEOWNERS` for review routing. +- Добавлен review checklist: + `docs/REVIEW_CHECKLIST_RU.md`. +- PR review process documented in PR template and review checklist. +- Branch protection policy documented as advisory: + `docs/BRANCH_PROTECTION_POLICY_RU.md`. - Зафиксирован residual risk register: `docs/RESIDUAL_RISKS_RU.md`. - Подготовлен план публичных issues для ручного заведения: @@ -75,6 +85,9 @@ backup, registry-readiness документации, плана российск - Финальная юридическая проверка пакета документов перед подачей. - Проверка совместимости с российскими ОС. - Публичные roadmap/issues из `docs/PUBLIC_ISSUES_PLAN_RU.md`. +- Visible external code review is still pending. +- Branch protection enablement is not claimed until repository settings are + verified. ## Честные ограничения @@ -103,5 +116,7 @@ backup, registry-readiness документации, плана российск - `docs/registry/RELEASE_EVIDENCE_RUNBOOK_RU.md` - `docs/registry/RELEASE_ARTIFACTS_STORAGE_RU.md` - `docs/QUALITY_STATUS_RU.md` +- `docs/REVIEW_CHECKLIST_RU.md` - `docs/RESIDUAL_RISKS_RU.md` - `docs/PUBLIC_ISSUES_PLAN_RU.md` +- `docs/BRANCH_PROTECTION_POLICY_RU.md` diff --git a/docs/PUBLIC_ISSUES_PLAN_RU.md b/docs/PUBLIC_ISSUES_PLAN_RU.md index 5556b1d..e4e4bcc 100644 --- a/docs/PUBLIC_ISSUES_PLAN_RU.md +++ b/docs/PUBLIC_ISSUES_PLAN_RU.md @@ -12,18 +12,20 @@ Gitea-контура, backup, public CI, coverage, security scanning и status f ## Issues to create manually -| Title | Purpose | Current status | -| --- | --- | --- | -| `[registry] Perform Gitea backup restore test` | Prove restore procedure on a separate host and keep `restore_tested=false` until evidence exists. | To create | -| `[registry] Prepare temporary Russian build-runner awatch-build-01` | Provision temporary or permanent Russian build-runner for registry release evidence. | To create | -| `[release] Produce first release evidence package` | Run release evidence scripts on `awatch-build-01` and collect artifacts/logs/checksums. | To create | -| `[legal] Prepare rightsholder evidence package` | Prepare rightsholder and legal evidence for future registry submission. | To create | -| `[qa] Define coverage threshold policy` | Define threshold only after stable coverage baseline review. | To create | -| `[security] Prepare external security/code review checklist` | Establish visible peer review and external security review checklist. | To create | -| `[compat] Test Russian OS compatibility matrix` | Validate supported Russian OS matrix and document evidence. | To create | -| `[ops] Validate release artifacts storage in RF` | Confirm release artifact storage location and retention in the Russian contour. | To create | -| `[docs] Refresh public demo pack and screenshots` | Update public demo pack, screenshots and non-sensitive demo evidence. | To create | -| `[pilot] Prepare Pilot Acceptance Checklist v2` | Update pilot acceptance checklist after residual risk register and public issue plan. | To create | +| Title | Labels | Short goal | Acceptance criteria | Status | +| --- | --- | --- | --- | --- | +| `[registry] Perform Gitea backup restore test` | `registry`, `ops`, `evidence` | Prove restore procedure on a separate host and keep `restore_tested=false` until evidence exists. | Restore log, checksum verification, post-restore checks and rollback notes are attached or linked. | planned | +| `[registry] Prepare temporary Russian build-runner awatch-build-01` | `registry`, `build-runner`, `ops` | Provision temporary or permanent Russian build-runner for registry release evidence. | Host provisioning notes, toolchain list, Gitea access method and required checks plan are documented. | planned | +| `[release] Produce first release evidence package` | `release`, `registry`, `evidence` | Run release evidence scripts on `awatch-build-01` and collect artifacts/logs/checksums. | Release evidence manifest, logs, checksums and artifact storage path are documented. | planned | +| `[legal] Prepare rightsholder evidence package` | `legal`, `registry`, `docs` | Prepare rightsholder and legal evidence for future registry submission. | Rightsholder evidence checklist, ownership notes and legal review TODOs are documented. | planned | +| `[qa] Define coverage threshold