docs(governance): prepare public issue creation package
This commit is contained in:
igor04091968
@@ -263,6 +263,10 @@ collectors.
|
||||
[docs/RESIDUAL_RISKS_RU.md](docs/RESIDUAL_RISKS_RU.md).
|
||||
- Public issues plan:
|
||||
[docs/PUBLIC_ISSUES_PLAN_RU.md](docs/PUBLIC_ISSUES_PLAN_RU.md).
|
||||
- Public issue templates are prepared and should be created manually or through
|
||||
the opt-in script; this does not claim community adoption:
|
||||
[creation runbook](docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md),
|
||||
[manifest](docs/public-issues/public-issues-manifest.json).
|
||||
|
||||
### Engineering governance and residual risks
|
||||
|
||||
@@ -272,6 +276,10 @@ collectors.
|
||||
[docs/RESIDUAL_RISKS_RU.md](docs/RESIDUAL_RISKS_RU.md).
|
||||
- Public issues plan:
|
||||
[docs/PUBLIC_ISSUES_PLAN_RU.md](docs/PUBLIC_ISSUES_PLAN_RU.md).
|
||||
- Public issues creation runbook:
|
||||
[docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md](docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md).
|
||||
- Public issues manifest:
|
||||
[docs/public-issues/public-issues-manifest.json](docs/public-issues/public-issues-manifest.json).
|
||||
- Advisory branch protection policy:
|
||||
[docs/BRANCH_PROTECTION_POLICY_RU.md](docs/BRANCH_PROTECTION_POLICY_RU.md).
|
||||
- CODEOWNERS and PR template are maintained for review routing and public
|
||||
|
||||
@@ -32,6 +32,12 @@ backup, registry-readiness документации, плана российск
|
||||
`docs/RESIDUAL_RISKS_RU.md`.
|
||||
- План публичных GitHub issues:
|
||||
`docs/PUBLIC_ISSUES_PLAN_RU.md`.
|
||||
- Пакет шаблонов публичных GitHub issues подготовлен:
|
||||
`docs/public-issues/`.
|
||||
- Manifest публичных issues:
|
||||
`docs/public-issues/public-issues-manifest.json`.
|
||||
- Runbook создания публичных issues:
|
||||
`docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md`.
|
||||
- Review checklist:
|
||||
`docs/REVIEW_CHECKLIST_RU.md`.
|
||||
- Advisory branch protection policy:
|
||||
@@ -74,6 +80,10 @@ backup, registry-readiness документации, плана российск
|
||||
`docs/RESIDUAL_RISKS_RU.md`.
|
||||
- Подготовлен план публичных issues для ручного заведения:
|
||||
`docs/PUBLIC_ISSUES_PLAN_RU.md`.
|
||||
- Подготовлен пакет issue templates со статусом `ready_to_create`:
|
||||
`docs/public-issues/`.
|
||||
- Подготовлен runbook ручного/opt-in создания issues:
|
||||
`docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md`.
|
||||
|
||||
## Planned / pending
|
||||
|
||||
@@ -84,7 +94,12 @@ backup, registry-readiness документации, плана российск
|
||||
- Юридическое подтверждение правообладателя.
|
||||
- Финальная юридическая проверка пакета документов перед подачей.
|
||||
- Проверка совместимости с российскими ОС.
|
||||
- Публичные roadmap/issues из `docs/PUBLIC_ISSUES_PLAN_RU.md`.
|
||||
- Публичные roadmap/issues из `docs/PUBLIC_ISSUES_PLAN_RU.md`: templates
|
||||
готовы, создание самих GitHub issues остается manual/pending, пока URLs не
|
||||
записаны в `docs/public-issues/public-issues-manifest.json`.
|
||||
- GitHub issue creation remains pending until URLs are recorded in
|
||||
`docs/public-issues/public-issues-manifest.json`.
|
||||
- URLs remain pending in `docs/public-issues/public-issues-manifest.json`.
|
||||
- Visible external code review is still pending.
|
||||
- Branch protection enablement is not claimed until repository settings are
|
||||
verified.
|
||||
@@ -119,4 +134,6 @@ backup, registry-readiness документации, плана российск
|
||||
- `docs/REVIEW_CHECKLIST_RU.md`
|
||||
- `docs/RESIDUAL_RISKS_RU.md`
|
||||
- `docs/PUBLIC_ISSUES_PLAN_RU.md`
|
||||
- `docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md`
|
||||
- `docs/public-issues/public-issues-manifest.json`
|
||||
- `docs/BRANCH_PROTECTION_POLICY_RU.md`
|
||||
|
||||
@@ -0,0 +1,137 @@
|
||||
# Runbook создания публичных GitHub issues
|
||||
|
||||
Дата: 2026-06-23
|
||||
|
||||
Статус: issue templates готовы к созданию. Реальные GitHub issues считаются
|
||||
pending, пока ссылки не записаны в
|
||||
`docs/public-issues/public-issues-manifest.json`.
|
||||
|
||||
GitHub issues используются для public roadmap visibility. Они не являются
|
||||
registry release evidence. Primary registry contour остается Russian Gitea +
|
||||
planned Russian build-runner.
|
||||
|
||||
## Подготовленный пакет
|
||||
|
||||
- Issue templates: `docs/public-issues/*.md`.
|
||||
- Manifest: `docs/public-issues/public-issues-manifest.json`.
|
||||
- Dry-run check: `scripts/prepare_public_issues.sh`.
|
||||
- Opt-in creation script: `scripts/create_public_issues_from_manifest.sh`.
|
||||
|
||||
## Ручное создание через GitHub UI
|
||||
|
||||
1. Открыть GitHub repository issue tracker.
|
||||
2. Для каждого файла `docs/public-issues/NNN-*.md` создать новый issue.
|
||||
3. Взять `Title` из секции `## Title`.
|
||||
4. Скопировать тело issue из markdown-файла целиком.
|
||||
5. Назначить labels из секции `## Labels`.
|
||||
6. Проверить, что в тексте нет секретов, персональных данных, реальных
|
||||
customer identifiers, внутренних IP/hostname и логов сотрудников.
|
||||
7. После публикации скопировать URL issue.
|
||||
8. Обновить `github_issue_url` в
|
||||
`docs/public-issues/public-issues-manifest.json`.
|
||||
|
||||
## Создание через gh CLI
|
||||
|
||||
Dry-run:
|
||||
|
||||
```bash
|
||||
bash scripts/prepare_public_issues.sh
|
||||
```
|
||||
|
||||
Скрипт проверяет наличие файлов, обязательные секции и manifest. Он не требует
|
||||
GitHub token и не создает issues.
|
||||
|
||||
Opt-in создание:
|
||||
|
||||
```bash
|
||||
gh auth status
|
||||
CONFIRM_CREATE_GITHUB_ISSUES=YES bash scripts/create_public_issues_from_manifest.sh
|
||||
```
|
||||
|
||||
Скрипт:
|
||||
|
||||
- требует `CONFIRM_CREATE_GITHUB_ISSUES=YES`;
|
||||
- требует `gh` и `jq`;
|
||||
- проверяет `gh auth status`;
|
||||
- создает отсутствующие labels;
|
||||
- создает issues по manifest;
|
||||
- печатает URL созданных issues для последующего ручного внесения в manifest.
|
||||
|
||||
Скрипт не запускается из `scripts/registry_readiness_check.sh`.
|
||||
|
||||
## Labels
|
||||
|
||||
Ожидаемые labels:
|
||||
|
||||
- `registry`
|
||||
- `ops`
|
||||
- `evidence`
|
||||
- `build-runner`
|
||||
- `release`
|
||||
- `legal`
|
||||
- `docs`
|
||||
- `qa`
|
||||
- `coverage`
|
||||
- `policy`
|
||||
- `security`
|
||||
- `review`
|
||||
- `governance`
|
||||
- `compat`
|
||||
- `demo`
|
||||
- `public`
|
||||
- `pilot`
|
||||
- `process`
|
||||
- `github`
|
||||
|
||||
## Обновление manifest после создания
|
||||
|
||||
До создания:
|
||||
|
||||
```json
|
||||
"github_issue_url": null
|
||||
```
|
||||
|
||||
После создания:
|
||||
|
||||
```json
|
||||
"github_issue_url": "https://github.com/igor04091968/AWatch-rus/issues/<number>"
|
||||
```
|
||||
|
||||
Status можно оставлять `ready_to_create` до отдельного решения о переводе в
|
||||
`created`; минимальное evidence требование - наличие URL.
|
||||
|
||||
## Запрещенные данные
|
||||
|
||||
В публичные issues нельзя вставлять:
|
||||
|
||||
- пароли, tokens, private keys, recovery codes;
|
||||
- реальные IP, hostname, VPN details или private network topology;
|
||||
- ФИО сотрудников, логи сотрудников, screenshots с персональными данными;
|
||||
- customer identifiers, contract data или private legal evidence;
|
||||
- security exploit details до triage по `SECURITY.md`.
