docs(governance): prepare public issue creation package
This commit is contained in:
igor04091968
@@ -0,0 +1,73 @@
|
||||
# Public issue template 001
|
||||
|
||||
## Title
|
||||
|
||||
[registry] Perform Gitea backup restore test
|
||||
|
||||
## Labels
|
||||
|
||||
`registry`, `ops`, `evidence`
|
||||
|
||||
## Purpose
|
||||
|
||||
Prove that the documented Gitea backup can be restored on a separate host and
|
||||
that restore evidence is reproducible.
|
||||
|
||||
## Background
|
||||
|
||||
The Russian Gitea contour and backup process are documented, but restore proof
|
||||
is not complete. The registry evidence manifest must keep restore status pending
|
||||
until a separate-host restore drill is recorded.
|
||||
|
||||
## Scope
|
||||
|
||||
- Run a restore drill on a separate test host or isolated environment.
|
||||
- Verify backup checksum before restore.
|
||||
- Verify repository availability after restore.
|
||||
- Record commands, logs, timestamps and rollback notes in non-sensitive form.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No production restore.
|
||||
- No change to runtime services, API, UI or business logic.
|
||||
- No claim that registry submission is complete.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- Restore log is attached or linked.
|
||||
- SHA256 verification is recorded.
|
||||
- Post-restore repository checks are recorded.
|
||||
- Rollback or cleanup notes are recorded.
|
||||
- Registry evidence manifest is updated only after evidence exists.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- Backup artifact name without secrets.
|
||||
- Checksum verification output.
|
||||
- Restore command log with sensitive values redacted.
|
||||
- Post-restore repository clone or integrity check.
|
||||
- Reviewer note confirming evidence location.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish passwords, tokens, private keys or recovery codes.
|
||||
- Do not publish customer identifiers, employee data or private infrastructure
|
||||
details.
|
||||
- Redact internal paths when they expose sensitive topology.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- Keep `restore_tested=false` until evidence is recorded.
|
||||
- Do not describe the restore contour as registry-ready until the drill is
|
||||
complete and reviewed.
|
||||
- GitHub issue visibility is public roadmap visibility, not registry release
|
||||
evidence.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Select isolated restore target.
|
||||
- [ ] Verify backup checksum.
|
||||
- [ ] Perform restore.
|
||||
- [ ] Run post-restore repository checks.
|
||||
- [ ] Record evidence location.
|
||||
- [ ] Update manifest only after evidence exists.
|
||||
@@ -0,0 +1,68 @@
|
||||
# Public issue template 002
|
||||
|
||||
## Title
|
||||
|
||||
[registry] Prepare temporary Russian build-runner awatch-build-01
|
||||
|
||||
## Labels
|
||||
|
||||
`registry`, `build-runner`, `ops`
|
||||
|
||||
## Purpose
|
||||
|
||||
Prepare the Russian build-runner contour required for registry release
|
||||
evidence.
|
||||
|
||||
## Background
|
||||
|
||||
GitHub Actions is public mirror validation only. Registry release evidence must
|
||||
be produced in the Russian contour connected to the Russian Gitea source.
|
||||
|
||||
## Scope
|
||||
|
||||
- Define provisioning notes for `awatch-build-01`.
|
||||
- Document toolchain, OS baseline, access model and Gitea clone method.
|
||||
- Document required checks for release evidence builds.
|
||||
- Keep runner status pending until provisioning evidence exists.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No production deployment.
|
||||
- No automatic release.
|
||||
- No claim that the build-runner is already ready.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- Build-runner setup notes exist.
|
||||
- Toolchain list is documented.
|
||||
- Gitea access method is documented without secrets.
|
||||
- Required checks list is documented.
|
||||
- Known blockers are recorded.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- Host provisioning notes without sensitive addresses.
|
||||
- Toolchain versions.
|
||||
- Gitea access verification with credentials redacted.
|
||||
- Planned release evidence command list.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish credentials, VPN data, SSH keys or private network topology.
