Skip to content

docs: NOTICE, SPDX, security policy, DCO, governance, support and conduct - #571

Merged
MaksymStoianov merged 7 commits into
developfrom
docs/governance-legal
Nov 3, 2026
Merged

MaksymStoianov merged 7 commits into
developfrom
docs/governance-legal

Conversation

@MaksymStoianov

Copy link
Copy Markdown
Member
  • NOTICE (shipped), SPDX-License-Identifier in all 337 src/ files (docs generator, verify-examples and sync scripts unaffected).
  • SECURITY.md: GitHub private vulnerability reporting (enabled) as the main channel, security@maksymstoianov.com as an alternative; acknowledgement 5 business days, assessment 14 days, critical/high fix 30 days.
  • DCO 1.1 in CONTRIBUTING + dco.yml check (same as bootgs/boot, release PRs develop → main not re-checked).
  • GOVERNANCE, MAINTAINERS, CODEOWNERS, SUPPORT (incl. moving from 2.x / apps-script-utils to 3.x / @bootgs/utils), Contributor Covenant 2.1, PR template, TRADEMARKS.md, docs/tools-and-ai.md, docs/privacy.md (no network calls in src).

🤖 Generated with Claude Code

MaksymStoianov and others added 7 commits November 3, 2026 16:51
Records the copyright, the Apache-2.0 licence, the separate terms of the
banner artwork and the trademark notice. package.json now publishes it
next to dist.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Maksym Stoianov <stoianov.maksym@gmail.com>
Every file under src/ starts with // SPDX-License-Identifier: Apache-2.0.
The line is not JSDoc, so the generated documentation is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Maksym Stoianov <stoianov.maksym@gmail.com>
Supported versions follow the rename: 3.x as @bootgs/utils once 3.0.0
is released, and security fixes for the 2.x line of apps-script-utils
for 3 months after that. Reports go through GitHub private
vulnerability reporting or security@maksymstoianov.com, with response
targets of 5 business days, 14 days and 30 days.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Maksym Stoianov <stoianov.maksym@gmail.com>
CONTRIBUTING.md quotes the Developer Certificate of Origin 1.1 and
explains git commit -s. The dco workflow fails a pull request whose
commits lack a Signed-off-by trailer matching their author; bot commits
and merges are skipped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Maksym Stoianov <stoianov.maksym@gmail.com>
GOVERNANCE.md covers decisions, releases and continuity; MAINTAINERS.md
and .github/CODEOWNERS name the lead maintainer; SUPPORT.md gives the
support policy and tells 2.x users of apps-script-utils how to move to
@bootgs/utils 3.x.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Maksym Stoianov <stoianov.maksym@gmail.com>
Replaces version 1.4 with the verbatim text of version 2.1; the
enforcement contact stays the same.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Maksym Stoianov <stoianov.maksym@gmail.com>
docs/tools-and-ai.md describes how AI assistants are used and the rules
for them; docs/privacy.md states that the library makes no network
calls of its own and collects no data; TRADEMARKS.md adds guidance on
the Boot.gs and @bootgs names.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Maksym Stoianov <stoianov.maksym@gmail.com>
@MaksymStoianov
MaksymStoianov merged commit 2cd5a8a into develop Nov 3, 2026
14 checks passed
@MaksymStoianov
MaksymStoianov deleted the docs/governance-legal branch November 3, 2026 17:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant