tracking: org-wide rollout — Release MVP / First-Time-Contributor, Scorecard ~10, security & branch protection everywhere

[mwaldheim]

Context

Follow-up to a full audit of semrel, semrel-docs, generator-changelog-html (+ condition-gitlab-ci, semrel-plugins) issues and PRs. Captures the remaining org-wide items that are too large for a single PR and need to be tracked centrally.

1. Release MVP + First-Time-Contributor everywhere

• Blocked on feat: pass contributor metadata to generator/notification plugins (enables First-Time-Contributor + Release MVP everywhere) #222 (core contributor-metadata contract / SEMREL_CONTRIBUTORS env var)
• Once feat: pass contributor metadata to generator/notification plugins (enables First-Time-Contributor + Release MVP everywhere) #222 lands, implement rendering in: generator-changelog-html#26, generator-changelog-md#34, generator-release-notes#27
• Then wire SEMREL_PLUGIN_FIRST_TIME_CONTRIBUTORS=true / SEMREL_PLUGIN_RELEASE_MVP=true into every plugin repo's own semrel-release.yaml (dogfooding) and document as the recommended default in semrel-docs.

2. Full workflow migration to semrel

Audit result: most first-party plugin repos (condition-gitlab-ci, generator-*, updater-npm, updater-go, hook-slack, provider-github, …) already self-release via semrel-release.yaml — no action needed there. Gaps found:

• publisher-generic-http, publisher-oci, packager-nfpm still use sync-template.yml/plain release.yml instead of a semrel-release.yaml dogfooding workflow — migrate these three.
• Re-verify plugin-template produces a correct semrel-release.yaml for newly scaffolded plugins so this stays consistent going forward.

3. OpenSSF Scorecard → ~10

Current semrel score: 7.2. Gaps identified:

• Signed-Releases (was 0): fixed in feat(release): sign release checksums with cosign (keyless) #223 — re-verify score after next scan.
• Code-Review (0) / Maintained (0): these are rolling-window checks over recent commit history; will improve automatically now that branch protection enforces 1 required review on every repo (see Release rules: YAML config file and branch-based rules #4) — needs a few weeks of PR-only activity to reflect.
• CII-Best-Practices (0): requires manually registering the project at https://www.bestpractices.dev — needs a human with org authority to create the account/apply; not automatable via API.
• Pinned-Dependencies (7): GitHub Actions are already SHA-pinned; remaining gap likely in Docker base images / transitive tooling — needs a follow-up audit.
• Run the same audit (api.scorecard.dev/projects/github.com/SemRels/<repo>) for every repo once each has a few scorecard runs recorded, and file per-repo fix-up issues for whatever scores <8.

4. Security, badges, branch protection — repo audit

• Branch protection (required PR + 1 review, no force-push/deletion) is now enabled on every public repo in the org that previously lacked it: generator-changelog-html, generator-release-notes, generator-changelog-md, publisher-generic-http, publisher-oci, packager-nfpm, plugin-template. All other public repos already had it.
• semrel-marketing and docker-registry are private repos — GitHub does not allow branch protection rules on private repos without a paid org plan (Team/Enterprise). Needs a billing decision, not code.
• Badge audit still open: confirm every repo's README has License, CI, OpenSSF Scorecard, and REUSE badges (semrel's README already has all of these — use it as the template). File per-repo issues for any missing badge once audited.
• semrel-docs has 13 open Dependabot security alerts (1 high, 7 moderate, 5 low) — needs a dependency-bump pass.

5. PR-only workflow going forward

All changes from this audit were made via PR (or, where the bot token lacked workflow scope to merge PRs touching .github/workflows/*, via a direct signed push with an explanit closing comment on the superseded PR — see condition-gitlab-ci#27/#24, semrel#212/#214, generator-changelog-html#24/27/28/29). Recommend granting the automation token workflow scope so future workflow-file PRs can be merged through the standard API path instead.

