From 7083e846bb68d02278c4471e38f425384a41216b Mon Sep 17 00:00:00 2001 From: Mariusz Sabath Date: Fri, 9 Oct 2026 14:46:24 -0400 Subject: [PATCH] docs: add org community-health files pointing at rossoctl/rossoctl GitHub serves community-health files from a `.github` repository to every repo in the org that does not define its own -- but only for a specific set of filenames, and only from a repo literally named `.github`. This repo had the issue templates and PR template but none of the four documents, so nothing was being inherited: `community/profile` reported `code_of_conduct: null` and `security: null` for rossoctl/moca. Adds the four as pointers, not copies, so rossoctl/rossoctl stays the single source of truth and these cannot drift from it: CODE_OF_CONDUCT.md -> org policy + where conduct reports go SECURITY.md -> org policy, plus the do-not-open-an-issue summary and the 48h/7d expectations inline CONTRIBUTING.md -> org process + an index of all nine project documents SUPPORT.md -> where to ask what, and the licensing note Two deviations from a pure pointer, both deliberate: SECURITY.md tells a reporter to file the advisory against the repository where they found the issue, rather than reproducing the org file's link to rossoctl/rossoctl's advisory form. A vulnerability in moca should not be reported against a different repo. SUPPORT.md states that each repo carries its own LICENSE and asks readers to report any repo missing one. A LICENSE in this repo would NOT be inherited -- verified: moca, cortex and examples each have their own real Apache-2.0 file -- so adding one here would imply an inheritance that does not exist. Root markdown is outside both the Docusaurus build (which sources docs/ and src/pages) and the link checker (which crawls the deployed site), so these files do not affect the website. Links verified with lychee: 23 OK, 0 errors. Assisted-By: Claude (Anthropic AI) Signed-off-by: Mariusz Sabath --- CODE_OF_CONDUCT.md | 19 +++++++++++++++++++ CONTRIBUTING.md | 40 ++++++++++++++++++++++++++++++++++++++++ SECURITY.md | 25 +++++++++++++++++++++++++ SUPPORT.md | 34 ++++++++++++++++++++++++++++++++++ 4 files changed, 118 insertions(+) create mode 100644 CODE_OF_CONDUCT.md create mode 100644 CONTRIBUTING.md create mode 100644 SECURITY.md create mode 100644 SUPPORT.md diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..2804d45 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,19 @@ +# Code of Conduct + +The rossoctl Code of Conduct is maintained in the main project repository: + +**→ [rossoctl/rossoctl/CODE_OF_CONDUCT.md](https://github.com/rossoctl/rossoctl/blob/main/CODE_OF_CONDUCT.md)** + +It applies to every repository, issue tracker, pull request and communication channel in the +[rossoctl organization](https://github.com/rossoctl). + +GitHub serves this file to any rossoctl repository that does not define its own, so the policy +is written once and inherited everywhere rather than copied and left to drift. + +## Reporting + +Reporting addresses and the enforcement process are in the document linked above; conduct +concerns are handled by the maintainers listed in +[MAINTAINERS.md](https://github.com/rossoctl/rossoctl/blob/main/MAINTAINERS.md). See also +[GOVERNANCE.md](https://github.com/rossoctl/rossoctl/blob/main/GOVERNANCE.md) for how +enforcement decisions are made. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..1fc296e --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,40 @@ +# Contributing to rossoctl + +The rossoctl contribution process — how to claim an issue, how review works, the developer's +guide and the path to becoming a maintainer — is maintained in the main project repository: + +**→ [rossoctl/rossoctl/CONTRIBUTING.md](https://github.com/rossoctl/rossoctl/blob/main/CONTRIBUTING.md)** + +GitHub serves this file to any rossoctl repository that does not define its own, so the +process is written once and inherited everywhere rather than copied and left to drift. + +## Project-wide documents + +| Topic | Document | +| --------------------------- | --------------------------------------------------------------------------------------------- | +| Contribution process | [CONTRIBUTING.md](https://github.com/rossoctl/rossoctl/blob/main/CONTRIBUTING.md) | +| Governance & voting | [GOVERNANCE.md](https://github.com/rossoctl/rossoctl/blob/main/GOVERNANCE.md) | +| Maintainers | [MAINTAINERS.md](https://github.com/rossoctl/rossoctl/blob/main/MAINTAINERS.md) | +| Becoming a maintainer | [CONTRIBUTOR_LADDER.md](https://github.com/rossoctl/rossoctl/blob/main/CONTRIBUTOR_LADDER.md) | +| How features are accepted | [FEATURE_ACCEPTANCE.md](https://github.com/rossoctl/rossoctl/blob/main/FEATURE_ACCEPTANCE.md) | +| Personas and roles | [PERSONAS_AND_ROLES.md](https://github.com/rossoctl/rossoctl/blob/main/PERSONAS_AND_ROLES.md) | +| Code of conduct | [CODE_OF_CONDUCT.md](https://github.com/rossoctl/rossoctl/blob/main/CODE_OF_CONDUCT.md) | +| Security policy | [SECURITY.md](https://github.com/rossoctl/rossoctl/blob/main/SECURITY.md) | +| License (Apache-2.0) | [LICENSE](https://github.com/rossoctl/rossoctl/blob/main/LICENSE) | + +## What an individual repository adds + +A rossoctl repository may carry its own `CONTRIBUTING.md` covering **only what is specific to +it** — prerequisites, build, test and lint commands — and link back here for the process. Note +that a local file **replaces** this one rather than merging with it, so a repo-specific +`CONTRIBUTING.md` should link the process documents above explicitly. + +Two files are **not** inherited and must exist in every repository: + +- **`LICENSE`** — GitHub does not inherit a license. A repository without one is + all-rights-reserved regardless of the organization's intent. +- **`CODEOWNERS`** — review assignment is per-repository. + +New repositories should start from +[**rossoctl/repo-template**](https://github.com/rossoctl/repo-template), which ships both of +those plus the project's documentation convention. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..28c9bb4 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,25 @@ +# Security Policy + +The rossoctl security policy — reporting process, response timelines, disclosure policy and +supported versions — is maintained in the main project repository: + +**→ [rossoctl/rossoctl/SECURITY.md](https://github.com/rossoctl/rossoctl/blob/main/SECURITY.md)** + +GitHub serves this file to any rossoctl repository that does not define its own, so the policy +is written once and inherited everywhere rather than copied and left to drift. + +## Reporting a vulnerability — the short version + +**Do NOT open a public GitHub issue for a security vulnerability.** + +1. **GitHub Security Advisories (preferred).** Report privately against the repository where + you found the issue, via its **Security → Advisories → Report a vulnerability** tab. For + the main project that is + [here](https://github.com/rossoctl/rossoctl/security/advisories/new). +2. **Email.** +3. **Include:** a clear description, steps to reproduce, affected versions, and potential + impact. + +You can expect acknowledgement within 48 hours and an initial assessment within 7 business +days. Full timelines, the coordinated-disclosure policy and the security controls in place are +in the linked policy above — read it before reporting. diff --git a/SUPPORT.md b/SUPPORT.md new file mode 100644 index 0000000..a1d0185 --- /dev/null +++ b/SUPPORT.md @@ -0,0 +1,34 @@ +# Getting help + +GitHub shows this page from the **Help** link on issues in any rossoctl repository that does +not define its own. + +## Where to ask + +| If you… | Then… | +| ---------------------------------------------- | -------------------------------------------------------------------------------------- | +| have a question about using rossoctl | open a **Question** issue on the relevant repository | +| think you have found a bug | open a **Bug report** on the repository where you saw it | +| want a new capability | open a **Feature request**; see [FEATURE_ACCEPTANCE.md](https://github.com/rossoctl/rossoctl/blob/main/FEATURE_ACCEPTANCE.md) for how proposals are evaluated | +| have found a **security vulnerability** | **do not open an issue** — follow [SECURITY.md](https://github.com/rossoctl/rossoctl/blob/main/SECURITY.md) | +| want to contribute a change | read [CONTRIBUTING.md](https://github.com/rossoctl/rossoctl/blob/main/CONTRIBUTING.md) | + +Issue templates are provided org-wide from this repository, so the forms are the same +everywhere. + +## Project documents + +Governance, maintainers, the contributor ladder, the code of conduct and the security policy +are maintained once in the main project repository, +[**rossoctl/rossoctl**](https://github.com/rossoctl/rossoctl) — see +[CONTRIBUTING.md](CONTRIBUTING.md) for the full index. + +## Licensing + +rossoctl is licensed under **Apache-2.0**. The canonical text is +[rossoctl/rossoctl/LICENSE](https://github.com/rossoctl/rossoctl/blob/main/LICENSE). + +GitHub does **not** inherit a license across repositories, so each rossoctl repository carries +its own `LICENSE` file — a repository without one would be all-rights-reserved whatever the +organization intends. If you find a rossoctl repository with no `LICENSE`, please report it as +a bug.