|
||||
|
||||
## Forbidden claims
|
||||
|
||||
Issues не должны утверждать:
|
||||
|
||||
- Do not claim completed Russian software registry submission.
|
||||
- Do not claim FSTEC/FSB certification.
|
||||
- Do not claim SIEM/DLP replacement.
|
||||
- Forbidden claim: ML/LLM-based detection is not claimed.
|
||||
- Forbidden claim: automatic remediation is not claimed.
|
||||
- Do not claim active external peer review until public reviewed PRs exist.
|
||||
- Do not claim enabled branch protection until repository settings are verified.
|
||||
- Do not claim ready Russian build-runner until provisioning evidence exists.
|
||||
- Do not claim completed restore test until restore evidence exists.
|
||||
|
||||
## Проверки перед commit
|
||||
|
||||
```bash
|
||||
python3 scripts/public_secret_pattern_check.py
|
||||
bash -n scripts/prepare_public_issues.sh
|
||||
bash scripts/prepare_public_issues.sh
|
||||
bash -n scripts/create_public_issues_from_manifest.sh
|
||||
bash -n scripts/registry_readiness_check.sh
|
||||
bash scripts/registry_readiness_check.sh
|
||||
git diff --check
|
||||
```
|
||||
@@ -2,30 +2,43 @@
|
||||
|
||||
Дата: 2026-06-22
|
||||
|
||||
Статус: public governance backlog plan.
|
||||
Статус: public governance backlog plan; issue templates are
|
||||
`ready_to_create`.
|
||||
|
||||
Этот документ перечисляет публичные GitHub issues, которые нужно завести
|
||||
вручную. Он не утверждает, что задачи уже созданы или выполнены.
|
||||
вручную или через opt-in `gh` script. Он не утверждает, что задачи уже созданы
|
||||
или выполнены.
|
||||
|
||||
Цель: повысить visibility development process после настройки российского
|
||||
Gitea-контура, backup, public CI, coverage, security scanning и status freeze.
|
||||
|
||||
Подготовленный пакет:
|
||||
|
||||
- issue templates: `docs/public-issues/`;
|
||||
- machine manifest:
|
||||
`docs/public-issues/public-issues-manifest.json`;
|
||||
- creation runbook: `docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md`;
|
||||
- dry-run check: `scripts/prepare_public_issues.sh`;
|
||||
- opt-in creation script: `scripts/create_public_issues_from_manifest.sh`.
|
||||
|
||||
Реальные GitHub issue URLs остаются pending, пока они не записаны в manifest.
|
||||
|
||||
## Issues to create manually
|
||||
|
||||
| Title | Labels | Short goal | Acceptance criteria | Status |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| `[registry] Perform Gitea backup restore test` | `registry`, `ops`, `evidence` | Prove restore procedure on a separate host and keep `restore_tested=false` until evidence exists. | Restore log, checksum verification, post-restore checks and rollback notes are attached or linked. | planned |
|
||||
| `[registry] Prepare temporary Russian build-runner awatch-build-01` | `registry`, `build-runner`, `ops` | Provision temporary or permanent Russian build-runner for registry release evidence. | Host provisioning notes, toolchain list, Gitea access method and required checks plan are documented. | planned |
|
||||
| `[release] Produce first release evidence package` | `release`, `registry`, `evidence` | Run release evidence scripts on `awatch-build-01` and collect artifacts/logs/checksums. | Release evidence manifest, logs, checksums and artifact storage path are documented. | planned |
|
||||
| `[legal] Prepare rightsholder evidence package` | `legal`, `registry`, `docs` | Prepare rightsholder and legal evidence for future registry submission. | Rightsholder evidence checklist, ownership notes and legal review TODOs are documented. | planned |
|
||||
| `[qa] Define coverage threshold policy` | `qa`, `coverage`, `policy` | Define threshold only after stable coverage baseline review. | Coverage baseline reviewed and initial threshold policy proposed without blocking current baseline workflow. | planned |
|
||||
| `[security] Prepare external security/code review checklist` | `security`, `review`, `governance` | Establish visible peer review and external security review checklist. | Checklist references `docs/REVIEW_CHECKLIST_RU.md` and defines public review evidence expectations. | planned |
|
||||
| `[compat] Test Russian OS compatibility matrix` | `compat`, `qa`, `registry` | Validate supported Russian OS matrix and document evidence. | Matrix lists target OS versions, test status and gaps without unsupported compatibility claims. | planned |
|
||||
| `[ops] Validate release artifacts storage in RF` | `ops`, `release`, `registry` | Confirm release artifact storage location and retention in the Russian contour. | Storage path, retention, access model and checksum verification procedure are documented. | planned |
|
||||
| `[docs] Refresh public demo pack and screenshots` | `docs`, `demo`, `public` | Update public demo pack, screenshots and non-sensitive demo evidence. | Demo materials contain no secrets, PII, real employee data or customer infrastructure identifiers. | planned |
|
||||
| `[pilot] Prepare Pilot Acceptance Checklist v2` | `pilot`, `qa`, `docs` | Update pilot acceptance checklist after residual risk register and public issue plan. | Checklist references residual risks, smoke checks and acceptance evidence needed for pilot stage. | planned |
|
||||
| `[governance] Enable PR-based review workflow` | `governance`, `review`, `process` | Move visible changes through pull requests where practical. | First public PR review record exists or a documented dry-run PR demonstrates the process. | planned |
|
||||
| `[governance] Add branch protection policy` | `governance`, `github`, `policy` | Configure GitHub branch protection after maintainer review of the advisory policy. | Branch protection settings are documented with screenshots or notes, or blockers are recorded. | planned |
|
||||
| `[registry] Perform Gitea backup restore test` | `registry`, `ops`, `evidence` | Prove restore procedure on a separate host and keep `restore_tested=false` until evidence exists. | Restore log, checksum verification, post-restore checks and rollback notes are attached or linked. | ready_to_create |
|
||||
| `[registry] Prepare temporary Russian build-runner awatch-build-01` | `registry`, `build-runner`, `ops` | Provision temporary or permanent Russian build-runner for registry release evidence. | Host provisioning notes, toolchain list, Gitea access method and required checks plan are documented. | ready_to_create |
|
||||
| `[release] Produce first release evidence package` | `release`, `registry`, `evidence` | Run release evidence scripts on `awatch-build-01` and collect artifacts/logs/checksums. | Release evidence manifest, logs, checksums and artifact storage path are documented. | ready_to_create |
|
||||
| `[legal] Prepare rightsholder evidence package` | `legal`, `registry`, `docs` | Prepare rightsholder and legal evidence for future registry submission. | Rightsholder evidence checklist, ownership notes and legal review TODOs are documented. | ready_to_create |
|
||||
| `[qa] Define coverage threshold policy` | `qa`, `coverage`, `policy` | Define threshold only after stable coverage baseline review. | Coverage baseline reviewed and initial threshold policy proposed without blocking current baseline workflow. | ready_to_create |
|
||||
| `[security] Prepare external security/code review checklist` | `security`, `review`, `governance` | Establish visible peer review and external security review checklist. | Checklist references `docs/REVIEW_CHECKLIST_RU.md` and defines public review evidence expectations. | ready_to_create |
|
||||
| `[compat] Test Russian OS compatibility matrix` | `compat`, `qa`, `registry` | Validate supported Russian OS matrix and document evidence. | Matrix lists target OS versions, test status and gaps without unsupported compatibility claims. | ready_to_create |
|
||||
| `[ops] Validate release artifacts storage in RF` | `ops`, `release`, `registry` | Confirm release artifact storage location and retention in the Russian contour. | Storage path, retention, access model and checksum verification procedure are documented. | ready_to_create |
|
||||
| `[docs] Refresh public demo pack and screenshots` | `docs`, `demo`, `public` | Update public demo pack, screenshots and non-sensitive demo evidence. | Demo materials contain no secrets, PII, real employee data or customer infrastructure identifiers. | ready_to_create |
|
||||
| `[pilot] Prepare Pilot Acceptance Checklist v2` | `pilot`, `qa`, `docs` | Update pilot acceptance checklist after residual risk register and public issue plan. | Checklist references residual risks, smoke checks and acceptance evidence needed for pilot stage. | ready_to_create |
|
||||
| `[governance] Enable PR-based review workflow` | `governance`, `review`, `process` | Move visible changes through pull requests where practical. | First public PR review record exists or a documented dry-run PR demonstrates the process. | ready_to_create |
|
||||
| `[governance] Add branch protection policy` | `governance`, `github`, `policy` | Configure GitHub branch protection after maintainer review of the advisory policy. | Branch protection settings are documented with screenshots or notes, or blockers are recorded. | ready_to_create |
|
||||
|
||||
## Guardrails
|
||||
|
||||
|
||||
@@ -68,19 +68,23 @@ visibility, release evidence contour and legal package. Они требуют д
|
||||
|
||||
## 3. Низкая публичная активность issue tracker
|
||||
|
||||
- Текущий статус: риск открыт частично; issue templates and public roadmap
|
||||
exist, but public roadmap-tasks are still few.
