KofTwentyTwo/gclo
2
0 Fork 0
Code Issues 28 Pull Requests 1 Actions Packages Projects Releases 22 Wiki Activity

Standards compliance: make gclo conform to KofTwentyTwo/standards for the 1.0.1 release (epic) #62

New Issue
Open
opened 2026-10-09 14:51:11 +00:00 by KofTwentyTwo · 4 comments
KofTwentyTwo commented 2026-10-09 14:51:11 +00:00 (Migrated from github.com)
Copy link
Copy source

Tracking issue for bringing this repository to 100% compliance with KofTwentyTwo/standards (commit 855cf44, pre-1.0 draft) in the 1.0.1 release. The full audit (168 requirement ids: 52 compliant, 50 partial, 36 non-compliant) is summarized in the sub-issues below.

Plan

Ordered as the standards README prescribes: settings, then security workflows, then repository files, then formatting, then analyzers. Every file change arrives as a Conventional-Commit, DCO-signed PR against main; settings and account items are the maintainer's.

# Workstream Standard ids Who
1 CI and security workflows: pr-gates, security, codeql, scorecard callers; hardened ci/release/nuget-updates; scanner configs; Dependabot cooldown; SBOM, SHA256SUMS, CC release notes, LICENSE in assets K22-CI-01, 12, 14, 15, 18, 20-24, 31; REL-01..07; DEP-20, 30; REPO-01, 03, 04 agent (PR)
2 Governance and docs: README, SECURITY, CONTRIBUTING, PR/issue templates, CODE_OF_CONDUCT, CLAUDE.md, ADRs, threat model, RELEASING SDLC-02, 03, 10, 11, 13, 15; REPO-02, 06, 07, 10, 11; REL-10, 20, 21; AI-40 agent (PR)
3 Kingsrook C# style: standard .editorconfig, Directory.Build.props, central package management, LF, global.json, Meziantou, reformat, SPDX headers, one type per file, PowerShell style and analyzer CODE-01..24; CODE-CS-01..13; CODE-SH-04..06; DEP-11 agent (PR)
4 Repository settings and rulesets, environments and secrets, org .github, retiring dev, exception-register entries, release checklist, access review REPO-20..22, 30-32, 40, 41; CI-01, 16; SEC-*; SDLC-33; REL-11, 12 maintainer

Conventions from here on

  • Branches <type>/<description> off main; PR titles are Conventional Commit headers; every commit git commit -S -s.
  • Agents do not merge, tag, release, or change settings (K22-AI-10); the maintainer does, after checks are green.

Sub-issues follow.

Tracking issue for bringing this repository to 100% compliance with [KofTwentyTwo/standards](https://github.com/KofTwentyTwo/standards) (commit `855cf44`, pre-1.0 draft) in the 1.0.1 release. The full audit (168 requirement ids: 52 compliant, 50 partial, 36 non-compliant) is summarized in the sub-issues below. ## Plan Ordered as the standards README prescribes: settings, then security workflows, then repository files, then formatting, then analyzers. Every file change arrives as a Conventional-Commit, DCO-signed PR against `main`; settings and account items are the maintainer's. | # | Workstream | Standard ids | Who | | --- | --- | --- | --- | | 1 | CI and security workflows: `pr-gates`, `security`, `codeql`, `scorecard` callers; hardened `ci`/`release`/`nuget-updates`; scanner configs; Dependabot cooldown; SBOM, `SHA256SUMS`, CC release notes, LICENSE in assets | K22-CI-01, 12, 14, 15, 18, 20-24, 31; REL-01..07; DEP-20, 30; REPO-01, 03, 04 | agent (PR) | | 2 | Governance and docs: README, SECURITY, CONTRIBUTING, PR/issue templates, CODE_OF_CONDUCT, CLAUDE.md, ADRs, threat model, RELEASING | SDLC-02, 03, 10, 11, 13, 15; REPO-02, 06, 07, 10, 11; REL-10, 20, 21; AI-40 | agent (PR) | | 3 | Kingsrook C# style: standard `.editorconfig`, `Directory.Build.props`, central package management, LF, `global.json`, Meziantou, reformat, SPDX headers, one type per file, PowerShell style and analyzer | CODE-01..24; CODE-CS-01..13; CODE-SH-04..06; DEP-11 | agent (PR) | | 4 | Repository settings and rulesets, environments and secrets, org `.github`, retiring `dev`, exception-register entries, release checklist, access review | REPO-20..22, 30-32, 40, 41; CI-01, 16; SEC-*; SDLC-33; REL-11, 12 | maintainer | ## Conventions from here on - Branches `<type>/<description>` off `main`; PR titles are Conventional Commit headers; every commit `git commit -S -s`. - Agents do not merge, tag, release, or change settings (K22-AI-10); the maintainer does, after checks are green. Sub-issues follow.
KofTwentyTwo commented 2026-10-09 15:43:50 +00:00 (Migrated from github.com)
Copy link
Copy source

Implementation status (2026-10-09)

PR Workstream Checks
#68 ci: standards gates, hardened workflows, SBOM, SHA256SUMS, CC release notes all green
#69 docs: README/SECURITY/CONTRIBUTING/templates, CoC, CLAUDE.md, 6 ADRs, threat model all green (stacked on #68)
#70 style: Kingsrook layout, standard editorconfig/props, CPM, LF, SPDX, one type per file, PowerShell green except pr / dependency-review (file-licensed packages; fixed by standards PR #4)
#71 ci: retire superseded gates (draft; after the ruleset edit) n/a
KofTwentyTwo/standards#4 allow-dependencies-licenses input, DCO parsing fix, EX-0003/EX-0004, analyzer settings pending

Maintainer-only items and the merge order are on #66; the v1.0.1 release checklist is #67. Agents stop at the pull request (K22-AI-10): merging, the ruleset changes, and the tag are yours.

