# Sustainability action plan: EDM4hep

From the EIC Software Sustainability Review, pass `2026-10-12-2`, assessed at commit `2b569d9fb708`. Full assessment: https://eic.github.io/SoftwareSustainabilityReview/projects/edm4hep.html

Levels: 0 Absent · 1 Initial · 2 Established · 3 Sustained. Each item names the step to the next level.

## High priority

- [ ] Add `CODE_OF_CONDUCT.md` to the key4hep `.github` repository with a named reporting contact so it applies to EDM4hep. *(`com.conduct`, now level 1, effort S)*

## Medium priority

- [ ] Route release-note, version-bump and Key4hepConfig/CI template updates through PRs and remove maintainer bypass from the `main` ruleset. *(`eng.change-control`, now level 1, effort S)*
- [ ] Set `required_approving_review_count` to 1 in the "Default branch (Key4hep)" ruleset. *(`eng.change-control`, now level 1, effort S)*
- [ ] Add an ASan/UBSan build of the ctest suite to `.github/workflows/lcg_linux_with_podio.yml`. *(`eng.static-quality`, now level 2, effort S)*
- [ ] Extend the README "Dependencies" section with every `find_package` dependency and minimum version, and add a table of CMake options. *(`doc.user`, now level 1, effort S)*
- [ ] Move the Doxygen build and deployment into a public GitHub Actions workflow (for example to GitHub Pages) triggered on `main` and tags. *(`doc.developer`, now level 2, effort S)*
- [ ] Extend `doc/contributing.md` with Key4hep-stack setup, `ctest` invocation, `pre-commit install`, and the clang-format/ruff conventions. *(`doc.contributing`, now level 1, effort S)*
- [ ] Review the 12 open issues older than one year, close or label them, and document the label scheme in `doc/contributing.md`. *(`com.responsiveness`, now level 2, effort S)*
- [ ] Add `.github/CODEOWNERS` naming two owners each for `edm4hep.yaml`, `utils/`, `tools/` and `python/`. *(`com.bus-factor`, now level 2, effort S)*
- [ ] Add `GOVERNANCE.md` naming the maintainers, how schema changes are decided (issue discussion, Key4hep meetings with linked minutes), and how to become a maintainer. *(`com.governance`, now level 1, effort S)*
- [ ] State in the README that tags follow SemVer as `vMM-mm-pp` and what a major, minor or patch bump means for schema and API compatibility. *(`dist.releases`, now level 1, effort S)*
- [ ] Add `VERSION` arguments to the ROOT, Python3 and HepPDT `find_package` calls matching the README. *(`dist.dependencies`, now level 1, effort S)*
- [ ] Record in each release note the Key4hep release stack and `key4hep-images` tag used by the release CI run. *(`dist.reproducibility`, now level 2, effort S)*
- [ ] Add `version` and `date-released` to CITATION.cff in the release-notes commit, and add a `.zenodo.json` or contributor list covering recent authors. *(`via.citation`, now level 2, effort S)*
- [ ] Fix the `downstream-build` job (key4hep-actions/downstream-build) so it passes, and add it to the ruleset's required status checks. *(`eng.ci`, now level 2, effort M)*
- [ ] Add a gcov/lcov build to `.github/workflows/lcg_linux_with_podio.yml` and upload the report to Codecov. *(`eng.testing`, now level 2, effort M)*
- [ ] Add an `ubuntu-24.04-arm` job building podio and EDM4hep and running ctest to `.github/workflows/lcg_linux_with_podio.yml`. *(`dist.portability`, now level 2, effort M)*
- [ ] (EIC side) Add a scheduled eic/containers or EDM4eic job that builds EDM4eic and EICrecon against EDM4hep `main` in `eic_ci:nightly`. *(`eic.environment`, now level 2, effort M)*

## Low priority

- [ ] Add a PR-template checkbox asking for a test with each schema or utility change. *(`eng.testing`, now level 2, effort S)*
- [ ] Add Doxygen comments to every public function in `utils/include/edm4hep/utils/vector_utils.h` and `cov_matrix_utils.h`. *(`doc.developer`, now level 2, effort S)*
- [ ] Label open enhancement issues such as utility requests with `good first issue` and link them from the README. *(`com.contributors`, now level 2, effort S)*
- [ ] Add `SPDX-License-Identifier` headers, list MurmurHash3 in `NOTICE`, and state inbound = outbound in `doc/contributing.md`. *(`via.license`, now level 2, effort S)*
- [ ] State in the README the institutions committed to maintaining EDM4hep and what happens when a maintainer leaves. *(`via.support`, now level 2, effort S)*