From 7e6c067adf8ba040a9fb75fdba6058f29ffa5561 Mon Sep 17 00:00:00 2001 From: igor04091968 Date: Tue, 23 Jun 2026 23:00:16 +0300 Subject: [PATCH] docs(governance): prepare branch protection and PR review evidence --- .github/CODEOWNERS | 16 ++- .github/pull_request_template.md | 8 ++ README.md | 6 + docs/BRANCH_PROTECTION_EVIDENCE_RU.md | 100 +++++++++++++++++ docs/BRANCH_PROTECTION_POLICY_RU.md | 37 +++++- docs/PROJECT_STATUS_RU.md | 21 ++++ docs/PR_REVIEW_EVIDENCE_RU.md | 74 ++++++++++++ docs/PR_REVIEW_WORKFLOW_RU.md | 106 ++++++++++++++++++ docs/RESIDUAL_RISKS_RU.md | 25 +++-- .../public-issues/public-issues-manifest.json | 6 +- .../REGISTRY_READINESS_CHANGELOG_RU.md | 40 +++++++ scripts/registry_readiness_check.sh | 88 ++++++++++++++- 12 files changed, 511 insertions(+), 16 deletions(-) create mode 100644 docs/BRANCH_PROTECTION_EVIDENCE_RU.md create mode 100644 docs/PR_REVIEW_EVIDENCE_RU.md create mode 100644 docs/PR_REVIEW_WORKFLOW_RU.md diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index fe636cb..c740a4d 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -17,13 +17,27 @@ # Operational scripts and automation. /scripts/ @igor04091968 +# Product documentation, demo material and screenshots. +/docs/ @igor04091968 +/docs/demo/ @igor04091968 +/docs/screenshots/ @igor04091968 +/docs/assets/screenshots/ @igor04091968 + # Registry-readiness evidence and policy documents. /docs/registry/ @igor04091968 -# GitHub public mirror validation metadata. +# GitHub public mirror validation metadata and governance controls. /.github/workflows/ @igor04091968 +/.github/workflows/ci.yml @igor04091968 +/.github/workflows/security.yml @igor04091968 +/.github/workflows/coverage.yml @igor04091968 /.github/pull_request_template.md @igor04091968 /.github/ISSUE_TEMPLATE/ @igor04091968 +/.github/CODEOWNERS @igor04091968 +/docs/BRANCH_PROTECTION_POLICY_RU.md @igor04091968 +/docs/BRANCH_PROTECTION_EVIDENCE_RU.md @igor04091968 +/docs/PR_REVIEW_WORKFLOW_RU.md @igor04091968 +/docs/PR_REVIEW_EVIDENCE_RU.md @igor04091968 # Ansible deployment automation. /ansible/ @igor04091968 diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 514a2d7..8ebaeb7 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -18,6 +18,14 @@ stand or unavailable tool. ## Review Checklist +- [ ] Linked issue is provided, or the PR explains why no issue is applicable. +- [ ] Runtime/API/UI impact is stated. +- [ ] Registry claims are checked and remain conservative. +- [ ] Secrets, PII, employee logs and customer identifiers are absent. +- [ ] Tests/checks executed are listed, or skipped checks have reasons. +- [ ] Evidence docs are updated when the change affects governance, registry + readiness or release evidence. +- [ ] GitHub Actions are public validation only, not registry release evidence. - [ ] I checked that this PR does not publish secrets, tokens, passwords, private keys, recovery codes or live credentials. - [ ] I checked that this PR does not publish personal data, real employee data, diff --git a/README.md b/README.md index 7f17a65..a57557e 100755 --- a/README.md +++ b/README.md @@ -283,6 +283,12 @@ collectors. [docs/public-issues/public-issues-manifest.json](docs/public-issues/public-issues-manifest.json). - Advisory branch protection policy: [docs/BRANCH_PROTECTION_POLICY_RU.md](docs/BRANCH_PROTECTION_POLICY_RU.md). +- Branch protection evidence template: + [docs/BRANCH_PROTECTION_EVIDENCE_RU.md](docs/BRANCH_PROTECTION_EVIDENCE_RU.md). +- PR-based review workflow: + [docs/PR_REVIEW_WORKFLOW_RU.md](docs/PR_REVIEW_WORKFLOW_RU.md). +- PR review evidence template: + [docs/PR_REVIEW_EVIDENCE_RU.md](docs/PR_REVIEW_EVIDENCE_RU.md). - CODEOWNERS and PR template are maintained for review routing and public change-control visibility. - Visible external code review is still pending until public reviewed PRs exist. diff --git a/docs/BRANCH_PROTECTION_EVIDENCE_RU.md b/docs/BRANCH_PROTECTION_EVIDENCE_RU.md new file mode 100644 index 0000000..b8961bf --- /dev/null +++ b/docs/BRANCH_PROTECTION_EVIDENCE_RU.md @@ -0,0 +1,100 @@ +# AWatch-rus: branch protection evidence + +Дата: 2026-06-23 + +branch_protection_status: "pending_manual_verification" + +GitHub issue: https://github.com/igor04091968/AWatch-rus/issues/49 + +Этот документ является evidence template для ручной проверки GitHub branch +protection на публичном зеркале. Он не утверждает, что branch protection уже +настроена или подтверждена. + +## Target + +- Repository: `igor04091968/AWatch-rus`. +- Platform role: GitHub public mirror validation only. +- Protected branch: `main`. +- Policy source: `docs/BRANCH_PROTECTION_POLICY_RU.md`. +- Evidence owner: maintainer. + +## Settings To Verify + +Maintainer должен вручную проверить, что для `main` configured rule включает: + +- require pull request before merging; +- require approvals: `1`; +- dismiss stale approvals when new commits are pushed; +- require review from CODEOWNERS, if available on the current GitHub plan; +- require status checks to pass before merging; +- require branches to be up to date before merging, if compatible with current + maintainer workflow; +- restrict