菜单
Inject and validate the legal and governance documents required for a CNCF-compliant open-source project: Apache 2.0, DCO, GOVERNANCE, SECURITY, CODE_OF_CONDUCT, and README hygiene. Specific to CNCF OSS migration.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | cncf-migration-compliance-docs |
| description | Inject and validate the legal and governance documents required for a CNCF-compliant open-source project: Apache 2.0, DCO, GOVERNANCE, SECURITY, CODE_OF_CONDUCT, and README hygiene. Specific to CNCF OSS migration. |
Use this skill when:
Do NOT use for general documentation tasks unrelated to OSS compliance.
| File | CNCF Requirement | Notes |
|---|---|---|
LICENSE | Apache License 2.0 | Must be at repo root |
CONTRIBUTING.md | DCO model (not CLA) | Must explain git commit -s |
CODE_OF_CONDUCT.md | CNCF CoC or Contributor Covenant v2 | Link to enforcement contact |
SECURITY.md | Vulnerability disclosure process | Private disclosure path |
GOVERNANCE.md | Maintainer roles and decision process | Required for incubation |
NOTICE | Apache 2.0 NOTICE file | List original copyright holder |
.mailmap | Canonical author identities | Required for clean contributor graph |
CHANGELOG.md | Semantic version history | Helps CLOMonitor score |
The Apache License 2.0 is required by CNCF for all hosted projects.
# Verify Apache 2.0 is present and unmodified
grep -c "Apache License, Version 2.0" LICENSE
The license must appear at the repo root. Do NOT modify the license text.
Credit the original corporate author in NOTICE, not in LICENSE.
CNCF requires DCO instead of a corporate CLA for contributor sign-off.
CONTRIBUTING.md must contain:
git commit -s or git commit --signoffgit rebase --signoff HEAD~N# Verify DCO enforcement action is present in CI
grep -r "DCO\|sign.off\|Signed-off-by" .github/workflows/
CNCF does NOT accept CLA bots as a substitute for DCO in sandbox projects.
Defines project roles and decision-making. Minimum structure:
## Roles
- **Maintainer**: merge rights, release authority
- **Reviewer**: PR review rights, no merge
- **Contributor**: anyone submitting PRs
## Decision Process
- Minor changes: single Maintainer approval
- Significant changes: consensus among active Maintainers
- Disputes: CNCF TOC mediation
## Maintainer List
See CODEOWNERS for current list.
Must provide a private disclosure path:
## Reporting a Vulnerability
Do NOT open a public GitHub issue for security vulnerabilities.
Report via: security@your-project.io (or GitHub private advisory)
Response SLA: 48 hours acknowledgement, 90 days disclosure window
CNCF rejects projects where the README:
Required badges for a healthy score:
[](LICENSE)
[](https://securityscorecards.dev/viewer/?uri=github.com/ORG/REPO)
[](https://clomonitor.io/projects/cncf/PROJECT)
# Check README and docs for internal-only content
grep -rn "\.viasat\.com\|ServiceNow\|internal\." docs/ README.md CONTRIBUTING.md \
| grep -v "<.*>" # placeholders are expected and OK
# Check for lead-capture forms or sales CTAs
grep -rni "contact sales\|request demo\|schedule a call\|enterprise plan" README.md docs/
| File | Status |
|---|---|
LICENSE | ✅ Apache 2.0 |
NOTICE | ✅ Present |
CONTRIBUTING.md | ✅ DCO model documented |
CODE_OF_CONDUCT.md | ✅ Contributor Covenant v2.1 |
SECURITY.md | ✅ Private disclosure via GitHub advisories |
GOVERNANCE.md | ✅ Roles and decision process defined |
CHANGELOG.md | ✅ Semantic versions v0.0.1–v2.0.0 |
.mailmap | ✅ Author identity map (3 verified, 3 TODO) |
cncf-migration-secrets-scrubber — scrub internal terms before releasecncf-migration-health-monitor — automated ongoing compliance checksMap internal corporate author identities (name + email) to public github.com identities using MCP-driven user lookup, then rewrite git history with git-filter-repo + .mailmap. Specific to CNCF OSS migration workflows.
Technically migrate a clean repository from GitHub Enterprise Server (GHES) to a public github.com org using squash-to-milestones or mirror-push, then configure branch protection and least-privilege RBAC. Specific to CNCF OSS migration.
Integrate CNCF CLOMonitor and OpenSSF Scorecard into CI/CD to continuously validate open-source project health after a GHES-to-github.com migration. Specific to CNCF OSS migration post-validation workflows.
Scan and strip hardcoded secrets, internal credentials, corporate hostnames, and proprietary naming from a GitHub Enterprise repo before it goes public. Specific to the Vionix CNCF migration workflow — do not use for general code review.
Create a new reusable composite GitHub Action with well-defined inputs/outputs that can be used by customer workflows.
File a Vionix LookinGlass mirror request for a github.com GitHub Action by filling out the IssueOps form at https://<git-host>/github/vionix-lookinglass/issues/new?template=mirrorrepo.yaml. Use this skill whenever the user asks to mirror a github.com repo/action into <git-host>, to "create a mirror request", "onboard a github action", or mentions vionix-lookinglass mirror issues — even if they only provide the upstream URL. It maps the user's intent to every form field, submits the issue with the gh CLI, and explains the follow-up IssueOps commands (@vionix validate, @vionix lgtm) and the GHAS exposed-secrets resume flow.