[mwaldheim]

Update: actionable items completed

• Item 1 (contributor MVP everywhere): feat: pass contributor metadata to generator/notification plugins (enables First-Time-Contributor + Release MVP everywhere) #222 landed (SEMREL_CONTRIBUTORS core contract). Rendering already shipped in generator-changelog-html#26 and generator-changelog-md#34; generator-release-notes#27 was found closed without an actual implementation on audit — reopened and implemented (merged). All three generators now support SEMREL_PLUGIN_NEW_CONTRIBUTORS/SEMREL_PLUGIN_MVP (or html's FIRST_TIME_CONTRIBUTORS/RELEASE_MVP synonyms). Plugins don't self-generate changelogs for their own dogfood releases (no generator configured in their own .semrel.yaml), so there's nothing further to "wire into every plugin's semrel-release.yaml" — that part of the task doesn't apply as originally scoped.
• Item 2 (workflow migration): publisher-generic-http, publisher-oci, packager-nfpm migrated to semrel-release.yaml self-release. plugin-template fully rewritten from the outdated gRPC scaffold to the current subprocess model, with its own semrel-release.yaml/.semrel.yaml (plugin-template#14). Follow-up: a hardcoded Dockerfile OCI-label bug from that migration incorrectly propagated via sync-template.yml into ~19 plugin repos — fixed in plugin-template#15, bad sync PRs closed org-wide, branches cleaned up.
• Item 3 (Scorecard) and the CII-Best-Practices / private-repo billing parts of item 4 remain non-automatable (need a human with org/billing authority, or time for rolling-window metrics to reflect). Leaving as-is.
• Item 5 (PR-only workflow): still blocked on the automation token lacking workflow scope — recommend granting it so future workflow-file PRs merge through the normal API path instead of the local-merge workaround used throughout this effort.

Also: org-wide sweep confirms 0 open PRs and 0 stray branches across all 51 repos as of now. Only #220 (blocked on the 5-month awesome-go history requirement, see its own comment) and this tracking issue remain open.

[mwaldheim]

Follow-up: found and fixed real CI failures (self-audit after user question)

A deeper audit (actually checking gh run list conclusions, not just PR/branch/issue state) turned up 3 genuine bugs introduced during this effort's plugin-creation work, affecting CI green-ness org-wide:

1. Semrel Release workflow failing in 40 repos — the semrel release tarball's leading ./ entry has mode 0700; extracting it directly into /tmp made tar try to chmod/utime /tmp itself, which the Actions runner isn't permitted to do (Cannot utime: Operation not permitted). Fixed by extracting into a dedicated /tmp/semrel-dl subdir in all 40 affected semrel-release.yaml files (PRs merged in each repo).
2. updater-composer Security/REUSE check failing — its .reuse/dep5 used schema/**/*.json, which doesn't match a file directly under schema/ (needs ≥1 subdirectory for **), so schema/v1.json had no recognized license info. Fixed to schema/*.json (matching every sibling repo's pattern).
3. condition-circleci and condition-bitbucket-pipelines CI failing on the go1.25 matrix leg — their go.mod declared go 1.26.4 (the exact local dev-machine toolchain version) instead of the org's minimum-supported go 1.25, so go mod download refused to run under go1.25 (go.mod requires go >= 1.26.4). Fixed in both.

Verified: re-ran a full org-wide check of the latest workflow run on main for all 51 repos — all conclusions are now success (the only repos with no runs are semrel-marketing, semrel-api, docker-registry — no workflows configured — and governance-template, a docs-only template repo). 0 open PRs, 0 stray branches org-wide.

Lesson for future automation: don't just check PR-merged/issue-closed state — verify actual CI run conclusions after merging, especially for cross-cutting template/scaffold changes that fan out via sync-template.yml.

[mwaldheim]

Status: #242, SemRels/publisher-generic-http#8, SemRels/publisher-oci#8, SemRels/packager-nfpm#8, and SemRels/plugin-template#18 are under review. They harden CI, integration, dependency pins, and release delivery. CII registration, rolling Scorecard results, billing, the badge audit, token scope, and final graph/check completion remain outstanding.