| name | cncf-migration-compliance-docs |
| description | Inject and validate the legal and governance documents required for a CNCF-compliant open-source project: Apache 2.0, DCO, GOVERNANCE, SECURITY, CODE_OF_CONDUCT, and README hygiene. Specific to CNCF OSS migration.
|
When to Use This Skill
Use this skill when:
- Setting up a net-new public OSS repository under a CNCF sandbox or incubating pattern
- Auditing an existing OSS repo for CNCF compliance gaps
- Reviewing README and docs for internal lead-capture forms or corporate branding
Do NOT use for general documentation tasks unrelated to OSS compliance.
Required Files Checklist
| File | CNCF Requirement | Notes |
|---|
LICENSE | Apache License 2.0 | Must be at repo root |
CONTRIBUTING.md | DCO model (not CLA) | Must explain git commit -s |
CODE_OF_CONDUCT.md | CNCF CoC or Contributor Covenant v2 | Link to enforcement contact |
SECURITY.md | Vulnerability disclosure process | Private disclosure path |
GOVERNANCE.md | Maintainer roles and decision process | Required for incubation |
NOTICE | Apache 2.0 NOTICE file | List original copyright holder |
.mailmap | Canonical author identities | Required for clean contributor graph |
CHANGELOG.md | Semantic version history | Helps CLOMonitor score |
Step 1 — LICENSE (Apache 2.0)
The Apache License 2.0 is required by CNCF for all hosted projects.
grep -c "Apache License, Version 2.0" LICENSE
The license must appear at the repo root. Do NOT modify the license text.
Credit the original corporate author in NOTICE, not in LICENSE.
Step 2 — DCO (Developer Certificate of Origin)
CNCF requires DCO instead of a corporate CLA for contributor sign-off.
CONTRIBUTING.md must contain:
- How to sign off commits:
git commit -s or git commit --signoff
- What the DCO means (link to developercertificate.org)
- How to fix unsigned commits:
git rebase --signoff HEAD~N
grep -r "DCO\|sign.off\|Signed-off-by" .github/workflows/
CNCF does NOT accept CLA bots as a substitute for DCO in sandbox projects.
Step 3 — GOVERNANCE.md
Defines project roles and decision-making. Minimum structure:
## Roles
- **Maintainer**: merge rights, release authority
- **Reviewer**: PR review rights, no merge
- **Contributor**: anyone submitting PRs
## Decision Process
- Minor changes: single Maintainer approval
- Significant changes: consensus among active Maintainers
- Disputes: CNCF TOC mediation
## Maintainer List
See CODEOWNERS for current list.
Step 4 — SECURITY.md
Must provide a private disclosure path:
## Reporting a Vulnerability
Do NOT open a public GitHub issue for security vulnerabilities.
Report via: security@your-project.io (or GitHub private advisory)
Response SLA: 48 hours acknowledgement, 90 days disclosure window
Step 5 — README Hygiene
CNCF rejects projects where the README:
- Embeds lead-capture forms or marketing CTAs
- Prominently shows a corporate logo above the project description
- Links to internal ticketing systems (Jira, ServiceNow) without placeholders
- Has no badge for license, CI status, or OpenSSF scorecard
Required badges for a healthy score:
[](LICENSE)
[](https://securityscorecards.dev/viewer/?uri=github.com/ORG/REPO)
[](https://clomonitor.io/projects/cncf/PROJECT)
Step 6 — Audit for Corporate Branding
grep -rn "\.viasat\.com\|ServiceNow\|internal\." docs/ README.md CONTRIBUTING.md \
| grep -v "<.*>"
grep -rni "contact sales\|request demo\|schedule a call\|enterprise plan" README.md docs/
Vionix Compliance Status
| File | Status |
|---|
LICENSE | ✅ Apache 2.0 |
NOTICE | ✅ Present |
CONTRIBUTING.md | ✅ DCO model documented |
CODE_OF_CONDUCT.md | ✅ Contributor Covenant v2.1 |
SECURITY.md | ✅ Private disclosure via GitHub advisories |
GOVERNANCE.md | ✅ Roles and decision process defined |
CHANGELOG.md | ✅ Semantic versions v0.0.1–v2.0.0 |
.mailmap | ✅ Author identity map (3 verified, 3 TODO) |
Related Skills
cncf-migration-secrets-scrubber — scrub internal terms before releasecncf-migration-health-monitor — automated ongoing compliance checks
