docs: add governance baseline and tighter public positioning

Author: hahajunj

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Reuse and adoption guidance
+    url: https://github.com/junjapp/oss-maintainer-workflows/blob/main/README.md
+    about: Read the README first if you are deciding whether to copy the full scaffold or only keep a lighter subset.
+  - name: Security reporting path
+    url: https://github.com/junjapp/oss-maintainer-workflows/blob/main/SECURITY.md
+    about: Use the security policy for vulnerability reports instead of opening a public issue.

CHANGELOG.md

@@ -4,6 +4,8 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+- Added a lightweight code of conduct and issue-template chooser config so copied repositories get a clearer public governance baseline.
+- Tightened the public description so the repository reads as a maintainer operations kit for small public OSS repositories.
 - Clarified that the validation script describes the source-repository baseline and can be replaced or trimmed by downstream repositories.
 - Tightened the reuse guidance around release/version alignment and example adoption notes.
 - Clarified the maintainer-layer problem this repository is meant to solve for small public OSS projects.

CODE_OF_CONDUCT.md

@@ -0,0 +1,27 @@
+# Code of Conduct
+
+This repository aims to keep maintainer-facing work public, respectful, and workable for contributors and maintainers.
+
+## Expected behavior
+
+- Assume good intent, then be specific about what is unclear or broken.
+- Prefer narrow, actionable feedback over pile-on commentary.
+- Keep issue and pull request discussion tied to repository behavior, docs, templates, or release workflow.
+- Respect different levels of OSS experience and explain context when a workflow is not obvious yet.
+
+## Unacceptable behavior
+
+- Harassment, abuse, threats, or personal attacks
+- Repeatedly derailing issue or pull request threads
+- Sharing private or sensitive information without permission
+- Demanding unpaid work or treating maintainers like a support queue
+
+## Enforcement
+
+If a thread stops being workable, repository maintainers may edit, lock, hide, or close the conversation, and may limit future participation when needed.
+
+For conduct concerns, use the maintainer or security contact path listed in this repository instead of escalating inside a public issue thread.
+
+## Attribution
+
+This document is adapted from the Contributor Covenant project and keeps only the parts that fit this repository's smaller public maintainer workflow.

README.md

@@ -1,6 +1,6 @@
 # oss-maintainer-workflows
 
-A reusable workflow kit for open-source maintainers.
+Reusable maintainer operations kit for small public OSS repositories.
 
 ## What this repository is for
 
@@ -14,6 +14,14 @@ This repository gives OSS maintainers a small, reusable starting point for day-t
 
 It is intentionally not an app starter. It is a repository operations starter.
 
+## What this repository is not trying to do
+
+- It is not a universal community playbook for every OSS project shape.
+- It is not a replacement for project-specific product docs or contributor onboarding.
+- It is not the right fit if your repository only needs one or two local templates and nothing else.
+
+If your project only needs a lighter setup, copy the smallest useful pieces instead of keeping the whole scaffold.
+
 ## Why this layer matters
 
 Small OSS projects often rebuild the same maintainer-facing surface from scratch:
@@ -41,11 +49,13 @@ This repository exists to keep that layer reusable, inspectable, and easy to ada
 
 - root documentation:
   - `README.md`
+  - `CODE_OF_CONDUCT.md`
   - `CONTRIBUTING.md`
   - `SECURITY.md`
   - `CHANGELOG.md`
 - repository workflow assets:
   - `.github/ISSUE_TEMPLATE/*.yml`
+  - `.github/ISSUE_TEMPLATE/config.yml`
   - `.github/pull_request_template.md`
   - `.github/CODEOWNERS`
   - `.github/workflows/*.yml`
@@ -101,6 +111,7 @@ If you want to see what that first downstream pass can look like, start with `ex
 ## Common adjustments
 
