Codeberg Settings Audit

Authoritative record of the Codeberg-side configuration for Spicer-Creek-Solutions-LLC/keystone-core, captured as part of closing out PUBLIC-LAUNCH-CHECKLIST.md E1.

Updated: 2026-05-27.

Why this file exists

E1 of the public-launch checklist asks for a range of Codeberg-side settings to match the v0.1.x posture. Those settings live in the Codeberg web UI and aren’t otherwise visible in-tree, so a drift between “what the checklist says” and “what Codeberg actually has” is easy to introduce silently. This doc is the in-repo source of truth for what was configured, what was deliberately deferred, and how to re-verify each setting.

If you change something on Codeberg that’s listed here, update this file in the same PR.

Audit scope

Every Codeberg-side setting called out in E1, plus the merge-method defaults (not in E1 but tightened during the same audit).

Current state

Repository metadata

Feature toggles

Merge methods

Branch protection on main

Applied via the Codeberg UI. The FORGEJO_TOKEN (keystone-bot) lacks admin scope on this org repo, so neither audit nor write of branch-protection rules is possible via API with that token. The maintainer applied each setting directly through the web UI.

Required status-check contexts (all from .forgejo/workflows/ci-fast.yml ):

• ci / lint (pull_request)
• ci / test (pull_request)
• ci / slo (pull_request)
• ci / integration (pull_request)
• ci / smoke (pull_request)
• ci / security (pull_request)
• ci / e2e (pull_request)
• ci / openapi (pull_request)
• ci / docs (pull_request)
• ci / proto (pull_request)
• ci / build (amd64, linux) (pull_request)

Add ci / dco-check (pull_request) to this list after the first PR that includes the new job lands on main (Codeberg autocompletes required-check names from observed history; the context must exist before it can be selected).

DCO enforcement

DCO sign-off is required on every commit per DCO.md and ../../AGENTS.md § 4. Forgejo branch protection has no native DCO toggle, so enforcement runs as a CI job: .forgejo/workflows/ci-fast.yml dco-check. The job walks every non-merge commit in the PR range and fails if any commit’s message lacks a Signed-off-by: trailer in the standard Name <email> format.

Lenient v0.1.x policy: any well-formed trailer counts. Tightening to “trailer email must match author email” is on the v0.x backlog alongside the signed-commits enablement.

How to re-verify

The repo metadata, feature toggles, and merge methods are readable via the public Forgejo REST API and the keystone-bot token:

OWNER=Spicer-Creek-Solutions-LLC
REPO=keystone-core
BASE=https://codeberg.org/api/v1/repos/$OWNER/$REPO

curl -s -H "Authorization: token $FORGEJO_TOKEN" "$BASE" \
  | jq '{default_branch, description, website,
         has_issues, has_pull_requests, has_releases, has_actions,
         has_wiki, has_packages, has_projects,
         default_merge_style, allow_merge_commits, allow_squash_merge,
         allow_rebase, allow_rebase_explicit, allow_fast_forward_only_merge,
         default_delete_branch_after_merge}'

curl -s -H "Authorization: token $FORGEJO_TOKEN" "$BASE/topics" | jq

Branch-protection settings require admin scope on the repo — verify via the Codeberg UI at https://codeberg.org/$OWNER/$REPO/settings/branches, or with an admin-scoped token via GET $BASE/branch_protections.

Deferrals

Recorded in ROADMAP.md :

• Required signed commits on main — deferred to v0.x. Contributor key-onboarding flow needs documenting before mandatory enforcement is reasonable. RELEASE-PLAYBOOK.md already covers signed release tags, which is the higher-value signing surface for v0.1.x.

References

• PUBLIC-LAUNCH-CHECKLIST.md E1 (this audit closes that item)
• ROADMAP.md “Phase E1: required signed commits on main branch protection”
• DCO.md
• ../../AGENTS.md §§ 2, 4
• .forgejo/workflows/ci-fast.yml dco-check job