|
||||
- Текущий статус: риск открыт частично; issue templates, public roadmap and
|
||||
issue creation package exist, but real GitHub issues are still pending until
|
||||
URLs are recorded.
|
||||
- Влияние: низкая внешняя visibility development process; сложнее показать
|
||||
плановое управление backlog and governance.
|
||||
- Почему не блокирует pilot/readiness stage: templates, roadmap and status docs
|
||||
already define expected process; missing public tasks are a visibility gap,
|
||||
not a runtime readiness gap.
|
||||
- Как риск будет снижаться: manually create public issues for registry, QA,
|
||||
security, compatibility, ops and pilot follow-up work.
|
||||
security, compatibility, ops and pilot follow-up work using
|
||||
`docs/public-issues/` and `docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md`.
|
||||
- Уже снижающие evidence/documents/CI: `ROADMAP.md`, issue templates,
|
||||
`docs/PROJECT_STATUS_RU.md`, `docs/PUBLIC_ISSUES_PLAN_RU.md`.
|
||||
- Следующий action: завести публичные issues по списку из
|
||||
`docs/PUBLIC_ISSUES_PLAN_RU.md`.
|
||||
`docs/PROJECT_STATUS_RU.md`, `docs/PUBLIC_ISSUES_PLAN_RU.md`,
|
||||
`docs/public-issues/public-issues-manifest.json`,
|
||||
`scripts/prepare_public_issues.sh`.
|
||||
- Следующий action: создать реальные GitHub issues и записать URLs в
|
||||
`docs/public-issues/public-issues-manifest.json`.
|
||||
|
||||
## 4. Низкая community adoption
|
||||
|
||||
@@ -183,3 +187,5 @@ visibility, release evidence contour and legal package. Они требуют д
|
||||
Полный список задач для ручного заведения в GitHub issue tracker:
|
||||
|
||||
- `docs/PUBLIC_ISSUES_PLAN_RU.md`.
|
||||
- `docs/public-issues/`.
|
||||
- `docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md`.
|
||||
|
||||
@@ -0,0 +1,73 @@
|
||||
# Public issue template 001
|
||||
|
||||
## Title
|
||||
|
||||
[registry] Perform Gitea backup restore test
|
||||
|
||||
## Labels
|
||||
|
||||
`registry`, `ops`, `evidence`
|
||||
|
||||
## Purpose
|
||||
|
||||
Prove that the documented Gitea backup can be restored on a separate host and
|
||||
that restore evidence is reproducible.
|
||||
|
||||
## Background
|
||||
|
||||
The Russian Gitea contour and backup process are documented, but restore proof
|
||||
is not complete. The registry evidence manifest must keep restore status pending
|
||||
until a separate-host restore drill is recorded.
|
||||
|
||||
## Scope
|
||||
|
||||
- Run a restore drill on a separate test host or isolated environment.
|
||||
- Verify backup checksum before restore.
|
||||
- Verify repository availability after restore.
|
||||
- Record commands, logs, timestamps and rollback notes in non-sensitive form.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No production restore.
|
||||
- No change to runtime services, API, UI or business logic.
|
||||
- No claim that registry submission is complete.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- Restore log is attached or linked.
|
||||
- SHA256 verification is recorded.
|
||||
- Post-restore repository checks are recorded.
|
||||
- Rollback or cleanup notes are recorded.
|
||||
- Registry evidence manifest is updated only after evidence exists.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- Backup artifact name without secrets.
|
||||
- Checksum verification output.
|
||||
- Restore command log with sensitive values redacted.
|
||||
- Post-restore repository clone or integrity check.
|
||||
- Reviewer note confirming evidence location.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish passwords, tokens, private keys or recovery codes.
|
||||
- Do not publish customer identifiers, employee data or private infrastructure
|
||||
details.
|
||||
- Redact internal paths when they expose sensitive topology.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- Keep `restore_tested=false` until evidence is recorded.
|
||||
- Do not describe the restore contour as registry-ready until the drill is
|
||||
complete and reviewed.
|
||||
- GitHub issue visibility is public roadmap visibility, not registry release
|
||||
evidence.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Select isolated restore target.
|
||||
- [ ] Verify backup checksum.
|
||||
- [ ] Perform restore.
|
||||
- [ ] Run post-restore repository checks.
|
||||
- [ ] Record evidence location.
|
||||
- [ ] Update manifest only after evidence exists.
|
||||
@@ -0,0 +1,68 @@
|
||||
# Public issue template 002
|
||||
|
||||
## Title
|
||||
|
||||
[registry] Prepare temporary Russian build-runner awatch-build-01
|
||||
|
||||
## Labels
|
||||
|
||||
`registry`, `build-runner`, `ops`
|
||||
|
||||
## Purpose
|
||||
|
||||
Prepare the Russian build-runner contour required for registry release
|
||||
evidence.
|
||||
|
||||
## Background
|
||||
|
||||
GitHub Actions is public mirror validation only. Registry release evidence must
|
||||
be produced in the Russian contour connected to the Russian Gitea source.
|
||||
|
||||
## Scope
|
||||
|
||||
- Define provisioning notes for `awatch-build-01`.
|
||||
- Document toolchain, OS baseline, access model and Gitea clone method.
|
||||
- Document required checks for release evidence builds.
|
||||
- Keep runner status pending until provisioning evidence exists.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No production deployment.
|
||||
- No automatic release.
|
||||
- No claim that the build-runner is already ready.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- Build-runner setup notes exist.
|
||||
- Toolchain list is documented.
|
||||
- Gitea access method is documented without secrets.
|
||||
- Required checks list is documented.
|
||||
- Known blockers are recorded.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- Host provisioning notes without sensitive addresses.
|
||||
- Toolchain versions.
|
||||
- Gitea access verification with credentials redacted.
|
||||
- Planned release evidence command list.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish credentials, VPN data, SSH keys or private network topology.
|
||||
- Do not include live internal IPs or host access details in the public issue.
|
||||
- Use sanitized host labels where possible.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- Do not mark `awatch-build-01` as ready before evidence exists.
|
||||
- Do not use GitHub Actions output as registry release evidence.
|
||||
- Primary registry contour remains Russian Gitea plus Russian build-runner.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Confirm target OS and hosting contour.
|
||||
- [ ] Install required toolchain.
|
||||
- [ ] Verify Russian Gitea clone path.
|
||||
- [ ] Document required checks.
|
||||
- [ ] Record blockers.
|
||||
- [ ] Update registry evidence docs only after verification.
|
||||
@@ -0,0 +1,70 @@
|
||||
# Public issue template 003
|
||||
|
||||
## Title
|
||||
|
||||
[release] Produce first release evidence package
|
||||
|
||||
## Labels
|
||||
|
||||
`release`, `registry`, `evidence`
|
||||
|
||||
## Purpose
|
||||
|
||||
Produce the first release evidence package from the Russian build-runner once
|
||||
the runner is available.
|
||||
|
||||
## Background
|
||||
|
||||
Release evidence scripts exist, but the first real release evidence build must
|
||||
run in the Russian build contour before it can be treated as registry evidence.
|
||||
|
||||
## Scope
|
||||
|
||||
- Run release evidence scripts on the Russian build-runner.
|
||||
- Collect logs, checksums, artifact manifest and command versions.
|
||||
- Store evidence in the documented Russian storage contour.
|
||||
- Link evidence from registry documentation after review.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No claim that release evidence is already produced.
|
||||
- No publication of secret build logs.
|
||||
- No runtime, API or UI changes.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- Release evidence manifest exists.
|
||||
- Build logs are retained with secrets redacted.
|
||||
- Checksums are recorded.
|
||||
- Artifact storage path is documented.
|
||||
- Review note confirms evidence completeness.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- Release manifest.
|
||||
- Build logs.
|
||||
- SHA256 checksums.
|
||||
- Cargo metadata/tree or equivalent dependency evidence.
|
||||
- Artifact retention note.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish credentials, private paths with sensitive data or customer
|
||||
environment identifiers.
|
||||
- Redact tokens and private repository access details.
|
||||
- Keep evidence links scoped to approved public-safe material.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- Do not treat GitHub Actions as release evidence.
|
||||
- Do not claim registry submission is complete.
|
||||
- Keep evidence pending until artifacts and checksums exist.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Confirm build-runner readiness.
|
||||
- [ ] Run release evidence script.
|
||||
- [ ] Verify generated checksums.
|
||||
- [ ] Store artifacts in Russian contour.
|
||||
- [ ] Review logs for sensitive data.
|
||||
- [ ] Record evidence links.
|
||||
@@ -0,0 +1,67 @@
|
||||
# Public issue template 004
|
||||
|
||||
## Title
|
||||
|
||||
[legal] Prepare rightsholder evidence package
|
||||
|
||||
## Labels
|
||||
|
||||
`legal`, `registry`, `docs`
|
||||
|
||||
## Purpose
|
||||
|
||||
Prepare the rightsholder and legal evidence checklist needed before any future
|
||||
Russian software registry submission.
