Standards conformance gaps (K22 audit 2026-10-12) #26

New Issue

2026-10-12T10:33:30Z

KofTwentyTwo commented

2026-10-12 10:33:30 +00:00

(Migrated from github.com)

Findings from the 2026-10-12 standards audit (tools/Test-RepoConformance.ps1: 24 FAIL, 8 PASS). Munitor is listed under Awaiting classification in standards MAINTAINERS.md, so it is formally Internal tier; these are the items needed for Product tier or an exception.

Repository settings (owner/admin)

K22-REPO-20/21: no rulesets; main and develop are unprotected. Add protect-main (and develop) requiring ci/circleci: orb-tools/lint, orb-tools/pack, orb-tools/review; add protect-release-tags for v*.
K22-REPO-22: merge commits and rebase allowed, branches not auto-deleted. The release flow (release/* -> main, main -> develop back-merge) uses merge commits; needs an EX- entry or a flow change.
K22-REPO-30: private vulnerability reporting, Dependabot alerts/security updates, code scanning, immutable releases are off.
K22-REPO-40: wiki enabled (empty; safe to disable). K22-REPO-41: no topics/homepage.
K22-REPO-12 / K22-TEST-25: no docs/security/assurance.json, no OpenSSF Best Practices enrollment.
K22-REPO-03: no .editorconfig. The standard profile mandates 3-space indent while scripts use 2 spaces: reformat or record an exception.

CI / release

K22-CI-*: the K22 CI rules assume GitHub Actions; Munitor uses CircleCI + circleci/orb-tools@12.1. Needs an EX- entry (CircleCI equivalence) or Actions gates (pr title/DCO, secrets, SCA, workflow lint).
K22-CI-02: CI runs only orb-tools lint/pack/review. make test-scripts, make test-templates and bats tests never run in CI. Add a test job.
K22-CI-11 (ref): circleci/orb-tools@12.1 floats on a minor; pin the exact version.
K22-REL-*: tag v0.3.3 exists and kof22/munitor@0.3.3 is published (2026-10-11), but there is no GitHub Release for v0.3.3 (latest is 0.3.2). No SHA256SUMS/attestation/SBOM for the packed orb.
Every push to feature/* publishes dev:snapshot, so any open feature branch overwrites the shared snapshot. Consider dev:<sha> only for feature branches.

Docs items were addressed in #25.

Findings from the 2026-10-12 standards audit (`tools/Test-RepoConformance.ps1`: 24 FAIL, 8 PASS). Munitor is listed under *Awaiting classification* in standards MAINTAINERS.md, so it is formally Internal tier; these are the items needed for Product tier or an exception. **Repository settings (owner/admin)** - [ ] K22-REPO-20/21: no rulesets; `main` and `develop` are unprotected. Add `protect-main` (and `develop`) requiring `ci/circleci: orb-tools/lint`, `orb-tools/pack`, `orb-tools/review`; add `protect-release-tags` for `v*`. - [ ] K22-REPO-22: merge commits and rebase allowed, branches not auto-deleted. The release flow (release/* -> main, main -> develop back-merge) uses merge commits; needs an EX- entry or a flow change. - [ ] K22-REPO-30: private vulnerability reporting, Dependabot alerts/security updates, code scanning, immutable releases are off. - [ ] K22-REPO-40: wiki enabled (empty; safe to disable). K22-REPO-41: no topics/homepage. - [ ] K22-REPO-12 / K22-TEST-25: no `docs/security/assurance.json`, no OpenSSF Best Practices enrollment. - [ ] K22-REPO-03: no `.editorconfig`. The standard profile mandates 3-space indent while scripts use 2 spaces: reformat or record an exception. **CI / release** - [ ] K22-CI-*: the K22 CI rules assume GitHub Actions; Munitor uses CircleCI + `circleci/orb-tools@12.1`. Needs an EX- entry (CircleCI equivalence) or Actions gates (pr title/DCO, secrets, SCA, workflow lint). - [ ] K22-CI-02: CI runs only orb-tools lint/pack/review. `make test-scripts`, `make test-templates` and `bats tests` never run in CI. Add a test job. - [ ] K22-CI-11 (ref): `circleci/orb-tools@12.1` floats on a minor; pin the exact version. - [ ] K22-REL-*: tag `v0.3.3` exists and `kof22/munitor@0.3.3` is published (2026-10-11), but there is no GitHub Release for v0.3.3 (latest is 0.3.2). No SHA256SUMS/attestation/SBOM for the packed orb. - [ ] Every push to `feature/*` publishes `dev:snapshot`, so any open feature branch overwrites the shared snapshot. Consider `dev:<sha>` only for feature branches. Docs items were addressed in #25.