policy` | `qa`, `coverage`, `policy` | Define threshold only after stable coverage baseline review. | Coverage baseline reviewed and initial threshold policy proposed without blocking current baseline workflow. | planned | +| `[security] Prepare external security/code review checklist` | `security`, `review`, `governance` | Establish visible peer review and external security review checklist. | Checklist references `docs/REVIEW_CHECKLIST_RU.md` and defines public review evidence expectations. | planned | +| `[compat] Test Russian OS compatibility matrix` | `compat`, `qa`, `registry` | Validate supported Russian OS matrix and document evidence. | Matrix lists target OS versions, test status and gaps without unsupported compatibility claims. | planned | +| `[ops] Validate release artifacts storage in RF` | `ops`, `release`, `registry` | Confirm release artifact storage location and retention in the Russian contour. | Storage path, retention, access model and checksum verification procedure are documented. | planned | +| `[docs] Refresh public demo pack and screenshots` | `docs`, `demo`, `public` | Update public demo pack, screenshots and non-sensitive demo evidence. | Demo materials contain no secrets, PII, real employee data or customer infrastructure identifiers. | planned | +| `[pilot] Prepare Pilot Acceptance Checklist v2` | `pilot`, `qa`, `docs` | Update pilot acceptance checklist after residual risk register and public issue plan. | Checklist references residual risks, smoke checks and acceptance evidence needed for pilot stage. | planned | +| `[governance] Enable PR-based review workflow` | `governance`, `review`, `process` | Move visible changes through pull requests where practical. | First public PR review record exists or a documented dry-run PR demonstrates the process. | planned | +| `[governance] Add branch protection policy` | `governance`, `github`, `policy` | Configure GitHub branch protection after maintainer review of the advisory policy. | Branch protection settings are documented with screenshots or notes, or blockers are recorded. | planned | ## Guardrails @@ -33,4 +35,6 @@ Gitea-контура, backup, public CI, coverage, security scanning и status f - Do not claim completed registry submission. - Do not claim fake community adoption. - Do not position GitHub Actions as the primary registry build contour. - +- Do not claim external peer review is active until public reviewed PRs exist. +- Do not claim branch protection is enabled until repository settings are + verified. diff --git a/docs/RESIDUAL_RISKS_RU.md b/docs/RESIDUAL_RISKS_RU.md index 4f24a18..6c3de7e 100644 --- a/docs/RESIDUAL_RISKS_RU.md +++ b/docs/RESIDUAL_RISKS_RU.md @@ -48,21 +48,23 @@ visibility, release evidence contour and legal package. Они требуют д - Следующий action: завести публичную задачу `[security] Prepare external security/code review checklist`. -## 2. Нет публично видимого peer review +## 2. Нет внешнего visible peer review / публично видимого peer review - Текущий статус: риск открыт; PR template and issue templates exist, but - public peer review history is still limited. + public peer review history is still limited and external review is pending. - Влияние: внешним аудиторам сложнее оценить review discipline and change control maturity. - Почему не блокирует pilot/readiness stage: current changes are protected by reproducible checks, public workflows and documented conservative positioning. -- Как риск будет снижаться: external review checklist, first public PR reviews, - explicit release branch review policy. +- Как риск будет снижаться: review checklist, CODEOWNERS routing, first public + PR reviews, explicit release branch review policy and advisory branch + protection. - Уже снижающие evidence/documents/CI: `.github/pull_request_template.md`, - `.github/ISSUE_TEMPLATE/`, `CONTRIBUTING.md`, `SECURITY.md`, public CI, - public security workflow. + `.github/CODEOWNERS`, `.github/ISSUE_TEMPLATE/`, + `docs/REVIEW_CHECKLIST_RU.md`, `docs/BRANCH_PROTECTION_POLICY_RU.md`, + `CONTRIBUTING.md`, `SECURITY.md`, public CI, public security workflow. - Следующий action: завести публичную задачу - `[security] Prepare external security/code review checklist`. + `[governance] Enable PR-based review workflow`. ## 