diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..3ec6720 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,125 @@ +# Contributor Covenant Code of Conduct + +## Our Pledge + +We as members, contributors, and leaders pledge to make participation in our +community a harassment-free experience for everyone, regardless of age, body +size, visible or invisible disability, ethnicity, sex characteristics, gender +identity and expression, level of experience, education, socio-economic status, +nationality, personal appearance, race, caste, color, religion, or sexual +identity and orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, +diverse, inclusive, and healthy community. + +## Our Standards + +Examples of behavior that contributes to a positive environment include: + +- Demonstrating empathy and kindness toward other people +- Being respectful of differing opinions, viewpoints, and experiences +- Giving and gracefully accepting constructive feedback +- Accepting responsibility and apologizing to those affected by our mistakes, + and learning from the experience +- Focusing on what is best not just for us as individuals, but for the overall + community + +Examples of unacceptable behavior include: + +- The use of sexualized language or imagery, and sexual attention or advances of + any kind +- Trolling, insulting or derogatory comments, and personal or political attacks +- Public or private harassment +- Publishing others' private information, such as a physical or email address, + without their explicit permission +- Other conduct which could reasonably be considered inappropriate in a + professional setting + +## Enforcement Responsibilities + +Community leaders are responsible for clarifying and enforcing our standards of +acceptable behavior and will take appropriate and fair corrective action in +response to any behavior that they deem inappropriate, threatening, offensive, +or harmful. + +Community leaders have the right and responsibility to remove, edit, or reject +comments, commits, code, wiki edits, issues, and other contributions that are +not aligned to this Code of Conduct, and will communicate reasons for moderation +decisions when appropriate. + +## Scope + +This Code of Conduct applies within all community spaces for Rethunk-Tech +projects, and also applies when an individual is officially representing the +community in public spaces. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported to the community leaders responsible for enforcement at +[oss@rethunk.tech](mailto:oss@rethunk.tech). + +All complaints will be reviewed and investigated promptly and fairly. + +All community leaders are obligated to respect the privacy and security of the +reporter of any incident. + +## Enforcement Guidelines + +Community leaders will follow these Community Impact Guidelines in determining +the consequences for any action they deem in violation of this Code of Conduct: + +### 1. Correction + +**Community Impact**: Use of inappropriate language or other behavior deemed +unprofessional or unwelcome in the community. + +**Consequence**: A private, written warning from community leaders, providing +clarity around the nature of the violation and an explanation of why the +behavior was inappropriate. A public apology may be requested. + +### 2. Warning + +**Community Impact**: A violation through a single incident or series of +actions. + +**Consequence**: A warning with consequences for continued behavior. No +interaction with the people involved, including unsolicited interaction with +those enforcing the Code of Conduct, for a specified period of time. This +includes avoiding interactions in community spaces as well as external channels +like social media. Violating these terms may lead to a temporary or permanent +ban. + +### 3. Temporary Ban + +**Community Impact**: A serious violation of community standards, including +sustained inappropriate behavior. + +**Consequence**: A temporary ban from any sort of interaction or public +communication with the community for a specified period of time. No public or +private interaction with the people involved, including unsolicited interaction +with those enforcing the Code of Conduct, is allowed during this period. +Violating these terms may lead to a permanent ban. + +### 4. Permanent Ban + +**Community Impact**: Demonstrating a pattern of violation of community +standards, including sustained inappropriate behavior, harassment of an +individual, or aggression toward or disparagement of classes of individuals. + +**Consequence**: A permanent ban from any sort of public interaction within the +community. + +## Attribution + +This Code of Conduct is adapted from the +[Contributor Covenant](https://www.contributor-covenant.org), version 2.1, +available at +https://www.contributor-covenant.org/version/2/1/code_of_conduct.html. + +Community Impact Guidelines were inspired by +[Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/diversity). + +For answers to common questions about this code of conduct, see the FAQ at +https://www.contributor-covenant.org/faq. Translations are available at +https://www.contributor-covenant.org/translations. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..f0a610b --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,39 @@ +# Contributing + +Thanks for considering a contribution to [Rethunk-Tech](https://github.com/Rethunk-Tech). +This is the **organization default**. If a repository ships its own +`CONTRIBUTING.md` (or `HUMANS.md` / `AGENTS.md`), follow those first. + +## Ground rules + +- Be respectful — see [`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md). +- Keep changes focused: one logical unit per PR when practical. +- Prefer fixing docs and tests alongside behavior changes. +- Do not commit secrets, credentials, or private customer data. + +## Commits + +Use [Conventional Commits](https://www.conventionalcommits.org/): + +```text +type(scope): subject +``` + +Common types: `feat`, `fix`, `docs`, `refactor`, `test`, `ci`, `build`, `chore`. +The body should explain **why**, not restate the diff. + +## Pull requests + +1. Branch from the repository default branch (`main` unless noted). +2. Run the project's documented checks (CI, `lefthook`, `gate`, etc.) before asking for review. +3. Describe: what changed, why, how you tested, and any deliberate tradeoffs. +4. Link related issues. + +## Security + +Report vulnerabilities privately — see [`SECURITY.md`](SECURITY.md). + +## Questions + +- Project-specific: open an issue on that repo +- Org / process: [oss@rethunk.tech](mailto:oss@rethunk.tech) or see [`SUPPORT.md`](SUPPORT.md) diff --git a/README.md b/README.md index 144210d..dd0e6c4 100644 --- a/README.md +++ b/README.md @@ -29,6 +29,7 @@ This org-templates dossier has no HUMANS-tier runbook — edit `profile/README.m | Resource | Description | | -------- | ----------- | | [`profile/README.md`](profile/README.md) | Public organization profile shown on github.com/Rethunk-Tech | +| [`SECURITY.md`](SECURITY.md) · [`SUPPORT.md`](SUPPORT.md) · [`CONTRIBUTING.md`](CONTRIBUTING.md) · [`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md) | Organization default community health files | | [`.github/workflows/ci.yml`](.github/workflows/ci.yml) | Workflow file validation for this repository | ## License diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..b3ea9f4 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,53 @@ +# Security Policy + +This is the **organization default** for [Rethunk-Tech](https://github.com/Rethunk-Tech). +If a repository has its own `SECURITY.md`, follow that file instead. + +## Supported versions + +Unless a repo says otherwise, only the default branch (`main`) is supported. +Security fixes land there; there is typically no long-lived release branch. + +## Reporting a vulnerability + +**Do not open a public issue** for security-sensitive findings. + +1. Prefer GitHub's private advisory flow on the affected repository: + `https://github.com/Rethunk-Tech//security/advisories/new` +2. If that is unavailable, email [oss@rethunk.tech](mailto:oss@rethunk.tech) with + **[SECURITY]** in the subject. + +Please include: + +- Affected repository and commit SHA (or release tag) +- Reproduction steps +- Observed vs. expected behavior +- Impact assessment (local-only, requires credentials, remote exploitability, etc.) + +We aim to acknowledge reports within a few business days. + +## Scope guidance + +**Usually in scope** + +- Remote or local code execution reachable through project code or config +- Credential or secret leakage via logs, artifacts, or docs +- Supply-chain issues in first-party packaging or release signing we control +- Unexpected code execution or privilege escalation via CLIs, git/Claude hooks, + or CI Actions we publish + +**Usually out of scope** + +- Issues that require already having root or physical access to the host +- Bugs solely in upstream dependencies without a demonstrable path through our code + (report those upstream; link us if relevant) +- Denial of service from intentional oversized local workloads (resource sizing) +- Social-engineering of individual maintainers outside published channels + +## Safe harbor + +We will not pursue legal action against good-faith research that: + +- Avoids violating privacy, destroying data, or degrading production services +- Stops at proof of concept without exfiltrating unrelated user data +- Gives us a reasonable chance to remediate before public disclosure diff --git a/SUPPORT.md b/SUPPORT.md new file mode 100644 index 0000000..d391640 --- /dev/null +++ b/SUPPORT.md @@ -0,0 +1,25 @@ +# Support + +This is the **organization default** for [Rethunk-Tech](https://github.com/Rethunk-Tech). +Prefer a repository's own docs when they exist. + +## How to get help + +| Need | Where | +|------|--------| +| Bug or feature for a specific project | Open an issue on that repository | +| Security vulnerability | See [`SECURITY.md`](SECURITY.md) — do **not** file a public issue | +| Website | [we.rethunk.tech](https://we.rethunk.tech/) | +| Org / OSS contact | [oss@rethunk.tech](mailto:oss@rethunk.tech) | + +## Before opening an issue + +1. Check the repo `README` (and `HUMANS.md` / `AGENTS.md` if present). +2. Search existing issues and discussions for duplicates. +3. Include OS, versions, exact commands, and minimal reproduction when reporting bugs. + +## What we do not offer here + +- Private consulting or custom implementation work via GitHub Issues +- Guaranteed SLAs on volunteer / OSS response times +- Support for archived repositories (see the org profile "Archived" section)