Stewardship Readiness Checklist #1

New Issue

drjones · 2026-05-20T17:17:48-07:00

drjones commented

2026-05-20 17:17:48 -07:00

Stewardship Readiness Checklist

Repo-Specific Decision

Status: BLOCKED: license unresolved
Kind: hardware
Visibility: private
Archived: no
Source files in Gitea head: 4500
Mapped local source: p4-bridge (25118 files scanned)

Concrete Blockers

High-confidence credential findings after remediation: 0
Generic secret-like findings needing review: 6
Release-blocking binary/archive artifacts: 0
Nested Git/gitlink entries: 1
License status: status-file-only-or-present

Next Actions

Review 6 generic secret-like findings and redact or mark false positive.
Resolve license/provenance before adding a final LICENSE.
Finish submodule/mirror decision for nested Git content.
Add real CI from detected manifests.

CI Recommendation

Node CI: install dependencies with detected package manager, run lint/test/build scripts when present.
Python CI: create venv, install deps, run pytest/ruff/mypy only if configured.
CMake/ESP-IDF CI: configure/build with pinned toolchain or ESP-IDF image.
Docker CI: validate compose config and build image without secrets.

Notes

This issue is based on the repo-specific deep audit after credential remediation. Do not close it with generic documentation work; close it only after the blockers above are handled or explicitly marked not applicable.

# Stewardship Readiness Checklist ## Repo-Specific Decision - Status: **BLOCKED: license unresolved** - Kind: `hardware` - Visibility: `private` - Archived: `no` - Source files in Gitea head: 4500 - Mapped local source: `p4-bridge` (25118 files scanned) ## Concrete Blockers - High-confidence credential findings after remediation: 0 - Generic secret-like findings needing review: 6 - Release-blocking binary/archive artifacts: 0 - Nested Git/gitlink entries: 1 - License status: status-file-only-or-present ## Next Actions - [ ] Review 6 generic secret-like findings and redact or mark false positive. - [ ] Resolve license/provenance before adding a final LICENSE. - [ ] Finish submodule/mirror decision for nested Git content. - [ ] Add real CI from detected manifests. ## CI Recommendation - [ ] Node CI: install dependencies with detected package manager, run lint/test/build scripts when present. - [ ] Python CI: create venv, install deps, run pytest/ruff/mypy only if configured. - [ ] CMake/ESP-IDF CI: configure/build with pinned toolchain or ESP-IDF image. - [ ] Docker CI: validate compose config and build image without secrets. ## Notes This issue is based on the repo-specific deep audit after credential remediation. Do not close it with generic documentation work; close it only after the blockers above are handled or explicitly marked not applicable.

drjones added this to the Triage milestone 2026-05-20 17:17:48 -07:00

drjones added the docs hardware firmware security needs-triage provenance labels 2026-05-20 17:17:48 -07:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: drjones/p4-bridge#1