Use this as the canonical baseline for repositories created from this template. Add labels only when a repository has a real workflow need that the default set cannot express clearly.
| Label | Purpose |
|---|---|
bug |
Confirmed or reported defect |
enhancement |
New or improved behavior |
documentation |
Documentation-only work |
maintenance |
Internal upkeep or operational work |
dependencies |
Dependency updates |
triage |
Awaiting initial review |
question |
Question requiring an answer |
discussion |
General community discussion |
idea |
Early-stage idea |
breaking-change |
Backward-incompatible change |
skip-changelog |
Exclude from generated release notes |
Triage new issues for validity, scope, priority, ownership, dependencies, and sensitive content. Close duplicates with a link to the canonical issue. Use milestones only for work tied to a defined outcome or delivery window.
Require review and passing checks before merging. Prefer small pull requests, protect the default branch, dismiss stale approvals after material changes, and require conversation resolution where appropriate.
Use annotated tags and GitHub releases for versioned deliverables. Review the
automatically generated notes, update CHANGELOG.md, document breaking changes
and migrations, and define a rollback approach for risky releases.
Enable only the categories the project will actively moderate. Discussion form filenames must match category slugs. Move actionable outcomes into issues and link the originating discussion so decisions remain traceable.
Enable security features explicitly rather than relying on repository defaults. Record the intended state of each feature so that reviewers can verify it has not drifted.
Recommended baseline for repositories created from this template:
| Feature | Recommended state | Notes |
|---|---|---|
| Private vulnerability reporting | Enabled | Required before publishing SECURITY.md with a Report a vulnerability instruction |
| Secret scanning | Enabled | Available on public repositories and on GitHub Advanced Security |
| Push protection | Enabled | Blocks secrets from entering the repository at push time |
| Dependabot version updates | Configured | Add .github/dependabot.yml for each relevant ecosystem |
| Code scanning (CodeQL) | Enable when applicable | Required for repositories with compilable or interpretable source code |
Review security settings after each transfer, visibility change, or organisation migration, as these operations can reset feature state. Document any deliberate exceptions and the reason for them.