|
||||
- Do not include live internal IPs or host access details in the public issue.
|
||||
- Use sanitized host labels where possible.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- Do not mark `awatch-build-01` as ready before evidence exists.
|
||||
- Do not use GitHub Actions output as registry release evidence.
|
||||
- Primary registry contour remains Russian Gitea plus Russian build-runner.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Confirm target OS and hosting contour.
|
||||
- [ ] Install required toolchain.
|
||||
- [ ] Verify Russian Gitea clone path.
|
||||
- [ ] Document required checks.
|
||||
- [ ] Record blockers.
|
||||
- [ ] Update registry evidence docs only after verification.
|
||||
@@ -0,0 +1,70 @@
|
||||
# Public issue template 003
|
||||
|
||||
## Title
|
||||
|
||||
[release] Produce first release evidence package
|
||||
|
||||
## Labels
|
||||
|
||||
`release`, `registry`, `evidence`
|
||||
|
||||
## Purpose
|
||||
|
||||
Produce the first release evidence package from the Russian build-runner once
|
||||
the runner is available.
|
||||
|
||||
## Background
|
||||
|
||||
Release evidence scripts exist, but the first real release evidence build must
|
||||
run in the Russian build contour before it can be treated as registry evidence.
|
||||
|
||||
## Scope
|
||||
|
||||
- Run release evidence scripts on the Russian build-runner.
|
||||
- Collect logs, checksums, artifact manifest and command versions.
|
||||
- Store evidence in the documented Russian storage contour.
|
||||
- Link evidence from registry documentation after review.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No claim that release evidence is already produced.
|
||||
- No publication of secret build logs.
|
||||
- No runtime, API or UI changes.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- Release evidence manifest exists.
|
||||
- Build logs are retained with secrets redacted.
|
||||
- Checksums are recorded.
|
||||
- Artifact storage path is documented.
|
||||
- Review note confirms evidence completeness.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- Release manifest.
|
||||
- Build logs.
|
||||
- SHA256 checksums.
|
||||
- Cargo metadata/tree or equivalent dependency evidence.
|
||||
- Artifact retention note.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish credentials, private paths with sensitive data or customer
|
||||
environment identifiers.
|
||||
- Redact tokens and private repository access details.
|
||||
- Keep evidence links scoped to approved public-safe material.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- Do not treat GitHub Actions as release evidence.
|
||||
- Do not claim registry submission is complete.
|
||||
- Keep evidence pending until artifacts and checksums exist.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Confirm build-runner readiness.
|
||||
- [ ] Run release evidence script.
|
||||
- [ ] Verify generated checksums.
|
||||
- [ ] Store artifacts in Russian contour.
|
||||
- [ ] Review logs for sensitive data.
|
||||
- [ ] Record evidence links.
|
||||
@@ -0,0 +1,67 @@
|
||||
# Public issue template 004
|
||||
|
||||
## Title
|
||||
|
||||
[legal] Prepare rightsholder evidence package
|
||||
|
||||
## Labels
|
||||
|
||||
`legal`, `registry`, `docs`
|
||||
|
||||
## Purpose
|
||||
|
||||
Prepare the rightsholder and legal evidence checklist needed before any future
|
||||
Russian software registry submission.
|
||||
|
||||
## Background
|
||||
|
||||
Technical readiness documentation does not replace legal confirmation. The
|
||||
rightsholder package remains pending until reviewed by the responsible party.
|
||||
|
||||
## Scope
|
||||
|
||||
- Prepare a rightsholder evidence checklist.
|
||||
- Identify ownership and license evidence to collect.
|
||||
- Document legal review TODOs.
|
||||
- Keep public wording conservative.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No legal conclusion by engineering.
|
||||
- No claim that registry submission is complete.
|
||||
- No publication of confidential contracts or personal data.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- Checklist of required legal evidence exists.
|
||||
- Ownership evidence categories are documented.
|
||||
- Open legal questions are recorded.
