.github

Org-level furniture for BaseLayerAI. This repo holds three kinds of things:

1. The org profile — profile/README.md renders as the landing page at github.com/BaseLayerAI.

2. Inherited community health files — CONTRIBUTING.md, SECURITY.md, SUPPORT.md, CODE_OF_CONDUCT.md, the PR template, and the issue templates apply to every repo in the org that does not override them with its own copy.

3. The reusable CI workflow — .github/workflows/ci-reusable.yml. Each repo carries a three-line ci.yml stub that calls it:

   jobs:
     ci:
       uses: BaseLayerAI/.github/.github/workflows/ci-reusable.yml@main

   The reusable workflow auto-detects the stack (Node / Python / shell) and runs the appropriate lint, typecheck, build, and test steps.

Contents

File	Purpose
profile/README.md	Org landing page shown at github.com/BaseLayerAI
CONTRIBUTING.md	Dev setup, lint gate, commit conventions, secrets policy
SECURITY.md	Private vulnerability reporting and leaked-credential procedure
SUPPORT.md	What support to expect and how to ask
CODE_OF_CONDUCT.md	Contributor Covenant 2.1, enforcement via repo issues
.github/PULL_REQUEST_TEMPLATE.md	PR checklist (secrets, env vars, docs, commit title)
.github/ISSUE_TEMPLATE/	Structured forms: bug_report.yml, agent_failure.yml, plus config.yml
.github/CODEOWNERS	Default reviewer for changes to this repo
.github/workflows/ci-reusable.yml	Org-wide reusable CI (stack auto-detection)
.github/workflows/ci.yml	This repo's own CI; calls the reusable workflow by local path
.github/dependabot.yml	Weekly grouped updates for GitHub Actions in this repo

How the reusable CI behaves

• Detection: package.json → Node job; pyproject.toml or requirements.txt → Python job; any *.sh → shell job. A repo can trigger more than one.
• Hard gates: the Node build step, Python compileall, and shellcheck --severity=error fail the run. Lint, typecheck, and test steps report but do not block, since not every agent repo defines them.
• Versioning: repos pin @main; this repo calls the workflow by local path so PRs here exercise the changed version before it lands.

What is NOT inherited

GitHub does not propagate everything from a .github repo. Each repo in the org carries its own copy of:

• LICENSE — never inherited; a repo without one shows no license on GitHub.
• README.md — the profile README covers the org page only, not individual repos.
• .github/dependabot.yml — Dependabot config is strictly per-repo.

If you add a repo to the org, copy those three in from the template before the first push.