3. Низкая публичная активность issue tracker @@ -166,9 +168,18 @@ visibility, release evidence contour and legal package. Они требуют д - Следующий action: завести публичную задачу `[legal] Prepare rightsholder evidence package`. +## Review/governance evidence added + +- CODEOWNERS exists for review routing and engineering ownership. +- PR review checklist exists in `docs/REVIEW_CHECKLIST_RU.md`. +- Advisory branch protection policy exists in + `docs/BRANCH_PROTECTION_POLICY_RU.md`. +- Public PR template includes security, registry-claim, runtime/API/UI, + smoke-test, rollback and evidence checklist items. +- Visible external code review remains pending until public reviewed PRs exist. + ## Следующие публичные задачи Полный список задач для ручного заведения в GitHub issue tracker: - `docs/PUBLIC_ISSUES_PLAN_RU.md`. - diff --git a/docs/REVIEW_CHECKLIST_RU.md b/docs/REVIEW_CHECKLIST_RU.md new file mode 100644 index 0000000..63255ad --- /dev/null +++ b/docs/REVIEW_CHECKLIST_RU.md @@ -0,0 +1,108 @@ +# AWatch-rus: PR / code review checklist + +Дата: 2026-06-22 + +Статус: advisory checklist for public review process. + +Этот документ описывает проверочный чеклист для pull requests и внешнего +инженерного review. Он не утверждает, что внешний peer review уже выполняется +регулярно, и не является гарантией отсутствия дефектов или уязвимостей. + +GitHub Actions используется только как public mirror validation. Registry +release evidence должен производиться на российском build-runner. + +## Общая безопасность изменений + +- Изменение имеет понятную цель, ограниченный scope and documented impact. +- Нет секретов, токенов, паролей, приватных ключей, recovery codes or live + credentials. +- Нет персональных данных сотрудников, реальных employee logs or customer + evidence. +- Нет реальных IP, hostname or infrastructure identifiers заказчика. +- Нет новых публичных портов, external callbacks or telemetry without explicit + documentation. +- Нет ослабления fail-closed checks, security gates or auditability. + +## Rust code quality + +- Rust-код форматируется `cargo fmt --all --check`. +- Для затронутого Rust workspace ожидаются relevant `cargo test` checks. +- Ошибки обрабатываются явно; нет silent fallback для security-sensitive paths. +- Timeouts, retries and bounds are explicit for network or long-running work. +- Новые dependencies justified and license-compatible. + +## API / contract compatibility + +- Public API, CLI flags, file formats and JSON contracts remain compatible, or + breaking impact is explicitly blocked for this stage. +- Backward compatibility checked for existing collectors, exporters, + dashboards and automation consumers. +- Error responses and status codes are not changed accidentally. + +## UI / runtime impact + +- PR states whether UI impact is none, documentation-only or user-visible. +- PR states whether runtime deployment impact is none or requires operator + action. +- No runtime behavior is changed by documentation/governance-only PRs. +- No service restart, migration or production config change is implied unless + explicitly documented. + +## Registry-readiness impact + +- GitHub Actions is public mirror validation only. +- Public CI, Coverage and Security workflows are not registry release evidence. +- Release evidence must be produced on the Russian build-runner. +- Russian Gitea remains the primary registry-readiness source contour. +- Do not claim completed Russian software registry submission. +- Do not claim FSTEC/FSB certification. +- Do not claim SIEM/DLP replacement. +- Do not mark restore test as completed while `restore_tested=false`. +- Do not mark `awatch-build-01` as ready until provisioning evidence exists. + +## Secret / PII safety + +- No secrets, tokens, passwords or private keys in code, docs, logs, + screenshots or workflow output. +- No employee personal data, real user activity traces or unredacted customer + identifiers. +- No customer IP addresses, internal hostnames, VPN details or private network + topology. +- Demo data is synthetic or anonymized. +- Public secret scan is expected to pass before merge. + +## Documentation impact + +- README, `docs/PROJECT_STATUS_RU.md`, registry docs and operational runbooks + are updated when