.github

Organization-wide community-health defaults for the melodic-software GitHub organization.

GitHub falls back to the files in this special repository for any repository that does not provide its own, so they all inherit the same contribution and disclosure workflow without redefining it.

These are the file-based governance defaults that GitHub's API cannot express. Everything the Pulumi GitHub provider can express is managed as infrastructure-as-code in the private github-iac repository, not here: repository settings, custom properties, rulesets, and labels. That name is deliberately not a link. The repository is private, so a link 404s for every reader outside the organization, and lychee.toml excludes it from the online link lane for the same reason.

What's here

• Policies: CODE_OF_CONDUCT.md, CONTRIBUTING.md, GOVERNANCE.md, SECURITY.md, and SUPPORT.md. A repository that ships its own copy overrides the default; everything else inherits these.
• Templates: .github/ISSUE_TEMPLATE/ (bug report, feature request, task, and the chooser config that disables blank issues) and .github/PULL_REQUEST_TEMPLATE.md.
• Profile: profile/README.md renders as the organization's public profile page. Other repositories do not inherit it.
• This repository's own CI: .github/workflows/ and .github/scripts/. ci.yml runs the SHA-pinned lint and hygiene lanes from ci-workflows and aggregates them into the single ci-status check the org ruleset requires. The pr-section-drift lane is a local script (.github/scripts/pr-section-drift.mjs and its tests) that compares .github/PULL_REQUEST_TEMPLATE.md and .claude/source-control.md against the pr-contract composite at the SHA .github/workflows/ci.yml pins. The pull-request contract itself (Conventional Commits title, do-not-merge label, issue linkage) is the pr-contract step inside the ci-status job, so there are no separate caller workflows for it. .github/dependabot.yml keeps the SHA-pinned composite actions current. Give every composite-action pin a # vX.Y.Z tag comment. Standards' pin-comment convention also permits a short-sha-and-date fallback, but Dependabot reads the current version out of that comment, so the fallback form leaves an action silently un-updated.
• Quality configs: the root dotfiles the CI lanes run against. .editorconfig, .gitattributes, .markdownlint-cli2.jsonc, _typos.toml, .gitleaks.toml, lychee.toml, and .editorconfig-checker.json are synced from standards; .gitignore is owned by this repository. Change a lint or hygiene rule in standards and let the sync land it here. An edit made directly to one of these files survives only until the next sync commit overwrites it. .shellcheckrc is the exception. It is a byte-identical copy of the same canonical file, but this repository is not on the shellcheck component's managed list, so nothing syncs it and nothing overwrites a local edit either. Adopting the component upstream is the durable fix; until then the copy drifts silently.
• Agent config: .claude/settings.json declares the melodic-software plugin marketplace, the plugins enabled for this project, and the SessionStart hook that runs .claude/cloud-bootstrap.sh, itself synced from standards and extended per-repo by an optional .claude/cloud-bootstrap.local.sh. .claude/source-control.md is the tracked team layer of the source-control convention (commit and PR-title pattern, required PR-body sections, merge lane); .work-item-tracker.json binds the work-items tracker provider and .github/recurring-schedule.json holds its recurring-work schedule. .claude/source-control.md and .work-item-tracker.json each resolve an optional gitignored *.local.* overlay for per-operator deviations. CLAUDE.md is the agent-loaded entry point: it routes to this file rather than restating it, and carries only what no other file states.
• Cloud Agent environment: .cursor/environment.json is the repo-managed Cursor Cloud Agent config and the highest-precedence environment source. Its install runs .cursor/install.sh, which installs the same lint/hygiene tools .github/workflows/ci.yml runs (markdownlint-cli2, typos, editorconfig-checker, gitleaks, lychee, actionlint, check-jsonschema, shellcheck), each pinned to the version the SHA-pinned ci-workflows action uses, so .cursor/check.sh reproduces the CI lanes, pr-section-drift included, and their ci-status aggregate locally.

The inventory above covers every tracked file, and no check enforces that. When a file is added or removed, update this section in the same change.

Editing a policy here changes it for every repository that has not overridden it, so treat these files as org-wide.