Prepare the repo for public access

[alvahdean]

Ensure branch security is adequate
Require PRs for merges into main
Provide adequate documentation

[alvahdean]

Public Repository Readiness Plan

Summary

Prepare FileClerk for public access with contributor documentation, reproducible builds, protected pull-request workflows, dependency and source-code security controls, and explicit licensing/privacy release gates. Application APIs, schemas, and runtime behavior remain unchanged.

Repository Content and Reproducibility

• Expand README.md with purpose, early-development status, current versus planned capabilities, ABP/.NET/Angular compatibility, repository layout, clean-clone setup, build/test commands, roadmap, contribution, security, and MIT license links.
• Add community files under .github/, adapting Starbender.Mazer conventions:
  • CODEOWNERS assigning @alvahdean.
  • Contribution guide targeting PRs to main.
  • Code of conduct and security policy using GitHub private vulnerability reporting.
  • Bug/feature issue templates, security routing, and a PR checklist.
• Pin toolchains:
  • Add global.json using .NET SDK 10.0.100 with latestPatch roll-forward.
  • Add .nvmrc and npm engines for Node 22.12.0, compatible with Angular 21.2. Angular compatibility
• Make the Angular workspace publicly reproducible:
  • Remove the unused @volo/abp.commercial.ng.ui dependency from the workspace manifest, library manifest, and ng-packagr allowlist.
  • Normalize the private workspace package name to a valid lowercase name.
  • Generate and commit package-lock.json.
  • Update Angular prerequisites and commands.
  • Verify npm ci, lint, and production library build from a clean clone.
• Add weekly Dependabot updates for NuGet under /src, npm under /src/angular, and GitHub Actions at /.

Licensing, Exposure, and Privacy Gates

• Before publication, obtain written confirmation from ABP/Volosoft that the generated application/module scaffold may be published under this repository’s MIT license. Commercial packages or source must not be published. ABP licensing FAQ
• Audit all tracked source and generated metadata to confirm no commercial ABP package contents, licensed templates, credentials, private configuration, or incompatible third-party code are committed.
• Run Gitleaks against the complete Git history and inspect every local/remote branch, tag, object, closed PR/issue, attachment, and workflow log that will become public.
• Produce an exposure report listing commit author/committer names and emails. The repository owner must explicitly approve that report before publication.
  • If the existing Gmail addresses are not approved, rewrite all matching author and committer emails to 14276880+alvahdean@users.noreply.github.com with git filter-repo.
  • Force-update every active branch before branch protection is enabled, then repeat the secret and object audits.
• Treat failed licensing confirmation, unresolved secret findings, or unapproved personal data as hard blockers to changing visibility.

CI, Dependency Review, and Branch Security

• Add a least-privilege CI workflow for PRs and pushes to main, plus manual dispatch:
  • .NET build and test: restore, Release build, and tests for src/Starbender.FileClerk.slnx.
  • Angular build: use Node 22.12, run npm ci, lint, and production build.
  • Dependency review: run GitHub’s dependency review action on PRs and reject newly introduced vulnerable dependencies. GitHub dependency review
  • Pin all actions to immutable commit SHAs, grant contents: read only, and cancel superseded runs.
• Create an active repository ruleset targeting main:
  • Require pull requests, strict branch freshness, and successful CI / .NET build and test, CI / Angular build, and CI / Dependency review checks.
  • Require all review conversations to be resolved.
  • Permit squash merges only and require linear history.
  • Block branch deletion and force/non-fast-forward pushes.
  • Configure no bypass actors, including administrators.
  • Initially require zero approvals because the repository has one maintainer; CODEOWNERS still requests review automatically.
• Enable automatic source-branch deletion, allow PR branch updates, and restrict Actions to GitHub-owned actions.
• Enable dependency alerts/security updates, secret scanning with push protection, CodeQL default setup for C# and JavaScript/TypeScript, and private vulnerability reporting.

Rollout and Acceptance

1. Complete licensing, history, exposure, and privacy gates while the repository remains private.
2. Open the documentation/reproducibility/CI PR and let all three CI checks run successfully.
3. Activate the ruleset with those exact status checks, then merge through the protected PR path.
4. Verify a test PR cannot merge with stale code, failed checks, or unresolved conversations, and confirm direct/force pushes and deletion of main are rejected.
5. Confirm clean-clone .NET and Angular builds, valid workflow/Dependabot YAML, recognized community files, successful CodeQL analysis, private vulnerability reporting, and Dependabot operation.
6. Change visibility to public only after every gate passes.
7. Verify anonymous access while logged out, review the public Security and Insights surfaces, and close issue Prepare the repo for public access #14 with links to the ruleset, CI runs, documentation, audit results, and enabled controls.