force pushes; +- restrict deletions; +- administrator bypass decision documented, preferably disabled for stricter + mode. + +## Required Checks + +Expected required checks are based on current workflow/job names: + +- `CI / Rust checks` +- `CI / Docs and registry checks` +- `CI / Smoke checks` +- `Coverage / Coverage baseline` +- `Security / Cargo audit` +- `Security / Cargo deny` +- `Security / Secret pattern check` +- `Security / Dependency review` + +If GitHub displays a different context name, record the exact displayed name and +update `docs/BRANCH_PROTECTION_POLICY_RU.md` before marking verification done. + +## Manual Verification Procedure + +1. Open repository settings for `igor04091968/AWatch-rus`. +2. Open branch protection or repository rules for branch `main`. +3. Compare enabled settings against this document and + `docs/BRANCH_PROTECTION_POLICY_RU.md`. +4. Verify required status-check names exactly as GitHub displays them. +5. Capture screenshot evidence without private account data or tokens. +6. Record evidence fields below. +7. Only after verification, update `branch_protection_status` from + `"pending_manual_verification"` to `"verified"` in a follow-up change. + +## Evidence Record + +- Screenshot filename placeholder: + `docs/evidence/github-branch-protection-main-YYYY-MM-DD.png` +- Date: `YYYY-MM-DD` +- Maintainer: `maintainer` +- Repository: `igor04091968/AWatch-rus` +- Protected branch: `main` +- Required checks verified: `pending` +- Admin bypass decision: `pending` +- Force-push restriction verified: `pending` +- Deletion restriction verified: `pending` +- Notes: `pending` + +## Not Registry Release Evidence + +GitHub branch protection evidence is governance/process evidence for the public +mirror. It is not registry release evidence and does not replace release +artifacts, checksums, build logs or release evidence from the Russian +build-runner. + +## Russian Contour Note + +Primary registry-readiness contour remains Russian Gitea plus the planned +Russian build-runner. GitHub remains public mirror validation only. + +## Guardrails + +- Do not record secrets, tokens, private URLs or account recovery details. +- Do not include private employee/customer data in screenshots. +- Do not claim branch protection is verified until maintainer evidence exists. +- Do not claim completed registry submission. +- Do not claim certification. +- Do not claim SIEM/DLP replacement. +- Do not claim ML/LLM-based detection. +- Do not claim automatic remediation. diff --git a/docs/BRANCH_PROTECTION_POLICY_RU.md b/docs/BRANCH_PROTECTION_POLICY_RU.md index 01fcd9d..7bf049f 100644 --- a/docs/BRANCH_PROTECTION_POLICY_RU.md +++ b/docs/BRANCH_PROTECTION_POLICY_RU.md @@ -1,6 +1,6 @@ # AWatch-rus: advisory branch protection policy -Дата: 2026-06-22 +Дата: 2026-06-23 Статус: recommended policy. Этот документ описывает целевую настройку GitHub branch protection для публичного зеркала. Он не утверждает, что branch @@ -32,6 +32,41 @@ contour остается Russian Gitea plus Russian build-runner release evidenc - Require linear history if compatible with the maintainer workflow. - Administrator bypass should be emergency-only and documented after the fact. +## Recommended GitHub Branch Protection Settings + +Recommended settings for `main` on the GitHub public mirror: + +- Require pull request before merging. +- Required approvals: `1`. +- Dismiss stale approvals when new commits are pushed. +- Require review from CODEOWNERS if available on the current GitHub plan. +- Require status checks to pass before merging. +- Require branches to be up to date before merging if this does not block the + current maintainer workflow. +- Restrict force pushes. +- Restrict deletions. +- Allow administrators bypass: documented decision only; stricter mode should + keep bypass disabled unless repository recovery requires it. + +Recommended required checks, using current workflow/job names: + +- `CI / Rust checks` +- `CI / Docs and registry checks` +- `CI / Smoke checks` +- `Coverage / Coverage baseline` +- `Security / Cargo audit` +- `Security / Cargo deny` +- `Security / Secret pattern check` +- `Security / Dependency review` + +Before verification, maintainer must compare these names with the exact check +names displayed by GitHub. If GitHub displays different names, update this +document and `docs/BRANCH_PROTECTION_EVIDENCE_RU.md` before recording evidence. + +Current evidence status is tracked in +`docs/BRANCH_PROTECTION_EVIDENCE_RU.md` and remains +`pending_manual_verification` until maintainer evidence is recorded. + ## Review expectations - CODEOWNERS routes changes to the current maintainer. diff --git a/docs/PROJECT_STATUS_RU.md b/docs/PROJECT_STATUS_RU.md index 77f1aab..970094c 100644 --- a/docs/PROJECT_STATUS_RU.md +++ b/docs/PROJECT_STATUS_RU.md @@ -47,6 +47,15 @@ backup, registry-readiness документации, плана российск `docs/REVIEW_CHECKLIST_RU.md`. - Advisory branch protection policy: `docs/BRANCH_PROTECTION_POLICY_RU.md`. +- PR-based workflow documentation: ready + (`docs/PR_REVIEW_WORKFLOW_RU.md`). +- PR review evidence package: ready + (`docs/PR_REVIEW_EVIDENCE_RU.md`). +- Branch protection evidence package: ready + (`docs/BRANCH_PROTECTION_EVIDENCE_RU.md`). +- Branch protection actual enablement: + `pending_manual_verification`. +- First reviewed PR evidence: pending. ## Что готово @@ -81,6 +90,12 @@ backup, registry-readiness документации, плана российск - PR review process documented in PR template and review checklist. - Branch protection policy documented as advisory: `docs/BRANCH_PROTECTION_POLICY_RU.md`. +- Branch protection evidence template prepared: + `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`. +- PR-based review workflow documented: + `docs/PR_REVIEW_WORKFLOW_RU.md`. +- PR review evidence template prepared: + `docs/PR_REVIEW_EVIDENCE_RU.md`. - Зафиксирован residual risk register: `docs/RESIDUAL_RISKS_RU.md`. - Подготовлен план публичных issues для ручного заведения: @@ -104,6 +119,9 @@ backup, registry-readiness документации, плана российск - Visible external code review is still pending. - Branch protection enablement is not claimed until repository settings are verified. +- Branch protection actual enablement remains `pending_manual_verification`. +- First reviewed PR evidence remains pending until a reviewed public PR is + merged and evidence is recorded. - Community adoption remains low until external contributors, public reviews and sustained third-party activity appear. @@ -135,8 +153,11 @@ backup, registry-readiness документации, плана российск - `docs/registry/RELEASE_ARTIFACTS_STORAGE_RU.md` - `docs/QUALITY_STATUS_RU.md` - `docs/REVIEW_CHECKLIST_RU.md` +- `docs/PR_REVIEW_WORKFLOW_RU.md` +- `docs/PR_REVIEW_EVIDENCE_RU.md` - `docs/RESIDUAL_RISKS_RU.md` - `docs/PUBLIC_ISSUES_PLAN_RU.md` - `docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md` - `docs/public-issues/public-issues-manifest.json` - `docs/BRANCH_PROTECTION_POLICY_RU.md` +- `docs/BRANCH_PROTECTION_EVIDENCE_RU.md` diff --git a/docs/PR_REVIEW_EVIDENCE_RU.md b/docs/PR_REVIEW_EVIDENCE_RU.md new file mode 100644 index 0000000..ccb5f74 --- /dev/null +++ b/docs/PR_REVIEW_EVIDENCE_RU.md @@ -0,0 +1,74 @@ +# AWatch-rus: PR review evidence + +Дата: 2026-06-23 + +pr_review_evidence_status: "pending_until_first_reviewed_pr_is_merged" + +GitHub issue: https://github.com/igor04091968/AWatch-rus/issues/48 + +Этот документ фиксирует, что будет считаться evidence для PR-based review +workflow. Он не утверждает, что external peer review уже выполнен. + +## Evidence Criteria + +Первый evidence-backed reviewed PR должен содержать: + +- PR URL; +- linked issue URL; +- completed pull request template; +- passed checks; +- reviewer approval; +- merge commit; +- no bypass, or documented bypass with reason and follow-up checks. + +## Evidence Record + +- PR URL: `pending` +- Linked issue URL: `pending` +- Reviewer: `pending` +- Reviewer type: `pending` +- Approval URL or screenshot filename: `pending` +- Passed checks: `pending` +- Merge commit: `pending` +- Bypass used: `pending` +- Date: `YYYY-MM-DD` +- Maintainer note: `pending` + +## Reviewer Interpretation + +Review by the same maintainer improves change discipline but does not prove +external peer review. External peer review must not be marked completed unless a +reviewed public PR includes a reviewer who is not the submitting maintainer and +the review is visible. + +## Current Status + +- PR workflow documentation: ready. +- PR template: ready. +- CODEOWNERS routing: ready. +- First reviewed PR evidence: pending. +- External peer review completed: not claimed. + +## Not Registry Release Evidence + +PR review evidence is governance/process evidence for public development +visibility. It is not registry release evidence and does not replace artifacts, +checksums, logs or release evidence from the Russian build-runner. + +## Russian Contour Note + +Primary registry-readiness contour remains Russian Gitea plus the planned +Russian build-runner. GitHub remains public mirror validation only. + +## Guardrails + +- Do not publish secrets, private URLs, private account data or customer + identifiers. +- Do not claim completed external peer review until the evidence record is + filled from a real reviewed PR. +- Do not claim branch protection verification from PR evidence alone. +- Do not claim completed registry submission. +- Do not claim certification. +- Do not claim SIEM/DLP replacement. +- Do not claim ML/LLM-based detection. +- Do not claim automatic remediation. diff --git a/docs/PR_REVIEW_WORKFLOW_RU.md b/docs/PR_REVIEW_WORKFLOW_RU.md new file mode 100644 index 0000000..addf974 --- /dev/null +++ b/docs/PR_REVIEW_WORKFLOW_RU.md @@ -0,0 +1,106 @@ +# AWatch-rus: PR-based review workflow + +Дата: 2026-06-23 + +Статус: workflow documentation ready; first reviewed PR evidence remains +pending. + +GitHub issue: https://github.com/igor04091968/AWatch-rus/issues/48 + +Этот документ описывает целевой PR-based workflow для публичного GitHub mirror. +Он не утверждает, что external peer review уже выполнен. + +## Scope + +- Repository: `igor04091968/AWatch-rus`. +- Branch: `main`. +- GitHub role: public mirror validation only. +- Primary