fix: keep template files valid without substituting placeholders - #1
Open
seungwonme wants to merge 1 commit into
Open
fix: keep template files valid without substituting placeholders#1seungwonme wants to merge 1 commit into
seungwonme wants to merge 1 commit into
Conversation
GitHub template copy does not replace {{tokens}}. Invalid URLs in the
issue chooser config broke new repositories, and OpenSSF L1 settings
cannot live in files. Document those settings in SETUP.md and add
Dependabot for GitHub Actions only.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TL;DR
This repository stays a GitHub template. Files remain generic. GitHub-parsed YAML no longer contains invalid
{{placeholder}}URLs. OpenSSF L1 settings that template copy cannot transfer are documented inSETUP.md.Why
GitHub copies template files as-is. It does not substitute
{{PROJECT_NAME}}or similar tokens, and it does not copy branch protection or private vulnerability reporting..github/ISSUE_TEMPLATE/config.ymlused{{SUPPORT_CHANNEL}}and a placeholder GitHub URL. Those are not validhttpsURLs, so the issue chooser can fail on both this template and every repository created from it.What
config.yml:blank_issues_enabled: true; securitycontact_linkspoints at GitHub docs (stable URL, no owner/repo).CODE_OF_CONDUCT.md: Contributor Covenant 2.1 text, contact still{{CONDUCT_CONTACT}}.AGENTS.md: short instructions; do not invent values for unset placeholders.SECURITY.md: 3 business day / 90 day response timeline; note that private reporting is a repo setting.SETUP.md: placeholder table plusghcommands for private vulnerability reporting, Dependabot alerts, wiki/projects off, and a default-branch ruleset..github/dependabot.yml: GitHub Actions only. No language stack, no CI workflow.Not in this PR
CODEOWNERS.ai-native-engineer/ project name.Check
{{tokens incontact_linksURLs.