chore: reconcile issue forms and add SECURITY.md and labels by aryanjasala · Pull Request #76 · rtCamp/plugin-elementary

aryanjasala · 2026-11-05T23:47:52Z

Description

Gets the starter ready for outside contributors, as the Q3 plan asks for all five public framework repositories: one bug form and one feature form instead of four overlapping templates, a security policy, the shared label set and grouped release notes. None of these files end up in a plugin created from the starter.

Technical Details

Issue forms reconciled. bug.yml already covered bug.md, and enhancement.yml had the same body as feature.yml, so there is now one bug form and one feature form (with a "new feature or improvement" dropdown). The internal "estimated time in hours" field is gone. config.yml turns off blank issues and points security reports to private vulnerability reporting. The task and epic templates and the existing CODEOWNERS are unchanged.
SECURITY.md, modelled on wp-primitives': the latest 1.x release and main are supported; copies of features-plugin-skeleton, the earlier repository, are not.
.github/labels.yml: the shared set (Type: * including Type: Feature, Priority: P0-P3, Status: *, BC: *, dependencies, good first issue, help wanted) and a proposed Scope: * set for the starter. The repository has no labels today.
No .github/release.yml. Since ci: release the skeleton with release-please #66 release-please writes each release's notes from the merged PR titles, so GitHub's generated-notes config would never be read. The labels are for triage.
Keeping these out of created plugins. A new .gitattributes export-ignores CODEOWNERS, SECURITY.md, the issue forms, labels.yml, main's .github/release-starter/ and release-starter.yml (and itself), so composer create-project never copies them. Init cleanup is already on in main (ci: release the skeleton with release-please #66, for the release-starter paths); the repository files join those 2 in cleanup.targets, so a git clone loses them on init too, as theme-elementary does. Copilot files, the other workflows, the task and epic templates and the PR template stay.
docs/initialization.md describes the new cleanup step; no CHANGELOG.md entry (release-please writes it).
Label descriptions use colons instead of dashes (for example Critical: blocks milestone). The live labels still have dashes, so the next label sync updates their descriptions.

Checklist

One bug form and one feature form; bug.md and enhancement.yml removed
SECURITY.md points to private vulnerability reporting (on for this repository)
labels.yml added (no release.yml: release-please writes the notes)
.gitattributes keeps the starter-only files out of composer create-project
Init cleanup on: wp-tooling's real cleanup, run on a scratch copy, removes exactly the 9 targets: the skeleton's 7 repository files plus .github/release-starter/ and release-starter.yml, which main added with cleanup already on (ci: release the skeleton with release-please #66). .gitattributes export-ignores the same list.
Every new YAML file parses and passes yamllint; bin/scaffold.config.js passes the repo's lint-staged checks

Screenshots

N/A

To-do

Apply labels.yml to the repository with gh label create --force after merge (it is data; merging changes no label).
Decide whether init cleanup should also remove documentation.yml, which ships into client plugins but only runs in this repository (listed in docs/internal/maintenance.md).

Fixes/Covers issue

N/A. Q3 plan, Workstream 7 (public repo basics).

One bug report form and one feature request form replace bug.md, bug.yml, enhancement.yml and feature.yml: bug.yml already covered bug.md, and enhancement.yml and feature.yml had identical bodies. The internal estimate field is gone; config.yml turns off blank issues and sends security reports to private vulnerability reporting. The task and epic templates and CODEOWNERS are unchanged.

labels.yml records the label set shared across the rtCamp framework repositories and a proposed Scope set for the skeleton; the repository has no labels yet. release.yml groups generated release notes by those labels and leaves out Dependabot.

composer create-project installs the Packagist dist archive, so a new .gitattributes export-ignores CODEOWNERS, SECURITY.md, the issue forms, labels.yml and release.yml. Init cleanup is off in this skeleton, so the git clone route is documented as a known gap instead of changing the init contract.

Turn init cleanup on with the same starter-only files .gitattributes keeps out of composer create-project: .gitattributes, CODEOWNERS, the bug and feature issue forms and their config.yml, labels.yml, release.yml and SECURITY.md. A git clone no longer carries them into a client plugin, as theme-elementary already does. Copilot files, workflows, the task and epic templates and the pull request template stay.

Feature requests set the org issue type but carried no label, and release notes filed features under BC: Additive only. Add Type: Feature to the shared label set, apply it from the feature form, and list it first under Features in release.yml.

release-please writes each GitHub release's notes from the merged pull request titles, so .github/release.yml, which only shapes GitHub's generated notes, is never read here. The labels stay for triage.

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

3 open issues

As written, this pattern is unlikely to match files within the .github/release-starter… · New
GitHub Issue Forms don’t support a top-level type key (supported keys include name,… · New
GitHub Issue Forms don’t support a top-level type key, which can break the issue form parsing.… · New

What changed in this PR

Prepares the starter repository for external contributors by consolidating GitHub issue forms, adding a security policy and shared label definitions, and ensuring these repo-only maintenance files are excluded from generated plugin copies.

