open-source-releaselisted

# Going public: releasing a repo as open source **Read [`references/OPEN-SOURCE-RELEASE.md`](references/OPEN-SOURCE-RELEASE.md) before applying any of this.** That file is the standard; everything below it is a summary to help you decide whether this skill applies and to check your work afterwards. Reference-architecture principles: P5. ## What this standard covers - The ordering principle - Secrets: audit history, not just HEAD - LICENSE - README for a stranger - Registry package visibility - Repo metadata: description and topics ## Failure modes | Symptom | Cause | |---|---| | A HEAD-only secret scan reports clean, but the repo still isn't safe to publish | Scanner never ran against history; a credential in an old commit is invisible to a diff-only tool | | Rotated credentials still turn up in a public security scan | History was scrubbed without rotating first — the exposure window already happened regardless | | A consumer can't pull the published image | Registry package created private on first push; repo visibility does not flip it (§5) | | Outside contributors fork, then ask what they're allowed to do with the code | LICENSE added after the fact instead of before the first public commit | | A stranger opens the README and closes the tab | Written for a teammate with context, not for someone deciding whether to keep reading | ## Checklist - [ ] Full git history scanned for secrets, not just HEAD; any hit rotated before anything else happens - [ ] LICENSE