| name | oss-release-audit |
| description | Pre-publish OSS compliance check — verifies secrets/artifacts are gitignored, LICENSE/NOTICE/THIRD_PARTY_NOTICES exist, no secrets or personal info are about to be committed, and tests pass. Use before publishing/committing for release or when asked to audit OSS readiness. |
OSS release audit
Read-only checks to run before publishing or a release commit. Report findings;
do not change files.
Steps
-
License/attribution files present at the repo root:
ls LICENSE NOTICE THIRD_PARTY_NOTICES.md models/stackchan/NOTICE
-
Generated output / internal docs / local config are NOT tracked
(each should report ignored):
git check-ignore artifacts/x.png .playwright-mcp/x .pytest_cache/v \
.claude/settings.local.json \
reference/stackchan_physics_param_identification_report.md
And confirm the tracked set looks right (no surprises):
git add -An --dry-run | sort
-
No secrets / personal info about to be committed. Grep tracked files
(exclude vendored JS) for API keys, tokens, private keys, and the local
machine's identity:
- patterns:
sk-, api[_-]?key=..., BEGIN ... PRIVATE KEY, AKIA...,
ghp_...
- personal: the OS username / home path / git email / handle
Use the Grep tool with
glob: "!**/vendor/**". Expect no matches.
-
Tests green:
uv run pytest -q
-
Report a punch list grouped by severity (BLOCKER / WARNING / NOTE). If a
[project.urls] repository URL is still unset in pyproject.toml, flag it as
a NOTE (add once the public repo exists).
Notes
- This is read-only; never commit or edit as part of the audit.
- The physics report is intentionally gitignored (internal, not distributed).
- Dependencies are all permissive (MIT/BSD/Apache);
certifi is MPL-2.0
(file-level, redistributed unmodified) — acceptable.
