# Open Source Release

> Use when moving a repository from private to public. The one-time gate that ongoing hygiene rules do not cover, ordered around the history-aware secret audit that cannot be fixed after the fact, plus licensing, the stranger-facing surface, and repo description and topics.

- Skill: `konradcinkusz/open-source-release` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add konradcinkusz/open-source-release`
- Raw SKILL.md: https://api.skillmd.com/api/skills/konradcinkusz/open-source-release/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: konradcinkusz (https://skillmd.com/u/konradcinkusz)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/konradcinkusz/open-source-release

---


# Going public: releasing a repo as open source

**Read [`references/OPEN-SOURCE-RELEASE.md`](references/OPEN-SOURCE-RELEASE.md) before applying any of this.**
That file is the standard; everything below it is a summary to help you decide
whether this skill applies and to check your work afterwards.

Reference-architecture principles: P5.

## What this standard covers

- The ordering principle
- Secrets: audit history, not just HEAD
- LICENSE
- README for a stranger
- Registry package visibility
- Repo metadata: description and topics

## Failure modes

| Symptom | Cause |
|---|---|
| A HEAD-only secret scan reports clean, but the repo still isn't safe to publish | Scanner never ran against history; a credential in an old commit is invisible to a diff-only tool |
| Rotated credentials still turn up in a public security scan | History was scrubbed without rotating first — the exposure window already happened regardless |
| A consumer can't pull the published image | Registry package created private on first push; repo visibility does not flip it (§5) |
| Outside contributors fork, then ask what they're allowed to do with the code | LICENSE added after the fact instead of before the first public commit |
| A stranger opens the README and closes the tab | Written for a teammate with context, not for someone deciding whether to keep reading |

## Checklist

- [ ] Full git history scanned for secrets, not just HEAD; any hit rotated before anything
      else happens
- [ ] LICENSE chosen and committed before the first public commit
- [ ] README opens with what/why in two sentences; quick start runs end to end from a clone
      with zero unwritten prerequisites; reuse shape documented if the repo is meant to be
      consumed by others
- [ ] Registry package visibility checked and flipped after the first publish, separately
      from repo visibility
- [ ] Description and topics set
- [ ] If history can't be made clean cheaply, a fresh-history repo was considered before a
      history rewrite

---

Generated from [`docs/guides/OPEN-SOURCE-RELEASE.md`](https://github.com/konradcinkusz/architecture-standards/blob/main/docs/guides/OPEN-SOURCE-RELEASE.md) by `scripts/build-marketplace.mjs`. Do not edit this file: change the source document, or its entry in `catalog/marketplace.catalog.json`, and re-run the generator.