Skip to content

MAINTAINERS.md

Latest commit

 

History

History
79 lines (53 loc) · 5.37 KB

MAINTAINERS.md

File metadata and controls

79 lines (53 loc) · 5.37 KB
Raw

Maintainers guide

How to operate this repository day to day. For who may do what and the decision rules, see GOVERNANCE.md; for how contributors work, see CONTRIBUTING.md. This file is the Habilité (maintainer) playbook and does not restate those.

The moving parts

Thing Where Note
Published plugins .claude-plugin/marketplace.json + plugins/ the only thing shipped in a release
Live backlog & roadmap Project board #8 single source of truth
Roles → access GitHub teams habilitated / certified / core-team mapped to the role ladder
Branch protection ruleset "main protection" + .github/rulesets/main.json main is PR-only
Releases release-please (ci.yml) + release-please-config.json 7 packages, auto
Pre-commit checks lefthook.yml + scripts/ json/yaml/schema/frontmatter/catalogs/counts

Daily

  • Triage issues. New issues auto-add to board #8. Set Status / Area / Priority / Work Type; link under an epic (native sub-issues) if relevant.
  • Roadmap. Priority is set by the community vote (mechanism in GOVERNANCE.md). Accepted items live on board #8 - keep ROADMAP.md as a pointer, do not maintain a second list.
  • Review PRs. Every PR needs a Habilité (CODEOWNERS) approval; checks lefthook, Commitlint, DCO must pass; squash-merge.

Releases

release-please opens/updates a chore: release main PR on each push to main.

  1. Review the version bumps + changelog in the release PR (it is authored by the aidd-bot App, so its checks run normally).
  2. Merge it: gh pr merge <n> --squash. No admin needed - the App is a ruleset bypass actor, so its PRs merge once checks pass.
  3. CI tags each bumped package, creates the GitHub Releases, and attaches the bundles:
    • aidd-framework-marketplace-X.Y.Z.zip (.claude-plugin/ + plugins/)
    • <plugin>-vX.Y.Z.zip
    • aidd-framework-<tool>-<mode>-X.Y.Z.zip - per-tool distributions (9 archives: 4 marketplace claude/cursor/copilot/codex + 5 flat incl. opencode), produced by the build-per-tool matrix job in ci.yml via aidd-cli framework build. Pinned to a specific @ai-driven-dev/cli version - bump it deliberately when adopting CLI build changes.

Versions live in .release-please-manifest.json. Forcing a version / pre-release: release-as in release-please-config.json (remove it after the release ships).

Dependencies (Dependabot)

Patch + minor bumps auto-merge once their checks pass (.github/workflows/dependabot-auto-merge.yml, via the aidd-bot App). Major bumps stay manual - review, then gh pr merge <n> --squash. If several lockfile bumps queue up, the first merges and the rest re-base automatically (or comment @dependabot rebase).

Branch protection & the bot bypass

main accepts only PRs (no direct push, no force-push, no deletion) with a CODEOWNERS review and passing lefthook / Commitlint / DCO.

Two bypass actors (both pull_request mode, so neither can push directly to main):

  • the aidd-bot GitHub App (Integration) - release-please and the Dependabot auto-merge mint a token from it (actions/create-github-app-token), so their PRs trigger the required checks and the App merges them past the human-review rule.
  • the admin team - lead maintainers can merge their own PR without a second review. Everyone else needs a code-owner review.

The App: ID in secret AIDD_BOT_APP_ID, key in AIDD_BOT_PRIVATE_KEY. If the App is broken/uninstalled, release and Dependabot PRs stop merging - fix the App rather than re-adding an admin bypass.

To change protection, edit .github/rulesets/main.json, then apply it live:

gh api -X PUT repos/ai-driven-dev/framework/rulesets/<id> --input .github/rulesets/main.json

Keep the file and the live ruleset in sync.

People

  • Promote to Habilité: a Habilité nominates a Certifié with a track record; majority of Habilité approves; add them to the habilitated team and CODEOWNERS.
  • Core Team / Certifié: managed via the core-team / certified teams (Core Team = paid AIDD programme members; Certifié = passed certification).
  • Inactivity 6 months -> emeritus by Habilité majority.

Security

  • Vulnerabilities: GitHub Security Advisories (see SECURITY.md); never a public issue.
  • Secret scanning + push protection + Dependabot alerts are enabled. Push protection blocks new secret commits; it does not scan history, so never paste tokens.
  • Plugin-specific runtime risks (CI permissions, MCP servers) belong in that plugin's README, not here.

Do NOT hand-edit

  • README counts (6 plugins · 31 skills · 3 agents and per-plugin) - auto-generated by scripts/sync-readme-counts.mjs via lefthook.
  • Per-plugin CATALOG.md - auto-generated by scripts/summarize-markdown.js via lefthook.
  • CONTRIBUTORS.md mosaic - the contrib.rocks image updates itself.

Multi-tool

The marketplace is Claude Code native. Other tools are served by per-release archives the aidd-cli builds; this repo stays Claude-authored and tool-agnostic in its prose. Keep tool-specific detail in plugin READMEs.

Build your own plugin

See CREATE_PLUGIN.md. New plugins must also be registered in release-please-config.json + .release-please-manifest.json, or they never release.