[aryanjasala]

Description

Gets the starter ready for outside contributors, as the Q3 plan asks for all five public framework repositories: issue forms instead of a Markdown bug template and blank issues, a security policy, code owners, the shared label set and grouped release notes. None of these files end up in a theme created from the starter.

Technical Details

• Issue forms. bug.yml replaces bug.md and asks for the starter version or commit, where it happens (editor, front end, build, init), the area, WordPress, PHP and Node versions, the environment, what happened, what was expected, steps and logs. feature.yml asks for the area, the problem, the proposal and alternatives. config.yml turns off blank issues and points security reports to private vulnerability reporting. The internal task.md and epic.md templates stay.
• SECURITY.md, modelled on wp-primitives': the latest 2.x release and main are supported, 1.x gets no further releases.
• .github/CODEOWNERS: * @aryanjasala @AnuragVasanwala @Adi-ty.
• .github/labels.yml: the shared set (Type: * including Type: Feature, Priority: P0-P3, Status: *, BC: *, dependencies, good first issue, help wanted), a proposed Scope: * set for the starter, and the 50 existing unprefixed labels listed as "legacy, keep until relabelled", so nothing in use disappears.
• .github/release.yml is removed. Since ci: release the starter with release-please #835 release-please writes each release's notes from the merged PR titles, so GitHub's generated-notes config is never read. The labels are for triage.
• Keeping these out of created themes. composer create-project installs the Packagist dist archive, so a new .gitattributes export-ignores CODEOWNERS, SECURITY.md, the issue forms and labels.yml (and itself). The same files join cleanup.targets in bin/scaffold.config.js, so npm run init removes them from a git clone too. The task and epic templates, the PR template, dependabot.yml and the workflows still ship.
• .gitattributes also export-ignores main's .github/release-starter/ and .github/workflows/release-starter.yml, so its list matches cleanup.targets again.
• Label descriptions use colons instead of dashes (for example Critical: blocks milestone). The live labels still have dashes, so the next label sync updates their descriptions.
• Docs that said issue templates and release.yml survive init are corrected (README.md, docs/initialization.md, docs/internal/maintenance.md, .claude/skills/README.md).

Checklist

• Issue forms replace bug.md and blank issues
• SECURITY.md points to private vulnerability reporting (on for this repository)
• CODEOWNERS added; every handle has write access
• labels.yml added; release.yml removed
• git archive HEAD (what create-project installs) contains none of the new files
• wp-tooling's cleanup code, run on a scratch clone, removes all 13 targets (the starter's repository files plus main's .github/release-starter/ and release-starter.yml) and keeps the task and epic templates, PR template, dependabot.yml and workflows
• Every new YAML file parses and passes yamllint

Screenshots

N/A

To-do

• Apply labels.yml to the repository with gh label create --force after merge (it is data; merging changes no label).
• Relabel open issues from the legacy labels to the shared ones, then drop the legacy block.

Fixes/Covers issue

N/A. Q3 plan, Workstream 7 (public repo basics).

[Copilot]

🔵 Needs a closer look

Cleanup on --reinit and --clean can delete project-owned replacements for starter files, including customized repository configuration and security policies.

No open issues 🎉

What changed in this PR

This PR prepares Theme Elementary for outside contributors and separates starter-specific repository files from generated themes.

Changes:

• Adds structured bug and feature forms, private security-reporting guidance, code owners and a shared label catalog.
• Excludes starter-only files from distribution archives and adds them to initialization cleanup.
• Updates cleanup documentation and removes the unused GitHub release-notes configuration following the release-please migration.

File	Description
SECURITY.md	Defines supported versions and private vulnerability reporting.
README.md	Clarifies which repository files initialization removes.
docs/​internal/​maintenance.md	Updates archive and cleanup verification guidance.
docs/​initialization.md	Documents removed and retained repository files.
bin/​scaffold.config.js	Adds starter-specific files to cleanup targets.
.github/​release.yml	Removes unused generated-release-notes configuration.
.github/​labels.yml	Defines shared, proposed scope and legacy labels.
.github/​ISSUE_TEMPLATE/​feature.yml	Adds a structured feature-request form.
.github/​ISSUE_TEMPLATE/​config.yml	Disables blank issues and links private security reporting.
.github/​ISSUE_TEMPLATE/​bug.yml	Adds a structured bug-report form.
.github/​ISSUE_TEMPLATE/​bug.md	Removes the superseded Markdown bug template.
.github/​CODEOWNERS	Assigns repository-wide code owners.
.gitattributes	Excludes starter-only files from distribution archives.
.claude/​skills/​README.md	Updates the documented cleanup behavior.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Interrupted initialization can persist setup state before cleanup, causing later runs to leave starter-owned policy and issue files behind even with --clean or --reinit.

No open issues 🎉

_{Review effort: Balanced}