[TRACKING] Apache Incubator onboarding checklist

Context

The incubation proposal has been accepted. This issue tracks everything we need to do between now and our first Apache release, so the whole community can see the state and pick up items.

Per our mentors, the sequence is: set up resources first, then repo transfer. The transfer itself requires us to invite an ASF Infra team member to our GitHub org — until then the initiative sits with us, so we should front-load everything that does not depend on it.

Please comment to claim an item rather than editing the list, and we will keep the checkboxes here as the single source of truth.

Phase 0 — Pre-transfer release (this week)

Our first Apache release will realistically take 1–3 months: software grant paperwork, LICENSE/NOTICE rework, and a two-phase vote (dev@ then general@incubator, 72h minimum each). We should cut one stable release on our current channels first so users have a stable landing point.

• Cut a stable release from the current repo
• Release notes must not describe the project as an Apache project — wording to be confirmed with mentors

Phase 1 — Resources we can set up now

• Collect ICLAs from all committers (slowest item, people-bound — start now)
• Confirm the Software Grant (SGA): signing entity and current status
• File a PODLINGNAMESEARCH issue to clear the project name
• Start the trademark transfer if the name is currently held by a company (historically the most common graduation blocker)
• Request Infra resources via mentors: mailing lists (dev@ / private@ / commits@), issue tracker decision, website space
• Register the podling in podlings.xml and set up the status page
• Move technical decision-making to the public mailing list once dev@ exists

Phase 2 — Repo transfer

• Clean up working files not meant for the ASF repo (maka-proposal-zh-review.txt, .pr-assets/, promo/, notes/)
• Add .asf.yaml (repo metadata, branch protection, notification routing)
• Invite an ASF Infra team member to the GitHub org and coordinate the transfer window

Phase 3 — First Apache release compliance

Findings from a repository audit run on main (see below), ordered by severity.

Blocking

• Add ASF license headers to source files. 2166 tracked .ts/.tsx/.mjs/.js files currently have none. Apache RAT will fail, and this is checked during the IPMC release vote. Mechanical but large; a script plus a one-off formatting commit recorded in .git-blame-ignore-revs is probably the right approach.
• Add a DISCLAIMER file. Required in every podling release artifact. DISCLAIMER-WIP is acceptable and lets us enumerate items not yet satisfied.
• Rewrite NOTICE to ASF form. Copyright should be attributed to The Apache Software Foundation and state incubating status. The current blanket sentence about third-party components is not accepted — NOTICE carries only notices we are legally required to reproduce; everything else belongs in LICENSE.

Before a binary release

• Declare Category B dependencies in LICENSE for binary artifacts: MPL-2.0 (lightningcss, caniuse-lite), OFL-1.1 (@fontsource-variable/geist*). Source releases are unaffected.
• Establish provenance for the code we will release. ICLAs are required from committers and from anyone who made a large/material contribution; smaller contributions are covered by Apache-2.0 clause 5 and need no paperwork. Material contributors who do not join the podling require an SGA instead. Concretely: (a) confirm the initial committer list and collect their ICLAs, (b) confirm SGA coverage, (c) review only the top contributors by volume who are not on the committer list. Paperwork is not required before the code import, but it must be complete before our first release.

Already in good shape

• LICENSE contains the full Apache-2.0 text and already declares bundled third-party code (trycua/cua, MIT).
• Dependency licenses are clean: 557 MIT, 73 ISC, 47 Apache-2.0, 26 BSD-3-Clause, 18 BSD-2-Clause, plus a small tail. No Category X dependencies (no GPL/AGPL/SSPL/BUSL/Elastic).
• No credential leaks. A secret scan matched 20 lines, all of which are test fixtures for our own redaction logic.