claims, checks, workflows or procedures change. +- New claims are conservative and evidence-backed. +- Pending work remains marked as planned/pending until evidence exists. +- Public mirror wording remains separate from registry release evidence. + +## Deployment / rollback impact + +- PR states whether deployment action is required. +- Rollback path is documented for runtime or automation changes. +- Documentation-only PRs state that runtime/API/UI impact is unchanged. +- Changes to scripts include syntax checks and a clear operator failure mode. + +## Smoke checks + +- Run checks relevant to changed files. +- For documentation/governance updates, expected minimum checks are: + `python3 scripts/public_secret_pattern_check.py`, + `bash -n scripts/registry_readiness_check.sh`, + `bash scripts/registry_readiness_check.sh`, + `git diff --check`. +- For shell changes, `bash -n` is mandatory for changed shell scripts. +- For Rust/product changes, Rust checks are required by risk and scope. + +## Evidence requirements + +- PR records commands run and results. +- Skipped checks include a concrete reason. +- Registry release evidence is not accepted from GitHub Actions alone. +- Russian build-runner release evidence must include logs, checksums and + artifact manifest when that contour is ready. +- Restore test evidence must include separate-host restore notes and checksum + verification before `restore_tested` changes from false. diff --git a/docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md b/docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md index ed5b755..b1263af 100644 --- a/docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md +++ b/docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md @@ -1,5 +1,42 @@ # Registry readiness changelog +## 2026-06-22 review governance and branch protection policy + +Added: + +- `.github/CODEOWNERS` for public review routing and engineering ownership. +- `docs/REVIEW_CHECKLIST_RU.md` for PR/code review checks. +- `docs/BRANCH_PROTECTION_POLICY_RU.md` as advisory GitHub branch protection + policy. +- Expanded `docs/PUBLIC_ISSUES_PLAN_RU.md` with governance issues for PR-based + review workflow and branch protection. +- Registry readiness checks for review/governance documents and false-claim + guardrails. + +Changed: + +- PR template now includes compact security, registry-claim, runtime/API/UI, + smoke-test, rollback and evidence checklist items. +- README and project status now link to review/governance documents. +- Residual risk register now records that visible external code review remains + pending. + +Runtime impact: + +- No runtime/product code changes. +- No API changes. +- No UI changes. +- No business logic changes. + +Guardrails: + +- Branch protection is documented as advisory and is not claimed as enabled. +- External visible peer review is not claimed as active. +- Restore test remains pending. +- Russian build-runner remains planned. +- Registry submission, FSTEC/FSB certification and SIEM/DLP replacement are not + claimed. + ## 2026-06-22 residual risk register and public issue plan Added: diff --git a/scripts/registry_readiness_check.sh b/scripts/registry_readiness_check.sh index 34bb27c..f04e2c2 100644 --- a/scripts/registry_readiness_check.sh +++ b/scripts/registry_readiness_check.sh @@ -49,11 +49,14 @@ required_files=( "docs/PROJECT_STATUS_RU.md" "docs/QUALITY_STATUS_RU.md" "docs/SECURITY_SCANNING_POLICY_RU.md" + "docs/REVIEW_CHECKLIST_RU.md" "docs/RESIDUAL_RISKS_RU.md" "docs/PUBLIC_ISSUES_PLAN_RU.md" + "docs/BRANCH_PROTECTION_POLICY_RU.md" "scripts/build_release_evidence.sh" "scripts/check_release_evidence.sh" "scripts/public_secret_pattern_check.py" + ".github/CODEOWNERS" ".github/workflows/ci.yml" ".github/workflows/security.yml" ".github/workflows/coverage.yml" @@ -245,8 +248,38 @@ require_grep "First release evidence build is not claimed as completed" "docs/re require_grep "Legal rightsholder package remains pending" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_legal_package_pending" require_grep "RESIDUAL_RISKS_RU\\.md" "README.md" "readme_residual_risks_link" require_grep "PUBLIC_ISSUES_PLAN_RU\\.md" "README.md" "readme_public_issues_plan_link" +require_grep "Engineering governance and