|
||||
|
||||
## Background
|
||||
|
||||
Technical readiness documentation does not replace legal confirmation. The
|
||||
rightsholder package remains pending until reviewed by the responsible party.
|
||||
|
||||
## Scope
|
||||
|
||||
- Prepare a rightsholder evidence checklist.
|
||||
- Identify ownership and license evidence to collect.
|
||||
- Document legal review TODOs.
|
||||
- Keep public wording conservative.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No legal conclusion by engineering.
|
||||
- No claim that registry submission is complete.
|
||||
- No publication of confidential contracts or personal data.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- Checklist of required legal evidence exists.
|
||||
- Ownership evidence categories are documented.
|
||||
- Open legal questions are recorded.
|
||||
- Public docs avoid certification and registry-completion claims.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- Legal checklist document.
|
||||
- Rightsholder evidence inventory in non-sensitive form.
|
||||
- Dependency/license summary reference.
|
||||
- Legal review status note.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish passport data, signatures, contracts or confidential legal
|
||||
documents.
|
||||
- Do not expose personal data of representatives.
|
||||
- Use references to private evidence storage when needed.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- Do not claim legal readiness until formal review is complete.
|
||||
- Do not claim completed Russian software registry submission.
|
||||
- GitHub issues are public tracking, not legal evidence.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Draft rightsholder evidence checklist.
|
||||
- [ ] Map ownership evidence categories.
|
||||
- [ ] Reference dependency/license documents.
|
||||
- [ ] Record open legal questions.
|
||||
- [ ] Review public wording for forbidden claims.
|
||||
@@ -0,0 +1,67 @@
|
||||
# Public issue template 005
|
||||
|
||||
## Title
|
||||
|
||||
[qa] Define coverage threshold policy
|
||||
|
||||
## Labels
|
||||
|
||||
`qa`, `coverage`, `policy`
|
||||
|
||||
## Purpose
|
||||
|
||||
Define a conservative coverage threshold policy after the baseline is stable and
|
||||
reviewed.
|
||||
|
||||
## Background
|
||||
|
||||
Coverage workflow exists for visibility, but threshold enforcement is not
|
||||
enabled yet. Premature thresholds can create noisy failures before the baseline
|
||||
is understood.
|
||||
|
||||
## Scope
|
||||
|
||||
- Review current coverage baseline.
|
||||
- Identify crates or modules where thresholds are meaningful.
|
||||
- Propose a staged threshold policy.
|
||||
- Document exceptions and review cadence.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No immediate hard threshold without baseline review.
|
||||
- No claim that coverage proves absence of defects.
|
||||
- No runtime, API or UI changes.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- Baseline coverage summary is reviewed.
|
||||
- Initial threshold proposal is documented.
|
||||
- Exceptions are documented.
|
||||
- Enforcement plan is staged and reversible.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- Coverage workflow artifact reference.
|
||||
- Baseline review notes.
|
||||
- Proposed threshold values.
|
||||
- Rationale for exclusions or delayed enforcement.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish private test data or production logs.
|
||||
- Keep coverage artifacts free of secrets and customer identifiers.
|
||||
- Avoid copying sensitive paths into public issue text.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- Coverage visibility is quality evidence, not registry release evidence.
|
||||
- Threshold policy must not imply certification.
|
||||
- GitHub remains public mirror validation only.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Review coverage baseline.
|
||||
- [ ] Identify meaningful threshold scope.
|
||||
- [ ] Document proposed values.
|
||||
- [ ] Document exclusions.
|
||||
- [ ] Decide when enforcement can start.
|
||||
@@ -0,0 +1,65 @@
|
||||
# Public issue template 006
|
||||
|
||||
## Title
|
||||
|
||||
[security] Prepare external security/code review checklist
|
||||
|
||||
## Labels
|
||||
|
||||
`security`, `review`, `governance`
|
||||
|
||||
## Purpose
|
||||
|
||||
Prepare a public checklist for future visible external security/code review.
|
||||
|
||||
## Background
|
||||
|
||||
Review checklist and CODEOWNERS exist, but active external peer review is not
|
||||
claimed until public reviewed pull requests or equivalent evidence exist.
|
||||
|
||||
## Scope
|
||||
|
||||
- Extend review evidence expectations from `docs/REVIEW_CHECKLIST_RU.md`.
|
||||
- Define security review scope and artifacts.
|
||||
- Define how reviewed PRs will be referenced.
|
||||
- Define forbidden data for public review comments.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No claim that external review is already active.
|
||||
- No publication of sensitive findings before triage.
|
||||
- Forbidden claim: automatic remediation is not claimed.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- External/security review checklist is documented.
|
||||
- Evidence format for reviewed PRs is defined.
|
||||
- Sensitive disclosure handling is documented.
|
||||
- First review remains pending until public evidence exists.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- Checklist document.
|
||||
- Link to review policy.
|
||||
- Future reviewed PR URL or placeholder status.
|
||||
- Security disclosure guardrails.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish exploit details before coordinated handling.
|
||||
- Do not publish customer data, employee data or secrets.
|
||||
- Keep vulnerability handling aligned with `SECURITY.md`.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- Do not claim active external peer review until public reviewed PRs exist.
|
||||
- Security review evidence is governance evidence, not certification.
|
||||
- Do not claim FSTEC/FSB certification.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Draft external review checklist.
|
||||
- [ ] Define evidence requirements.
|
||||
- [ ] Define sensitive disclosure rules.
|
||||
- [ ] Link to `docs/REVIEW_CHECKLIST_RU.md`.
|
||||
- [ ] Record first reviewed PR only after it exists.
|
||||
@@ -0,0 +1,66 @@
|
||||
# Public issue template 007
|
||||
|
||||
## Title
|
||||
|
||||
[compat] Test Russian OS compatibility matrix
|
||||
|
||||
## Labels
|
||||
|
||||
`compat`, `qa`, `registry`
|
||||
|
||||
## Purpose
|
||||
|
||||
Build an evidence-backed compatibility matrix for target Russian operating
|
||||
systems.
|
||||
|
||||
## Background
|
||||
|
||||
Compatibility must be tested and documented. Unsupported compatibility claims
|
||||
must not be made before evidence exists.
|
||||
|
||||
## Scope
|
||||
|
||||
- Define target OS versions.
|
||||
- Run installation and smoke checks where applicable.
|
||||
- Record pass/fail/blocked status.
|
||||
- Document gaps and next actions.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No claim of support for untested OS versions.
|
||||
- No certification claims.
|
||||
- No runtime change in this issue.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- Compatibility matrix exists.
|
||||
- Each target OS has status and evidence reference.
|
||||
- Failed or blocked cases include next action.
|
||||
- Public wording avoids unsupported claims.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- OS/version list.
|
||||
- Test command summary.
|
||||
- Smoke check results.
|
||||
- Known gaps and blockers.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish customer infrastructure identifiers.
|
||||
- Do not publish private hostnames, credentials or internal IPs.
|
||||
- Use sanitized environment descriptions.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- Compatibility matrix is evidence support, not registry completion.
|
||||
- Do not claim FSTEC/FSB certification.
|
||||
- Do not claim support until test evidence exists.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Define OS list.
|
||||
- [ ] Run installation checks.
|
||||
- [ ] Run smoke checks.
|
||||
- [ ] Record evidence.
|
||||
- [ ] Update compatibility matrix.
|
||||
@@ -0,0 +1,67 @@
|
||||
# Public issue template 008
|
||||
|
||||
## Title
|
||||
|
||||
[ops] Validate release artifacts storage in RF
|
||||
|
||||
## Labels
|
||||
|
||||
`ops`, `release`, `registry`
|
||||
|
||||
## Purpose
|
||||
|
||||
Validate the storage location, retention and integrity process for release
|
||||
artifacts in the Russian contour.
|
||||
|
||||
## Background
|
||||
|
||||
Release evidence requires reproducible artifacts and checksums stored in the
|
||||
approved contour. Storage remains pending until verified.
|
||||
|
||||
## Scope
|
||||
|
||||
- Identify storage path or service in the Russian contour.
|
||||
- Document retention and access model.
|
||||
- Verify checksum procedure.
|
||||
- Document backup or immutability expectations.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No publication of private artifact URLs if access is restricted.
|
||||
- No release creation.
|
||||
- No runtime/API/UI change.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- Storage location is documented in non-sensitive form.
|
||||
- Retention policy is documented.
|
||||
- Access model is documented.
|
||||
- Checksum verification procedure is documented.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- Storage policy note.
|
||||
- Checksum verification example.
|
||||
- Retention setting or procedure.
|
||||
- Access model review note.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish credentials or private storage tokens.
|
||||
- Do not expose private URLs that grant access.