|
||||
- Public docs avoid certification and registry-completion claims.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- Legal checklist document.
|
||||
- Rightsholder evidence inventory in non-sensitive form.
|
||||
- Dependency/license summary reference.
|
||||
- Legal review status note.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish passport data, signatures, contracts or confidential legal
|
||||
documents.
|
||||
- Do not expose personal data of representatives.
|
||||
- Use references to private evidence storage when needed.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- Do not claim legal readiness until formal review is complete.
|
||||
- Do not claim completed Russian software registry submission.
|
||||
- GitHub issues are public tracking, not legal evidence.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Draft rightsholder evidence checklist.
|
||||
- [ ] Map ownership evidence categories.
|
||||
- [ ] Reference dependency/license documents.
|
||||
- [ ] Record open legal questions.
|
||||
- [ ] Review public wording for forbidden claims.
|
||||
@@ -0,0 +1,67 @@
|
||||
# Public issue template 005
|
||||
|
||||
## Title
|
||||
|
||||
[qa] Define coverage threshold policy
|
||||
|
||||
## Labels
|
||||
|
||||
`qa`, `coverage`, `policy`
|
||||
|
||||
## Purpose
|
||||
|
||||
Define a conservative coverage threshold policy after the baseline is stable and
|
||||
reviewed.
|
||||
|
||||
## Background
|
||||
|
||||
Coverage workflow exists for visibility, but threshold enforcement is not
|
||||
enabled yet. Premature thresholds can create noisy failures before the baseline
|
||||
is understood.
|
||||
|
||||
## Scope
|
||||
|
||||
- Review current coverage baseline.
|
||||
- Identify crates or modules where thresholds are meaningful.
|
||||
- Propose a staged threshold policy.
|
||||
- Document exceptions and review cadence.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No immediate hard threshold without baseline review.
|
||||
- No claim that coverage proves absence of defects.
|
||||
- No runtime, API or UI changes.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- Baseline coverage summary is reviewed.
|
||||
- Initial threshold proposal is documented.
|
||||
- Exceptions are documented.
|
||||
- Enforcement plan is staged and reversible.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- Coverage workflow artifact reference.
|
||||
- Baseline review notes.
|
||||
- Proposed threshold values.
|
||||
- Rationale for exclusions or delayed enforcement.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish private test data or production logs.
|
||||
- Keep coverage artifacts free of secrets and customer identifiers.
|
||||
- Avoid copying sensitive paths into public issue text.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- Coverage visibility is quality evidence, not registry release evidence.
|
||||
- Threshold policy must not imply certification.
|
||||
- GitHub remains public mirror validation only.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Review coverage baseline.
|
||||
- [ ] Identify meaningful threshold scope.
|
||||
- [ ] Document proposed values.
|
||||
- [ ] Document exclusions.
|
||||
- [ ] Decide when enforcement can start.
|
||||
@@ -0,0 +1,65 @@
|
||||
# Public issue template 006
|
||||
|
||||
## Title
|
||||
|
||||
[security] Prepare external security/code review checklist
|
||||
|
||||
## Labels
|
||||
|
||||
`security`, `review`, `governance`
|
||||
|
||||
## Purpose
|
||||
|
||||
Prepare a public checklist for future visible external security/code review.
|
||||
|
||||
## Background
|
||||
|
||||
Review checklist and CODEOWNERS exist, but active external peer review is not
|
||||
claimed until public reviewed pull requests or equivalent evidence exist.
|
||||
|
||||
## Scope
|
||||
|
||||
- Extend review evidence expectations from `docs/REVIEW_CHECKLIST_RU.md`.
|
||||
- Define security review scope and artifacts.
|
||||
- Define how reviewed PRs will be referenced.
|
||||
- Define forbidden data for public review comments.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No claim that external review is already active.
|
||||
- No publication of sensitive findings before triage.
|
||||
- Forbidden claim: automatic remediation is not claimed.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- External/security review checklist is documented.
|
||||
- Evidence format for reviewed PRs is defined.