residual risks" "README.md" "readme_engineering_governance_section" +require_grep "REVIEW_CHECKLIST_RU\\.md" "README.md" "readme_review_checklist_link" +require_grep "BRANCH_PROTECTION_POLICY_RU\\.md" "README.md" "readme_branch_protection_policy_link" +require_grep "CODEOWNERS" "README.md" "readme_codeowners" +require_grep "\\* @igor04091968" ".github/CODEOWNERS" "codeowners_default_owner" +require_grep "/adk-rust/" ".github/CODEOWNERS" "codeowners_rust_workspace" +require_grep "/scripts/" ".github/CODEOWNERS" "codeowners_scripts" +require_grep "/docs/registry/" ".github/CODEOWNERS" "codeowners_registry_docs" +require_grep "/\\.github/workflows/" ".github/CODEOWNERS" "codeowners_workflows" +require_grep "/ansible/" ".github/CODEOWNERS" "codeowners_ansible" +require_grep "SECURITY\\.md" ".github/CODEOWNERS" "codeowners_security_docs" +require_grep "не публиковать секреты|No secrets" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_no_secrets" +require_grep "персональных данных|personal data" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_no_pii" +require_grep "реальных IP|hostname|customer infrastructure identifiers" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_no_customer_infra" +require_grep "GitHub Actions.*public mirror validation" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_github_public_only" +require_grep "Release evidence must be produced on the Russian build-runner" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_russian_runner" +require_grep "Do not claim FSTEC/FSB certification" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_no_fstec_fsb" +require_grep "Do not claim SIEM/DLP replacement" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_no_siem_dlp" +require_grep "restore_tested=false|restore_tested.*false" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_restore_false" +require_grep "Require pull request before merge" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_require_pr" +require_grep "Require status checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_status_checks" +require_grep 'Require `CI` workflow' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ci" +require_grep 'Require `Security` workflow' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_security" +require_grep 'Require `Coverage` workflow' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_coverage" +require_grep "no coverage threshold" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_no_coverage_threshold" +require_grep "Restrict force push" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_force_push" +require_grep "Require conversation resolution" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_conversation_resolution" +require_grep "Require linear history" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_linear_history" +require_grep "emergency-only" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_admin_bypass" +require_grep "recommended policy|advisory branch protection policy" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_advisory_not_enabled" require_grep "Один основной разработчик" "docs/RESIDUAL_RISKS_RU.md" "risk_single_developer" -require_grep "Нет публично видимого peer review" "docs/RESIDUAL_RISKS_RU.md" "risk_peer_review" +require_grep "Нет внешнего visible peer review" "docs/RESIDUAL_RISKS_RU.md" "risk_peer_review" require_grep "Низкая публичная активность issue tracker" "docs/RESIDUAL_RISKS_RU.md" "risk_issue_tracker_activity" require_grep "Низкая community adoption" "docs/RESIDUAL_RISKS_RU.md" "risk_community_adoption" require_grep "Gitea restore test еще не выполнен" "docs/RESIDUAL_RISKS_RU.md" "risk_restore_test_pending" @@ -267,6 +300,10 @@ require_grep "\\[compat\\] Test Russian OS compatibility matrix" "docs/PUBLIC_IS require_grep "\\[ops\\] Validate release artifacts storage in RF" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issue_artifact_storage" require_grep "\\[docs\\] Refresh public demo pack and screenshots" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issue_demo_pack" require_grep "\\[pilot\\] Prepare Pilot Acceptance Checklist v2" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issue_pilot_acceptance_v2" +require_grep "\\[governance\\] Enable PR-based review workflow" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issue_pr_review_workflow" +require_grep "\\[governance\\] Add branch protection policy" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issue_branch_protection_policy" +require_grep "Acceptance criteria" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_acceptance_criteria" +require_grep "planned" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_status_planned" require_grep "Do not mark restore test as completed until restore evidence exists" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_restore_guardrail" require_grep "Do not mark .