From 9111e758a41b5d6f5867d19ec01c2bdcacad91c9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Est=C3=A9fano=20Vechietti?=
 <311154804+estefano-vechietti-azion@users.noreply.github.com>
Date: Tue, 29 Sep 2026 17:31:44 -0300
Subject: [PATCH] feat: publish organization default community health files

PRE-11 / SO-4944. Defaults used by every aziontech repository that has
no own version: SECURITY.md (disclosure via security@azion.com),
CONTRIBUTING.md, issue forms (blank issues disabled, security contact
link) and the pull request template. Adds CODEOWNERS, MIT LICENSE,
Dependabot for actions and the OSSF Scorecard gate required for public
repositories.
---
 .github/ISSUE_TEMPLATE/bug_report.yml      | 49 +++++++++++++++++++
 .github/ISSUE_TEMPLATE/config.yml          |  8 ++++
 .github/ISSUE_TEMPLATE/feature_request.yml | 26 ++++++++++
 .github/dependabot.yml                     | 21 ++++++++
 .github/pull_request_template.md           | 33 +++++++++++++
 .github/workflows/ossf-scorecard.yml       | 56 ++++++++++++++++++++++
 CODEOWNERS                                 | 10 ++++
 CONTRIBUTING.md                            | 30 ++++++++++++
 LICENSE                                    | 21 ++++++++
 README.md                                  | 22 +++++++--
 SECURITY.md                                | 35 ++++++++++++++
 11 files changed, 308 insertions(+), 3 deletions(-)
 create mode 100644 .github/ISSUE_TEMPLATE/bug_report.yml
 create mode 100644 .github/ISSUE_TEMPLATE/config.yml
 create mode 100644 .github/ISSUE_TEMPLATE/feature_request.yml
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/pull_request_template.md
 create mode 100644 .github/workflows/ossf-scorecard.yml
 create mode 100644 CODEOWNERS
 create mode 100644 CONTRIBUTING.md
 create mode 100644 LICENSE
 create mode 100644 SECURITY.md

diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
new file mode 100644
index 0000000..88ca8a9
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -0,0 +1,49 @@
+name: Bug report
+description: Something does not work as expected.
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        **Security issue?** Do not use this form. Email security@azion.com (see SECURITY.md).
+        Do not paste tokens, credentials or internal hostnames: this issue may be public.
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: What you observed, including exact error messages.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What you expected
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. ...
+        2. ...
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Release tag, commit or package version.
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: OS, runtime and versions, relevant configuration.
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: Relevant output, with secrets removed.
+      render: shell
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000..4665be3
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/aziontech/.github/blob/main/SECURITY.md
+    about: Do not open a public issue. Email security@azion.com as described in the Security Policy.
+  - name: Azion product support
+    url: https://www.azion.com/
+    about: Questions about Azion products and your account go to Azion support, not to GitHub issues.
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
new file mode 100644
index 0000000..ad1f9b1
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -0,0 +1,26 @@
+name: Feature request
+description: Propose a new capability or an improvement.
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What you are trying to do and why the current behavior falls short.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: The change you suggest.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..a7e4fb3
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,21 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "02:00"
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 0000000..0cdf6d8
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,33 @@
+## Description
+
+<!-- What changes and why. Link the ticket or issue. -->
+
+## Type of change
+
+- [ ] `feat:` new feature
+- [ ] `fix:` bug fix
+- [ ] `docs:` / `refactor:` / `test:` / `ci:` / `chore:`
+- [ ] Breaking change
+
+## Bump
+
+<!-- Pick ONE. It drives the next SemVer release. -->
+- [ ] `#major` — breaking change
+- [ ] `#minor` — new backward-compatible feature
+- [ ] `#patch` — fix, refactor, docs
+- [ ] `#none` — no release (CI, internal docs)
+
+## Testing
+
+- [ ] Tests added or updated for the changed behavior
+- [ ] CI is green
+
+## Checklist
+
+- [ ] PR title follows Conventional Commits (`type: description`, optional `[TICKET]` prefix)
+- [ ] `CHANGELOG.md` updated, if the repository keeps one
+- [ ] No secrets, credentials or internal hostnames in code, logs or this description
+
+## Related issues
+
+<!-- Closes #123 / ENG-123 -->
diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
new file mode 100644
index 0000000..949b61c
--- /dev/null
+++ b/.github/workflows/ossf-scorecard.yml
@@ -0,0 +1,56 @@
+# OSSF Scorecard — PUBLIC repositories only.
+# Runs the PUBLIC ossf/scorecard-action on GitHub-hosted runners (free for public).
+# Results are NOT published (publish_results: false -> no OpenSSF API, no badge).
+# The job gates the PR on the aggregate score. Ramp with THRESHOLD + MODE before
+# flipping MODE=enforce org-wide (today 0/52 public repos are >= 8).
+name: OSSF Scorecard
+
+on:
+  pull_request:
+    branches: [ "main", "master", "dev", "develop", "stage" ]
+  schedule:
+    - cron: "0 6 * * 1"      # weekly measurement on the default branch
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  scorecard:
+    name: OSSF Scorecard          # <- this string is the required_status_checks context
+    runs-on: ubuntu-latest        # GitHub-hosted, free for public — never azion-runners
+    permissions:
+      contents: read
+    env:
+      THRESHOLD: "8"              # target aggregate; start lower during the ramp
+      MODE: "warn"               # warn = never blocks; enforce = fail PR below THRESHOLD
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Run Scorecard (results not published)
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.json
+          results_format: json
+          publish_results: false   # NOT published: no OpenSSF API, no badge
+
+      - name: Gate on aggregate score
+        run: |
+          SCORE=$(jq -r '.score' results.json)
+          echo "OSSF aggregate = ${SCORE}  (threshold ${THRESHOLD}, mode ${MODE})"
+          # -1 == inconclusive: don't block on it
+          if [ "$SCORE" = "-1" ] || [ "$SCORE" = "null" ]; then
+            echo "::warning::Scorecard returned inconclusive score — not gating"; exit 0
+          fi
+          below=$(awk -v s="$SCORE" -v t="$THRESHOLD" 'BEGIN{print (s<t)?1:0}')
+          if [ "$below" = "1" ]; then
+            if [ "$MODE" = "enforce" ]; then
+              echo "::error::OSSF ${SCORE} < ${THRESHOLD} — blocking merge"; exit 1
+            else
+              echo "::warning::OSSF ${SCORE} < ${THRESHOLD} — warn mode, not blocking"
+            fi
+          fi
+          # NOTE: results.json (full findings) is never printed — only the aggregate.
+          # To also keep findings in the private Security tab, run a second step with
+          # results_format: sarif + github/codeql-action/upload-sarif (needs security-events: write).
diff --git a/CODEOWNERS b/CODEOWNERS
new file mode 100644
index 0000000..1cb6d8e
--- /dev/null
+++ b/CODEOWNERS
@@ -0,0 +1,10 @@
+# CODEOWNERS — aziontech/.github
+# These files are the default for every repository in the organization.
+
+*                                   @aziontech/team-delivery-engineering
+
+SECURITY.md                         @aziontech/security-office
+/.github/                           @aziontech/team-delivery-engineering @aziontech/security-office
+/.github/workflows/                 @aziontech/team-delivery-engineering @aziontech/security-office
+/CODEOWNERS                         @aziontech/team-delivery-engineering @aziontech/security-office
+LICENSE                             @aziontech/team-delivery-engineering
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..0ba7ddc
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,30 @@
+# Contributing
+
+Thanks for contributing to an `aziontech` project. This guide applies to every repository in the organization that
+does not publish its own `CONTRIBUTING.md`.
+
+## Before you start
+
+- **Security issues:** do not open an issue or pull request. Follow the [Security Policy](SECURITY.md).
+- **Bugs and features:** search the existing issues first, then open one with the matching template.
+- **Large changes:** open an issue to discuss the approach before writing code.
+
+## Pull requests
+
+1. Branch from the default branch (`main`). Keep branches short-lived.
+2. Keep each pull request focused on one change.
+3. Title in [Conventional Commits](https://www.conventionalcommits.org/) format. A ticket prefix is optional:
+   - `fix: handle empty response`
+   - `[ENG-123] feat(cache): add purge by tag`
+
+   Types: `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `build`, `ci`, `chore`, `revert`.
+4. Add or update tests for the behavior you change, and make sure CI is green.
+5. Fill in the pull request template, including the version bump (`#major`, `#minor`, `#patch` or `#none`).
+6. Do not commit secrets, credentials or internal hostnames. Secret scanning blocks pushes that contain them.
+
+Pull requests are merged after review by the code owners of the changed files.
+
+## Versioning
+
+Releases follow [Semantic Versioning](https://semver.org/) and are tagged `vMAJOR.MINOR.PATCH`. Notable changes
+are recorded in the repository's `CHANGELOG.md`.
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..6be4a00
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2010-2026 Azion Technologies
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/README.md b/README.md
index 30e93a8..c743a0b 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,23 @@
 