Changes:

Consolidates issue templates into a single bug form and a single feature form, and disables blank issues with a security contact link.
Adds SECURITY.md and a shared .github/labels.yml label set for triage consistency across framework repos.
Adds export-ignore + init cleanup targets to keep starter-only repository files out of composer create-project outputs.

File	Description
docs/initialization.md	Updates initialization docs to reflect expanded cleanup scope.
bin/scaffold.config.js	Expands init cleanup targets to remove repo-only files from git clones on init.
SECURITY.md	Adds a security policy and vulnerability reporting guidance.
.github/labels.yml	Defines shared + repo-specific label taxonomy to be applied via `gh`.
.github/ISSUE_TEMPLATE/feature.yml	Reworks feature request issue form and aligns it to shared labels.
.github/ISSUE_TEMPLATE/enhancement.yml	Removes overlapping enhancement template.
.github/ISSUE_TEMPLATE/config.yml	Disables blank issues and adds a private security reporting link.
.github/ISSUE_TEMPLATE/bug.yml	Reworks bug report issue form and aligns it to shared labels.
.github/ISSUE_TEMPLATE/bug.md	Removes redundant legacy bug template.
.gitattributes	Adds export-ignore rules to exclude repo-only files from dist exports.

_{Review effort: Lite}

Init cleanup also runs on --reinit, "Re-run full setup" and --clean, and deletes each target. A project's own CODEOWNERS, SECURITY.md, .gitattributes or issue forms live at the same paths as the skeleton's, so the next re-run would delete them. Those targets now apply only before init writes .wp-scaffold.json; the skeleton-named release paths stay unconditional. Also adds tests/js/starter-files.test.js, which fails when an export-ignore path in .gitattributes is missing from the cleanup targets (and is itself skeleton-only), and lists release-please's autorelease labels in labels.yml so a later prune can't remove the label it tags releases by.

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

4 open issues

The export-ignore rule for /.github/release-starter may not exclude files within that… · New
GitHub Issue Forms don’t (historically) support a top-level type: key in the form YAML schema. If… · New
Same issue as in bug.yml: the top-level type: key is not part of the standard Issue Forms… · New
This parsing assumes each export-ignore entry maps 1:1 to a literal cleanup target path. If… · New

3 resolved since last review

_{Review effort: Lite}

+/.github/ISSUE_TEMPLATE/feature.yml export-ignore
+/.github/labels.yml                 export-ignore
+/SECURITY.md                        export-ignore
+/.github/release-starter            export-ignore


-description: If something isn't working as expected
+name: Bug report
+description: Something in the plugin-elementary skeleton is broken or behaves unexpectedly.
+type: Bug


-title: '[Feature Request]: '
+name: Feature request
+description: Suggest a new capability, or an improvement to an existing one, for the skeleton.
+type: Feature


+		const ignored = fs
+			.readFileSync( path.join( root, '.gitattributes' ), 'utf8' )
+			.split( '\n' )
+			.map( ( line ) => line.trim() )
+			.filter( ( line ) => /\sexport-ignore$/.test( line ) )
+			.map( ( line ) => line.split( /\s+/ )[ 0 ].replace( /^\//, '' ) );


Adi-ty

Approving. Please run the labels.yml sync at merge so the forms' Type: labels exist.

The firstSetup check in bin/scaffold.config.js is a good workaround for now. We'll follow up in wp-tooling, continuing rtCamp/wp-tooling#68:

Recovering from a failed init: the engine writes .wp-scaffold.json before cleanup runs, so if a first init fails partway, the skeleton's files stay behind and a re-run treats the plugin as already set up. The engine will undo the steps it has already applied, so running init again is a clean first setup.
Keeping project files on --reinit and --clean: the engine will support deletions that run on first setup only, so the starters don't need this check.

aryanjasala added 7 commits November 6, 2026 05:02

chore: drop the generated release notes config

a5b00d2

release-please writes each GitHub release's notes from the merged pull request titles, so .github/release.yml, which only shapes GitHub's generated notes, is never read here. The labels stay for triage.

chore: use colons instead of dashes in label descriptions

9e728d0

aryanjasala requested review from Adi-ty and AnuragVasanwala as code owners November 5, 2026 23:47

Copilot AI balanced review requested due to automatic review settings November 5, 2026 23:47

Copilot AI reviewed Nov 6, 2026

View reviewed changes

Comment thread .gitattributes Resolved

Comment thread .github/ISSUE_TEMPLATE/bug.yml Resolved

Comment thread .github/ISSUE_TEMPLATE/feature.yml Resolved

Copilot AI balanced review requested due to automatic review settings November 6, 2026 00:23

Copilot AI reviewed Nov 6, 2026

View reviewed changes

Adi-ty approved these changes Nov 9, 2026

View reviewed changes

Navigation Menu

Repository navigation

chore: reconcile issue forms and add SECURITY.md and labels - #76

chore: reconcile issue forms and add SECURITY.md and labels#76
aryanjasala wants to merge 8 commits into
mainfrom
chore/community-files

aryanjasala commented Nov 5, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Adi-ty left a comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

aryanjasala commented Nov 5, 2026

Description

Technical Details

Checklist

Screenshots

To-do

Fixes/Covers issue

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Adi-ty left a comment

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants