Repository navigation
chore: add issue forms, SECURITY.md, CODEOWNERS and labels - #68
Open
aryanjasala wants to merge 8 commits into
Open
aryanjasala wants to merge 8 commits into
aryanjasala wants to merge 8 commits into
Conversation
Bug report and feature request forms replace blank issues for outside contributors; config.yml sends security reports to private vulnerability reporting. The internal task template stays.
labels.yml records the label set shared across the rtCamp framework repositories plus this repository's Scope labels, with live colours and descriptions. release.yml groups generated release notes by those labels.
Feature requests set the org issue type but carried no label, and release notes filed features under BC: Additive only. Add Type: Feature to the shared label set, apply it from the feature form, and list it first under Features in release.yml.
release-please writes each GitHub release's notes from the merged pull request titles, so .github/release.yml, which only shapes GitHub's generated notes, is never read here. The labels stay for triage.
Contributor
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
4 open issues
type: Bugis not supported by the standard… · Newtype: Featureis not part of the classic GitHub issue forms template schema (which… · New|| ...), which… · New
What changed in this PR
Prepares the repository for outside contributors by adding standardized GitHub community/triage configuration (issue forms, security policy, CODEOWNERS, and a shared label set) aligned with the other rtCamp framework repos.
Changes:
- Added issue forms for bug reports and feature requests, plus config to disable blank issues.
- Added
SECURITY.mdwith supported-version policy and private vulnerability reporting instructions. - Added
.github/CODEOWNERSand a shared.github/labels.ymldefinition for label sync.
| File | Description |
|---|---|
| SECURITY.md | Adds security policy, supported versions table, and reporting guidance. |
| .github/labels.yml | Defines shared + repo-specific label taxonomy for later sync via gh. |
| .github/ISSUE_TEMPLATE/feature.yml | Adds structured feature request issue form and default label. |
| .github/ISSUE_TEMPLATE/config.yml | Disables blank issues and routes security reports to PV reporting. |
| .github/ISSUE_TEMPLATE/bug.yml | Adds structured bug report form requesting actionable workflow/run details. |
| .github/CODEOWNERS | Establishes default code owners for review routing. |
Review effort: Lite
| @@ -0,0 +1,98 @@ | |||
| name: Bug report | |||
| description: A reusable workflow fails, misbehaves or rejects a valid caller. | |||
| type: Bug | |||
| @@ -0,0 +1,69 @@ | |||
| name: Feature request | |||
| description: Suggest a new input, output, workflow or behaviour. | |||
| type: Feature | |||
| ## Supported versions | ||
|
|
||
| | Version | Supported | | ||
| |---|---| |
Comment on lines
+5
to
+7
| # `gh label create <name> --color <color> --description <description> --force` | ||
| # for each entry: missing labels are created and existing ones updated. That | ||
| # never deletes a label, so removing an entry here does not remove it on GitHub. |
…abel command The Scope: CD Product and Scope: CD Services descriptions named cd-product-* and cd-services-* workflows that don't exist here; they now name cd-github-release, cd-wp-org, cd-s3 and cd-built-branch. The labels.yml header quotes the name and description in its gh label create example, since most labels contain spaces or colons.
Contributor
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
5 open issues
||) in the diff, which would… · New|| ...), which…type: Featureis not part of the classic GitHub issue forms template schema (which…type: Bugis not supported by the standard…
Review effort: Lite
Comment on lines
+5
to
+8
| | Version | Supported | | ||
| |---|---| | ||
| | v1 (`@v1`, and the `v1.x` and `v1.x.y` tags) | Yes | | ||
| | Branches, untagged commits and other refs | No; pin `@v1` | |
Contributor
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
7 open issues
||at the start of each row, which breaks GitHub-flavored Markdown table rendering… · New||) in the diff, which would…|| ...), which…type: Featureis not part of the classic GitHub issue forms template schema (which…type: Bugis not supported by the standard…
Review effort: Lite
Comment on lines
+5
to
+8
| | Version | Supported | | ||
| |---|---| | ||
| | v1 (`@v1`, and the `v1.x` and `v1.x.y` tags) | Yes | | ||
| | Branches, untagged commits and other refs | No; pin `@v1` | |
|
|
||
| # --- Shared: dependencies and outside contributors --------------------------- | ||
| - name: "dependencies" | ||
| color: "0366d6" |
GitHub already lists "Report a security vulnerability" in the issue chooser because private vulnerability reporting is on, and it links to SECURITY.md. The contact link added a second entry pointing at the same advisory form. task.md was an internal planning template showing to every visitor. Maintainers can still open a blank issue, which only they see.
Adi-ty
approved these changes
Nov 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
Gets the repository ready for outside contributors, as the Q3 plan asks for all five public framework repositories: issue forms instead of blank issues, a security policy, code owners, one shared label set and grouped release notes. Same set of files in wp-primitives, wp-tooling, theme-elementary and plugin-elementary.
Closes
N/A
Changes
bug.ymlasks for the workflow, the caller's ref (@v1), the runner, a run link, the caller snippet, what happened, what was expected and logs.feature.ymlasks for the workflow, the problem, the proposal, alternatives and whether it stays compatible with@v1.config.ymlturns off blank issues. Security reports go through GitHub's own "Report a security vulnerability" entry, which the chooser shows because private vulnerability reporting is on, so there is no extra contact link. The internaltask.mdtemplate is removed; maintainers can still open a blank issue, which only they see.SECURITY.md, modelled on wp-primitives': report through GitHub's "Report a vulnerability" (private vulnerability reporting is on),v1(@v1and thev1.xtags) supported, branches and untagged commits not..github/CODEOWNERS:* @aryanjasala @AnuragVasanwala @Adi-ty @justlevine(David reviews shared workflows, as agreed with Growth Engineering)..github/labels.yml: 31 labels, the shared set (Type: *including a newType: Feature,Priority: P0-P3,Status: *,BC: *,dependencies,good first issue,help wanted) plus this repository'sScope: *labels, with the live colours and descriptions..github/release.yml. release-please writes each release's notes from the merged PR titles, so GitHub's generated-notes config would never be read. The labels are for triage.CHANGELOG.mdentry: release-please writes it from the PR title, andchorecuts no release.Critical: blocks milestone). The live labels still have dashes, so the next label sync updates their descriptions.How I verified
Every new YAML file parses with
yq, and the issue forms were checked against GitHub's form schema by hand (body types, unique ids,validations.required). Every CODEOWNERS handle has write access here.Acceptance criteria
Runtime behavior
Code quality
Housekeeping
CHANGELOG.mdentry (release-please owns it)examples/<workflow>.ymladded or updated to match any input change (no input changed)yamllint,actionlintandbin/check-workflows.shpass locallyReviewer notes
labels.ymlis data, not settings. Merging it changes no label. I have a small script that applies alabels.ymlwithgh label create --force; Run it just before merging, soType: Featureexists when the feature form first applies it; a label-sync workflow could do this later.Featureand the newType: Featurelabel.Scope: CD ProductandScope: CD Servicesdescriptions now name the real CD workflows (cd-github-release,cd-wp-org,cd-s3,cd-built-branch) instead ofcd-product-*andcd-services-*, and thelabels.ymlheader quotes the label name in itsgh label createexample (7b25958, 0b5561c).