Where each repository stands

7. Where each repo stands

Legend: yes, partial, no, n/a, not checked. Checked on 13 November 2026.

Repo	CI on PRs	Version-bump check	Release on new VERSION	Docker images	GitHub Releases	Pages	CODEOWNERS	Branch protection on main	Security audit
SpaceWorks	yes (checks.yml; tests.yml on the integration branch)	yes (required; integration branch, main at 0.9.3 does not have the job yet)	yes, plus signed installer assets	yes, 2 images, amd64+arm64	yes (0.9.1 to 0.9.3)	n/a	yes on the integration branch; none on main	yes: 5 required checks, admins enforced, maintainer-only push	yes, pip-audit weekly and on PRs
Workspace	yes (Quality gate, CI)	no	yes (state-based)	yes, 2 images	yes (0.6.7 latest)	n/a	yes	partial: maintainer-only push, admins enforced, no required checks	partial: npm audit advisory
Events	yes (CI, Quality gate)	no	yes	yes, 2 images	yes (0.12.0)	n/a	yes	partial (as Workspace)	yes, blocking npm audit
Machines	yes (tests.yml)	no	yes	yes, 2 images (+dev)	yes (0.6.0)	n/a	yes	partial	yes (security-audit.yml)
Inventory	yes (Quality gate, CI)	no	yes	yes, 2 images (+dev)	yes (0.6.0)	n/a	yes	partial	partial: advisory in CI, blocking in the cron package
Bookings	yes (tests.yml)	no	yes	yes, 2 images (+dev)	yes (0.6.0)	n/a	yes	partial	yes
Organization	yes (tests.yml)	no	yes	yes, 2 images (+dev)	yes (0.8.1)	n/a	no	yes (maintainer-only on main and dev, since 2026-11-13)	yes
Android	yes (build, 2 UI jobs)	no (no VERSION file)	no	n/a	no (none published)	n/a	no	yes: 3 required checks, strict, admins enforced, maintainer-only	no
iOS	yes (build and test x2)	no	no	n/a	no	n/a	no	yes: 2 required checks, strict, admins enforced, maintainer-only	no
Website	no	n/a	n/a	n/a	n/a	yes (served, no workflow)	no	partial: maintainer-only push, no checks	n/a
Docs	yes (build on PR)	n/a	n/a	n/a	n/a	yes (workflow)	yes	partial: maintainer-only push, no checks	not checked
Design System	yes (build, previews, tokens)	no (no VERSION)	no (no tag)	n/a	no	yes (workflow)	no	partial: maintainer-only push, no checks	n/a
.github	no workflows	n/a	n/a	n/a	n/a	n/a	n/a (community health files)	partial: maintainer-only push	n/a

Current rule (v2.0.1, 2026-11-13): Observed at 2026-11-13: the Design System row’s “no VERSION”, “no tag” and “no GitHub Releases” cells are historical. v2.0.0 is the released baseline; the requested checkpoint is VERSION 2.0.1 (local baseline still 2.0.0), with phase 2 targeting v2.1.0. See the §6 observation for evidence boundaries. (1A-N33) — supersedes the line above; see docs/current-rules.md#cr-release-01.

“Partial” on branch protection means main is protected from force-push and limited to the maintainer (admins included) but GitHub is not told which checks must be green. Required checks on Docker/Next.js repos are a setting to apply, not code to write.

8. Bringing each repo up to the rules

Ordered by how much risk each gap leaves open.

