release-check

Release Readiness Audit

Pre-release cross-cutting check: security, dependencies, required community files, and code quality. Documentation and metadata checks live in /release-docs-check — run that separately.

---

1. Dependency vulnerabilities

npm audit --audit-level=high

• Confirm zero High / Critical
• If any remain, distinguish direct vs. transitive in the report
• Note whether npm audit fix can resolve them

---

2. Required community files

Use Glob to confirm each file exists:

File	Purpose
LICENSE	License (required)
README.md	Project overview (required)
CONTRIBUTING.md	Contribution guide (required)
SECURITY.md	Vulnerability reporting policy (required)
CODE_OF_CONDUCT.md	Code of conduct (recommended)
.env.example	Environment variable template (required)

---

3. Personal / project-specific info leaks

Grep (excluding node_modules, .next, .git):

• Personal domains / URLs: scan source for \.info, \.dev, \.me patterns
• Personal names / handles: repository owner names must not be hardcoded in source
• Project-specific names: your own project or brand names (e.g., my-blog-name) must not remain in source

Allowed locations: package.json, README.md, CONTRIBUTING.md, SECURITY.md, LICENSE, _release/.

---

4. Secrets / credential leaks

Grep for these patterns:

• API key prefixes: sk-, AIza, ghp_, xoxb-, AKIA
• Hardcoded passwords: password\s*=\s*["'][^"']{8,}
• Bearer tokens: Bearer [A-Za-z0-9+/]{20,}

Read .env.example and verify it contains placeholders only.

---

5. Code quality

• Stray console.log: Grep under app/(admin)/baan-admin/api/
• TODO/FIXME/HACK: Grep under app/, lib/ (minor ones are warnings)
• Japanese error messages: confirm API responses under app/(admin)/baan-admin/api/ do not contain Japanese (exclude translation files like _lib/i18n.ts)

---

6. Baseline security configuration

• .gitignore: .env*, data/, *.pem, .session-secret, etc. are excluded
• package.json: "private": true is set correctly (appropriate for an application)
• TypeScript strict: tsconfig.json has strict: true

---

7. GitHub repository settings (manual)

Cannot be verified from code — confirm manually before release:

• GitHub Private Vulnerability Reporting enabled (Security tab)
• Default branch is main
• Branch protection rules set up (if required)

---

Output format

Clean: ✅ OK Issue: ❌ description (file:line) Warning: ⚠️ description Manual check: 👤 description

Summary format

## Release Readiness

| Category | Status |
|----------|--------|
| Dependency vulnerabilities | ✅ / ❌ |
| Required community files | ✅ / ❌ |
| Personal info leaks | ✅ / ❌ |
| Secret leaks | ✅ / ❌ |
| Code quality | ✅ / ⚠️ / ❌ |
| Baseline security | ✅ / ❌ |

### Verdict
🟢 READY / 🟡 CAUTION / 🔴 NOT READY