chore: OSS audit fixes — restore full LICENSE, add NOTICE, prune upstream-specific config#5
Merged
Merged
Conversation
…c config, repoint README
LICENSE was truncated to 12 lines (ends mid-sentence at "permissions and").
Pre-existing upstream defect inherited via fork; publishing under Apache 2.0
requires the full license text. Now contains the existing Imhotep copyright
header plus the verbatim Apache 2.0 license body. Adding a NOTICE file to
attribute upstream alongside the fork, per Apache 2.0 convention.
Stale image references in README contradicted the fork notice — three
`derailed/popeye` invocations (run/save examples and the CronJob snippet)
now point at `ghcr.io/nudgebee/popeye`. Dead Travis-CI badge and the
Docker Hub badge (we publish to GHCR, not Docker Hub) removed; remaining
badges relabeled as upstream-project badges so the link targets aren't
misleading. Gitpod button removed (pointed at upstream). Contact section
now distinguishes upstream questions from fork-specific issues and links
SECURITY.md.
`.goreleaser.yml` deleted — fork only ships a container image, there is
no goreleaser workflow, and the config still baked `derailed/popeye`
into ldflags.
`.github/FUNDING.yml` deleted — pointed sponsors at the upstream author,
not appropriate for the fork.
`.github/ISSUE_TEMPLATE/{bug_report,feature_request}.md` deleted — they
were upstream's generic templates and routed users in a way that
contradicts CONTRIBUTING.md ("file popeye bugs/features upstream; only
fork-specific issues here"). Removing them gives the GitHub default
blank issue page; we can re-add a fork-scoped template later if needed.
Dockerfile base bumped alpine:3.19 → alpine:3.21 for current security
patches. Statically linked binary, no runtime impact.
.gitignore: add .DS_Store so macOS metadata doesn't get staged.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request transitions the repository into a Nudgebee-maintained fork by removing upstream-specific configuration files, updating the Dockerfile to Alpine 3.21, and revising documentation to reflect the new image registry and contact details. Feedback was provided regarding a discrepancy between the README's CronJob example and the actual manifest files, with a suggestion to include the ":latest" tag for consistency.
RamanKharchee
approved these changes
May 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses the OSS-readiness audit findings flagged after the initial cleanup.
Must-fix
NOTICEattributing upstream (Imhotep Software LLC / derailed/popeye) and the Nudgebee fork.Should-fix
derailed/popeyeimage references in README (run examples and the CronJob snippet) atghcr.io/nudgebee/popeye. Removed the dead Travis-CI badge and the Docker Hub badge (we publish to GHCR, not Docker Hub). Remaining badges relabeled as upstream-project badges. Dropped the Gitpod button (pointed at upstream)..goreleaser.yml— fork only ships a container image and the config still bakedderailed/popeyeintoldflags..github/FUNDING.yml— pointed sponsors at the upstream author..github/ISSUE_TEMPLATE/*— upstream's templates; routed users in a way that contradicts CONTRIBUTING.md.Nice-to-have
.gitignore— added.DS_Store.Test plan
release.ymlpush to GHCR successfully