chore: OSS readiness – governance, supply-chain hardening, and doc fixes

.github/CODEOWNERS

@@ -0,0 +1,15 @@
+# Code owners for qodeca/8cli
+#
+# Outside (fork) pull requests that touch these paths require review from
+# @marcinobel. CODEOWNERS only gates pull requests; the maintainer's own
+# direct pushes are unaffected.
+#
+# When a second maintainer is onboarded, replace the catch-all with finer
+# path-scoped rules while @marcinobel keeps gatekeeping the security-critical
+# surfaces listed below (CI/release automation and credential handling).
+
+* @marcinobel
+
+# Security-critical surfaces (explicit for emphasis; covered by the catch-all):
+/.github/   @marcinobel
+/scripts/   @marcinobel

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: GPL-3.0-only
-# SPDX-FileCopyrightText: 2026 Qodeca
+# SPDX-FileCopyrightText: 2026 Qodeca sp. z o.o.
 
 name: Bug report
 description: Report a problem with 8cli

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: GPL-3.0-only
-# SPDX-FileCopyrightText: 2026 Qodeca
+# SPDX-FileCopyrightText: 2026 Qodeca sp. z o.o.
 
 blank_issues_enabled: false
 contact_links:

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: GPL-3.0-only
-# SPDX-FileCopyrightText: 2026 Qodeca
+# SPDX-FileCopyrightText: 2026 Qodeca sp. z o.o.
 
 name: Feature request
 description: Suggest a new command, flag, or capability

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,6 +1,6 @@
 <!--
 SPDX-License-Identifier: GPL-3.0-only
-SPDX-FileCopyrightText: 2026 Qodeca
+SPDX-FileCopyrightText: 2026 Qodeca sp. z o.o.
 -->
 
 ## Summary

.github/dependabot.yml

@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: GPL-3.0-only
-# SPDX-FileCopyrightText: 2026 Qodeca
+# SPDX-FileCopyrightText: 2026 Qodeca sp. z o.o.
 
 # Keeps SHA-pinned GitHub Actions and npm dependencies current.
 # Note: the n8n test image is pinned (tag+digest) in test/e2e/setup/global.ts;

.github/workflows/ci.yml

@@ -1,18 +1,18 @@
 # SPDX-License-Identifier: GPL-3.0-only
-# SPDX-FileCopyrightText: 2026 Qodeca
+# SPDX-FileCopyrightText: 2026 Qodeca sp. z o.o.
 
 name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, develop]
   pull_request:
 
 # Least privilege: grant nothing by default, then `contents: read` per job.
 permissions: {}
 
-# Cancel superseded PR runs (unique group per branch); main/tag runs get a
-# unique group via run_id so post-merge e2e is never cancelled.
+# Cancel superseded PR runs (unique group per branch); main/develop/tag runs get
+# a unique group via run_id so post-merge e2e is never cancelled.
 concurrency:
   group: ci-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
@@ -31,6 +31,10 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run check:headers
+      - name: REUSE compliance
+        # charset-normalizer extra avoids reuse's "no encoding module" error on
+        # minimal runners. pipx is preinstalled on ubuntu-latest.
+        run: pipx run --spec "reuse[charset-normalizer]==6.2.0" reuse lint
       - run: npm run typecheck
       - run: npm run lint
       - run: npm run format:check

.github/workflows/publish.yml

@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: GPL-3.0-only
-# SPDX-FileCopyrightText: 2026 Qodeca
+# SPDX-FileCopyrightText: 2026 Qodeca sp. z o.o.
 
 name: Publish
 
@@ -22,14 +22,18 @@ permissions:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    # Gate the OIDC publish behind a protected environment: configure `release`
+    # in repo settings with a required reviewer + a `v*` tag deployment filter
+    # so the npm token is only minted after approval.
+    environment: release
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22
           cache: npm
           registry-url: https://registry.npmjs.org
-      - run: npm install -g npm@latest # trusted publishing needs npm >= 11.5.1
+      - run: npm install -g npm@11 # trusted publishing needs npm >= 11.5.1 (pinned major, not @latest)
       - run: npm ci
       - run: npm test
       - run: npm publish --access public