|
||||
- Redact internal storage topology where needed.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- Storage validation is a prerequisite for release evidence, not proof of
|
||||
registry submission.
|
||||
- Do not claim release package completion until artifacts exist.
|
||||
- Primary evidence remains in the Russian contour.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Identify storage contour.
|
||||
- [ ] Document retention.
|
||||
- [ ] Document access model.
|
||||
- [ ] Verify checksum procedure.
|
||||
- [ ] Record blockers.
|
||||
@@ -0,0 +1,67 @@
|
||||
# Public issue template 009
|
||||
|
||||
## Title
|
||||
|
||||
[docs] Refresh public demo pack and screenshots
|
||||
|
||||
## Labels
|
||||
|
||||
`docs`, `demo`, `public`
|
||||
|
||||
## Purpose
|
||||
|
||||
Refresh public demo materials and screenshots while keeping them free of
|
||||
sensitive data.
|
||||
|
||||
## Background
|
||||
|
||||
Public demo evidence improves transparency, but demo assets must not expose
|
||||
customer infrastructure, employee data or secrets.
|
||||
|
||||
## Scope
|
||||
|
||||
- Review demo pack and screenshots.
|
||||
- Replace stale screenshots where needed.
|
||||
- Confirm demo data is synthetic or anonymized.
|
||||
- Update public demo references.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No use of real employee activity logs.
|
||||
- No customer infrastructure disclosure.
|
||||
- No product behavior change.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- Demo assets are current.
|
||||
- Sensitive data review is recorded.
|
||||
- Screenshots use synthetic/anonymized data.
|
||||
- README/docs links remain valid.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- Updated demo asset list.
|
||||
- Screenshot review note.
|
||||
- Secret/PII scan result.
|
||||
- Link validation notes where applicable.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish secrets, tokens, internal hostnames, private IPs, employee
|
||||
names or customer identifiers.
|
||||
- Use synthetic data for examples.
|
||||
- Remove metadata from images when needed.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- Demo pack is public visibility, not registry release evidence.
|
||||
- Do not claim customer adoption from demo assets.
|
||||
- Do not imply certification.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Inventory demo assets.
|
||||
- [ ] Refresh stale screenshots.
|
||||
- [ ] Check for secrets and PII.
|
||||
- [ ] Update references.
|
||||
- [ ] Record review result.
|
||||
@@ -0,0 +1,66 @@
|
||||
# Public issue template 010
|
||||
|
||||
## Title
|
||||
|
||||
[pilot] Prepare Pilot Acceptance Checklist v2
|
||||
|
||||
## Labels
|
||||
|
||||
`pilot`, `qa`, `docs`
|
||||
|
||||
## Purpose
|
||||
|
||||
Update pilot acceptance criteria after the residual risk register and public
|
||||
issue plan.
|
||||
|
||||
## Background
|
||||
|
||||
Pilot acceptance must distinguish technical readiness, operational evidence,
|
||||
governance visibility and pending registry release evidence.
|
||||
|
||||
## Scope
|
||||
|
||||
- Update pilot acceptance checklist.
|
||||
- Reference residual risks and smoke checks.
|
||||
- Define evidence required for pilot closeout.
|
||||
- Keep registry completion claims out of pilot wording.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No change to runtime behavior.
|
||||
- No claim that registry submission is complete.
|
||||
- No automatic acceptance without evidence.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- Pilot checklist v2 exists.
|
||||
- Residual risks are referenced.
|
||||
- Smoke and evidence checks are listed.
|
||||
- Pending registry items remain marked pending.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- Updated checklist.
|
||||
- Links to residual risks and validation runbooks.
|
||||
- Pilot smoke command results when available.
|
||||
- Open gap list.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish real customer data, employee logs or confidential pilot notes.
|
||||
- Use sanitized evidence references.
|
||||
- Keep private pilot evidence outside public issue text.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- Pilot acceptance is not registry registration.
|
||||
- Registry release evidence still requires the Russian build-runner.
|
||||
- Do not claim certification or SIEM/DLP replacement.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Review current pilot checklist.
|
||||
- [ ] Add residual risk references.
|
||||
- [ ] Add smoke/evidence requirements.
|
||||
- [ ] Mark pending registry items.
|
||||
- [ ] Review forbidden claims.
|
||||
@@ -0,0 +1,66 @@
|
||||
# Public issue template 011
|
||||
|
||||
## Title
|
||||
|
||||
[governance] Enable PR-based review workflow
|
||||
|
||||
## Labels
|
||||
|
||||
`governance`, `review`, `process`
|
||||
|
||||
## Purpose
|
||||
|
||||
Move visible changes through pull requests where practical and record review
|
||||
evidence.
|
||||
|
||||
## Background
|
||||
|
||||
PR template, CODEOWNERS and review checklist exist. Active visible external
|
||||
review is still pending until reviewed public PRs exist.
|
||||
|
||||
## Scope
|
||||
|
||||
- Define PR-based workflow for public changes.
|
||||
- Run a documented dry-run PR or first reviewed PR.
|
||||
- Record required status checks.
|
||||
- Record review evidence expectations.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No claim that external review is already active.
|
||||
- No bypass of emergency maintainer control for security incidents.
|
||||
- No runtime behavior change.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- PR workflow is documented.
|
||||
- First reviewed PR or dry-run PR is recorded.
|
||||
- Required evidence and checks are listed.
|
||||
- Open blockers are documented.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- Reviewed PR URL or dry-run PR URL after creation.
|
||||
- Checklist completion note.
|
||||
- CI/security/coverage status notes.
|
||||
- Review comment or approval evidence when available.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish secrets or private customer context in PRs or issues.
|
||||
- Do not expose security-sensitive details before triage.
|
||||
- Keep emergency fixes possible under documented policy.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- PR review workflow is governance evidence, not registry release evidence.
|
||||
- Do not claim external peer review is active until public reviewed PRs exist.
|
||||
- GitHub remains public mirror validation only.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Define PR workflow.
|
||||
- [ ] Create dry-run or first reviewed PR.
|
||||
- [ ] Record checks.
|
||||
- [ ] Record review evidence.
|
||||
- [ ] Update status docs after evidence exists.
|
||||
@@ -0,0 +1,67 @@
|
||||
# Public issue template 012
|
||||
|
||||
## Title
|
||||
|
||||
[governance] Add branch protection policy
|
||||
|
||||
## Labels
|
||||
|
||||
`governance`, `github`, `policy`
|
||||
|
||||
## Purpose
|
||||
|
||||
Verify and, after maintainer review, configure GitHub branch protection aligned
|
||||
with the advisory policy.
|
||||
|
||||
## Background
|
||||
|
||||
Branch protection policy is documented as advisory. It must not be claimed as
|
||||
enabled until repository settings are verified and evidence is recorded.
|
||||
|
||||
## Scope
|
||||
|
||||
- Review advisory branch protection policy.
|
||||
- Verify current repository settings.
|
||||
- Configure settings if approved.
|
||||
- Record screenshots or textual evidence after verification.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- No claim that branch protection is enabled before verification.
|
||||
- No destructive repository setting changes without maintainer review.
|
||||
- No runtime/API/UI change.
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
- Current branch protection state is documented.
|
||||
- Approved settings are recorded.
|
||||
- Evidence is attached or linked after verification.
|
||||
- If blocked, blockers are recorded.
|
||||
|
||||
## Evidence required
|
||||
|
||||
- Repository settings notes or screenshots.
|
||||
- Required status checks list.
|
||||
- Maintainer approval note.
|
||||
- Blocker list if settings cannot be changed.
|
||||
|
||||
## Safety/privacy guardrails
|
||||
|
||||
- Do not publish admin tokens or private repository settings that expose
|
||||
sensitive access details.
|
||||
- Redact account-level private information in screenshots.
|
||||
- Keep emergency access policy documented.
|
||||
|
||||
## Registry-positioning guardrails
|
||||
|
||||
- Do not claim branch protection is enabled until settings are verified.
|
||||
- Branch protection is governance control, not registry release evidence.
|
||||
- GitHub remains public mirror validation only.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Review advisory policy.
|
||||
- [ ] Verify current settings.
|
||||
- [ ] Configure approved settings if authorized.
|
||||
- [ ] Record evidence.
|
||||
- [ ] Update status docs only after verification.
