Repository navigation
chore: add open-source policy files (NOTICE, SECURITY, CONTRIBUTING) - #122
Conversation
Prepare the repository for open source: a NOTICE with the copyright holder, a security policy with a private disclosure route (GitHub private vulnerability reporting and security@agentrelay.com), and contributor guidelines. Declare Apache-2.0 in each package.json (and the matching lockfile entries) so published packages carry license metadata. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
 [Medium impact] The PR appears safe to merge.
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
- SECURITY.md: email is the preferred channel until GitHub private vulnerability reporting is enabled; supported-versions wording fits what this repo ships. - CONTRIBUTING.md: describe what CI and fork pull requests actually do. - Drop NOTICE: this repo has no third-party attributions to carry, so a NOTICE would only add a redistribution obligation. - Copy LICENSE into each published package so npm tarballs carry it. - README: the license is Apache-2.0 (it said MIT). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
Devin Review found 1 potential issue.
1 flag not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)
There was a problem hiding this comment.
All reported issues were addressed across 11 files (changes from recent commits).
Reply with feedback, questions, or to request a fix.
View guided diff | Re-trigger cubic
- CONTRIBUTING: the no-secrets guarantee applies to fork pull requests. - Package LICENSE copies carry the copyright line (root LICENSE verbatim where it has one). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
All reported issues were addressed across 8 files (changes from recent commits).
Reply with feedback, questions, or to request a fix.
View guided diff | Re-trigger cubic
The root LICENSE here is a trimmed variant (no appendix, reworded definition). Ship the unmodified apache.org text in each package, with the copyright line filled in. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
What
Open-source readiness prep (part of the self-host open-source review, 2026-11-03). This PR changes no runtime code.
SECURITY.md: private disclosure through GitHub private vulnerability reporting or security@agentrelay.com, response targets, scope.
CONTRIBUTING.md: how to build and test, PR expectations (no secrets, customer data or production identifiers in fixtures), and the inbound=outbound Apache-2.0 contribution terms.
package.json license fields:
"license": "Apache-2.0"on each workspace package and the matching `package-lock.json` workspace entries (no dependency changes). The published npm packages currently carry no license metadata.CI hardening:
contract.ymlgets an explicit top-levelpermissions: contents: read, so it no longer inherits the default token scope on pull requests.NOTICE: not added. This repo has no third-party attributions, and a NOTICE would oblige every redistributor to carry it. Published packages instead ship a LICENSE copy (canonical Apache-2.0 text).
Not in this PR (needs an admin)
Branch protection / rulesets on main, environment protection rules, and enabling private vulnerability reporting are repository settings; they are listed in the open-source readiness report for Khaliq.
🤖 Generated with Claude Code
Open in [code]smith · Need help on this PR? Tag
@codesmith-botwith what you need.