registry contour: Russian Gitea plus planned Russian build-runner. + +## Workflow + +1. Significant changes should be made on a branch and submitted through a pull + request. +2. Each PR should link the relevant GitHub issue or state why no issue is + applicable. +3. The PR template must be completed before merge. +4. CODEOWNERS should route review to the responsible maintainer or reviewer. +5. CI, Coverage and Security checks should pass before merge. +6. Any bypass must be documented in the PR or follow-up evidence note. + +## Docs-Only Changes + +Docs-only governance changes may use a reduced local check set when no product +code changes: + +- `python3 scripts/public_secret_pattern_check.py` +- `bash scripts/prepare_public_issues.sh` +- `bash -n scripts/registry_readiness_check.sh` +- `bash scripts/registry_readiness_check.sh` +- `git diff --check` + +If shell scripts change, run `bash -n` for each changed shell script. + +## Runtime/Product Changes + +Runtime, API, UI or product-code changes require a broader validation plan. +Expected checks include: + +- `cargo fmt --all --check` +- `cargo test --workspace` +- `cargo clippy --workspace --all-targets -- -D warnings` +- `cargo build --workspace` +- relevant smoke tests for deployment, pilot validation or browser behavior; +- rollback notes when operational behavior changes. + +## Security-Sensitive Changes + +Security-sensitive changes require: + +- public secret-pattern scan; +- review against `SECURITY.md`; +- no secrets, tokens, private keys, recovery codes or customer identifiers; +- no exploit detail in public text before security triage. + +## Registry Documentation Changes + +Registry docs must preserve conservative claims: + +- GitHub Actions is public mirror validation only. +- Registry release evidence requires Russian Gitea and the planned Russian + build-runner. +- Do not claim completed registry submission. +- Do not claim FSTEC/FSB certification. +- Do not claim SIEM/DLP replacement. +- Do not claim ML/LLM-based detection. +- Do not claim automatic remediation. +- Do not claim branch protection verification until maintainer evidence exists. +- Do not claim external peer review completion until reviewed PR evidence + exists. + +## Required Check Names + +Current workflow/job names used for branch protection planning: + +- `CI / Rust checks` +- `CI / Docs and registry checks` +- `CI / Smoke checks` +- `Coverage / Coverage baseline` +- `Security / Cargo audit` +- `Security / Cargo deny` +- `Security / Secret pattern check` +- `Security / Dependency review` + +These names should be rechecked against GitHub UI before branch protection is +marked verified. + +## Evidence + +Evidence for the first reviewed PR is tracked in +`docs/PR_REVIEW_EVIDENCE_RU.md`. + +## Not Registry Release Evidence + +PR review workflow evidence improves public process visibility. It is not +registry release evidence and does not replace release evidence generated on the +Russian build-runner. diff --git a/docs/RESIDUAL_RISKS_RU.md b/docs/RESIDUAL_RISKS_RU.md index 2a461a3..77ad50f 100644 --- a/docs/RESIDUAL_RISKS_RU.md +++ b/docs/RESIDUAL_RISKS_RU.md @@ -50,21 +50,26 @@ visibility, release evidence contour and legal package. Они требуют д ## 2. Нет внешнего visible peer review / публично видимого peer review -- Текущий статус: риск открыт; PR template and issue templates exist, but - public peer review history is still limited and external review is pending. +- Текущий статус: риск открыт; PR template, CODEOWNERS, public governance + issues and PR workflow docs exist, but first reviewed PR evidence and branch + protection verification are still pending. - Влияние: внешним аудиторам сложнее оценить review discipline and change control maturity. - Почему не блокирует pilot/readiness stage: current changes are protected by reproducible checks, public workflows and documented conservative positioning. -- Как риск будет снижаться: review checklist, CODEOWNERS routing, first public - PR reviews, explicit release branch review policy and advisory branch - protection. +- Как риск будет снижаться: review checklist, CODEOWNERS routing, public issue + #48, `docs/PR_REVIEW_WORKFLOW_RU.md`, first public reviewed PR evidence, + explicit release branch review policy and verified branch protection evidence. - Уже снижающие evidence/documents/CI: `.github/pull_request_template.md`, `.github/CODEOWNERS`, `.github/ISSUE_TEMPLATE/`, `docs/REVIEW_CHECKLIST_RU.md`, `docs/BRANCH_PROTECTION_POLICY_RU.md`, + `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`, + `docs/PR_REVIEW_WORKFLOW_RU.md`, `docs/PR_REVIEW_EVIDENCE_RU.md`, `CONTRIBUTING.md`, `SECURITY.md`, public CI, public security workflow. -- Следующий action: завести публичную задачу - `[governance] Enable PR-based review workflow`. +- Residual risk: remains open until branch protection is verified and first + reviewed PR evidence exists. +- Следующий action: выполнить maintainer verification for branch protection and + record first reviewed PR evidence without overstating external peer review. ## 3. Низкая публичная активность issue tracker @@ -180,6 +185,12 @@ visibility, release evidence contour and legal package. Они требуют д - PR review checklist exists in `docs/REVIEW_CHECKLIST_RU.md`. - Advisory branch protection policy exists in `docs/BRANCH_PROTECTION_POLICY_RU.md`. +- Branch protection evidence template exists in + `docs/BRANCH_PROTECTION_EVIDENCE_RU.md` with + `pending_manual_verification` status. +- PR-based workflow documentation exists in `docs/PR_REVIEW_WORKFLOW_RU.md`. +- PR review evidence template exists in `docs/PR_REVIEW_EVIDENCE_RU.md`; + first reviewed PR evidence remains pending. - Public PR template includes security, registry-claim, runtime/API/UI, smoke-test, rollback and evidence checklist items. - Visible external code review remains pending until public reviewed PRs exist. diff --git a/docs/public-issues/public-issues-manifest.json b/docs/public-issues/public-issues-manifest.json index b3f9a81..78f0d1d 100644 --- a/docs/public-issues/public-issues-manifest.json +++ b/docs/public-issues/public-issues-manifest.json @@ -112,7 +112,8 @@ "status": "created", "github_issue_url": "https://github.com/igor04091968/AWatch-rus/issues/48", "created_at": "2026-06-23T19:43:08Z", - "created_by": "maintainer" + "created_by": "maintainer", + "next_evidence_doc": "docs/PR_REVIEW_EVIDENCE_RU.md" }, { "id": "012", @@ -122,7 +123,8 @@ "status": "created", "github_issue_url": "https://github.com/igor04091968/AWatch-rus/issues/49", "created_at": "2026-06-23T19:43:10Z", - "created_by": "maintainer" + "created_by": "maintainer", + "next_evidence_doc": "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" } ] } diff --git a/docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md b/docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md index edaac83..301201c 100644 --- a/docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md +++ b/docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md @@ -1,5 +1,45 @@ # Registry readiness changelog +## 2026-06-23 branch protection and PR review evidence package + +Added: + +- `docs/BRANCH_PROTECTION_EVIDENCE_RU.md` with + `pending_manual_verification` status for GitHub branch protection evidence. +- `docs/PR_REVIEW_WORKFLOW_RU.md` with PR-based review workflow rules. +- `docs/PR_REVIEW_EVIDENCE_RU.md` with evidence criteria for the first reviewed + public PR. +- Public issues manifest links issue #48 to PR review evidence and issue #49 to + branch protection evidence. + +Changed: + +- `docs/BRANCH_PROTECTION_POLICY_RU.md` now lists recommended settings and real + current GitHub Actions check names. +- `.github/pull_request_template.md` includes compact governance/evidence + checklist items. +- `.github/CODEOWNERS` has clearer zones for workflows/security/governance, + registry docs, scripts, Rust workspace, demo/screenshots/docs. +- Project status and residual risks now distinguish prepared governance + evidence from pending verification. + +Runtime impact: + +- No runtime/product code changes. +- No API changes. +- No UI changes. +- No business logic changes. + +Guardrails: + +- Branch protection verification remains pending until maintainer records + repository settings evidence. +- External peer review is not claimed completed until real reviewed PR evidence + exists. +- GitHub remains public mirror validation only. +- Russian Gitea plus planned Russian build-runner remains the primary registry + contour. + ## 2026-06-23 public roadmap issues created and linked Changed: diff --git a/scripts/registry_readiness_check.sh b/scripts/registry_readiness_check.sh index 684b202..95083ca 100644 --- a/scripts/registry_readiness_check.sh +++ b/scripts/registry_readiness_check.sh @@ -59,6 +59,9 @@ required_files=( "docs/RESIDUAL_RISKS_RU.md" "docs/PUBLIC_ISSUES_PLAN_RU.md" "docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md" + "docs/PR_REVIEW_WORKFLOW_RU.md" + "docs/PR_REVIEW_EVIDENCE_RU.md" + "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "docs/public-issues/public-issues-manifest.json" "docs/public-issues/001-registry-gitea-restore-test.md" "docs/public-issues/002-registry-russian-build-runner.md" @@ -236,6 +239,8 @@ if [[ -s "$PUBLIC_ISSUES_MANIFEST" ]]; then ) ) ) + and ([.issues[] | select(.id == "011" and .github_issue_url == "https://github.com/igor04091968/AWatch-rus/issues/48" and .status == "created" and .next_evidence_doc == "docs/PR_REVIEW_EVIDENCE_RU.md")] | length == 1) + and ([.issues[] | select(.id == "012" and .github_issue_url == "https://github.com/igor04091968/AWatch-rus/issues/49" and .status == "created" and .next_evidence_doc == "docs/BRANCH_PROTECTION_EVIDENCE_RU.md")] | length == 1) ' "$PUBLIC_ISSUES_MANIFEST" >/dev/null || fail "public_issues_manifest_required_fields" elif command -v python3 >/dev/null 2>&1; then python3 - "$PUBLIC_ISSUES_MANIFEST" <<'PY' || fail "public_issues_manifest_required_fields" @@ -282,6 +287,23 @@ for issue in issues: raise SystemExit("created issue created_by mismatch") else: raise SystemExit("issue status mismatch") + +issue_by_id = {issue.get("id"): issue for issue in issues} +issue_011 = issue_by_id.get("011") or {} +if issue_011.get("status") != "created": + raise