Add SECURITY, CONTRIBUTING, RELEASING and issue/PR templates - #60
Merged
Conversation
No repository in the organisation had any of these; community health scores sit between 12% and 37%. Placing them here makes them apply org-wide. SECURITY.md is deliberately minimal: it points at GitHub private vulnerability reporting and states that backporting is decided case by case. No supported-versions table and no response-time promise, since neither is a commitment anyone has made. CONTRIBUTING.md documents what the build actually enforces - notably 'mvn spotless:apply', which the older site documentation does not mention because it predates Spotless. It also asks contributors not to touch existing copyright headers. RELEASING.md consolidates the site-publishing procedure, which is currently documented in six READMEs with four mutually inconsistent commands, two of which contradict their own POM. No CODE_OF_CONDUCT: it needs an enforcement contact and a body able to act, and we have neither. Open to being argued out of that. Part of #58
This was referenced Aug 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #58.
No repository in the organisation has a security policy, a contributing guide, or issue/PR templates. GitHub community-health scores across our repos run 12%–37%. Putting these in
.githubmakes them apply everywhere at once.SECURITY.mdThe gap that actually matters: plexus-archiver has 5 published advisories and we have never documented a private reporting channel.
Kept deliberately narrow — it points at GitHub private vulnerability reporting and says backporting is decided case by case. No supported-versions table and no response-time SLA, because those are commitments nobody has made and a stale table is worse than none. It also states that archived repos get no fixes, which is currently true but written down nowhere.
This is the one file here that binds other maintainers, so I would like at least one ack before merging rather than just letting the window lapse.
CONTRIBUTING.mdDocuments what the build already enforces, which is mostly undocumented today:
mvn verifybuilds; CI runs across JDK 8/21/25 on three OSes with Maven 3.9.11mvn spotless:apply. Right now a first-time contributor gets a red CI run on formatting with nothing anywhere telling them why. The site's Get Involved page still tells people to importmaven-idea-codestyle.xmlinto~/.IntelliJIDEA/config/codestyles, which predates Spotless entirely.Per the discussion in #58, "where to ask" says GitHub Issues and states plainly that there is no Plexus mailing list, since older docs point at one that is defunct.
RELEASING.mdMaintainer-facing, and the reason it's in this PR rather than a later one: six READMEs currently document site publishing with four different commands, and two of them contradict their own POM (plexus-utils and plexus-xml say
site site:stage scm-publish:publish-scm, while their POMs bindpublish-scmtosite-deployand carry the comment "mono-module doesn't require site:stage"). The README cleanup wants to replace all six with one link, so the target has to exist first.It splits the single-module case (
mvn -Preporting clean verify site-deploy, 10 repos) from the multi-module one (site site:stage scm-publish:publish-scm, 4 repos), and records two things that were only folklore: thatplexus-sec-dispatcherhas noscm-publishconfiguration at all so neither command works there, and that snapshot deployment inmaven-deploy.ymlis currently a placeholder that echoes and exits.Templates
One bug template and a short PR template. Intentionally light — the bug form asks for version, JDK/Maven, expected, actual, reproducer, and nothing else.
Not included:
CODE_OF_CONDUCT.mdA code of conduct needs an enforcement contact and a body empowered to act on reports. codehaus-plexus has neither, and a Contributor Covenant pointing at an address nobody watches is worse than not having one. Happy to be argued out of this if someone wants to own it.