konradcinkusz Going public: releasing a repo as open source
Read references/OPEN-SOURCE-RELEASE.md before applying any of this.
That file is the standard; everything below it is a summary to help you decide
whether this skill applies and to check your work afterwards.
Reference-architecture principles: P5.
What this standard covers
- The ordering principle
- Secrets: audit history, not just HEAD
- LICENSE
- README for a stranger
- Registry package visibility
- Repo metadata: description and topics
Failure modes
| Symptom | Cause |
|---|---|
| A HEAD-only secret scan reports clean, but the repo still isn't safe to publish | Scanner never ran against history; a credential in an old commit is invisible to a diff-only tool |
| Rotated credentials still turn up in a public security scan | History was scrubbed without rotating first — the exposure window already happened regardless |
| A consumer can't pull the published image | Registry package created private on first push; repo visibility does not flip it (§5) |
| Outside contributors fork, then ask what they're allowed to do with the code | LICENSE added after the fact instead of before the first public commit |
| A stranger opens the README and closes the tab | Written for a teammate with context, not for someone deciding whether to keep reading |
Checklist
- Full git history scanned for secrets, not just HEAD; any hit rotated before anything else happens
- LICENSE chosen and committed before the first public commit
- README opens with what/why in two sentences; quick start runs end to end from a clone with zero unwritten prerequisites; reuse shape documented if the repo is meant to be consumed by others
- Registry package visibility checked and flipped after the first publish, separately from repo visibility
- Description and topics set
- If history can't be made clean cheaply, a fresh-history repo was considered before a history rewrite
Generated from docs/guides/OPEN-SOURCE-RELEASE.md by scripts/build-marketplace.mjs. Do not edit this file: change the source document, or its entry in catalog/marketplace.catalog.json, and re-run the generator.