CHANGELOG.md

@@ -1,6 +1,6 @@
 <!--
 SPDX-License-Identifier: GPL-3.0-only
-SPDX-FileCopyrightText: 2026 Qodeca
+SPDX-FileCopyrightText: 2026 Qodeca sp. z o.o.
 -->
 
 # Changelog
@@ -12,6 +12,22 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+### Added
+
+- REUSE 3.3 / SPDX licensing compliance: `LICENSES/GPL-3.0-only.txt`, `REUSE.toml`, and an
+  `SPDX-License-Identifier` header on every source file, enforced by a `reuse lint` CI step.
+- Open-source governance set: `CLA.md`, `COPYRIGHT`, `TRADEMARKS.md`, `SUPPORT.md`, and
+  `CITATION.cff`, plus `.github/CODEOWNERS` and a Dependabot config for npm and GitHub Actions.
+
+### Changed
+
+- Releases are cut from a signed tag, and the npm publish workflow runs behind a protected
+  `release` environment (OIDC trusted publishing, no stored token).
+
+### Security
+
+- GitHub Actions are pinned to full commit SHAs, hardening the release supply chain.
+
 ## [0.1.1] - 2026-06-14
 
 ### Fixed

CITATION.cff

@@ -0,0 +1,12 @@
+cff-version: 1.2.0
+message: 'If you use this software, please cite it using these metadata.'
+title: 8cli
+abstract: 'AI-first, JSON-native CLI for remotely managing n8n instances.'
+type: software
+authors:
+  - name: 'Qodeca sp. z o.o.'
+repository-code: 'https://github.com/qodeca/8cli'
+url: 'https://github.com/qodeca/8cli'
+license: GPL-3.0-only
+version: 0.1.1
+date-released: 2026-06-14

CLA.md

@@ -0,0 +1,35 @@
+# Contributor License Agreement (CLA)
+
+This Contributor License Agreement ("Agreement") is between you ("Contributor") and **Qodeca sp. z o.o.** ("Qodeca", the project steward). It applies to any contribution you submit to the 8cli project.
+
+## 1. Definitions
+
+"Contribution" means any original work of authorship – code, documentation, assets, or other material – that you intentionally submit to the project (for example, via a pull request).
+
+## 2. Copyright
+
+You retain ownership of the copyright in your Contribution. This Agreement does not transfer your copyright.
+
+## 3. Broad licence grant
+
+You grant to Qodeca and to recipients of software distributed by Qodeca a **perpetual, worldwide, non-exclusive, royalty-free, irrevocable licence** to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute your Contribution and such derivative works **under the project's current open-source licence (GPL-3.0-only) and under any other licensing terms Qodeca may choose**, including proprietary or commercial terms (dual-licensing). This grant is what preserves the project's ability to be offered under additional terms in the future; without it, contributions could only ever be redistributed under GPL-3.0-only.
+
+## 4. Patent grant
+
+You grant to Qodeca and to recipients of the software a perpetual, worldwide, non-exclusive, royalty-free, irrevocable patent licence to make, have made, use, offer to sell, sell, import, and otherwise transfer your Contribution, where such licence applies only to patent claims you can license that are necessarily infringed by your Contribution alone or by combination with the project.
+
+## 5. Your representations
+
+You represent that: (a) each Contribution is your original creation, or you have the right to submit it under this Agreement; (b) your Contribution does not knowingly violate any third party's rights; and (c) if your employer has rights to intellectual property you create, you have permission to make the Contribution, or your employer has waived such rights.
+
+## 6. No obligation
+
+You understand that the decision to include your Contribution in any project or release is entirely at the discretion of the maintainers, and this Agreement does not obligate Qodeca to use your Contribution.
+
+## 7. No warranty
+
+Contributions are provided "as is", without warranty of any kind.
+
+## How to sign
+
+By opening a pull request, you agree to the terms of this CLA; your Git author identity on the PR is your signature of record. (A CLA-assistant bot to record signatures automatically may be enabled in the future.)