|
||||
@@ -0,0 +1,104 @@
|
||||
{
|
||||
"status": "planned_issue_templates_ready",
|
||||
"github_issue_tracker": "manual_or_gh_cli_creation_required",
|
||||
"github_role": "public_mirror_validation_only",
|
||||
"registry_release_evidence": "requires_russian_build_runner",
|
||||
"issues": [
|
||||
{
|
||||
"id": "001",
|
||||
"title": "[registry] Perform Gitea backup restore test",
|
||||
"labels": ["registry", "ops", "evidence"],
|
||||
"source": "docs/public-issues/001-registry-gitea-restore-test.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
},
|
||||
{
|
||||
"id": "002",
|
||||
"title": "[registry] Prepare temporary Russian build-runner awatch-build-01",
|
||||
"labels": ["registry", "build-runner", "ops"],
|
||||
"source": "docs/public-issues/002-registry-russian-build-runner.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
},
|
||||
{
|
||||
"id": "003",
|
||||
"title": "[release] Produce first release evidence package",
|
||||
"labels": ["release", "registry", "evidence"],
|
||||
"source": "docs/public-issues/003-release-evidence-package.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
},
|
||||
{
|
||||
"id": "004",
|
||||
"title": "[legal] Prepare rightsholder evidence package",
|
||||
"labels": ["legal", "registry", "docs"],
|
||||
"source": "docs/public-issues/004-legal-rightsholder-package.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
},
|
||||
{
|
||||
"id": "005",
|
||||
"title": "[qa] Define coverage threshold policy",
|
||||
"labels": ["qa", "coverage", "policy"],
|
||||
"source": "docs/public-issues/005-coverage-threshold-policy.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
},
|
||||
{
|
||||
"id": "006",
|
||||
"title": "[security] Prepare external security/code review checklist",
|
||||
"labels": ["security", "review", "governance"],
|
||||
"source": "docs/public-issues/006-external-security-code-review-checklist.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
},
|
||||
{
|
||||
"id": "007",
|
||||
"title": "[compat] Test Russian OS compatibility matrix",
|
||||
"labels": ["compat", "qa", "registry"],
|
||||
"source": "docs/public-issues/007-russian-os-compatibility-matrix.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
},
|
||||
{
|
||||
"id": "008",
|
||||
"title": "[ops] Validate release artifacts storage in RF",
|
||||
"labels": ["ops", "release", "registry"],
|
||||
"source": "docs/public-issues/008-release-artifacts-storage-rf.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
},
|
||||
{
|
||||
"id": "009",
|
||||
"title": "[docs] Refresh public demo pack and screenshots",
|
||||
"labels": ["docs", "demo", "public"],
|
||||
"source": "docs/public-issues/009-public-demo-pack-refresh.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
},
|
||||
{
|
||||
"id": "010",
|
||||
"title": "[pilot] Prepare Pilot Acceptance Checklist v2",
|
||||
"labels": ["pilot", "qa", "docs"],
|
||||
"source": "docs/public-issues/010-pilot-acceptance-checklist-v2.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
},
|
||||
{
|
||||
"id": "011",
|
||||
"title": "[governance] Enable PR-based review workflow",
|
||||
"labels": ["governance", "review", "process"],
|
||||
"source": "docs/public-issues/011-governance-pr-based-review-workflow.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
},
|
||||
{
|
||||
"id": "012",
|
||||
"title": "[governance] Add branch protection policy",
|
||||
"labels": ["governance", "github", "policy"],
|
||||
"source": "docs/public-issues/012-governance-branch-protection-policy.md",
|
||||
"status": "ready_to_create",
|
||||
"github_issue_url": null
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -1,5 +1,42 @@
|
||||
# Registry readiness changelog
|
||||
|
||||
## 2026-06-23 public issue creation package
|
||||
|
||||
Added:
|
||||
|
||||
- `docs/public-issues/` with public issue templates for the planned governance,
|
||||
registry, QA, security, compatibility, ops, demo and pilot tasks.
|
||||
- `docs/public-issues/public-issues-manifest.json` with `ready_to_create`
|
||||
status and `github_issue_url: null` until real issue URLs are recorded.
|
||||
- `docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md` for manual and opt-in `gh` CLI
|
||||
issue creation.
|
||||
- `scripts/prepare_public_issues.sh` as a dry-run validation and command
|
||||
preparation script.
|
||||
- `scripts/create_public_issues_from_manifest.sh` as an opt-in helper that
|
||||
requires `CONFIRM_CREATE_GITHUB_ISSUES=YES`.
|
||||
|
||||
Changed:
|
||||
|
||||
- `docs/PUBLIC_ISSUES_PLAN_RU.md`, project status, residual risks and README now
|
||||
distinguish prepared issue templates from real created GitHub issues.
|
||||
- Registry readiness checks now verify the public issue package and pending URL
|
||||
status.
|
||||
|
||||
Runtime impact:
|
||||
|
||||
- No runtime/product code changes.
|
||||
- No API changes.
|
||||
- No UI changes.
|
||||
- No business logic changes.
|
||||
|
||||
Guardrails:
|
||||
|
||||
- GitHub remains public mirror validation only.
|
||||
- Russian Gitea plus planned Russian build-runner remains the primary registry
|
||||
contour.
|
||||
- Real GitHub issue creation remains manual/opt-in.
|
||||
- GitHub issue URLs remain pending until created and recorded in the manifest.
|
||||
|
||||
## 2026-06-22 review governance and branch protection policy
|
||||
|
||||
Added:
|
||||
|
||||
+72
@@ -0,0 +1,72 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
MANIFEST="$ROOT/docs/public-issues/public-issues-manifest.json"
|
||||
|
||||
if [[ "${CONFIRM_CREATE_GITHUB_ISSUES:-}" != "YES" ]]; then
|
||||
printf 'create_public_issues=refused\n' >&2
|
||||
printf 'Set CONFIRM_CREATE_GITHUB_ISSUES=YES to create GitHub issues.\n' >&2
|
||||
printf 'Run scripts/prepare_public_issues.sh first and review the issue bodies.\n' >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
if ! command -v gh >/dev/null 2>&1; then
|
||||
printf 'create_public_issues=fail\n' >&2
|
||||
printf 'gh CLI is not installed or not in PATH.\n' >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
if ! command -v jq >/dev/null 2>&1; then
|
||||
printf 'create_public_issues=fail\n' >&2
|
||||
printf 'jq is required for manifest-driven issue creation.\n' >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
if [[ ! -s "$MANIFEST" ]]; then
|
||||
printf 'create_public_issues=fail\n' >&2
|
||||
printf 'Missing manifest: docs/public-issues/public-issues-manifest.json\n' >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
jq -e . "$MANIFEST" >/dev/null
|
||||
jq -e '
|
||||
.status == "planned_issue_templates_ready"
|
||||
and .github_issue_tracker == "manual_or_gh_cli_creation_required"
|
||||
and .github_role == "public_mirror_validation_only"
|
||||
and .registry_release_evidence == "requires_russian_build_runner"
|
||||
and all(.issues[]; .status == "ready_to_create")
|
||||
' "$MANIFEST" >/dev/null
|
||||
|
||||
gh auth status >/dev/null
|
||||
|
||||
existing_labels="$(mktemp)"
|
||||
trap 'rm -f "$existing_labels"' EXIT
|
||||
gh label list --limit 500 --json name --jq '.[].name' >"$existing_labels"
|
||||
|
||||
while IFS= read -r label; do
|
||||
if ! grep -Fxq "$label" "$existing_labels"; then
|
||||
gh label create "$label" --color "ededed" --description "AWatch-rus public governance label"
|
||||
printf '%s\n' "$label" >>"$existing_labels"
|
||||
fi
|
||||
done < <(jq -r '.issues[].labels[]' "$MANIFEST" | sort -u)
|
||||
|
||||
created=0
|
||||
|
||||
while IFS=$'\t' read -r title labels source; do
|
||||
body="$ROOT/$source"
|
||||
if [[ ! -s "$body" ]]; then
|
||||
printf 'create_public_issues=fail\n' >&2
|
||||
printf 'Missing issue body: %s\n' "$source" >&2
|
||||
exit 2
|
||||
fi
|
||||
url="$(gh issue create --title "$title" --label "$labels" --body-file "$body")"
|
||||
printf 'created_issue=%s\n' "$url"
|
||||
created=$((created + 1))
|
||||
done < <(
|
||||
jq -r '.issues[] | [.title, (.labels | join(",")), .source] | @tsv' "$MANIFEST"
|
||||
)
|
||||
|
||||
printf 'create_public_issues=ok\n'
|
||||
printf 'created=%d\n' "$created"
