drjones/gitea-stewardship-ledger
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Add repo-by-repo maintainer decisions

Browse Source
This commit is contained in:
drjones
2026-05-20 22:16:37 -07:00
parent 03a72d7baf
commit 6e209b6265
2 changed files with 98 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
README.md
View File

@@ -365,3 +365,31 @@ After review, the forge still had too much scaffolding and too many placeholder
- Verified the affected remotes no longer track those sidecar/cache files.
Keeper decision: inactive shells should be archived, not polished. Real work now belongs on repos with source, manifests, or confirmed local project content.
## Repo-by-Repo Maintainer Decisions: 2026-05-20
Replaced the broad readiness checklist language with repo-specific maintainer decisions for every active repository.
### Outputs
- Local action report: `GITEA_REPO_ACTION_PLAN_2026-05-20.md`
- Ledger report path: `reports/GITEA_REPO_ACTION_PLAN_2026-05-20.md`
- Active readiness issues corrected: 45
- Archived shell repos skipped: 13
- High-confidence credential findings after remediation: 0
### Decision Rules Applied
- Archived repos remain archived when they contain no real project source beyond stewardship scaffolding.
- Active repos are marked by their current blocking condition: license unresolved, artifact provenance, generic secret-review findings, or nested Git source gaps.
- Readiness issues now point to concrete next moves: review generic secret-like findings, resolve license/provenance, migrate binary artifacts to verified releases, or confirm nested Git source URLs.
- Placeholder status was not expanded further. The pass replaced it with repo-specific blocker counts and maintainer actions.
### Still Blocked
- Final `LICENSE` files remain blocked until ownership and upstream source licenses are proven per repo.
- Generic secret-like findings remain in 26 repos and need line-by-line review before release work.
- Release-blocking binary/archive artifacts remain in 9 repos and need either removal, release-asset migration, or provenance notes.
- Two nested Git links still lack confirmed source URLs: `c5-project/esp32-wifi-penetration-tool` and `car-key-killer/cypher-pulse`.
Keeper decision: the next useful pass is not more scaffolding. It is targeted cleanup against the action report: secrets review first, then artifact provenance, then license resolution, then real per-project CI.