CLAUDE.md

@@ -59,7 +59,7 @@ src/
 │   ├── folder.ts              folder tree|create|delete|move|sync
 │   ├── datatable.ts           dt list|get|rows|create|delete|insert
 │   ├── audit.ts               audit run
-│   └── source-control.ts      sc status|pull|push
+│   └── source-control.ts      sc status|pull|push (push: unsupported stub – public API has no push)
 └── formatters/
     ├── index.ts               Output dispatcher (JSON default, table opt-in)
     ├── json.ts                JSON.stringify to stdout
@@ -183,10 +183,12 @@ required; targets free Community n8n, so license-gated groups – variable/proje
 source-control – assert the gated-error contract). `test/e2e-macos/` covers the real
 `security` keychain without Docker. Command→branch→spec coverage map: `test/e2e/COVERAGE.md`.
 
-CI (`.github/workflows/ci.yml`) runs three jobs on every push and PR: `check` (typecheck,
-lint, format check, unit tests, build, `npm audit`, SPDX-header check), `e2e` (Linux +
-Docker), and `e2e-macos`. Releases publish to npm via OIDC trusted publishing when a GitHub
-Release is published (`.github/workflows/publish.yml`).
+CI (`.github/workflows/ci.yml`) runs three jobs on pushes to `main`/`develop` and on every
+pull request: `check` (typecheck,
+lint, format check, unit tests, build, `npm audit`, SPDX-header check, `reuse lint`), `e2e`
+(Linux + Docker), and `e2e-macos`. Releases publish to npm via OIDC trusted publishing – from
+a signed tag, behind a protected `release` environment – when a GitHub Release is published
+(`.github/workflows/publish.yml`).
 
 ## Licensing and headers
 
@@ -195,7 +197,7 @@ to any new file:
 
 ```
 // SPDX-License-Identifier: GPL-3.0-only
-// SPDX-FileCopyrightText: 2026 Qodeca
+// SPDX-FileCopyrightText: 2026 Qodeca sp. z o.o.
 ```
 
 In `bin/8cli.ts` the header sits immediately after the `#!/usr/bin/env node` shebang.

CODE_OF_CONDUCT.md

@@ -1,6 +1,6 @@
 <!--
 SPDX-License-Identifier: GPL-3.0-only
-SPDX-FileCopyrightText: 2026 Qodeca
+SPDX-FileCopyrightText: 2026 Qodeca sp. z o.o.
 -->
 
 # Code of conduct

CONTRIBUTING.md

@@ -1,15 +1,19 @@
 <!--
 SPDX-License-Identifier: GPL-3.0-only
-SPDX-FileCopyrightText: 2026 Qodeca
+SPDX-FileCopyrightText: 2026 Qodeca sp. z o.o.
 -->
 
 # Contributing to 8cli
 
 Thanks for your interest in improving 8cli. This document covers how to set up the project,
 the quality gates your change must pass, and how to submit it.
 
-By contributing, you agree that your contributions are licensed under the project's
-**GPL-3.0-only** license, and that you have the right to submit them under that license.
+By contributing, you agree to the project's [Contributor License Agreement](./CLA.md)
+(CLA). It confirms you have the right to submit your contribution and grants Qodeca a
+broad licence (GPL-3.0-only plus any other terms Qodeca may choose, preserving the
+dual-licensing option). By opening a pull request you agree to the CLA; your Git author
+identity is your signature of record. (Automatic recording via a CLA-assistant bot may be
+added in the future.)
 