|
||||
printf 'Update docs/public-issues/public-issues-manifest.json with the printed issue URLs.\n'
|
||||
Executable
+120
@@ -0,0 +1,120 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
ISSUES_DIR="$ROOT/docs/public-issues"
|
||||
MANIFEST="$ISSUES_DIR/public-issues-manifest.json"
|
||||
|
||||
expected_files=(
|
||||
"001-registry-gitea-restore-test.md"
|
||||
"002-registry-russian-build-runner.md"
|
||||
"003-release-evidence-package.md"
|
||||
"004-legal-rightsholder-package.md"
|
||||
"005-coverage-threshold-policy.md"
|
||||
"006-external-security-code-review-checklist.md"
|
||||
"007-russian-os-compatibility-matrix.md"
|
||||
"008-release-artifacts-storage-rf.md"
|
||||
"009-public-demo-pack-refresh.md"
|
||||
"010-pilot-acceptance-checklist-v2.md"
|
||||
"011-governance-pr-based-review-workflow.md"
|
||||
"012-governance-branch-protection-policy.md"
|
||||
)
|
||||
|
||||
required_sections=(
|
||||
"Title"
|
||||
"Labels"
|
||||
"Purpose"
|
||||
"Scope"
|
||||
"Non-goals"
|
||||
"Acceptance criteria"
|
||||
"Evidence required"
|
||||
"Safety/privacy guardrails"
|
||||
"Registry-positioning guardrails"
|
||||
)
|
||||
|
||||
failures=()
|
||||
|
||||
fail() {
|
||||
failures+=("$1")
|
||||
}
|
||||
|
||||
section_value() {
|
||||
local section="$1"
|
||||
local file="$2"
|
||||
awk -v section="$section" '
|
||||
$0 == "## " section { found = 1; next }
|
||||
found && /^## / { exit }
|
||||
found && NF { print; exit }
|
||||
' "$file"
|
||||
}
|
||||
|
||||
labels_for_gh() {
|
||||
printf '%s' "$1" \
|
||||
| tr -d '`' \
|
||||
| tr ',' '\n' \
|
||||
| sed -E 's/^[[:space:]]+|[[:space:]]+$//g' \
|
||||
| awk 'NF { printf "%s%s", sep, $0; sep="," }'
|
||||
}
|
||||
|
||||
if [[ ! -d "$ISSUES_DIR" ]]; then
|
||||
fail "missing_directory:docs/public-issues"
|
||||
fi
|
||||
|
||||
if [[ ! -s "$MANIFEST" ]]; then
|
||||
fail "missing_or_empty:docs/public-issues/public-issues-manifest.json"
|
||||
fi
|
||||
|
||||
for name in "${expected_files[@]}"; do
|
||||
file="$ISSUES_DIR/$name"
|
||||
if [[ ! -s "$file" ]]; then
|
||||
fail "missing_or_empty:docs/public-issues/$name"
|
||||
continue
|
||||
fi
|
||||
for section in "${required_sections[@]}"; do
|
||||
if ! grep -Eq "^## ${section}$" "$file"; then
|
||||
fail "missing_section:docs/public-issues/$name:$section"
|
||||
fi
|
||||
done
|
||||
done
|
||||
|
||||
if [[ -s "$MANIFEST" ]] && command -v jq >/dev/null 2>&1; then
|
||||
jq -e . "$MANIFEST" >/dev/null || fail "invalid_json:docs/public-issues/public-issues-manifest.json"
|
||||
jq -e '
|
||||
.status == "planned_issue_templates_ready"
|
||||
and .github_issue_tracker == "manual_or_gh_cli_creation_required"
|
||||
and .github_role == "public_mirror_validation_only"
|
||||
and .registry_release_evidence == "requires_russian_build_runner"
|
||||
and (.issues | length == 12)
|
||||
and all(.issues[]; .status == "ready_to_create" and .github_issue_url == null)
|
||||
' "$MANIFEST" >/dev/null || fail "manifest_required_fields"
|
||||
while IFS= read -r source; do
|
||||
[[ -s "$ROOT/$source" ]] || fail "manifest_source_missing:$source"
|
||||
done < <(jq -r '.issues[].source' "$MANIFEST")
|
||||
elif [[ -s "$MANIFEST" ]]; then
|
||||
printf 'warning: jq not found; JSON syntax validation skipped\n' >&2
|
||||
fi
|
||||
|
||||
if ((${#failures[@]} > 0)); then
|
||||
printf 'public_issues_prepare=fail\n'
|
||||
for failure in "${failures[@]}"; do
|
||||
printf '%s\n' "$failure"
|
||||
done
|
||||
exit 2
|
||||
fi
|
||||
|
||||
printf 'public_issues_prepare=ok\n'
|
||||
printf 'status=ready_to_create\n'
|
||||
printf 'issue_templates=%d\n' "${#expected_files[@]}"
|
||||
printf '\n'
|
||||
printf 'Manual gh CLI commands, after maintainer review and gh auth:\n'
|
||||
|
||||
for name in "${expected_files[@]}"; do
|
||||
file="$ISSUES_DIR/$name"
|
||||
title="$(section_value "Title" "$file")"
|
||||
labels="$(labels_for_gh "$(section_value "Labels" "$file")")"
|
||||
rel="docs/public-issues/$name"
|
||||
printf 'gh issue create --title %q --label %q --body-file %q\n' "$title" "$labels" "$rel"
|
||||
done
|
||||
|
||||
printf '\n'
|
||||
printf 'After creating issues, update docs/public-issues/public-issues-manifest.json with github_issue_url values.\n'
|
||||
@@ -4,6 +4,8 @@ set -euo pipefail
|
||||
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
REGISTRY_DIR="$ROOT/docs/registry"
|
||||
MANIFEST="$REGISTRY_DIR/registry-evidence-manifest.json"
|
||||
PUBLIC_ISSUES_DIR="$ROOT/docs/public-issues"
|
||||
PUBLIC_ISSUES_MANIFEST="$PUBLIC_ISSUES_DIR/public-issues-manifest.json"
|
||||
|
||||
failures=()
|
||||
|
||||
@@ -31,6 +33,10 @@ if [[ ! -d "$REGISTRY_DIR" ]]; then
|
||||
fail "missing_directory:docs/registry"
|
||||
fi
|
||||
|
||||
if [[ ! -d "$PUBLIC_ISSUES_DIR" ]]; then
|
||||
fail "missing_directory:docs/public-issues"
|
||||
fi
|
||||
|
||||
required_files=(
|
||||
"docs/registry/REGISTER_RU_SOFTWARE_READINESS_RU.md"
|
||||
"docs/registry/SOURCE_CODE_AND_BUILD_INFRASTRUCTURE_RU.md"
|
||||
@@ -52,10 +58,26 @@ required_files=(
|
||||
"docs/REVIEW_CHECKLIST_RU.md"
|
||||
"docs/RESIDUAL_RISKS_RU.md"
|
||||
"docs/PUBLIC_ISSUES_PLAN_RU.md"
|
||||
"docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md"
|
||||
"docs/public-issues/public-issues-manifest.json"
|
||||
"docs/public-issues/001-registry-gitea-restore-test.md"
|
||||
"docs/public-issues/002-registry-russian-build-runner.md"
|
||||
"docs/public-issues/003-release-evidence-package.md"
|
||||
"docs/public-issues/004-legal-rightsholder-package.md"
|
||||
"docs/public-issues/005-coverage-threshold-policy.md"
|
||||
"docs/public-issues/006-external-security-code-review-checklist.md"
|
||||
"docs/public-issues/007-russian-os-compatibility-matrix.md"
|
||||
"docs/public-issues/008-release-artifacts-storage-rf.md"
|
||||
"docs/public-issues/009-public-demo-pack-refresh.md"
|
||||
"docs/public-issues/010-pilot-acceptance-checklist-v2.md"
|
||||
"docs/public-issues/011-governance-pr-based-review-workflow.md"
|
||||
"docs/public-issues/012-governance-branch-protection-policy.md"
|
||||
"docs/BRANCH_PROTECTION_POLICY_RU.md"
|
||||
"scripts/build_release_evidence.sh"
|
||||
"scripts/check_release_evidence.sh"
|
||||
"scripts/public_secret_pattern_check.py"
|
||||
"scripts/prepare_public_issues.sh"
|
||||
"scripts/create_public_issues_from_manifest.sh"
|
||||
".github/CODEOWNERS"
|
||||
".github/workflows/ci.yml"
|
||||
".github/workflows/security.yml"
|
||||
@@ -191,6 +213,55 @@ PY
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ -s "$PUBLIC_ISSUES_MANIFEST" ]]; then
|
||||
if command -v jq >/dev/null 2>&1; then
|
||||
jq -e . "$PUBLIC_ISSUES_MANIFEST" >/dev/null || fail "invalid_json:docs/public-issues/public-issues-manifest.json"
|
||||
jq -e '
|
||||
.status == "planned_issue_templates_ready"
|
||||
and .github_issue_tracker == "manual_or_gh_cli_creation_required"
|
||||
and .github_role == "public_mirror_validation_only"
|
||||
and .registry_release_evidence == "requires_russian_build_runner"
|
||||
and (.issues | length == 12)
|
||||
and all(.issues[];
|
||||
.status == "ready_to_create"
|
||||
and .github_issue_url == null
|
||||
and (.source | startswith("docs/public-issues/"))
|
||||
)
|
||||
' "$PUBLIC_ISSUES_MANIFEST" >/dev/null || fail "public_issues_manifest_required_fields"
|
||||
elif command -v python3 >/dev/null 2>&1; then
|
||||
python3 - "$PUBLIC_ISSUES_MANIFEST" <<'PY' || fail "public_issues_manifest_required_fields"
|
||||
import json
|
||||
import sys
|
||||
|
||||
with open(sys.argv[1], "r", encoding="utf-8") as fh:
|
||||
data = json.load(fh)
|
||||
|
||||
expected = {
|
||||
"status": "planned_issue_templates_ready",
|
||||
"github_issue_tracker": "manual_or_gh_cli_creation_required",
|
||||
"github_role": "public_mirror_validation_only",
|
||||
"registry_release_evidence": "requires_russian_build_runner",
|
||||
}
|
||||
for key, value in expected.items():
|
||||
if data.get(key) != value:
|
||||
raise SystemExit(f"{key} mismatch")
|
||||
|
||||
issues = data.get("issues")
|
||||
if not isinstance(issues, list) or len(issues) != 12:
