Kit para mantenedores de código abierto

Heavyweight README (Best-README structure) – TOC, shields refs

CONTRIBUTING – setup, workflow, gates

Contributor Covenant 2.1 adapted (CC BY 4.0)

GOVERNANCE.md – roles, decision process

Code ownership policy: ownership models, RACI, MUST/SHOULD rules, CODEOWNERS standard and example, review SLAs, escalation, orphaned code, transfers, metrics

Versioning policy: SemVer or CalVer rules, release types and cadence, changelog conventions, support tiers, LTS, CRA support period, backports, yanking

Keep a Changelog + SemVer

Release notes: highlights, features, fixes, breaking changes with migration, deprecations with deprecation and sunset dates, CVE fixes, known issues, upgrade steps

SECURITY.md: supported versions, private reporting channels, response targets, embargo, safe harbour, CVE and advisories, security.txt, CRA note

Public CVD policy: scope, safe harbour, reporting channels, response timelines, embargo, CVE and advisories, credit, CRA notes, ready RFC 9116 security.txt

OSPS Baseline self-assessment: target level, 64 requirements by family with evidence, Scorecard results, level summary, remediation plan

SBOM production, signing, VEX rules, distribution, supplier SBOMs, retention, exceptions, metrics, CISA 2026 to CycloneDX and SPDX field map