|
||||
- Sensitive disclosure handling is documented.
|
||||
- First review remains pending until public evidence exists.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- Checklist document.
|
||||
- Link to review policy.
|
||||
- Future reviewed PR URL or placeholder status.
|
||||
- Security disclosure guardrails.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish exploit details before coordinated handling.
|
||||
- Do not publish customer data, employee data or secrets.
|
||||
- Keep vulnerability handling aligned with `SECURITY.md`.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- Do not claim active external peer review until public reviewed PRs exist.
|
||||
- Security review evidence is governance evidence, not certification.
|
||||
- Do not claim FSTEC/FSB certification.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Draft external review checklist.
|
||||
- [ ] Define evidence requirements.
|
||||
- [ ] Define sensitive disclosure rules.
|
||||
- [ ] Link to `docs/REVIEW_CHECKLIST_RU.md`.
|
||||
- [ ] Record first reviewed PR only after it exists.
|
||||
@@ -0,0 +1,66 @@
|
||||
# Public issue template 007
|
||||
|
||||
## Title
|
||||
|
||||
[compat] Test Russian OS compatibility matrix
|
||||
|
||||
## Labels
|
||||
|
||||
`compat`, `qa`, `registry`
|
||||
|
||||
## Purpose
|
||||
|
||||
Build an evidence-backed compatibility matrix for target Russian operating
|
||||
systems.
|
||||
|
||||
## Background
|
||||
|
||||
Compatibility must be tested and documented. Unsupported compatibility claims
|
||||
must not be made before evidence exists.
|
||||
|
||||
## Scope
|
||||
|
||||
- Define target OS versions.
|
||||
- Run installation and smoke checks where applicable.
|
||||
- Record pass/fail/blocked status.
|
||||
- Document gaps and next actions.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No claim of support for untested OS versions.
|
||||
- No certification claims.
|
||||
- No runtime change in this issue.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- Compatibility matrix exists.
|
||||
- Each target OS has status and evidence reference.
|
||||
- Failed or blocked cases include next action.
|
||||
- Public wording avoids unsupported claims.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- OS/version list.
|
||||
- Test command summary.
|
||||
- Smoke check results.
|
||||
- Known gaps and blockers.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish customer infrastructure identifiers.
|
||||
- Do not publish private hostnames, credentials or internal IPs.
|
||||
- Use sanitized environment descriptions.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- Compatibility matrix is evidence support, not registry completion.
|
||||
- Do not claim FSTEC/FSB certification.
|
||||
- Do not claim support until test evidence exists.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Define OS list.
|
||||
- [ ] Run installation checks.
|
||||
- [ ] Run smoke checks.
|
||||
- [ ] Record evidence.
|
||||
- [ ] Update compatibility matrix.
|
||||
@@ -0,0 +1,67 @@
|
||||
# Public issue template 008
|
||||
|
||||
## Title
|
||||
|
||||
[ops] Validate release artifacts storage in RF
|
||||
|
||||
## Labels
|
||||
|
||||
`ops`, `release`, `registry`
|
||||
|
||||
## Purpose
|
||||
|
||||
Validate the storage location, retention and integrity process for release
|
||||
artifacts in the Russian contour.
|
||||
|
||||
## Background
|
||||
|
||||
Release evidence requires reproducible artifacts and checksums stored in the
|
||||
approved contour. Storage remains pending until verified.
|
||||
|
||||
## Scope
|
||||
|
||||
- Identify storage path or service in the Russian contour.
|
||||
- Document retention and access model.
|
||||
- Verify checksum procedure.
|
||||
- Document backup or immutability expectations.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No publication of private artifact URLs if access is restricted.
|
||||
- No release creation.
|
||||
- No runtime/API/UI change.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- Storage location is documented in non-sensitive form.
|
||||
- Retention policy is documented.
|
||||
- Access model is documented.
|
||||
- Checksum verification procedure is documented.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- Storage policy note.
|
||||
- Checksum verification example.
