| name | open-source-governance |
| description | Open source policy, license compliance, contribution guidelines, dependency management, and supply chain security |
| license | Apache-2.0 |
Open Source Governance Skill
🔴 AI FIRST Quality Principle
Apply the AI FIRST principle: never accept first-pass quality. Minimum 2 iterations. Read all output, improve every section. No shortcuts.
Purpose
Defines governance for open source software use, contribution, and publication ensuring license compliance and supply chain security.
License Compliance
Approved Licenses
- MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause
- ISC, CC-BY-4.0, Unlicense, 0BSD
Restricted Licenses (Require Review)
- GPL-2.0, GPL-3.0, LGPL, AGPL
- SSPL, BSL, Commons Clause
Prohibited
- No license specified (proprietary by default)
- Licenses incompatible with project license
Dependency Management
- Pin dependencies to specific versions
- Use lock files (package-lock.json)
- Regular dependency updates via Dependabot
- Security scanning for known vulnerabilities
- SBOM generation for supply chain transparency
Contribution Guidelines
- CONTRIBUTING.md required in all repos
- Code of Conduct (Contributor Covenant)
- Developer Certificate of Origin (DCO)
- PR review requirements
- CLA not required for Hack23 projects
Supply Chain Security