Skip to content

Release Archive Audit

Run this review on a candidate edition ZIP before delivery. Archive creation does not grant redistribution rights and does not detect every secret by itself. Complete release readiness first.

For a local check of both generated edition archives, run scripts/validate_release_archives.sh from the repository root (Python 3, unzip, sha256sum, and Docker required). Docker must be installed and its daemon running; the pinned Gitleaks image must be pullable or already available locally. The Release archive validation workflow (.github/workflows/release-archive-validation.yml) runs the same packaging, companion checksum, embedded manifest, forbidden-path, and pinned Gitleaks scan checks. Path filters apply to pull_request and push to main; v* tag pushes and workflow_dispatch are not path-filtered. It does not publish the ZIPs or grant permission to redistribute them.

Inspect contents and integrity

unzip -l /path/to/de-starter-kit-bigquery.zip
(cd /path/to && sha256sum -c de-starter-kit-bigquery.zip.sha256)
python scripts/check_release_archive_paths.py --archive /path/to/de-starter-kit-bigquery.zip --expected-root de-starter-kit-bigquery
mkdir -p /tmp/de-starter-kit-audit
unzip -q /path/to/de-starter-kit-bigquery.zip -d /tmp/de-starter-kit-audit
(cd /tmp/de-starter-kit-audit && sha256sum -c de-starter-kit-bigquery/MANIFEST.sha256)

Confirm the archive includes the intended edition files, plus the repository LICENSE, NOTICE, and SUPPORT.md at the bundle root once those files exist, and excludes .env*, local profiles.yml, private key files, cloud credential JSON, .venv, target/, dbt_packages/, logs/, customer data, and unrelated editions. Verify the ZIP checksum and embedded MANIFEST.sha256; review the extracted file list before any scan or distribution. Check the checksum after any archive change.

Scan and approve

  • Run the organization's approved secret scanner against the extracted archive; do not print or paste any finding values into chat or logs.
  • Review SQL, README snippets, profiles, seeds, and screenshots for account IDs, private URLs, real names, contact details, credential material, and client-specific data.
  • Verify source attribution and redistribution terms; the repository software license and TheLook data terms are separate decisions.
  • Confirm generated locks match the reviewed requirements.txt files and installation commands use hash verification.
  • Record scanner name/version, archive SHA-256, reviewer, date, exclusions/remediations, and release approval in a private release record.
  • Require a successful Release archive validation run for the exact candidate SHA or tag. Skipped pull-request or main path-filtered runs are not evidence; a workflow configured in YAML is not evidence that it ran. Review Actionlint and Gitleaks results for the same candidate when those checks apply.

Do not distribute while licensing, data terms, or any credential finding remains unresolved.