|
||||
- Retention setting or procedure.
|
||||
- Access model review note.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish credentials or private storage tokens.
|
||||
- Do not expose private URLs that grant access.
|
||||
- Redact internal storage topology where needed.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- Storage validation is a prerequisite for release evidence, not proof of
|
||||
registry submission.
|
||||
- Do not claim release package completion until artifacts exist.
|
||||
- Primary evidence remains in the Russian contour.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Identify storage contour.
|
||||
- [ ] Document retention.
|
||||
- [ ] Document access model.
|
||||
- [ ] Verify checksum procedure.
|
||||
- [ ] Record blockers.
|
||||
@@ -0,0 +1,67 @@
|
||||
# Public issue template 009
|
||||
|
||||
## Title
|
||||
|
||||
[docs] Refresh public demo pack and screenshots
|
||||
|
||||
## Labels
|
||||
|
||||
`docs`, `demo`, `public`
|
||||
|
||||
## Purpose
|
||||
|
||||
Refresh public demo materials and screenshots while keeping them free of
|
||||
sensitive data.
|
||||
|
||||
## Background
|
||||
|
||||
Public demo evidence improves transparency, but demo assets must not expose
|
||||
customer infrastructure, employee data or secrets.
|
||||
|
||||
## Scope
|
||||
|
||||
- Review demo pack and screenshots.
|
||||
- Replace stale screenshots where needed.
|
||||
- Confirm demo data is synthetic or anonymized.
|
||||
- Update public demo references.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No use of real employee activity logs.
|
||||
- No customer infrastructure disclosure.
|
||||
- No product behavior change.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- Demo assets are current.
|
||||
- Sensitive data review is recorded.
|
||||
- Screenshots use synthetic/anonymized data.
|
||||
- README/docs links remain valid.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- Updated demo asset list.
|
||||
- Screenshot review note.
|
||||
- Secret/PII scan result.
|
||||
- Link validation notes where applicable.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish secrets, tokens, internal hostnames, private IPs, employee
|
||||
names or customer identifiers.
|
||||
- Use synthetic data for examples.
|
||||
- Remove metadata from images when needed.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- Demo pack is public visibility, not registry release evidence.
|
||||
- Do not claim customer adoption from demo assets.
|
||||
- Do not imply certification.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Inventory demo assets.
|
||||
- [ ] Refresh stale screenshots.
|
||||
- [ ] Check for secrets and PII.
|
||||
- [ ] Update references.
|
||||
- [ ] Record review result.
|
||||
@@ -0,0 +1,66 @@
|
||||
# Public issue template 010
|
||||
|
||||
## Title
|
||||
|
||||
[pilot] Prepare Pilot Acceptance Checklist v2
|
||||
|
||||
## Labels
|
||||
|
||||
`pilot`, `qa`, `docs`
|
||||
|
||||
## Purpose
|
||||
|
||||
Update pilot acceptance criteria after the residual risk register and public
|
||||
issue plan.
|
||||
|
||||
## Background
|
||||
|
||||
Pilot acceptance must distinguish technical readiness, operational evidence,
|
||||
governance visibility and pending registry release evidence.
|
||||
|
||||
## Scope
|
||||
|
||||
- Update pilot acceptance checklist.
|
||||
- Reference residual risks and smoke checks.
|
||||
- Define evidence required for pilot closeout.
|
||||
- Keep registry completion claims out of pilot wording.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No change to runtime behavior.
|
||||
- No claim that registry submission is complete.
|
||||
- No automatic acceptance without evidence.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- Pilot checklist v2 exists.
|
||||
- Residual risks are referenced.
|
||||
- Smoke and evidence checks are listed.
|
||||
- Pending registry items remain marked pending.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- Updated checklist.
|
||||
- Links to residual risks and validation runbooks.
|
||||
- Pilot smoke command results when available.
|
||||
- Open gap list.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish real customer data, employee logs or confidential pilot notes.
|
||||
- Use sanitized evidence references.