References

• Incubator Cookbook
• ASF Release Policy
• ASF Third Party License Policy
• Apache Project Maturity Model

背景

孵化提案已通过。本 issue 用于跟踪从现在到首个 Apache 版本发布之间的全部待办，方便整个社区了解进度并认领任务。

按导师的建议，顺序是：先 setup 各种资源，再做 repo transfer。transfer 本身需要我们邀请 ASF Infra 团队成员进入 GitHub org，在那之前主动权都在项目这边，所以应当把不依赖 transfer 的事情尽量前置。

认领任务请在下方评论，不要直接编辑列表；上方英文清单的 checkbox 保持为唯一事实来源。

阶段 0 — Transfer 前发版（本周）

首个 Apache 版本实际上需要 1–3 个月：软件捐赠的法务流程、LICENSE/NOTICE 重做，以及两阶段投票（先 dev@ 再 general@incubator，各自至少 72 小时）。我们应当先在现有渠道发一个稳定版，让用户有一个稳定的落脚点。

• 从当前仓库发布一个稳定版
• Release notes 中不得将项目描述为 Apache 项目 —— 具体措辞待与导师确认

阶段 1 — 现在就能推进的资源准备

• 收集所有 committer 的 ICLA（最慢的一项，取决于人的配合，现在就启动）
• 确认 Software Grant（SGA）：签署主体与当前进度
• 提交 PODLINGNAMESEARCH issue，确认项目名称可用
• 若名称目前由公司持有，启动商标转让（历史上最常见的毕业阻塞项）
• 通过导师向 Infra 申请资源：邮件列表（dev@ / private@ / commits@）、issue 跟踪方案、网站空间
• 在 podlings.xml 中登记 podling 并建立状态页
• dev@ 建好后，将技术决策迁移到公开邮件列表上进行

阶段 2 — 仓库迁移

• 清理不应进入 ASF 仓库的工作文件（maka-proposal-zh-review.txt、.pr-assets/、promo/、notes/）
• 添加 .asf.yaml（仓库元信息、分支保护、通知路由）
• 邀请 ASF Infra 团队成员进入 GitHub org，并协调迁移时间窗口

阶段 3 — 首个 Apache 版本的合规工作

以下为在 main 上执行仓库审计得到的结论，按严重程度排序。

阻塞项

• 为源文件添加 ASF license header。 目前 2166 个纳入版本控制的 .ts/.tsx/.mjs/.js 文件均无 header。Apache RAT 检查会失败，且这是 IPMC 发布投票时的必查项。工作量大但纯机械；较合适的做法是用脚本批量处理，并将这次格式化提交记入 .git-blame-ignore-revs。
• 添加 DISCLAIMER 文件。 每个 podling 发布物都必须包含。可以使用 DISCLAIMER-WIP，它允许我们列出尚未满足的条目。
• 按 ASF 规范重写 NOTICE。 版权应归属 The Apache Software Foundation 并声明孵化状态。当前那句关于第三方组件的笼统表述不被接受 —— NOTICE 只承载法律上必须转载的声明，其余内容都应放在 LICENSE 中。

二进制发布前需完成

• 在 LICENSE 中声明 Category B 依赖（针对二进制产物）：MPL-2.0（lightningcss、caniuse-lite）、OFL-1.1（@fontsource-variable/geist*）。源码发布不受影响。
• 理清待发布代码的权属来源。 ICLA 的签署要求是：committer，以及做出实质性（large/material）贡献的人；较小的贡献由 Apache-2.0 第 5 条覆盖，无需任何文书。实质性贡献者若不加入 podling，则需要 SGA 而非 ICLA。具体做法：(a) 确定初始 committer 名单并收齐其 ICLA，(b) 确认 SGA 的覆盖范围，(c) 只需逐个核对贡献量靠前且不在 committer 名单中的人。代码导入前不要求文书齐备，但首次发布前必须完成。

已经达标的部分

• LICENSE 包含完整的 Apache-2.0 全文，并已声明所内含的第三方代码（trycua/cua，MIT）。
• 依赖许可证情况良好：557 个 MIT、73 个 ISC、47 个 Apache-2.0、26 个 BSD-3-Clause、18 个 BSD-2-Clause，以及少量其他。不存在任何 Category X 依赖（无 GPL/AGPL/SSPL/BUSL/Elastic）。
• 无凭据泄露。密钥扫描命中 20 处，全部是我们自己脱敏逻辑的测试 fixture。

参考资料

• Incubator Cookbook
• ASF Release Policy
• ASF Third Party License Policy
• Apache Project Maturity Model

---

The repository audit in Phase 3 and this issue text were drafted with Claude Code; the findings were produced by scripted scans over main and should be re-verified by reviewers.