# GitHub Public Release Checklist

Tasks required before making clew-engine public on GitHub.

---

## Security

- [x] Add `SECURITY.md` — responsible disclosure policy, vulnerability reporting contact, and supported versions table
- [x] Fix Dockerfile `image.licenses` label — currently set to `MIT`, must be `AGPL-3.0-only` to match the actual license
- [x] Add Dependabot configuration (`.github/dependabot.yml`) — automated dependency vulnerability scanning for pip and GitHub Actions
- [ ] Enable GitHub secret scanning on the repository settings
- [x] Audit docker-compose.yml default credentials — add prominent warning comments that `neo4j/password` and `redis` defaults must be changed before any networked or production deployment
- [x] Verify no real API keys, tokens, or credentials exist anywhere in git history (use `git log -S` or `truffleHog`)

---

## GitHub Repository Files

- [x] Add `SECURITY.md` (see Security section above)
- [x] Add `CODE_OF_CONDUCT.md` — standard Contributor Covenant (required by most open source communities)
- [x] Add `.github/PULL_REQUEST_TEMPLATE.md` — structured PR description with checklist (motivation, changes, test plan, checklist)
- [x] Add `.github/ISSUE_TEMPLATE/bug_report.yml` — structured bug report template
- [x] Add `.github/ISSUE_TEMPLATE/feature_request.yml` — structured feature request template
- [x] Add `.github/ISSUE_TEMPLATE/config.yml` — disable blank issues, link to Discussions for questions
- [x] Add `CODEOWNERS` file — route PR review requests to appropriate maintainers by package/directory
- [x] Add `.github/dependabot.yml` — Dependabot config (see Security section)

---

## Repository Settings (GitHub UI)

- [ ] Set repository description (one-line summary matching README tagline)
- [ ] Set repository website/URL (docs site, or project homepage)
- [ ] Add repository topics/tags (e.g. `mcp`, `rag`, `code-search`, `ai`, `vector-search`, `neo4j`, `qdrant`, `python`)
- [ ] Configure branch protection on `main`: require PR + CI pass before merge, no direct pushes
- [ ] Enable GitHub Discussions — for Q&A and community support
- [ ] Enable GitHub Sponsorship if applicable (adds a Sponsor button)
- [ ] Review repository visibility settings (ensure no private forks or linked private repos are exposed)

---

## Licensing

- [x] Fix Dockerfile `image.licenses` label from `MIT` to `AGPL-3.0-only`
- [x] Verify all third-party dependencies are license-compatible with AGPL-3.0 (check each `pyproject.toml`)
- [x] Ensure `LICENSING.md` clearly explains the dual-license model (AGPL-3.0 for open source use, commercial license for proprietary use) so adopters understand their obligations

---

## Documentation

- [x] Add CI status badge to `README.md` (GitHub Actions CI workflow badge)
- [x] Add license badge to `README.md` (AGPL-3.0)
- [x] Add PyPI version badge to `README.md` once package is published
- [x] Promote CHANGELOG `[unreleased]` section to `[0.1.0] - 2026-02-18` (or actual release date) before tagging
- [x] Verify `.env.example` includes every environment variable referenced in the codebase — do a grep pass to confirm nothing is missing
- [x] Review README quick-start steps end-to-end — confirm a fresh user can follow them successfully (especially Docker Compose bring-up)
- [ ] Add code coverage badge to `README.md` once coverage reporting CI step is set up

---

## CI/CD

- [x] Add code coverage reporting step to `ci.yml` — upload to Codecov or similar, generate badge
- [x] Add Dependabot config (`.github/dependabot.yml`) for automated PRs on stale dependencies
- [x] Verify `release.yml` workflow runs cleanly end-to-end — test with a pre-release tag (e.g. `v0.1.0-rc1`) before the real release
- [x] Confirm all required CI secrets are documented — list in `CONTRIBUTING.md` or a `docs/maintainer-guide.md` so maintainers know what to configure (e.g. `PYPI_TOKEN`, Docker Hub credentials, etc.)
- [x] Remove or disable `clew-pr-analysis.yml` if it depends on a self-hosted Clew instance that won't be available for public forks — or add a guard so it only runs on the upstream repo

---

## Release

- [ ] Tag `v0.1.0` once all checklist items are complete
- [ ] Update `CHANGELOG.md` `[unreleased]` → `[0.1.0]` with the release date
- [ ] Verify the GitHub release created by `release.yml` includes correct binary artifacts for all target platforms (Linux/macOS, amd64/arm64)
- [ ] Publish `clew` package to PyPI and confirm `pip install clew` works
- [ ] Publish Docker images and confirm `docker compose up` works from a clean environment
- [ ] Test the installation script (`scripts/install.sh` or equivalent) on a clean machine

---

## Community Readiness

- [x] Add `CODE_OF_CONDUCT.md` (see GitHub Repository Files section)
- [x] Enable GitHub Discussions so users have a place for questions without filing issues
- [x] Review `CONTRIBUTING.md` — ensure the "first contribution" path is clear for external contributors who don't have internal context
- [ ] Consider pinning a "good first issue" label and tagging a few starter tasks in the issue tracker to encourage early contributions