Repo	Gap	Fix
All server repos	Cannot verify here that the integration branch’s version-bump and signed assets are on main	Merge the integration branch to main (maintainer) so SpaceWorks main has version-bump, tests.yml, cosign signing and CODEOWNERS; the live protection already requires version-bump, so until the job exists on main a PR into main will wait on a check that never reports. Land it first.
Workspace, Events, Machines, Inventory, Bookings	main has no required status checks	In branch protection, require the PR jobs by name (Lint, typecheck, unit tests, build, PostgreSQL integration tests or the Quality gate job, shellcheck and images where present) and enable “require branches to be up to date” as the mobile repos do.
Organization	No CODEOWNERS and no required checks (branch protection added 2026-11-13: maintainer-only main and dev)	Add required checks and .github/CODEOWNERS with * @Shaan-Shoukath.
Next.js repos (6)	No version-bump check, so a forgotten VERSION raise silently skips the release	Add a version-bump job and a check_version_bump.py like SpaceWorks, require it on PRs into main, and make “release note exists” part of it. Workspace’s VERSION (0.10.0) is ahead of its last release (0.6.7); decide whether those versions were published or skipped and write that down.
Next.js repos (6)	Installer assets are not signed	Extend the release workflow with the release-assets.sh and cosign SHA256SUMS steps from SpaceWorks so install.sh has the same verification story.
Android	No version scheme, no signed release, no GitHub Release	Add a VERSION file; in a release workflow on main, derive versionName from it and versionCode from the run number, sign with an upload keystore stored as GitHub secrets (environment-protected), build the APK and bundle, and attach them with checksums to a GitHub Release titled SpaceWorks Android X.Y.Z. Add the version-bump check, CODEOWNERS and a dependency audit (Gradle dependency verification or an OSV scan).
iOS	Same: no version scheme, no archive, no release	Add VERSION; feed MARKETING_VERSION and CURRENT_PROJECT_VERSION from it and the run number; add a release workflow that archives and exports a signed build (certificate and provisioning in secrets) and attaches it to a GitHub Release. Add the version-bump check, CODEOWNERS, and a Swift package audit.
Website	No CI at all; the build and its tests never run before publish	Add a workflow that runs python build.py and the test_*.cjs tests on PRs, then deploys to Pages from main like Docs and the Design System. Add CODEOWNERS.
Docs	Required checks not set; audit not checked	Require the build job; add npm audit to the build job.
Design System	No VERSION, tag or release; no CODEOWNERS; no required checks	Add a VERSION file (start at 2.0.0), tag v2.0.0, and a small workflow that creates a GitHub Release when VERSION changes. Add CODEOWNERS, and require the build job.
Machines, Bookings, Organization	Security audit and tests run as separate PR workflows with no shared required list	Require Lint, typecheck, unit tests, build, Integration and end-to-end tests and npm-audit together.
Every repo	The weekly audit exists only in SpaceWorks	Add a weekly schedule: trigger to each npm audit workflow so new advisories surface without a PR.

Current rule (v2.0.1, 2026-11-13): The Design System gap row’s missing VERSION/tag/release claims are superseded by CR-RELEASE-01. SW-386 (2026-11-13) makes all proposed workflow/CODEOWNERS/required-check changes in this table rules only, deferred from implementation; this batch adds none. (1A-N34) — supersedes the line above; see docs/current-rules.md#cr-delivery-01.

Checklist for a new repository

Current rule (v2.0.1, 2026-11-13): This checklist states the desired pipeline, not authorisation to provision it now. SW-386 (2026-11-13) defers workflows, CODEOWNERS and branch-protection changes; preserve existing automation. (1A-N35) — supersedes the line above; see docs/current-rules.md#cr-delivery-01.

1. dev and main branches; main protected (maintainer-only, admins enforced, no force-push).
2. A PR workflow whose job names are the required checks.
3. A VERSION file, a version-bump job and a release note per version.
4. A release workflow that triggers on main, builds the artifacts, tags vX.Y.Z-main.<run>.<sha> and creates the GitHub Release.
5. .github/CODEOWNERS with * @Shaan-Shoukath.
6. A dependency audit on PRs and weekly.
7. Secrets and signing keys only in GitHub secrets or environments.

Branch protection across the org (applied 2026-11-13)

In every SpaceWorks-Labs repository, main and (where it exists) dev are protected: only Shaan-Shoukath may push or merge, the rule applies to admins too, and force-pushes and deletion are blocked. Required status checks are unchanged (they are listed per repository above); adding the missing ones is part of the CI/CD rule in product rules section 14, not yet applied.

Part of Pipelines, versions and releases, published from docs/delivery.md. Edit it there.