Travis Herbranson 236616514f Add repo-hygiene-audit skill (Phase 7: repeatable hygiene sweep)

Read-only scripted audit across homelab/pbs/docker/root domains:
git auditability + .git ownership/dubious, .env perms (0660/devprojects),
inline compose secrets, non-git dirs, uv-init stubs, compose naming,
master-vs-main default, dirty trees, worktrees, herbygitea residue, doc
presence. Emits text/json/md findings mapped to remediation-plan phases.

SKILL.md + scripts/audit.py (stdlib-only) + references + packed .skill.
First run: 39 repos, 62 findings, ruff-clean.

2026-05-22 23:11:48 -04:00

1.9 KiB

Raw Blame History

Session — build repo-hygiene-audit skill (2026-05-22)

Phase 7 of repo-hygiene-remediation (trellis thread "dev-setup-and-hygiene" #272): make the 2026-05-19/20 audit repeatable. Decisions going in: weekly cadence, manual trigger, full skill with scripted checks.

What was built

New repo pbs/repo-hygiene-audit-skill following the repo-per-skill house style (a-review-skill / session-notes-skill / Claude-Code-Scaffolding-Skill).
repo-hygiene-audit/SKILL.md — trigger description + 5-step workflow over the 4 domains.
repo-hygiene-audit/scripts/audit.py — pure-stdlib, read-only check engine.
references/check-catalog.md, references/findings-format.md.

Checks implemented

git auditability + .git ownership/dubious + group drift; .env perms (0660 / devprojects target); inline compose secrets; non-git dirs with content; uv-init stubs; docker-compose.yml→compose.yml naming; master-vs-main default; leftover docs-audit branches; dirty trees; stray worktrees; unpushed/no-upstream; herbygitea residue; stale review docs; missing/bloated docs.

First-run results (39 repos, 4 domains)

high=11, medium=19, low=23, info=9 (total 62). Matched the known audit backlog: root-owned non-git docker stacks (authelia/traefik), world-readable .env (trellis-mcp, vault-mcp, ob1-deploy, python-uv .env.local), master defaults (authentik, pbsii, zero-check-pipeline, docker-container, ssh-login-alerter, hunyuan3d-sunnie, instamesh-docker), uv-init stubs (zero-check-pipeline, wiki-context), GEMINI.md in work-index-dashboard, herbygitea residue in workstation-ansible/CLAUDE.md + sshkm. Ruff clean.

Open for Travis

Remote: not chosen. Commit is local-only. Likely GitHub-destined (manual push).
Second deliverable: canonical CLAUDE.md skeleton folded into Claude-Code-Scaffolding-Skill (template only; not wired into scaffold.py).
Cadence automation deferred (--fail-on is the hook when ready).

1.9 KiB Raw Blame History