# Sustainability action plan: EIC containers

From the EIC Software Sustainability Review, pass `2026-10-12`, assessed at commit `a5bead855571`. Full assessment: https://eic.github.io/SoftwareSustainabilityReview/projects/containers.html

Levels: 0 Absent · 1 Initial · 2 Established · 3 Sustained. Each item names the step to the next level.

## High priority

- [ ] Replace `:latest` with `:nightly` and a `<version>-stable` example in `docs/README.md` and in the fallback of `scripts/build-eic.sh`. *(`doc.user`, now level 1, effort S)*
- [ ] Add `.github/CODEOWNERS` with two owners per directory and document the release-tagging and backport procedure in `docs/releasing.md`. *(`com.bus-factor`, now level 1, effort S)*
- [ ] Add `GOVERNANCE.md` naming the maintainers, the owning ePIC body, how package additions are decided, and how to become a maintainer. *(`com.governance`, now level 0, effort S)*
- [ ] Add `CODE_OF_CONDUCT.md` to `eic/.github` (or link the collaboration code) with a reporting contact. *(`com.conduct`, now level 1, effort S)*
- [ ] Add a `LICENSE` file with the GPL-3.0-or-later text that the image label already declares (or another chosen OSI license) so GitHub detects it. *(`via.license`, now level 0, effort S)*
- [ ] Add `CITATION.cff` and enable the Zenodo-GitHub integration so each `-stable` release gets a DOI. *(`via.citation`, now level 0, effort S)*
- [ ] State in README.md the ePIC computing body that owns eic-shell, the maintainers' institutions and any funding acknowledgement. *(`via.support`, now level 1, effort S)*

## Medium priority

- [ ] Change the bypass team in the "Default" ruleset to `pull_request` bypass mode so that all changes go through PRs. *(`eng.change-control`, now level 2, effort S)*
- [ ] Add `.github/CODEOWNERS` naming at least two owners for `spack-environment/`, `containers/` and `.github/workflows/`. *(`eng.change-control`, now level 2, effort S)*
- [ ] Add a smoke-test job per image flavor that runs `eic-info` and imports key Python modules (ROOT, podio, edm4eic, acts) inside each pipeline-tagged image. *(`eng.testing`, now level 1, effort S)*
- [ ] Add the eic_xl image to the npsim/EICrecon job matrix in `.github/workflows/build-push.yml`. *(`eng.testing`, now level 1, effort S)*
- [ ] Add `pre-commit.ci - pr` to the required status checks of the "Default" ruleset. *(`eng.static-quality`, now level 2, effort S)*
- [ ] Add a CI step that runs `docker buildx build --check` on both main Dockerfiles, replacing the skipped hadolint hook. *(`eng.static-quality`, now level 2, effort S)*
- [ ] Document the image runtime interface (tags, environment variables, `/etc/eic_info`, `profile.d` hooks) in `docs/image-interface.md`. *(`eng.modularity`, now level 2, effort S)*
- [ ] Add a "Using the images" section to `README.md` linking the docs site and listing the image flavors and tag scheme. *(`doc.user`, now level 1, effort S)*
- [ ] Update the buildcache references and image table in `docs/` and add a page describing the eicweb GitLab pipeline and benchmark triggers. *(`doc.developer`, now level 2, effort S)*
- [ ] Add `CONTRIBUTING.md` (linked from README.md) with the review expectations, how to propose new packages or flavors, and the local build workflow. *(`doc.contributing`, now level 2, effort S)*
- [ ] Apply the existing `bug`/`enhancement`/`question` labels to every new issue and document the triage practice in CONTRIBUTING.md. *(`com.responsiveness`, now level 1, effort S)*
- [ ] Invite package requests as PRs to `spack-environment/` from ePIC working groups and document how in CONTRIBUTING.md. *(`com.contributors`, now level 1, effort S)*
- [ ] Document the version scheme, release branches and backport labels in README.md. *(`dist.releases`, now level 1, effort S)*
- [ ] Add `SECURITY.md` naming a private vulnerability reporting route and enable GitHub private vulnerability reporting. *(`dist.dependencies`, now level 2, effort S)*
- [ ] Bump npsim to 1.9.0 in `spack-environment/packages.yaml` and record the reason for the ACTS 46.8.1 pin in a comment next to it. *(`eic.currency`, now level 2, effort S)*

## Low priority

- [ ] Label at least three open issues (for example *(`doc.contributing`, now level 2, effort S)*
- [ ] Close or rebase the 16 PRs older than 90 days. *(`com.responsiveness`, now level 1, effort S)*
- [ ] Move the duplicated npsim/EICrecon job steps in `build-push.yml` into one reusable workflow. *(`eng.modularity`, now level 2, effort M)*