mirror of
https://github.com/trailofbits/skills.git
synced 2026-09-14 14:28:48 +08:00
Evan Sultanik
0cb5f95840
* Add open-sourcing plugin Skill for preparing a repository for public release, generalized from the internal open-sourcing guide. Generic workflow (secrets audit, licensing, docs, CI, release automation) with a Trail of Bits policy overlay loaded via git-remote/committer-email detection. Includes per-language packaging references and readiness-check scripts. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Modernize open-sourcing skill to current toolchain practice Align guidance with the current cookiecutter-python toolchain and 2026 ecosystem state, verified against primary sources: respect-existing- tooling principle (warn on stale toolchains, adopt modern defaults only when absent), SLSA provenance job in the PyPI release workflow, ty pre-1.0 pinning caveat, uv audit/interrogate, rulesets wording, Dependabot grouping and cooldown, and a new JavaScript/TypeScript reference covering npm trusted publishing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Dan Guido <dan@trailofbits.com>
open-sourcing
Prepares a repository for public open-source release.
Based on Trail of Bits' internal open-sourcing guide, generalized for any project. Covers the full path from private repository to public release:
- Secrets hygiene first: full-history scanning, the fresh-repository rule for repos that ever held credentials, and the non-git surfaces (Actions logs, releases, wikis) that go public with the code
- Licensing: selection criteria (permissive vs. copyleft vs. Creative Commons), SPDX metadata consistency, and fork/relicensing rules
- Documentation and community files: README contents, CONTRIBUTING, SECURITY.md, code of conduct
- CI and repository settings: required checks, branch protection, Dependabot/Renovate, workflow hardening (SHA pinning, least-privilege permissions, zizmor)
- Release automation: semver tagging, CI-driven releases, trusted publishing
- Language-specific packaging references for Python, C/C++, Rust, Go, JavaScript/TypeScript, and Ruby
Organization detection
The skill detects Trail of Bits repositories (via git remotes in the
trailofbits/lifting-bits/crytic GitHub organizations, or
@trailofbits.com committer emails) and applies the company's license policy
and publishing conventions on top of the generic workflow. All other
repositories get the generic guidance. Only public information is included in
the Trail of Bits profile; internal process details remain in internal
documentation.
Usage
Ask Claude to:
- "Prepare this repository for public release"
- "Open source this project"
- "Is this repo ready to be made public?"
- "Help me choose a license for this project"
- "Set up release automation before we publish this"
Contents
skills/open-sourcing/
├── SKILL.md # Release-readiness workflow
├── references/
│ ├── licensing.md # License selection and mechanics
│ ├── trailofbits.md # Trail of Bits policy overlay
│ ├── python.md # Publishing (defers to modern-python skill)
│ ├── c-cpp.md # CMake, sanitizers, clang tooling, vcpkg
│ ├── rust.md # cargo, crate lints, crates.io
│ ├── go.md # Module layout, golangci-lint, goreleaser
│ ├── javascript.md # package.json metadata, npm trusted publishing
│ └── ruby.md # Bundler, RuboCop, RubyGems
└── scripts/
├── detect_org.sh # Organization profile detection
└── check_readiness.sh # Release-readiness indicators