Assumptions

• The repository becomes public only after all gates pass.
• The commercial Angular dependency is removed because source inspection confirms it is declared but unused.
• Personal email exposure requires explicit owner approval; the noreply rewrite path is mandatory if approval is withheld.
• Release signing, SBOMs, artifact attestations, DCO/CLA policy, and formal support/versioning policies remain follow-up work until public packages are produced.
• Once a second maintainer exists, the ruleset will be raised to one required approval with mandatory CODEOWNER review.

[alvahdean]

Publication risk acceptance

The repository owner has explicitly accepted the following risks for this publication:

• Historical commits and cached GitHub objects may continue to expose alvahdean@gmail.com; the GitHub Support purge is deferred and is no longer a blocker for this publication.
• Written ABP/Volosoft confirmation for publishing the generated scaffold and .abppkg metadata under MIT is being waived for now; the associated licensing uncertainty is accepted by the repository owner.

These decisions do not waive the remaining technical controls. Before changing visibility, the rollout will still:

• require the Container stack status check on main;
• merge and validate the currently open Dependabot updates;
• repeat the secret/object audit while treating the accepted Gmail address as personal-data exposure rather than a secret finding;
• verify clean CodeQL and secret-scanning state;
• enable and verify private vulnerability reporting immediately after publication;
• verify anonymous repository access and the public Security surfaces.

[alvahdean]

Publication rollout completed on 2026-08-06.\n\nEvidence:\n- Repository visibility is now public: https://github.com/Starbender-Systems/Starbender.FileClerk\n- Final published main SHA: \n- Final CI passed, including .NET, Angular, Container stack, and Dependency review: https://github.com/Starbender-Systems/Starbender.FileClerk/actions/runs/31073482103\n- Final CodeQL passed and there are zero open code-scanning alerts: https://github.com/Starbender-Systems/Starbender.FileClerk/actions/runs/31073481978\n- There are zero open secret-scanning alerts.\n- Gitleaks 8.30.1 found no leaks in the working tree or across all fetched branch, tag, and pull-request refs.\n- The active main ruleset has no bypass actors, requires strict branch freshness plus all four CI checks, requires PRs and resolved conversations, permits squash merges only, and blocks deletion/non-fast-forward pushes: https://github.com/Starbender-Systems/Starbender.FileClerk/rules/20483777\n- Controlled live probes previously confirmed that direct, force, and deletion pushes to main are rejected and leave main unchanged.\n- CodeQL default setup is configured for Actions, C#, JavaScript, and TypeScript.\n- Secret scanning with push protection, Dependabot security updates, read-only workflow permissions, GitHub-owned Actions only, automatic branch deletion, and PR branch updates are enabled.\n- Private vulnerability reporting is enabled. The public advisory route resolves to GitHub authentication rather than 404: https://github.com/Starbender-Systems/Starbender.FileClerk/security/advisories/new\n- Anonymous repository browsing, Git access, Security, and Insights surfaces were verified.\n- GitHub recognizes the README, MIT license, code of conduct, contribution guide, pull-request template, and security policy.\n- The accepted dependency changes were incorporated through merged PRs #31, #35, #36, #37, #38, #39, and #40. PRs #32-#34 and #41-#42 were redundant after those central/coordinated upgrades and were closed as superseded.\n- Two medium, development-only transitive Dependabot alerts remain visible: through Angular's dev-server toolchain and through Angular CLI. Their patched major versions are not currently selected by the upstream chains; no incompatible override or alert dismissal was used.\n- Owner acceptance of historical Gmail exposure and waiver of the ABP permission gate are recorded here: https://github.com/Starbender-Systems/Starbender.FileClerk/issues/14#issuecomment-5200331067\n\nClosing this publication-readiness issue as complete.

[alvahdean]

Correction to the closure evidence: the final published main SHA is 3ceeee5. The two remaining medium development-only transitive alerts are uuid, through the Angular dev-server toolchain, and @hono/node-server, through Angular CLI.