chore(community): community health files and manual release proposing - #45
Merged
Conversation
…security policy, codeowners, dependabot Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Pushes to main no longer open/update the release PR - proposing a release is now Run workflow -> mode: propose. The push trigger stays for the tag-and-release chain (merge of a chore(release) PR), and the former bootstrap path is preserved as mode: publish-current. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
using-system
changed the title
propose, tag-and-publish, and publish-current are the three dispatch modes; tagging is guarded against re-running on an already-tagged version. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
using-system
force-pushed
the
chore/community-files
branch
from
August 23, 2026 12:30
c167914 to
3eeac71
Compare
Exactly one open chore(release) PR is merged by publish; multiple is an error, none is an error unless the version is already tagged (re-run). RELEASE_TOKEN (fine-grained PAT, optional secret) is used to create and merge the release PR so its required status checks actually run. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The required-status-checks rule was removed from the main ruleset (API): it made GITHUB_TOKEN-created release PRs unmergeable, since bot PRs never trigger workflows. PR-required + squash-only + human merge remain enforced; CI stays visible on every PR. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Everything a first external contributor needs (community profile was at 42%), plus the release-proposing switch:
.apm/contracts by-name, generated dirs,.odd/memory), the CI-canonical build/test/lint commands, the two hard MCP constraints (deferring to the spec as owner), and the PR rules (squash title = release note, Conventional Commits, no breaking markers without discussion).config.yml(blank issues off; questions → Discussions, vulnerabilities → private reporting).propose-releasebecomes a manual dispatch (Run workflow → mode: propose) — pushes to main no longer open release PRs; merging achore(release)PR still tags/publishes automatically, and the bootstrap path survives asmode: publish-current.Reviewed by a Fable 5 multi-angle pass: 10 findings, all addressed.
Settings applied separately via API: squash-only merges with PR-title-as-commit, delete-branch-on-merge, Discussions on, wiki off, private vulnerability reporting + Dependabot alerts on; the ruleset enforces PR-required + squash-only (required status checks were tried then removed: GITHUB_TOKEN-created release PRs never trigger workflows, so required checks made them unmergeable).
🤖 Generated with Claude Code