oss-release-audit

name	oss-release-audit
description	Pre-publish OSS compliance check — verifies secrets/artifacts are gitignored, LICENSE/NOTICE/THIRD_PARTY_NOTICES exist, no secrets or personal info are about to be committed, and tests pass. Use before publishing/committing for release or when asked to audit OSS readiness.

OSS release audit

Read-only checks to run before publishing or a release commit. Report findings; do not change files.

Steps

1. License/attribution files present at the repo root:

   ls LICENSE NOTICE THIRD_PARTY_NOTICES.md models/stackchan/NOTICE
   

2. Generated output / internal docs / local config are NOT tracked (each should report ignored):

   git check-ignore artifacts/x.png .playwright-mcp/x .pytest_cache/v \
     .claude/settings.local.json \
     reference/stackchan_physics_param_identification_report.md
   

   And confirm the tracked set looks right (no surprises):

   git add -An --dry-run | sort
   

3. No secrets / personal info about to be committed. Grep tracked files (exclude vendored JS) for API keys, tokens, private keys, and the local machine's identity:

   • patterns: sk-, api[_-]?key=..., BEGIN ... PRIVATE KEY, AKIA..., ghp_...
   • personal: the OS username / home path / git email / handle Use the Grep tool with glob: "!**/vendor/**". Expect no matches.

4. Tests green:

   uv run pytest -q
   

5. Report a punch list grouped by severity (BLOCKER / WARNING / NOTE). If a [project.urls] repository URL is still unset in pyproject.toml, flag it as a NOTE (add once the public repo exists).

Notes

• This is read-only; never commit or edit as part of the audit.
• The physics report is intentionally gitignored (internal, not distributed).
• Dependencies are all permissive (MIT/BSD/Apache); certifi is MPL-2.0 (file-level, redistributed unmodified) — acceptable.