docs: add org-level CODE_OF_CONDUCT.md and SECURITY.md

[Timur Tukaev (tym83)]

Adds community health files to the org .github repo so every cozystack repository without its own surfaces a working Code of Conduct and Security tab (copied from cozystack/cozystack). Repos with their own files keep them. Addresses cozystack/community#78.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 229ef92f-033b-4ce4-be36-3c454fdb3953

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[IvanHunters]

Verdict

NOT LGTM

The code of conduct is fine and lands cleanly. The security policy has a scope problem that only appears once you ask where GitHub actually serves it, and the answer is: everywhere except the repository it says it covers.

Findings

• [CRITICAL] SECURITY.md:5, the org default is served only where its own scope excludes it
• [CRITICAL] SECURITY.md:36, both private reporting channels are dead on the repos that inherit this

Caveats

• Both files are byte-identical copies of what cozystack/cozystack carries today, with no sync mechanism. cozystack/cozystack#4223 changes the source, so the org copy starts diverging the day that lands.
• terraform-provider-cozystack keeps its own, materially different policy. Pre-existing, unaffected either way.
• The code of conduct checks out: the CNCF link resolves and the enforcement contact is live. Neither new file mentions the governance role that cozystack/cozystack#4296 removes.

[IvanHunters]

[CRITICAL] the org default is served only where its own scope excludes it

Line 5 reads "This policy applies to the cozystack/cozystack repository and to release artifacts produced from it". A file in .github is the organisation fallback: GitHub serves it on every repository that has no SECURITY.md of its own, and never on one that does.

$ gh api orgs/cozystack/repos --paginate \
    --jq '.[] | select(.archived==false and .fork==false) | .name' | wc -l
30
$ # of those, the ones carrying their own SECURITY.md:
cozystack
terraform-provider-cozystack

So this text renders on the other 28 repositories and never on cozystack/cozystack, which keeps its own. Someone reporting a flaw in etcd-operator or blockstor opens the Security tab and is handed a policy that explicitly disclaims their repository, sitting above a supported-versions table describing a release line that is not theirs. Every "this repository" statement in the file is false as served, and the response targets read as commitments by maintainers who never made them.

Generalise the scope section for organisation-wide use, or ship the file per repository instead of centralising it.

[IvanHunters]

[CRITICAL] both private reporting channels are dead on the repos that inherit this

Channel 1 is GitHub Private Vulnerability Reporting. Channel 2 is a repo-relative link to MAINTAINERS.md. Across the 28 repositories that inherit this file, channel 2 resolves nowhere:

$ # MAINTAINERS.md over the 28 repos that inherit this file:
(matches: 0)
$ # control, against a repo that does have one:
$ gh api repos/cozystack/cozystack/contents/MAINTAINERS.md --silent && echo present
present

The control matters: a lookup that returns nothing everywhere is worth nothing until it is shown to return something somewhere.

Private Vulnerability Reporting is additionally disabled on at least nine of the inheriting repositories, among them blockstor, etcd-operator, ccp, copy-fail-blocker, keycloak-kms-proxy, kilo-clustermesh-operator and windows-golden-image. On those nine a reporter has neither private channel, and the file's own channel 3 is to ask on a public channel for a contact path while withholding the details, which is the outcome a security policy exists to avoid.

Enable PVR across the organisation and make the maintainers reference absolute rather than repo-relative, before this merges.

[IvanHunters]

Verdict

LGTM with non-blocking notes

Both blockers from round 1 are genuinely closed, and I checked them against the served reality rather than the wording. The scope section now says what the file is, cozystack/cozystack is named as keeping its own policy, every link is absolute, and the two channels resolve: PVR is enabled on cozystack/cozystack and MAINTAINERS.md returns 200. Of 48 repositories in the org, six carry their own SECURITY.md and four of those are archived forks, so the default lands where it is meant to.

Notes

• Channel 3 of the primary policy did not make it across. cozystack/cozystack/SECURITY.md ends its list with "If you have neither, use a public community channel only to request a private contact path, without disclosing any vulnerability details." That clause exists for the reporter with no GitHub account and no existing contact, which is exactly who an org-wide default serves, and the copy here stops at two channels after telling them not to post publicly.
• Line 15 says PVR "routes to the maintainers". GitHub notifies repository admins and security managers. @matthieu-robin and @mattia-eleuteri hold write on cozystack/cozystack, and gh api orgs/cozystack/security-managers returns [], so two of the five people line 16 names as responsible for security response see a report only once someone adds them to the advisory. Adding them as org Security Managers would make the sentence true rather than aspirational.
• Eight of the repositories that inherit this file have their own PVR switched on, so GitHub shows a "Report a vulnerability" button pointing at that repository's advisories rather than the URL on line 15. Nothing is lost, the report still reaches that repo's admins, but the single-inbox framing is not what a reporter will actually see.
• The roster and the 3/7/90 day commitments are duplicated from the primary policy into a different repository with different reviewers. They match today. A pointer would not go stale.
• CODE_OF_CONDUCT.md:3 links the CNCF code via blob/master/, which survives only on GitHub's rename redirect (302 to /main/). Same file carries two H1 headings.