 - replace the generic project description with the actual repository purpose
+- keep only the governance files your repository is willing to maintain in public
 - review the issue templates and remove anything your repository will not maintain
 - confirm `README.md`, `CODEOWNERS`, `SECURITY.md`, and release notes reflect real maintainers
 - align package metadata, changelog sections, and release checks before the next release

package.json

@@ -1,7 +1,7 @@
 {
   "name": "oss-maintainer-workflows",
   "version": "0.1.4",
-  "description": "A reusable workflow kit for open-source maintainers.",
+  "description": "Reusable maintainer operations kit for small public OSS repositories.",
   "type": "module",
   "private": false,
   "scripts": {
@@ -15,7 +15,9 @@
     "open-source",
     "maintainer",
     "github-actions",
-    "workflow-template"
+    "workflow-template",
+    "issue-templates",
+    "repository-governance"
   ],
   "license": "MIT"
 }

scripts/validate-repo.mjs

@@ -6,12 +6,14 @@ export const requiredPaths = [
   "package-lock.json",
   "README.md",
   "LICENSE",
+  "CODE_OF_CONDUCT.md",
   "CONTRIBUTING.md",
   "SECURITY.md",
   "CHANGELOG.md",
   ".github/CODEOWNERS",
   ".github/release.yml",
   ".github/pull_request_template.md",
+  ".github/ISSUE_TEMPLATE/config.yml",
   ".github/ISSUE_TEMPLATE/bug-report.yml",
   ".github/ISSUE_TEMPLATE/docs-request.yml",
   ".github/ISSUE_TEMPLATE/workflow-improvement.yml",

tests/public-surface.test.mjs

@@ -6,10 +6,12 @@ import { spawnSync } from "node:child_process";
 
 const publicFiles = [
   "README.md",
+  "CODE_OF_CONDUCT.md",
   "CONTRIBUTING.md",
   "docs/maintenance-cadence.md",
   "docs/project-roadmap.md",
   "docs/release-playbook.md",
+  ".github/ISSUE_TEMPLATE/config.yml",
   ".github/workflows/validate.yml",
   ".github/workflows/release-check.yml",
   ".github/release.yml",
@@ -104,20 +106,36 @@ test("public docs describe a concrete adoption and release path", async () => {
   const packageJson = JSON.parse(
     await fs.readFile(path.join(repoRoot, "package.json"), "utf8"),
   );
+  const codeOfConduct = await fs.readFile(
+    path.join(repoRoot, "CODE_OF_CONDUCT.md"),
+    "utf8",
+  );
+  const issueTemplateConfig = await fs.readFile(
+    path.join(repoRoot, ".github", "ISSUE_TEMPLATE", "config.yml"),
+    "utf8",
+  );
 
   assert.match(readme, /Minimal rollout path/);
   assert.match(readme, /Replace before reuse/);
   assert.match(readme, /Validation baseline/);
   assert.match(readme, /What tends to belong here/);
+  assert.match(readme, /What this repository is not trying to do/);
+  assert.match(readme, /If your project only needs a lighter setup/);
   assert.doesNotMatch(readme, /README\.zh-CN\.md/);
   assert.match(readme, /README\.md`?, `?CODEOWNERS`?, and `?SECURITY\.md/);
   assert.match(readme, /This repository keeps active maintainer values for its own public operation/);
   assert.match(readme, /maintainer-workflows\.paths\.json/);
   assert.match(readme, /first downstream pass can look like/);
+  assert.match(readme, /CODE_OF_CONDUCT\.md/);
+  assert.match(readme, /\.github\/ISSUE_TEMPLATE\/config\.yml/);
   assert.match(codeowners, /Replace this entry before reusing the scaffold/);
   assert.match(codeowners, /This repository keeps an active owner entry because it is the live source repository/);
   assert.match(security, /Replace the contact path before you reuse this scaffold/);
   assert.match(security, /contact the active maintainer directly for this repository/);
+  assert.match(codeOfConduct, /Contributor Covenant/);
+  assert.match(codeOfConduct, /public, respectful, and workable/);
+  assert.match(issueTemplateConfig, /blank_issues_enabled: false/);
+  assert.match(issueTemplateConfig, /contact_links:/);
   assert.match(releasePlaybook, /Versioning notes/);
   assert.match(releasePlaybook, /Release note/);
   assert.match(releasePlaybook, /Pre-tag command sequence/);
@@ -140,4 +158,8 @@ test("public docs describe a concrete adoption and release path", async () => {
   assert.match(roadmap, /copy and cleanup cycle/);
   assert.match(roadmap, /real downstream first pass/);
   assert.equal(packageJson.version, "0.1.4");
+  assert.equal(
+    packageJson.description,
+    "Reusable maintainer operations kit for small public OSS repositories.",
+  );
 });