## Implementation status (2026-10-09) | PR | Workstream | Checks | | --- | --- | --- | | #68 | ci: standards gates, hardened workflows, SBOM, SHA256SUMS, CC release notes | all green | | #69 | docs: README/SECURITY/CONTRIBUTING/templates, CoC, CLAUDE.md, 6 ADRs, threat model | all green (stacked on #68) | | #70 | style: Kingsrook layout, standard editorconfig/props, CPM, LF, SPDX, one type per file, PowerShell | green except `pr / dependency-review` (file-licensed packages; fixed by standards PR #4) | | #71 | ci: retire superseded gates (draft; after the ruleset edit) | n/a | | KofTwentyTwo/standards#4 | `allow-dependencies-licenses` input, DCO parsing fix, EX-0003/EX-0004, analyzer settings | pending | Maintainer-only items and the merge order are on #66; the v1.0.1 release checklist is #67. Agents stop at the pull request (K22-AI-10): merging, the ruleset changes, and the tag are yours.
KofTwentyTwo commented 2026-10-09 16:01:29 +00:00 (Migrated from github.com)
Copy link
Copy source

Progress (2026-10-09, afternoon)

Item State
standards#4 (license input, DCO fix, exceptions, docs gate repair) merged ae174f5
#68 CI gates (callers re-pinned to ae174f5, license exemption input) green, CLEAN, awaiting maintainer merge
#69 docs, #70 style, #71 retire gates green (#70's pr / dependency-review will pass once rebased onto #68's pin); awaiting the stack merge
protect-main ruleset updated: linear history, signatures, thread resolution, strict checks, squash only
protect-release-tags ruleset updated: creation rule, admin bypass
Repository merge settings, wiki, homepage, PR #48 retarget blocked: maintainer action (command on #66)
.git-blame-ignore-revs, dev retirement, context switch after the merges (#66)
## Progress (2026-10-09, afternoon) | Item | State | | --- | --- | | standards#4 (license input, DCO fix, exceptions, docs gate repair) | **merged** `ae174f5` | | #68 CI gates (callers re-pinned to `ae174f5`, license exemption input) | green, `CLEAN`, awaiting maintainer merge | | #69 docs, #70 style, #71 retire gates | green (#70's `pr / dependency-review` will pass once rebased onto #68's pin); awaiting the stack merge | | `protect-main` ruleset | updated: linear history, signatures, thread resolution, strict checks, squash only | | `protect-release-tags` ruleset | updated: creation rule, admin bypass | | Repository merge settings, wiki, homepage, PR #48 retarget | **blocked**: maintainer action (command on #66) | | `.git-blame-ignore-revs`, `dev` retirement, context switch | after the merges (#66) |
KofTwentyTwo commented 2026-10-09 16:19:06 +00:00 (Migrated from github.com)
Copy link
Copy source

All four stacked PRs (#68 → #69 → #70 → #71) are green and CLEAN as of 16:20 UTC; see #66 for the maintainer merge sequence.

All four stacked PRs (#68 → #69 → #70 → #71) are green and `CLEAN` as of 16:20 UTC; see #66 for the maintainer merge sequence.
KofTwentyTwo commented 2026-10-11 12:30:12 +00:00 (Migrated from github.com)
Copy link
Copy source

Shipped: v1.1.0 is the first stable release with the full standards adoption (shared signed Velopack workflow, provenance, SBOMs, signed+DCO commits, 100% coverage gates, FlaUI gate, smoke test of the published app, data root outside the install folder, default-token accounts, dev edition). Conformance was 0 FAIL at 3f05d54; remaining SHOULD-level items are the org-level ones on #66 (org .github repository, allowed-actions policy). Closing this epic is the owner's call once #66 is settled.

Shipped: v1.1.0 is the first stable release with the full standards adoption (shared signed Velopack workflow, provenance, SBOMs, signed+DCO commits, 100% coverage gates, FlaUI gate, smoke test of the published app, data root outside the install folder, default-token accounts, dev edition). Conformance was 0 FAIL at 3f05d54; remaining SHOULD-level items are the org-level ones on #66 (org .github repository, allowed-actions policy). Closing this epic is the owner's call once #66 is settled.
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
.NET
Pull requests that update .NET code
 bug
Something isn't working
 deferred
Agreed follow-up, not scheduled
 dependencies
Pull requests that update a dependency file
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 github_actions
Pull requests that update GitHub Actions code
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 needs-owner
Blocked on an action only the owner can take
 priority
Owner-flagged: work this first
 quality
Standards, simplicity, enforcement
 question
Further information is requested
 refactor
Restructuring without behavior change
 release
Release pipeline / distribution
 wontfix
This will not be worked on
No labels release
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: KofTwentyTwo/gclo#62