|
||||
raise SystemExit("issues length mismatch")
|
||||
for issue in issues:
|
||||
if issue.get("status") != "ready_to_create":
|
||||
raise SystemExit("issue status mismatch")
|
||||
if issue.get("github_issue_url") is not None:
|
||||
raise SystemExit("github_issue_url must remain null until created")
|
||||
if not str(issue.get("source", "")).startswith("docs/public-issues/"):
|
||||
raise SystemExit("issue source mismatch")
|
||||
PY
|
||||
else
|
||||
fail "json_validator_missing:jq_or_python3_required"
|
||||
fi
|
||||
fi
|
||||
|
||||
require_grep "git\\.iri1968\\.dpdns\\.org" "docs/registry/SOURCE_CODE_AND_BUILD_INFRASTRUCTURE_RU.md" "gitea_domain_source_infra"
|
||||
require_grep "git\\.iri1968\\.dpdns\\.org" "docs/registry/GIT_RU_MIRRORING_RUNBOOK_RU.md" "gitea_domain_git_runbook"
|
||||
require_grep "git\\.iri1968\\.dpdns\\.org" "docs/registry/WIKI_AND_DOCUMENTATION_POLICY_RU.md" "gitea_domain_wiki_policy"
|
||||
@@ -216,6 +287,9 @@ require_grep "Russian build-runner.*required|requires_russian_build_runner" "doc
|
||||
require_grep "docs/registry" "docs/PROJECT_STATUS_RU.md" "project_status_registry_docs"
|
||||
require_grep "RESIDUAL_RISKS_RU\\.md" "docs/PROJECT_STATUS_RU.md" "project_status_residual_risks_link"
|
||||
require_grep "PUBLIC_ISSUES_PLAN_RU\\.md" "docs/PROJECT_STATUS_RU.md" "project_status_public_issues_plan_link"
|
||||
require_grep "docs/public-issues" "docs/PROJECT_STATUS_RU.md" "project_status_public_issue_templates"
|
||||
require_grep "PUBLIC_ISSUES_CREATION_RUNBOOK_RU\\.md" "docs/PROJECT_STATUS_RU.md" "project_status_public_issue_runbook"
|
||||
require_grep "manual/pending.*URLs.*public-issues-manifest|URLs.*public-issues-manifest" "docs/PROJECT_STATUS_RU.md" "project_status_issue_creation_pending_urls"
|
||||
require_grep "GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU\\.md|Restore outline|Post-restore checks" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_restore_runbook"
|
||||
require_grep "awatch-gitea-backup\\.timer" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_timer"
|
||||
require_grep "sha256|SHA256" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_sha256"
|
||||
@@ -242,12 +316,18 @@ require_grep "public GitHub Actions validation passed" "docs/registry/REGISTRY_R
|
||||
require_grep "No business logic changes" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_no_business_logic_changes"
|
||||
require_grep "RESIDUAL_RISKS_RU\\.md" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_residual_risks"
|
||||
require_grep "PUBLIC_ISSUES_PLAN_RU\\.md" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_issues_plan"
|
||||
require_grep "public issue creation package" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_issue_creation_package"
|
||||
require_grep "docs/public-issues" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_issues_dir"
|
||||
require_grep "runtime/product code changes" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_issues_no_runtime"
|
||||
require_grep "GitHub remains public mirror validation only" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_issues_github_role"
|
||||
require_grep "Restore test is not claimed as completed" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_restore_not_completed"
|
||||
require_grep "Russian build-runner is not claimed as ready" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_build_runner_not_ready"
|
||||
require_grep "First release evidence build is not claimed as completed" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_release_evidence_not_completed"
|
||||
require_grep "Legal rightsholder package remains pending" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_legal_package_pending"
|
||||
require_grep "RESIDUAL_RISKS_RU\\.md" "README.md" "readme_residual_risks_link"
|
||||
require_grep "PUBLIC_ISSUES_PLAN_RU\\.md" "README.md" "readme_public_issues_plan_link"
|
||||
require_grep "PUBLIC_ISSUES_CREATION_RUNBOOK_RU\\.md" "README.md" "readme_public_issues_creation_runbook"
|
||||
require_grep "public-issues/public-issues-manifest\\.json" "README.md" "readme_public_issues_manifest"
|
||||
require_grep "Engineering governance and residual risks" "README.md" "readme_engineering_governance_section"
|
||||
require_grep "REVIEW_CHECKLIST_RU\\.md" "README.md" "readme_review_checklist_link"
|
||||
require_grep "BRANCH_PROTECTION_POLICY_RU\\.md" "README.md" "readme_branch_protection_policy_link"
|
||||
@@ -303,7 +383,10 @@ require_grep "\\[pilot\\] Prepare Pilot Acceptance Checklist v2" "docs/PUBLIC_IS
|
||||
require_grep "\\[governance\\] Enable PR-based review workflow" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issue_pr_review_workflow"
|
||||
require_grep "\\[governance\\] Add branch protection policy" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issue_branch_protection_policy"
|
||||
require_grep "Acceptance criteria" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_acceptance_criteria"
|
||||
require_grep "planned" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_status_planned"
|
||||
require_grep "ready_to_create" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_status_ready_to_create"
|
||||
require_grep "docs/public-issues" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_templates_dir"
|
||||
require_grep "public-issues-manifest\\.json" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_manifest_link"
|
||||
require_grep "URLs.*pending|pending.*URLs" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_urls_pending"
|
||||
require_grep "Do not mark restore test as completed until restore evidence exists" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_restore_guardrail"
|
||||
require_grep "Do not mark .*awatch-build-01.* as ready until provisioning evidence exists" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_build_runner_guardrail"
|
||||
require_grep "public mirror validation only" "SECURITY.md" "security_public_mirror_validation"
|
||||
@@ -326,6 +409,9 @@ scan_files=(
|
||||
"$ROOT/docs/REVIEW_CHECKLIST_RU.md"
|
||||
"$ROOT/docs/RESIDUAL_RISKS_RU.md"
|
||||
"$ROOT/docs/PUBLIC_ISSUES_PLAN_RU.md"
|
||||
"$ROOT/docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md"
|
||||
"$ROOT/docs/public-issues"/*.md
|
||||
"$ROOT/docs/public-issues"/*.json
|
||||
"$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md"
|
||||
"$ROOT/SECURITY.md"
|
||||
"$ROOT/CONTRIBUTING.md"
|
||||
@@ -349,6 +435,9 @@ claim_scan_files=(
|
||||
"$ROOT/docs/REVIEW_CHECKLIST_RU.md"
|
||||
"$ROOT/docs/RESIDUAL_RISKS_RU.md"
|
||||
"$ROOT/docs/PUBLIC_ISSUES_PLAN_RU.md"
|
||||
"$ROOT/docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md"
|
||||
"$ROOT/docs/public-issues"/*.md
|
||||
"$ROOT/docs/public-issues"/*.json
|
||||
"$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md"
|
||||
"$ROOT/SECURITY.md"
|
||||
"$ROOT/CONTRIBUTING.md"
|
||||
@@ -397,6 +486,13 @@ if grep -RInEi "(юридически заверш(е|ё)нн?ая регист
|
||||
fi
|
||||
rm -f /tmp/registry_forbidden_legal_done.$$
|
||||
|
||||
if grep -RInEi "(completed Russian software registry submission|registry submission is complete|Russian software registry submission.{0,80}(completed|done))" "${claim_scan_files[@]}" \
|
||||
| grep -Eiv "(do not|no claim|not |не |forbidden|pending|until evidence)" \
|
||||
>/tmp/registry_forbidden_registry_submission_done.$$ 2>/dev/null; then
|
||||
fail "forbidden_claim_registry_submission_completed:$(cat /tmp/registry_forbidden_registry_submission_done.$$)"
|
||||
fi
|
||||
rm -f /tmp/registry_forbidden_registry_submission_done.$$
|
||||
|
||||
if grep -RInEi "(branch protection).{0,120}(enabled|включ(е|ё)н|настроен|active)" "$ROOT/README.md" "$ROOT/docs/PROJECT_STATUS_RU.md" "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md" "$REGISTRY_DIR"/*.md \
|
||||
| grep -Eiv "(not |не |не утверждает|not claimed|advisory|until repository settings|если применимо|recommended)" \
|
||||
>/tmp/registry_forbidden_branch_protection_enabled.$$ 2>/dev/null; then
|
||||
|
||||
Reference in New Issue
Block a user