|
||||
- Keep private pilot evidence outside public issue text.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- Pilot acceptance is not registry registration.
|
||||
- Registry release evidence still requires the Russian build-runner.
|
||||
- Do not claim certification or SIEM/DLP replacement.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Review current pilot checklist.
|
||||
- [ ] Add residual risk references.
|
||||
- [ ] Add smoke/evidence requirements.
|
||||
- [ ] Mark pending registry items.
|
||||
- [ ] Review forbidden claims.
|
||||
@@ -0,0 +1,66 @@
|
||||
# Public issue template 011
|
||||
|
||||
## Title
|
||||
|
||||
[governance] Enable PR-based review workflow
|
||||
|
||||
## Labels
|
||||
|
||||
`governance`, `review`, `process`
|
||||
|
||||
## Purpose
|
||||
|
||||
Move visible changes through pull requests where practical and record review
|
||||
evidence.
|
||||
|
||||
## Background
|
||||
|
||||
PR template, CODEOWNERS and review checklist exist. Active visible external
|
||||
review is still pending until reviewed public PRs exist.
|
||||
|
||||
## Scope
|
||||
|
||||
- Define PR-based workflow for public changes.
|
||||
- Run a documented dry-run PR or first reviewed PR.
|
||||
- Record required status checks.
|
||||
- Record review evidence expectations.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No claim that external review is already active.
|
||||
- No bypass of emergency maintainer control for security incidents.
|
||||
- No runtime behavior change.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- PR workflow is documented.
|
||||
- First reviewed PR or dry-run PR is recorded.
|
||||
- Required evidence and checks are listed.
|
||||
- Open blockers are documented.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- Reviewed PR URL or dry-run PR URL after creation.
|
||||
- Checklist completion note.
|
||||
- CI/security/coverage status notes.
|
||||
- Review comment or approval evidence when available.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish secrets or private customer context in PRs or issues.
|
||||
- Do not expose security-sensitive details before triage.
|
||||
- Keep emergency fixes possible under documented policy.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- PR review workflow is governance evidence, not registry release evidence.
|
||||
- Do not claim external peer review is active until public reviewed PRs exist.
|
||||
- GitHub remains public mirror validation only.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Define PR workflow.
|
||||
- [ ] Create dry-run or first reviewed PR.
|
||||
- [ ] Record checks.
|
||||
- [ ] Record review evidence.
|
||||
- [ ] Update status docs after evidence exists.
|
||||
@@ -0,0 +1,67 @@
|
||||
# Public issue template 012
|
||||
|
||||
## Title
|
||||
|
||||
[governance] Add branch protection policy
|
||||
|
||||
## Labels
|
||||
|
||||
`governance`, `github`, `policy`
|
||||
|
||||
## Purpose
|
||||
|
||||
Verify and, after maintainer review, configure GitHub branch protection aligned
|
||||
with the advisory policy.
|
||||
|
||||
## Background
|
||||
|
||||
Branch protection policy is documented as advisory. It must not be claimed as
|
||||
enabled until repository settings are verified and evidence is recorded.
|
||||
|
||||
## Scope
|
||||
|
||||
- Review advisory branch protection policy.
|
||||
- Verify current repository settings.
|
||||
- Configure settings if approved.
|
||||
- Record screenshots or textual evidence after verification.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No claim that branch protection is enabled before verification.
|
||||
- No destructive repository setting changes without maintainer review.
|
||||
- No runtime/API/UI change.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- Current branch protection state is documented.
|
||||
- Approved settings are recorded.
|
||||
- Evidence is attached or linked after verification.
|
||||
- If blocked, blockers are recorded.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- Repository settings notes or screenshots.
|
||||
- Required status checks list.
|
||||
- Maintainer approval note.
|
||||
- Blocker list if settings cannot be changed.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish admin tokens or private repository settings that expose
|
||||
sensitive access details.
|
||||
- Redact account-level private information in screenshots.