 ## Prerequisites
 
@@ -56,7 +60,7 @@ npm run test:e2e:macos  # the real macOS keychain (macOS only, no Docker)
 - **License header** – every new file under `bin/` or `src/` must start with:
   ```
   // SPDX-License-Identifier: GPL-3.0-only
-  // SPDX-FileCopyrightText: 2026 Qodeca
+  // SPDX-FileCopyrightText: 2026 Qodeca sp. z o.o.
   ```
   (In `bin/8cli.ts` it goes immediately after the shebang.)
 - **Commits** – use [Conventional Commits](https://www.conventionalcommits.org/)
@@ -75,6 +79,7 @@ npm run test:e2e:macos  # the real macOS keychain (macOS only, no Docker)
 2. Make your change with tests and docs updated.
 3. Ensure all quality gates pass.
 4. Open a pull request describing the change and linking any related issue.
+5. By opening the pull request you agree to the [CLA](./CLA.md).
 
 ## Reporting bugs and requesting features
 
@@ -88,10 +93,12 @@ Releases publish to npm automatically via **trusted publishing** (OIDC) – do n
 
 1. Bump `version` in `package.json` (follow [SemVer](https://semver.org)).
 2. Move the relevant `CHANGELOG.md` entries from `[Unreleased]` into the new version section.
-3. Commit, then create a matching tag and a **GitHub Release** (for example `v0.2.0`).
+3. Commit, then create a matching **signed, annotated** tag
+   (`git tag -s v0.2.0 -m "v0.2.0"`) and a **GitHub Release** (for example `v0.2.0`).
 4. Publishing the release triggers `.github/workflows/publish.yml`, which runs the tests and
    then `npm publish` over OIDC – no token, with provenance attestation generated
-   automatically.
+   automatically. The job runs in the protected `release` environment, so a maintainer must
+   approve the deployment before the npm token is minted.
 
 Trusted publishing is configured for `@qodeca/8cli` against the `qodeca` GitHub org, the
 `8cli` repository, and the `publish.yml` workflow. The package is owned under the Qodeca

COPYRIGHT

@@ -0,0 +1,37 @@
+# Copyright and licensing notice
+
+Copyright (c) 2026 Qodeca sp. z o.o.
+
+8cli — an AI-first, JSON-native CLI for remotely managing n8n instances — is
+released under the GNU General Public License, version 3 only (`GPL-3.0-only`).
+The full license text is in [`LICENSE`](LICENSE) (and, per the REUSE
+specification, in [`LICENSES/GPL-3.0-only.txt`](LICENSES/GPL-3.0-only.txt)).
+
+## Relicensing record
+
+8cli was originally developed as part of an internal Qodeca monorepo and was not
+publicly distributed before its open-source release. Qodeca sp. z o.o., as the
+sole copyright holder of the contents of this repository at the time of release,
+authorises and releases this work under `GPL-3.0-only`, effective 2026-06-13
+(the initial public OSS release). This notice is the authorising act of record.
+
+Authorised by: Marcin Obel, on behalf of Qodeca sp. z o.o.
+
+## Names, logos, and trademarks
+
+The `GPL-3.0-only` grant covers source code and documentation. It does **not**
+grant rights to the names "8cli" or "Qodeca", the Qodeca logo, or any Qodeca
+trademark or service mark. The third-party name "n8n" is a trademark of its
+respective owner and is used here only descriptively (nominative use). See
+[`TRADEMARKS.md`](TRADEMARKS.md).
+
+## Third-party components
+
+Bundled third-party dependencies retain their own licenses, reproduced in
+[`THIRD-PARTY-LICENSES.md`](THIRD-PARTY-LICENSES.md).
+
+## Per-file licensing
+
+Per-file license information follows the REUSE specification
+(<https://reuse.software>): inline SPDX identifiers in source files and glob
+rules in [`REUSE.toml`](REUSE.toml). Run `reuse lint` to verify coverage.