Agent Skills: open-source-audit + security-audit, and the repo-audits store (ADR-009)#68

Merged

tlmquintino merged 28 commits into

mainfrom

add-pre-publication-agent-skill

Jul 8, 2026

Commits on Jul 2, 2026

Commits on Jul 8, 2026

Review: portable skill format, capability-based model wording, docs check
tlmquintino
committed
Extend pre-publication skill: copied-code scan, security audit, re-runs
tlmquintino
committed
Add ADR-009 and wire skill/legal docs to the repo-audits store
tlmquintino
committed
ADR-009: note access is owners-only while maturing; repo-admin read access may come later
tlmquintino
committed
Add security-audit skill and wire it into the pre-publication gate
tlmquintino
committed
Rename pre-publication-check skill to open-source-audit
tlmquintino
committed
Add generic SECURITY.md template for ECMWF repositories
tlmquintino
committed
Address Copilot review comments
tlmquintino
committed
Refine audit skills from first real run (hydro-station-mapping)
tlmquintino
committed
open-source-audit: clarify weak-copyleft and UNKNOWN dependency licences
tlmquintino
committed
Keep audit skills agnostic to GitHub-native security services
tlmquintino
committed
docs(adr): add ADR-010 adopting SPDX licence identifiers and REUSE headers
tlmquintino
committed
docs(licensing): add SPDX/REUSE standard and copy-ready templates
tlmquintino
committed
docs(skills,legal): recommend SPDX/REUSE headers going forward
tlmquintino
committed
open-source-audit: add CITATION.cff + DOI as an advisory (should)
tlmquintino
committed
Consistency pass across PR items
tlmquintino
committed
Address Copilot review: SHA-pin CI template actions, drop ADR TODO
tlmquintino
committed
Accept ADR-009/ADR-010; SPDX/REUSE in force; add CITATION.cff example
tlmquintino
committed
docs(adr): add ADR-011 adopting PVR for coordinated vulnerability disclosure
tlmquintino
committed
docs(guidelines): add Security Vulnerability Disclosure procedure
tlmquintino
committed
docs(security): align SECURITY.md template and security-audit skill to PVR-first
tlmquintino
committed
security-audit: pipe syft SBOM into grype so the example is runnable
tlmquintino
committed
Address Copilot review: PVR visibility wording, explicit grype stdin
tlmquintino
committed
Address Copilot review: year placeholders in REUSE.toml and CITATION.cff
tlmquintino
committed
ADR-009: write access for owner-auditors, read access ECMWF-internal
tlmquintino
committed
open-source-audit: give the copied-code sweep greps an explicit search root
tlmquintino
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Agent Skills: open-source-audit + security-audit, and the repo-audits store (ADR-009)#68

Agent Skills: open-source-audit + security-audit, and the repo-audits store (ADR-009)#68
tlmquintino merged 28 commits into
mainfrom
add-pre-publication-agent-skill

Commits on Jul 2, 2026

Add pre-publication agent skill

Update copyright references from European Commission to European Union

Commits on Jul 8, 2026

Review: portable skill format, capability-based model wording, docs check

Extend pre-publication skill: copied-code scan, security audit, re-runs

Add ADR-009 and wire skill/legal docs to the repo-audits store

ADR-009: note access is owners-only while maturing; repo-admin read access may come later

Add security-audit skill and wire it into the pre-publication gate

Rename pre-publication-check skill to open-source-audit

Add generic SECURITY.md template for ECMWF repositories

Address Copilot review comments

Refine audit skills from first real run (hydro-station-mapping)

open-source-audit: clarify weak-copyleft and UNKNOWN dependency licences

Keep audit skills agnostic to GitHub-native security services

docs(adr): add ADR-010 adopting SPDX licence identifiers and REUSE headers

docs(licensing): add SPDX/REUSE standard and copy-ready templates

docs(skills,legal): recommend SPDX/REUSE headers going forward

open-source-audit: add CITATION.cff + DOI as an advisory (should)

Consistency pass across PR items

Address Copilot review: SHA-pin CI template actions, drop ADR TODO

Accept ADR-009/ADR-010; SPDX/REUSE in force; add CITATION.cff example

docs(adr): add ADR-011 adopting PVR for coordinated vulnerability disclosure

docs(guidelines): add Security Vulnerability Disclosure procedure

docs(security): align SECURITY.md template and security-audit skill to PVR-first

security-audit: pipe syft SBOM into grype so the example is runnable

Address Copilot review: PVR visibility wording, explicit grype stdin

Address Copilot review: year placeholders in REUSE.toml and CITATION.cff

ADR-009: write access for owner-auditors, read access ECMWF-internal

open-source-audit: give the copied-code sweep greps an explicit search root