|
||||
- Keep emergency access policy documented.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- Do not claim branch protection is enabled until settings are verified.
|
||||
- Branch protection is governance control, not registry release evidence.
|
||||
- GitHub remains public mirror validation only.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Review advisory policy.
|
||||
- [ ] Verify current settings.
|
||||
- [ ] Configure approved settings if authorized.
|
||||
- [ ] Record evidence.
|
||||
- [ ] Update status docs only after verification.
|
||||
@@ -0,0 +1,104 @@
|
||||
{
|
||||
"status": "planned_issue_templates_ready",
|
||||
"github_issue_tracker": "manual_or_gh_cli_creation_required",
|
||||
"github_role": "public_mirror_validation_only",
|
||||
"registry_release_evidence": "requires_russian_build_runner",
|
||||
"issues": [
|
||||
{
|
||||
"id": "001",
|
||||
"title": "[registry] Perform Gitea backup restore test",
|
||||
"labels": ["registry", "ops", "evidence"],
|
||||
"source": "docs/public-issues/001-registry-gitea-restore-test.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
},
|
||||
{
|
||||
"id": "002",
|
||||
"title": "[registry] Prepare temporary Russian build-runner awatch-build-01",
|
||||
"labels": ["registry", "build-runner", "ops"],
|
||||
"source": "docs/public-issues/002-registry-russian-build-runner.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
},
|
||||
{
|
||||
"id": "003",
|
||||
"title": "[release] Produce first release evidence package",
|
||||
"labels": ["release", "registry", "evidence"],
|
||||
"source": "docs/public-issues/003-release-evidence-package.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
},
|
||||
{
|
||||
"id": "004",
|
||||
"title": "[legal] Prepare rightsholder evidence package",
|
||||
"labels": ["legal", "registry", "docs"],
|
||||
"source": "docs/public-issues/004-legal-rightsholder-package.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
},
|
||||
{
|
||||
"id": "005",
|
||||
"title": "[qa] Define coverage threshold policy",
|
||||
"labels": ["qa", "coverage", "policy"],
|
||||
"source": "docs/public-issues/005-coverage-threshold-policy.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
},
|
||||
{
|
||||
"id": "006",
|
||||
"title": "[security] Prepare external security/code review checklist",
|
||||
"labels": ["security", "review", "governance"],
|
||||
"source": "docs/public-issues/006-external-security-code-review-checklist.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
},
|
||||
{
|
||||
"id": "007",
|
||||
"title": "[compat] Test Russian OS compatibility matrix",
|
||||
"labels": ["compat", "qa", "registry"],
|
||||
"source": "docs/public-issues/007-russian-os-compatibility-matrix.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
},
|
||||
{
|
||||
"id": "008",
|
||||
"title": "[ops] Validate release artifacts storage in RF",
|
||||
"labels": ["ops", "release", "registry"],
|
||||
"source": "docs/public-issues/008-release-artifacts-storage-rf.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
},
|
||||
{
|
||||
"id": "009",
|
||||
"title": "[docs] Refresh public demo pack and screenshots",
|
||||
"labels": ["docs", "demo", "public"],
|
||||
"source": "docs/public-issues/009-public-demo-pack-refresh.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
},
|
||||
{
|
||||
"id": "010",
|
||||
"title": "[pilot] Prepare Pilot Acceptance Checklist v2",
|
||||
"labels": ["pilot", "qa", "docs"],
|
||||
"source": "docs/public-issues/010-pilot-acceptance-checklist-v2.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
},
|
||||
{
|
||||
"id": "011",
|
||||
"title": "[governance] Enable PR-based review workflow",
|
||||
"labels": ["governance", "review", "process"],
|
||||
"source": "docs/public-issues/011-governance-pr-based-review-workflow.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
},
|
||||
{
|
||||
"id": "012",
|
||||
"title": "[governance] Add branch protection policy",
|
||||
"labels": ["governance", "github", "policy"],
|
||||
"source": "docs/public-issues/012-governance-branch-protection-policy.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
}
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user