.github

Two-factor authentication is required organisation-wide: GitHub reports two_factor_requirement_enabled for the monumental-archive organisation, covering repository write access and private vulnerability reports alike.

Collaborator permissions are assigned explicitly, never inherited by default. The repository baseline script sets the default repository permission to the lowest privilege and review routing goes through CODEOWNERS to the owners team; the settings are code, applied and drift-checked by settings/repo-baseline.sh. https://github.com/monumental-archive/.github/tree/main/settings

An organisation-level ruleset blocks direct pushes to main: every change must arrive as a pull request and pass required status checks. The rules and their rationale are recorded in docs/rulesets.md and the Monday audit re-checks them for drift. https://github.com/monumental-archive/.github/blob/main/docs/rulesets.md

The organisation ruleset restricts branch deletion on the primary branch, so deleting main is refused rather than confirmed away. Recorded in docs/rulesets.md. https://github.com/monumental-archive/.github/blob/main/docs/rulesets.md

Untrusted workflow metadata is validated before use: the shared workflows accept inputs against allowlists (the artifact classes: set, the pinned publish stub shape checked by lint:release-stub), and zizmor fails the gate on template-injection patterns where untrusted context would reach a shell.

This is the project's central architectural rule, not an incidental setting: no workflow that runs caller-supplied code may declare id-token: write. lint:capability-boundary enforces it in the gate and fails the build if a workflow_call workflow ever acquires the privileged identity, so a certificate bearing this repository's identity can never be minted by a job executing a caller's code.

Every official channel is HTTPS: the repository, releases, documentation and issue tracker are all served by GitHub over TLS, and no plaintext URI appears in the tree.

Distribution is over HTTPS and authenticated beyond transport: releases carry Sigstore evidence bundles and GitHub artifact attestations, and every consumed tool is pinned with per-platform checksums in mise.lock, so a substituted artifact fails verification rather than merely a certificate check.

Secret scanning with push protection is enforced by the organisation security configuration, so an unencrypted credential is blocked at push time; trivy's secret rules also run in the gate. The architecture removes most of the risk at source: publishing is keyless via OIDC and trusted publishing, so there are few long-lived secrets to leak.

README.md documents basic usage for consumers (adopt the gate in about six lines, copy scaffold/, run mise run ci), and docs/runbook.md is the full operating manual for wiring a repository in and for recovery. https://github.com/monumental-archive/.github/blob/main/docs/runbook.md

SUPPORT.md and the repository's issue forms document how to report a defect, and SECURITY.md documents the separate private path for vulnerabilities. https://github.com/monumental-archive/.github/blob/main/SUPPORT.md

GitHub Issues and pull requests are open for public discussion of proposed changes and usage obstacles; both are searchable and individually addressable by URL. https://github.com/monumental-archive/.github/issues

CONTRIBUTING.md explains the contribution process: open an issue first for anything large, pull requests for small self-contained fixes, Conventional Commits, DCO sign-off, a green mise run ci, squash merge. https://github.com/monumental-archive/.github/blob/main/CONTRIBUTING.md

0BSD — OSI-approved and FSF-free. https://github.com/monumental-archive/.github/blob/main/LICENSE

The released assets carry the same 0BSD licence as the source; there is no separate licence for releases. https://github.com/monumental-archive/.github/blob/main/LICENSE

LICENSE at the repository root and the full text in LICENSES/0BSD.txt, the REUSE-standard location. api.reuse.software independently reports the project compliant. https://github.com/monumental-archive/.github/blob/main/LICENSE

Released assets ship from this repository, which carries LICENSE at its root and LICENSES/0BSD.txt alongside, with per-file attribution recorded in REUSE.toml. https://github.com/monumental-archive/.github/blob/main/LICENSE

Publicly readable at a static URL. https://github.com/monumental-archive/.github

Git records what changed, who changed it and when, for every revision, and the history is public. Beyond that, each revision carries a signed source-provenance attestation, so the record is independently verifiable rather than merely readable.

mise/config.toml lists every direct tool dependency at an exact version, and mise.lock records per-platform checksums for each. Renovate reads the same file natively. https://github.com/monumental-archive/.github/blob/main/mise/config.toml

The organisation's repositories and their status are documented rather than assumed: docs/migration-playbook.md records which codebases join the governance and how, and the scheduled audit enumerates the live repository population from the GitHub API rather than from a hand-kept list. https://github.com/monumental-archive/.github/blob/main/docs/migration-playbook.md

No generated executable artifacts are committed. The repository contains shell tasks, workflow YAML, configuration and documentation; tools arrive at runtime through mise from pinned, checksummed downloads rather than being vendored.

No unreviewable binary artifacts are committed — every tracked file is text and reviewable in a diff.

SECURITY.md names the security contact and the reporting channel: private vulnerability reporting through the repository's Security tab, with a 14-day acknowledgement commitment. https://github.com/monumental-archive/.github/blob/main/SECURITY.md