bofh-review

name

bofh-review

description

Merciless pre-publication audit of everything that becomes visible when the repo goes public or a release ships — secrets and identifiers in full git history, PR/issue bodies and comments, Actions logs, package artifact contents, dependency licenses, and public-project security posture. Verdict is NO COMEBACK or EXPOSED with required fixes. Run before flipping visibility and before any release while findings are cheap to fix.

BOFH review — the "no comeback" gate

Assume every byte will be read by a competitor, a journalist, and opposing counsel. Your job is to find what they would find, first. Report-only: produce findings and a verdict; fixes happen as normal PRs afterwards.

Severity: BLOCKER (do not publish), RISK (publish invites trouble), SLOPPY (won't sue you, will embarrass you).

1. Secrets — tree and full history

• Working tree: scan for key/token/credential patterns (AKIA, AIza, ghp_, gho_, -----BEGIN, client_secret, password\s*=, high-entropy strings) across all files including dotfiles.
• Full pushed history: git log -p --all piped through the same patterns — a secret deleted in a later commit is still published history. If gitleaks or trufflehog is installed, run it too (gitleaks detect --source .); don't install tools just for this.
• .gitignored files never uploaded ≠ safe: check nothing ignored is referenced by committed code as if it will exist.

2. Identifiers — everywhere GitHub will render

Internal/client names (org names, GCP project IDs, personal emails, internal hostnames) in:

• tree and full history (git log -p --all | grep -inE '<patterns>')
• commit messages on all refs
• PR and issue bodies AND comments (gh pr list --state all --json number,body,comments, same for issues) — these render publicly and are editable after the fact
• release notes / CHANGELOG
• Actions run logs — private-era logs become readable on flip; sample the logs of every workflow (gh run view <id> --log | grep -iE '<patterns>'). Logs cannot be edited, only deleted (gh api -X DELETE repos/{owner}/{repo}/actions/runs/{id}/logs).

Build the pattern list from context (client names, --project values seen in session history, personal emails) — do not rely on a canned list alone.

3. Package artifacts — what actually ships

• uv build, then list both sdist and wheel contents in full. The wheel should contain only the package; the sdist only package + build/docs essentials. Flag anything else (agent configs, CI files, scratch, tests with realistic data) — decide deliberately, don't ship by default.
• Grep the built artifacts for the identifier patterns from §2.

4. Legal and trademark

• Every runtime dependency's license must be MIT-compatible (uv run python -c over importlib.metadata, or check each dist's METADATA License field).
• Trademark posture: product names (Google, Gemini) used nominatively only — the description must not imply endorsement ("for", not "by"); no logos copied into the repo.
• LICENSE year/holder correct; README claims (e.g. "read-only") must be true — an inaccurate safety claim is a liability, verify against tests/auditor.

5. Public-project posture

• SECURITY.md with a private disclosure route (email, not public issues).
• Workflow hygiene: third-party actions pinned (tags minimum, SHAs better), workflow permissions minimal, no pull_request_target footguns, environment protecting the publish.
• Branch protection still on; repo description/topics presentable.

6. Verdict

A table: finding → severity → surface → required fix. Then one line: NO COMEBACK (nothing above SLOPPY, and SLOPPYs listed) or EXPOSED (any BLOCKER/RISK, publish blocked until fixed). Re-run after fixes; the verdict must be earned, not negotiated.