KofTwentyTwo commented

2026-10-12 11:25:04 +00:00

(Migrated from github.com)

Status after 2026-10-12 (owner-authorized gap fixes):

K22-REPO-20/21: rulesets protect-main and protect-develop (signed commits, PR required, deletion and force-push blocked, required checks orb-tools/lint, orb-tools/pack, orb-tools/review, test; no bypass actors). protect-release-tags for v* (admin-only creation, no update or delete).
K22-REPO-22: GitFlow merge commits are kept. Recorded as standards exception EX-0009.
K22-REPO-30: private vulnerability reporting, Dependabot alerts and security updates, secret scanning with push protection, and immutable releases are on. CodeQL default setup is configured but has no supported language to analyze (Bash/YAML only).
K22-REPO-40/41: wiki disabled; topics and homepage (orb registry page) set.
K22-REPO-03: .editorconfig added. The 2-space layout is kept under EX-0011.
K22-CI: CircleCI equivalence recorded as EX-0010. A test job now runs make test-scripts test-templates and bats tests (#29).
K22-CI-11: circleci/orb-tools@12.5.0 is pinned exactly.
K22-REL: GitHub Releases v0.3.3 and v0.3.4 published with the registry orb source and SHA256SUMS. v0.3.4 is immutable.
Feature-branch snapshot overwrite: feature branches now publish only dev:<sha> (#29).
K22-REPO-12 / K22-TEST-25: docs/security/assurance.json and OpenSSF Best Practices enrollment are still open (needs the maintainer's provider login).
Build-provenance attestation and SBOM for the orb: not started. The release has checksums only.

Leaving this open for the two remaining items.

🤖 Generated with Claude Code

Status after 2026-10-12 (owner-authorized gap fixes): - [x] K22-REPO-20/21: rulesets `protect-main` and `protect-develop` (signed commits, PR required, deletion and force-push blocked, required checks `orb-tools/lint`, `orb-tools/pack`, `orb-tools/review`, `test`; no bypass actors). `protect-release-tags` for `v*` (admin-only creation, no update or delete). - [x] K22-REPO-22: GitFlow merge commits are kept. Recorded as standards exception **EX-0009**. - [x] K22-REPO-30: private vulnerability reporting, Dependabot alerts and security updates, secret scanning with push protection, and immutable releases are on. CodeQL default setup is configured but has no supported language to analyze (Bash/YAML only). - [x] K22-REPO-40/41: wiki disabled; topics and homepage (orb registry page) set. - [x] K22-REPO-03: `.editorconfig` added. The 2-space layout is kept under **EX-0011**. - [x] K22-CI: CircleCI equivalence recorded as **EX-0010**. A `test` job now runs `make test-scripts test-templates` and `bats tests` (#29). - [x] K22-CI-11: `circleci/orb-tools@12.5.0` is pinned exactly. - [x] K22-REL: GitHub Releases v0.3.3 and v0.3.4 published with the registry orb source and `SHA256SUMS`. v0.3.4 is immutable. - [x] Feature-branch snapshot overwrite: feature branches now publish only `dev:<sha>` (#29). - [ ] K22-REPO-12 / K22-TEST-25: `docs/security/assurance.json` and OpenSSF Best Practices enrollment are still open (needs the maintainer's provider login). - [ ] Build-provenance attestation and SBOM for the orb: not started. The release has checksums only. Leaving this open for the two remaining items. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/Munitor#26