Open-source readiness audit: no LICENSE, hardcoded repo1.dso.mil default, internal docs, history scan

[dgershman]

Question

Is there anything in this repo that would prevent it from becoming open source?

I audited the current main tree (shallow clone, 167 files). Short answer: one hard blocker, four disclosure decisions, and one check that still has to be run. No secrets found.

1. Hard blocker — there is no LICENSE

gh repo view reports licenseInfo: null, and there is no LICENSE* file in the tree. Making the repo public without one does not make it open source — with no license, default copyright applies and nobody may use, modify, or redistribute it.

Action: pick a license (MIT or Apache-2.0; Apache-2.0 if you want the explicit patent grant) and add LICENSE. Add a short License section to README.md.

2. repo1.dso.mil is the hardcoded default host

Not a legal blocker — repo1.dso.mil is a public-facing DoD GitLab — but it's baked into shipped code, not just fixtures:

File	What
internal/config/config.go:50	Host: "repo1.dso.mil" — the default config value
glkcli/init.go:13	host = "repo1.dso.mil" in the scaffolded config template
glkcli/artifacts.go:26	"repo1.dso.mil": { — host allowlist entry
glkcli/work_items.go:13	help URL pinned to that host

It appears in ~25 files overall including README.md, ARCHITECTURE.md, skill/SKILL.md, and the test suite.

Decision required: publishing this advertises that Radius Method works Platform One / Big Bang, and makes the tool read as single-tenant rather than a general GitLab CLI. Either (a) keep it as a documented default, or (b) make host required with no default and move repo1 to an example. Option (b) is the better OSS posture and is a small change; config_test.go asserts the default in three places and would need updating with it.

3. The PRD is internal product content

gitlab-kiosk-prd.md opens with the tool's purpose framed around "Platform One / DoD GitLab" and "Claude Code needs frequent read access to repo1.dso.mil during Platform One / Big Bang work", plus the rationale for replacing a prior MCP server. 14 dso.mil references.

Action: remove it from the public repo, or rewrite as a neutral DESIGN.md without the engagement framing.

4. docs-local/ is internal ops notes

docs-local/macos-go-test-approval-repro-2026-04-13.md documents reproducing "the real operator pain on managed macOS" — managed-device execution policy details. Internal troubleshooting, not user-facing.

Action: drop the directory (or move it out of the repo).

5. Packaging assumes a private repo

Formula/gitlab-kiosk.rb uses SSH URLs:

url "ssh://git@github.com/radiusmethod/gitlab-kiosk.git"
head "ssh://git@github.com/radiusmethod/gitlab-kiosk.git", branch: "main"

That works for a private repo with keys configured; a public formula should build from HTTPS or release tarballs so anyone can brew install. Also review .goreleaser.yml and .github/workflows/release.yml for private-tap assumptions and org-scoped secrets.

What is already clean — no action needed

• No secrets. Every glpat- occurrence is a placeholder (glpat-xxxxxxxxxxxxxxxxxxxx in README.md:242 and glkcli/init.go:17) or a test literal (glpat-secret in internal/gitlab/client_test.go). .envrc.example contains only commented placeholders.
• Recorded HTTP fixtures are scrubbed. testdata/fixtures/*.json and internal/vcr/testdata/*.json reference repo1.dso.mil but contain no auth headers, tokens, or email addresses. The recorded content is public projects (Big Bang, Kyverno).
• Dependencies are permissive. BurntSushi/toml (MIT), spf13/cobra + pflag (Apache-2.0), go.yaml.in/yaml/v3, modernc.org/sqlite (BSD-3). No copyleft. A formal go-licenses inventory is still worth generating for the record.
• AGENTS.md / CLAUDE.md are fine to publish in principle — give them a read for internal workflow references before flipping the switch.

6. Still to run — git history scan

This audit covered the current tree only (git clone --depth 1), so it says nothing about history. A credential committed and later removed is still public once the repo is. Run gitleaks detect or trufflehog git over full history before changing visibility, and if anything turns up, plan a history rewrite or a fresh-history re-publish rather than a simple flip.

Acceptance criteria

• LICENSE exists and README.md states the license.
• A decision on Implement GitLab HTTP client with safety invariants and optional token #2 is recorded in the PR, and if option (b) is chosen the default is removed and config_test.go updated.
• gitlab-kiosk-prd.md and docs-local/ are removed or rewritten for a public audience.
• Homebrew formula and release workflow work for an unauthenticated user.
• A full-history secret scan has been run and its result is reported on this issue.
• No change to the fixtures is required unless the history scan says otherwise.

🐦‍⬛ Created with Crow via Claude Code

[dgershman]

Full-history secret scan — clean, no rewrite needed

Ran the required history scan in PR #108. The audit in this issue covered only the current tree (shallow clone); this ran over all 165 commits with two independent scanners.

Scanner	Scope	Result
gitleaks 8.30.1	165 commits, ~953 KB	1 finding — false positive
TruffleHog 3.96.0	1,344 chunks, ~1.01 MB	0 verified, 0 unverified

The one gitleaks finding is a false positive

Rule generic-api-key, at glkcli/artifacts_test.go:203, commit 2cb129183f9ada935862ea04179bbf7c046f8f74 ("Add bulk artifact archive download"). The matched text:

content, err := os.ReadFile(filepath.Join(dir, "pod_logs", "keycloak", "keycloak-0.txt"))

The rule fired on the string literal keycloak-0.txt — 26 characters, entropy 3.52 — because it follows the word keycloak. It is a test asserting the path of an extracted pod log, not a credential. TruffleHog, which verifies candidate secrets against live providers, found nothing at all.

No credential was ever committed. No history rewrite or fresh-history re-publish is required.

Acceptance criteria status

• LICENSE exists and README.md states the license — Apache-2.0
• Decision on Implement GitLab HTTP client with safety invariants and optional token #2 recorded in the PR — option (b): default removed, host required, config_test.go updated
• gitlab-kiosk-prd.md and docs-local/ removed
• Homebrew formula and Makefile tap URL work for an unauthenticated user (SSH → HTTPS)
• Full-history secret scan run and reported (this comment)
• No fixture changes required — the scan did not say otherwise

Two bugs the host change surfaced

Worth noting since they weren't in the original audit:

1. grec checkout built a hostless clone URL. With no configured host it produced https:///big-bang/bigbang.git and passed it to git. Now guarded.
2. glk doctor reported an empty host as healthy (gitlab host ok (source: default)). Now an error that counts as a problem.

Still open — deliberately not done

Repository visibility has not been changed. That flip is irreversible in practice (forks, caches, mirrors persist) and is yours alone to make. Everything else in this issue is ready in #108.

Two optional follow-ups: a go-licenses inventory for the record (all deps are already MIT / Apache-2.0 / BSD-3, no copyleft), and a human read of AGENTS.md / CLAUDE.md for internal workflow references.

🐦‍⬛ Generated with Claude Code, orchestrated by Crow