Skip to content
github-actions

Policies

  • AI covenant nobody has checked this yet, still a draft
    The rules for AI-assisted work in github-actions: a contributor owns what they submit; a schema description says what its GitHub, SchemaStore or build-type source says and cites the page; GitHub’s documentation is cited, never copied; the SchemaStore copy is never edited; and the scheduled librarian works through pull requests a person approves, with least privilege.

  • License and attribution checked by automation only, still a draft
    Which license covers what in the github-actions repository: Apache-2.0 for the schema, the generated models and the code; SchemaStore’s two schemas under Apache-2.0 with JSON Schema Store’s notice; GitHub’s documentation, under CC BY 4.0, cited and never copied; the linkml-project-copier scaffolding under MIT; the KTL sidecar and site templates under Apache-2.0; and the bundle under CC BY 4.0.

  • Security policy nobody has checked this yet, still a draft
    How to report a vulnerability in github-actions (GitHub’s private vulnerability reporting, not a public issue), which release gets fixes, what the repository releases and runs, what holds each workflow, the ruleset that holds main, and the two repository settings not yet in force: required reviewers on the release Environment, and secret scanning with push protection.