236616514f
Read-only scripted audit across homelab/pbs/docker/root domains: git auditability + .git ownership/dubious, .env perms (0660/devprojects), inline compose secrets, non-git dirs, uv-init stubs, compose naming, master-vs-main default, dirty trees, worktrees, herbygitea residue, doc presence. Emits text/json/md findings mapped to remediation-plan phases. SKILL.md + scripts/audit.py (stdlib-only) + references + packed .skill. First run: 39 repos, 62 findings, ruff-clean.
40 lines
1.9 KiB
Markdown
40 lines
1.9 KiB
Markdown
# Session — build repo-hygiene-audit skill (2026-05-22)
|
|
|
|
Phase 7 of repo-hygiene-remediation (trellis thread "dev-setup-and-hygiene" #272):
|
|
make the 2026-05-19/20 audit repeatable. Decisions going in: weekly cadence,
|
|
manual trigger, full skill with scripted checks.
|
|
|
|
## What was built
|
|
|
|
- New repo `pbs/repo-hygiene-audit-skill` following the repo-per-skill house
|
|
style (a-review-skill / session-notes-skill / Claude-Code-Scaffolding-Skill).
|
|
- `repo-hygiene-audit/SKILL.md` — trigger description + 5-step workflow over the
|
|
4 domains.
|
|
- `repo-hygiene-audit/scripts/audit.py` — pure-stdlib, read-only check engine.
|
|
- `references/check-catalog.md`, `references/findings-format.md`.
|
|
|
|
## Checks implemented
|
|
|
|
git auditability + .git ownership/dubious + group drift; `.env` perms (0660 /
|
|
devprojects target); inline compose secrets; non-git dirs with content;
|
|
uv-init stubs; docker-compose.yml→compose.yml naming; master-vs-main default;
|
|
leftover docs-audit branches; dirty trees; stray worktrees; unpushed/no-upstream;
|
|
herbygitea residue; stale review docs; missing/bloated docs.
|
|
|
|
## First-run results (39 repos, 4 domains)
|
|
|
|
high=11, medium=19, low=23, info=9 (total 62). Matched the known audit backlog:
|
|
root-owned non-git docker stacks (authelia/traefik), world-readable .env
|
|
(trellis-mcp, vault-mcp, ob1-deploy, python-uv .env.local), master defaults
|
|
(authentik, pbsii, zero-check-pipeline, docker-container, ssh-login-alerter,
|
|
hunyuan3d-sunnie, instamesh-docker), uv-init stubs (zero-check-pipeline,
|
|
wiki-context), GEMINI.md in work-index-dashboard, herbygitea residue in
|
|
workstation-ansible/CLAUDE.md + sshkm. Ruff clean.
|
|
|
|
## Open for Travis
|
|
|
|
- Remote: not chosen. Commit is local-only. Likely GitHub-destined (manual push).
|
|
- Second deliverable: canonical CLAUDE.md skeleton folded into
|
|
Claude-Code-Scaffolding-Skill (template only; not wired into scaffold.py).
|
|
- Cadence automation deferred (`--fail-on` is the hook when ready).
|