*awatch-build-01.* as ready until provisioning evidence exists" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_build_runner_guardrail" require_grep "public mirror validation only" "SECURITY.md" "security_public_mirror_validation" @@ -286,14 +323,17 @@ scan_files=( "$REGISTRY_DIR"/*.json "$ROOT/docs/QUALITY_STATUS_RU.md" "$ROOT/docs/SECURITY_SCANNING_POLICY_RU.md" + "$ROOT/docs/REVIEW_CHECKLIST_RU.md" "$ROOT/docs/RESIDUAL_RISKS_RU.md" "$ROOT/docs/PUBLIC_ISSUES_PLAN_RU.md" + "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md" "$ROOT/SECURITY.md" "$ROOT/CONTRIBUTING.md" "$ROOT/ROADMAP.md" "$ROOT/deny.toml" "$ROOT/.github/workflows"/*.yml "$ROOT/.github/ISSUE_TEMPLATE"/*.yml + "$ROOT/.github/CODEOWNERS" "$ROOT/.github/pull_request_template.md" "$ROOT/scripts/build_release_evidence.sh" "$ROOT/scripts/check_release_evidence.sh" @@ -306,8 +346,10 @@ claim_scan_files=( "$REGISTRY_DIR"/*.json "$ROOT/docs/QUALITY_STATUS_RU.md" "$ROOT/docs/SECURITY_SCANNING_POLICY_RU.md" + "$ROOT/docs/REVIEW_CHECKLIST_RU.md" "$ROOT/docs/RESIDUAL_RISKS_RU.md" "$ROOT/docs/PUBLIC_ISSUES_PLAN_RU.md" + "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md" "$ROOT/SECURITY.md" "$ROOT/CONTRIBUTING.md" "$ROOT/ROADMAP.md" @@ -335,7 +377,7 @@ fi rm -f /tmp/registry_forbidden_fstec_fsb.$$ if grep -RInEi "(заменяет|replacement for|replaces).{0,80}(SIEM|DLP)|((SIEM|DLP).{0,80}(replacement|заменяет))" "${claim_scan_files[@]}" \ - | grep -Eiv "(не |not |does not|not_claimed|не является|не подменяет|не заявляет|forbidden|not_made)" \ + | grep -Eiv "(не |not |are not|does not|not_claimed|не является|не подменяет|не заявляет|forbidden|not_made)" \ >/tmp/registry_forbidden_replacement.$$ 2>/dev/null; then fail "forbidden_claim_siem_dlp_replacement:$(cat /tmp/registry_forbidden_replacement.$$)" fi @@ -355,6 +397,20 @@ if grep -RInEi "(юридически заверш(е|ё)нн?ая регист fi rm -f /tmp/registry_forbidden_legal_done.$$ +if grep -RInEi "(branch protection).{0,120}(enabled|включ(е|ё)н|настроен|active)" "$ROOT/README.md" "$ROOT/docs/PROJECT_STATUS_RU.md" "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md" "$REGISTRY_DIR"/*.md \ + | grep -Eiv "(not |не |не утверждает|not claimed|advisory|until repository settings|если применимо|recommended)" \ + >/tmp/registry_forbidden_branch_protection_enabled.$$ 2>/dev/null; then + fail "forbidden_claim_branch_protection_enabled:$(cat /tmp/registry_forbidden_branch_protection_enabled.$$)" +fi +rm -f /tmp/registry_forbidden_branch_protection_enabled.$$ + +if grep -RInEi "(external|visible|peer).{0,80}(review).{0,120}(active|performed|completed|done|выполняется|проведен|провед(е|ё)н|активен)" "$ROOT/README.md" "$ROOT/docs/PROJECT_STATUS_RU.md" "$ROOT/docs/RESIDUAL_RISKS_RU.md" "$REGISTRY_DIR"/*.md \ + | grep -Eiv "(not |не |pending|still pending|не утверждает|not claimed|until public reviewed PRs)" \ + >/tmp/registry_forbidden_external_review_active.$$ 2>/dev/null; then + fail "forbidden_claim_external_review_active:$(cat /tmp/registry_forbidden_external_review_active.$$)" +fi +rm -f /tmp/registry_forbidden_external_review_active.$$ + if grep -RInEi "(restore(_| )?test|restore_tested|тестов(ое|ого)[[:space:]]+восстановлен).{0,120}(completed|done|passed|true|выполнен|готов|подтвержден)" "$ROOT/docs/RESIDUAL_RISKS_RU.md" "$ROOT/docs/PUBLIC_ISSUES_PLAN_RU.md" "$ROOT/docs/PROJECT_STATUS_RU.md" "$REGISTRY_DIR"/*.md "$REGISTRY_DIR"/*.json \ | grep -Eiv "(not |не |false|pending|not completed|not claimed|не выполнен|еще не выполнен|ещё не выполнен|не заяв|не готов|until evidence|restore_tested.*false|если.*выполнен)" \ >/tmp/registry_forbidden_restore_done.$$ 2>/dev/null; then