SystemExit("issue 011 status mismatch") +if issue_011.get("github_issue_url") != "https://github.com/igor04091968/AWatch-rus/issues/48": + raise SystemExit("issue 011 URL mismatch") +if issue_011.get("next_evidence_doc") != "docs/PR_REVIEW_EVIDENCE_RU.md": + raise SystemExit("issue 011 next_evidence_doc mismatch") + +issue_012 = issue_by_id.get("012") or {} +if issue_012.get("status") != "created": + raise SystemExit("issue 012 status mismatch") +if issue_012.get("github_issue_url") != "https://github.com/igor04091968/AWatch-rus/issues/49": + raise SystemExit("issue 012 URL mismatch") +if issue_012.get("next_evidence_doc") != "docs/BRANCH_PROTECTION_EVIDENCE_RU.md": + raise SystemExit("issue 012 next_evidence_doc mismatch") PY else fail "json_validator_missing:jq_or_python3_required" @@ -316,6 +338,10 @@ require_grep "PUBLIC_ISSUES_PLAN_RU\\.md" "docs/PROJECT_STATUS_RU.md" "project_s require_grep "docs/public-issues" "docs/PROJECT_STATUS_RU.md" "project_status_public_issue_templates" require_grep "PUBLIC_ISSUES_CREATION_RUNBOOK_RU\\.md" "docs/PROJECT_STATUS_RU.md" "project_status_public_issue_runbook" require_grep "Public issues:[[:space:]]*created and linked in manifest|Созданы 12 публичных" "docs/PROJECT_STATUS_RU.md" "project_status_issue_creation_created_urls" +require_grep "PR-based workflow documentation:[[:space:]]*ready" "docs/PROJECT_STATUS_RU.md" "project_status_pr_workflow_ready" +require_grep "Branch protection evidence package:[[:space:]]*ready" "docs/PROJECT_STATUS_RU.md" "project_status_branch_evidence_ready" +require_grep "pending_manual_verification" "docs/PROJECT_STATUS_RU.md" "project_status_branch_pending_manual" +require_grep "First reviewed PR evidence:[[:space:]]*pending|First reviewed PR evidence remains pending" "docs/PROJECT_STATUS_RU.md" "project_status_first_reviewed_pr_pending" require_grep "GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU\\.md|Restore outline|Post-restore checks" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_restore_runbook" require_grep "awatch-gitea-backup\\.timer" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_timer" require_grep "sha256|SHA256" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_sha256" @@ -347,6 +373,9 @@ require_grep "public roadmap issues created and linked" "docs/registry/REGISTRY_ require_grep "docs/public-issues" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_issues_dir" require_grep "runtime/product code changes" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_issues_no_runtime" require_grep "GitHub remains public mirror validation only" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_issues_github_role" +require_grep "branch protection and PR review evidence package" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_branch_pr_evidence_package" +require_grep "No runtime/product code changes" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_branch_pr_no_runtime" +require_grep "External peer review is not claimed completed" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_external_review_not_completed" require_grep "Restore test is not claimed as completed" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_restore_not_completed" require_grep "Russian build-runner is not claimed as ready" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_build_runner_not_ready" require_grep "First release evidence build is not claimed as completed" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_release_evidence_not_completed" @@ -358,14 +387,27 @@ require_grep "public-issues/public-issues-manifest\\.json" "README.md" "readme_p require_grep "Engineering governance and residual risks" "README.md" "readme_engineering_governance_section" require_grep "REVIEW_CHECKLIST_RU\\.md" "README.md" "readme_review_checklist_link" require_grep "BRANCH_PROTECTION_POLICY_RU\\.md" "README.md" "readme_branch_protection_policy_link" +require_grep "BRANCH_PROTECTION_EVIDENCE_RU\\.md" "README.md" "readme_branch_protection_evidence_link" +require_grep "PR_REVIEW_WORKFLOW_RU\\.md" "README.md" "readme_pr_review_workflow_link" +require_grep "PR_REVIEW_EVIDENCE_RU\\.md" "README.md" "readme_pr_review_evidence_link" require_grep "CODEOWNERS" "README.md" "readme_codeowners" require_grep "\\* @igor04091968" ".github/CODEOWNERS" "codeowners_default_owner" require_grep "/adk-rust/" ".github/CODEOWNERS" "codeowners_rust_workspace" require_grep "/scripts/" ".github/CODEOWNERS" "codeowners_scripts" +require_grep "/docs/demo/" ".github/CODEOWNERS" "codeowners_demo_docs" +require_grep "/docs/screenshots/" ".github/CODEOWNERS" "codeowners_screenshots" require_grep "/docs/registry/" ".github/CODEOWNERS" "codeowners_registry_docs" require_grep "/\\.github/workflows/" ".github/CODEOWNERS" "codeowners_workflows" +require_grep "/\\.github/workflows/security\\.yml" ".github/CODEOWNERS" "codeowners_security_workflow" +require_grep "PR_REVIEW_WORKFLOW_RU\\.md" ".github/CODEOWNERS" "codeowners_pr_review_docs" +require_grep "BRANCH_PROTECTION_EVIDENCE_RU\\.md" ".github/CODEOWNERS" "codeowners_branch_evidence" require_grep "/ansible/" ".github/CODEOWNERS" "codeowners_ansible" require_grep "SECURITY\\.md" ".github/CODEOWNERS" "codeowners_security_docs" +require_grep "Linked issue" ".github/pull_request_template.md" "pr_template_linked_issue" +require_grep "Runtime/API/UI impact" ".github/pull_request_template.md" "pr_template_runtime_api_ui" +require_grep "Registry claims" ".github/pull_request_template.md" "pr_template_registry_claims" +require_grep "Secrets, PII" ".github/pull_request_template.md" "pr_template_secrets_pii" +require_grep "GitHub Actions.