open-source-governance

name	open-source-governance
description	Open source policy, license compliance, contribution guidelines, dependency management, and supply chain security
license	Apache-2.0

Open Source Governance Skill

🔴 AI FIRST Quality Principle

Apply the AI FIRST principle: never accept first-pass quality. Minimum 2 iterations. Read all output, improve every section. No shortcuts.

Purpose

Defines governance for open source software use, contribution, and publication ensuring license compliance and supply chain security.

License Compliance

Approved Licenses

• MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause
• ISC, CC-BY-4.0, Unlicense, 0BSD

Restricted Licenses (Require Review)

• GPL-2.0, GPL-3.0, LGPL, AGPL
• SSPL, BSL, Commons Clause

Prohibited

• No license specified (proprietary by default)
• Licenses incompatible with project license

Dependency Management

• Pin dependencies to specific versions
• Use lock files (package-lock.json)
• Regular dependency updates via Dependabot
• Security scanning for known vulnerabilities
• SBOM generation for supply chain transparency

Contribution Guidelines

• CONTRIBUTING.md required in all repos
• Code of Conduct (Contributor Covenant)
• Developer Certificate of Origin (DCO)
• PR review requirements
• CLA not required for Hack23 projects

Supply Chain Security