 Default community health files for the `aziontech` GitHub organization.
 
-GitHub uses the files in this repository for every `aziontech` repository that does not have its own version:
-issue and pull request templates, `SECURITY.md` and `CONTRIBUTING.md`.
-
+GitHub uses the files in this repository for every `aziontech` repository that does not have its own version.
 A file in a repository always takes precedence over the default here.
+
+| File | Default for |
+|---|---|
+| [`SECURITY.md`](SECURITY.md) | Vulnerability disclosure (security@azion.com) |
+| [`CONTRIBUTING.md`](CONTRIBUTING.md) | Branches, Conventional Commits, pull requests, versioning |
+| [`.github/ISSUE_TEMPLATE/`](.github/ISSUE_TEMPLATE/) | Bug report and feature request forms; blank issues disabled |
+| [`.github/pull_request_template.md`](.github/pull_request_template.md) | Pull request description |
+
+`CODEOWNERS` is **not** inherited by other repositories: each repository keeps its own. The `CODEOWNERS` here only
+covers this repository.
+
+This repository is public by GitHub requirement. It must not contain internal policies, procedures, hostnames or
+contacts beyond the public security address.
+
+## Changing a default
+
+Open a pull request. Changes here affect every repository in the organization that relies on the default, so they
+need review from Delivery Engineering, and from Security Office for anything security-related (see `CODEOWNERS`).
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..143a902
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,35 @@
+# Security Policy
+
+This policy applies to every repository in the `aziontech` organization that does not publish its own `SECURITY.md`.
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues, discussions or pull requests.**
+
+Send an email to **security@azion.com** with:
+
+- The affected repository, and the version, tag or commit
+- Type of vulnerability and its impact
+- Step-by-step instructions to reproduce
+- Proof-of-concept or exploit code, if available
+
+## Response Timeline
+
+| Stage | SLA |
+|-------|-----|
+| Acknowledgment | 2 business days |
+| Status update | 5 business days |
+| Fix or mitigation | Based on severity |
+
+## Vulnerability Management
+
+When we receive a vulnerability report:
+
+1. We acknowledge receipt within 2 business days
+2. We confirm the issue and determine the affected versions
+3. We prepare a fix for all supported versions
+4. We release the fix and publish a security advisory
+
+## Acknowledgments
+
+We appreciate responsible disclosure and will acknowledge security researchers who report valid vulnerabilities.