*not registry release evidence" ".github/pull_request_template.md" "pr_template_github_not_registry_evidence" require_grep "не публиковать секреты|No secrets" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_no_secrets" require_grep "персональных данных|personal data" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_no_pii" require_grep "реальных IP|hostname|customer infrastructure identifiers" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_no_customer_infra" @@ -375,7 +417,19 @@ require_grep "Do not claim FSTEC/FSB certification" "docs/REVIEW_CHECKLIST_RU.md require_grep "Do not claim SIEM/DLP replacement" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_no_siem_dlp" require_grep "restore_tested=false|restore_tested.*false" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_restore_false" require_grep "Require pull request before merge" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_require_pr" +require_grep "Recommended GitHub Branch Protection Settings" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_recommended_settings" +require_grep 'Required approvals:[[:space:]]*`1`' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_one_approval" +require_grep "Dismiss stale approvals" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_dismiss_stale" +require_grep "CODEOWNERS" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_codeowners_review" require_grep "Require status checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_status_checks" +require_grep "CI / Rust checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ci_rust_checks" +require_grep "CI / Docs and registry checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ci_docs_registry_checks" +require_grep "CI / Smoke checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ci_smoke_checks" +require_grep "Coverage / Coverage baseline" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_coverage_baseline_check" +require_grep "Security / Cargo audit" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_security_cargo_audit" +require_grep "Security / Cargo deny" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_security_cargo_deny" +require_grep "Security / Secret pattern check" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_secret_pattern_check" +require_grep "Security / Dependency review" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_dependency_review" require_grep 'Require `CI` workflow' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ci" require_grep 'Require `Security` workflow' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_security" require_grep 'Require `Coverage` workflow' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_coverage" @@ -385,6 +439,24 @@ require_grep "Require conversation resolution" "docs/BRANCH_PROTECTION_POLICY_RU require_grep "Require linear history" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_linear_history" require_grep "emergency-only" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_admin_bypass" require_grep "recommended policy|advisory branch protection policy" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_advisory_not_enabled" +require_grep "branch_protection_status:[[:space:]]*\"pending_manual_verification\"" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_pending_manual" +require_grep "https://github\\.com/igor04091968/AWatch-rus/issues/49" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_issue_49" +require_grep "Not Registry Release Evidence|Not registry release evidence" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_not_registry" +require_grep "Russian Contour Note" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_russian_contour" +require_grep "CI / Rust checks" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_required_checks" +require_grep "workflow documentation ready" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_ready" +require_grep "https://github\\.com/igor04091968/AWatch-rus/issues/48" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_issue_48" +require_grep "PR template must be completed" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_template_required" +require_grep "CODEOWNERS" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_codeowners" +require_grep "CI, Coverage and Security checks" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_checks" +require_grep "public secret-pattern scan" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_secret_scan" +require_grep "GitHub Actions is public mirror validation only" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_github_public_only" +require_grep "pr_review_evidence_status:[[:space:]]*\"pending_until_first_reviewed_pr_is_merged\"" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_pending_first_reviewed_pr" +require_grep "reviewer approval" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_reviewer_approval" +require_grep "External peer review completed:[[:space:]]*not claimed" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_external_not_claimed" +require_grep "Not Registry Release Evidence|Not registry release evidence" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_not_registry" +require_grep "\"next_evidence_doc\"[[:space:]]*:[[:space:]]*\"docs/PR_REVIEW_EVIDENCE_RU\\.md\"" "docs/public-issues/public-issues-manifest.json" "manifest_issue_48_next_evidence_doc" +require_grep "\"next_evidence_doc\"[[:space:]]*:[[:space:]]*\"docs/BRANCH_PROTECTION_EVIDENCE_RU\\.md\"" "docs/public-issues/public-issues-manifest.json" "manifest_issue_49_next_evidence_doc" require_grep "Один основной разработчик" "docs/RESIDUAL_RISKS_RU.md" "risk_single_developer" require_grep "Нет внешнего visible peer review" "docs/RESIDUAL_RISKS_RU.md" "risk_peer_review" require_grep "Низкая публичная активность issue tracker" "docs/RESIDUAL_RISKS_RU.md" "risk_issue_tracker_activity" @@ -437,6 +509,9 @@ scan_files=( "$ROOT/docs/RESIDUAL_RISKS_RU.md" "$ROOT/docs/PUBLIC_ISSUES_PLAN_RU.md" "$ROOT/docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md" + "$ROOT/docs/PR_REVIEW_WORKFLOW_RU.md" + "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md" + "$ROOT/docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "$ROOT/docs/public-issues"/*.md "$ROOT/docs/public-issues"/*.json "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md" @@ -463,6 +538,9 @@ claim_scan_files=( "$ROOT/docs/RESIDUAL_RISKS_RU.md" "$ROOT/docs/PUBLIC_ISSUES_PLAN_RU.md" "$ROOT/docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md" + "$ROOT/docs/PR_REVIEW_WORKFLOW_RU.md" + "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md" + "$ROOT/docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "$ROOT/docs/public-issues"/*.md "$ROOT/docs/public-issues"/*.json "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md" @@ -500,7 +578,7 @@ fi rm -f /tmp/registry_forbidden_replacement.$$ if grep -RInEi "(ML/LLM-based detection|LLM-based detection|ML-based detection|automatic remediation)" "${claim_scan_files[@]}" \ - | grep -Eiv "(forbidden|not_made|not_claimed|no claim|не заявляет|не фиксируется|не используется|does not claim)" \ + | grep -Eiv "(forbidden|not_made|not_claimed|no claim|do not claim|не заявляет|не фиксируется|не используется|does not claim)" \ >/tmp/registry_forbidden_ai_auto.$$ 2>/dev/null; then fail "forbidden_claim_ai_or_automatic_remediation:$(cat /tmp/registry_forbidden_ai_auto.$$)" fi @@ -520,15 +598,15 @@ if grep -RInEi "(completed Russian software registry submission|registry submiss fi rm -f /tmp/registry_forbidden_registry_submission_done.$$ -if grep -RInEi "(branch protection).{0,120}(enabled|включ(е|ё)н|настроен|active)" "$ROOT/README.md" "$ROOT/docs/PROJECT_STATUS_RU.md" "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md" "$REGISTRY_DIR"/*.md \ - | grep -Eiv "(not |не |не утверждает|not claimed|advisory|until repository settings|если применимо|recommended)" \ +if grep -RInEi "(branch protection).{0,120}(enabled|включ(е|ё)н|настроен|active)" "$ROOT/README.md" "$ROOT/docs/PROJECT_STATUS_RU.md" "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md" "$ROOT/docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "$ROOT/docs/PR_REVIEW_WORKFLOW_RU.md" "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md" "$REGISTRY_DIR"/*.md \ + | grep -Eiv "(not |не |не утверждает|not claimed|advisory|until repository settings|если применимо|recommended|pending_manual_verification|until maintainer evidence|until.*evidence|to verify)" \ >/tmp/registry_forbidden_branch_protection_enabled.$$ 2>/dev/null; then fail "forbidden_claim_branch_protection_enabled:$(cat /tmp/registry_forbidden_branch_protection_enabled.$$)" fi rm -f /tmp/registry_forbidden_branch_protection_enabled.$$ -if grep -RInEi "(external|visible|peer).{0,80}(review).{0,120}(active|performed|completed|done|выполняется|проведен|провед(е|ё)н|активен)" "$ROOT/README.md" "$ROOT/docs/PROJECT_STATUS_RU.md" "$ROOT/docs/RESIDUAL_RISKS_RU.md" "$REGISTRY_DIR"/*.md \ - | grep -Eiv "(not |не |pending|still pending|не утверждает|not claimed|until public reviewed PRs)" \ +if grep -RInEi "(external|visible|peer).{0,80}(review).{0,120}(active|performed|completed|done|выполняется|проведен|провед(е|ё)н|активен)" "$ROOT/README.md" "$ROOT/docs/PROJECT_STATUS_RU.md" "$ROOT/docs/RESIDUAL_RISKS_RU.md" "$ROOT/docs/PR_REVIEW_WORKFLOW_RU.md" "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md" "$REGISTRY_DIR"/*.md \ + | grep -Eiv "(not |не |pending|still pending|не утверждает|not claimed|until public reviewed PRs|until reviewed PR evidence|unless a reviewed public PR|is not claimed)" \ >/tmp/registry_forbidden_external_review_active.$$ 2>/dev/null; then fail "forbidden_claim_external_review_active:$(cat /tmp/registry_forbidden_external_review_active.$$)" fi