Add OSS governance, dependency review, and Atlas-Commons README links

.github/BRANCH_PROTECTION.md

@@ -0,0 +1,56 @@
+# Branch protection for `main`
+
+Merging to `main` requires passing CI and a pull request. Configuration lives in this repository so it can be reviewed and re-applied consistently.
+
+## What runs on every PR and push to `main`
+
+Workflow: [`.github/workflows/ci.yml`](workflows/ci.yml)
+
+The final job is always named **Required checks**. Branch rulesets require that status to be green before merge.
+
+## DCO (Developer Certificate of Origin)
+
+Install the [DCO GitHub App](https://github.com/apps/dco) on the Atlas-Commons organization.
+
+Every commit must include sign-off:
+
+```bash
+git commit -s -m "Your message"
+```
+
+## Apply the ruleset (one-time)
+
+GitHub rulesets are configured on the repository, not via git push.
+
+```bash
+chmod +x .github/scripts/apply-main-ruleset.sh
+./.github/scripts/apply-main-ruleset.sh Atlas-Commons REPO_NAME
+```
+
+Or apply to every catalog repo from a machine with `gh` authenticated:
+
+```bash
+./scripts/apply-all-catalog-rulesets.sh
+```
+
+### Private repositories (Bot, atlas-commons-website)
+
+Repository rulesets on **private** repos require GitHub Team or Pro. For those repos, configure branch protection manually under **Settings → Branches** until the org upgrades, or make the repo public.
+
+The apply script skips private repos automatically.
+
+### Important: check name must exist first
+
+GitHub only lets you select status checks that have run at least once. Open a PR against `main` (or push once) **before** applying the ruleset.
+
+## Apply rulesets to all catalog repos
+
+See [`atlas-commons-github-templates/scripts/apply-all-catalog-rulesets.sh`](https://github.com/Atlas-Commons/atlas-commons-github-templates) in the template pack, or run from any repo:
+
+```bash
+for repo in Bot atlas-commons-website technitiumdns-api home-assistant-technitiumdns \
+  StreamBooru Hassio-Addons Danbooru-Import-Scripts EmbyArrSync windowsRDP-SSH-tunnel-script; do
+  gh api --method POST "repos/Atlas-Commons/${repo}/rulesets" --input .github/rulesets/main.json 2>/dev/null || \
+  gh api --method PUT "repos/Atlas-Commons/${repo}/rulesets/$(gh api repos/Atlas-Commons/${repo}/rulesets --jq '.[]|select(.name=="Protect main")|.id')" --input .github/rulesets/main.json
+done
+```

.github/CODEOWNERS

@@ -1 +1,2 @@
-.github/* @Amateur-God
+# Default reviewers for Atlas Commons repositories.
+* @Amateur-God

.github/CODE_OF_CONDUCT.md

@@ -43,91 +43,18 @@ acceptable behavior and will take appropriate and fair corrective action in
 response to any behavior that they deem inappropriate, threatening, offensive,
 or harmful.
 
-Community leaders have the right and responsibility to remove, edit, or reject
-comments, commits, code, wiki edits, issues, and other contributions that are
-not aligned to this Code of Conduct, and will communicate reasons for moderation
-decisions when appropriate.
-
 ## Scope
 
 This Code of Conduct applies within all community spaces, and also applies when
 an individual is officially representing the community in public spaces.
-Examples of representing our community include using an official e-mail address,
-posting via an official social media account, or acting as an appointed
-representative at an online or offline event.
 
 ## Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported to the community leaders responsible for enforcement at
-frenck@frenck.dev.
+reported to **stephen@atlastechsolutions.co.uk**.
 
 All complaints will be reviewed and investigated promptly and fairly.
 
-All community leaders are obligated to respect the privacy and security of the
-reporter of any incident.
-
-## Enforcement Guidelines
-
-Community leaders will follow these Community Impact Guidelines in determining
-the consequences for any action they deem in violation of this Code of Conduct:
-
-### 1. Correction
-
-**Community Impact**: Use of inappropriate language or other behavior deemed
-unprofessional or unwelcome in the community.
-
-**Consequence**: A private, written warning from community leaders, providing
-clarity around the nature of the violation and an explanation of why the
-behavior was inappropriate. A public apology may be requested.
-
-### 2. Warning
-
-**Community Impact**: A violation through a single incident or series
-of actions.
-
-**Consequence**: A warning with consequences for continued behavior. No
-interaction with the people involved, including unsolicited interaction with
-those enforcing the Code of Conduct, for a specified period of time. This
-includes avoiding interactions in community spaces as well as external channels
-like social media. Violating these terms may lead to a temporary or
-permanent ban.
-
-### 3. Temporary Ban
-
-**Community Impact**: A serious violation of community standards, including
-sustained inappropriate behavior.
-
-**Consequence**: A temporary ban from any sort of interaction or public
-communication with the community for a specified period of time. No public or
-private interaction with the people involved, including unsolicited interaction
-with those enforcing the Code of Conduct, is allowed during this period.
-Violating these terms may lead to a permanent ban.
-
-### 4. Permanent Ban
-
-**Community Impact**: Demonstrating a pattern of violation of community
-standards, including sustained inappropriate behavior, harassment of an
-individual, or aggression toward or disparagement of classes of individuals.
-
-**Consequence**: A permanent ban from any sort of public interaction within
-the community.
-
 ## Attribution
 
-This Code of Conduct is adapted from the [Contributor Covenant][homepage],
-version 2.0, available at
-[https://www.contributor-covenant.org/version/2/0/code_of_conduct.html][v2.0].
-
-Community Impact Guidelines were inspired by
-[Mozilla's code of conduct enforcement ladder][mozilla coc].
-
-For answers to common questions about this code of conduct, see the FAQ at
-[https://www.contributor-covenant.org/faq][faq]. Translations are available
-at [https://www.contributor-covenant.org/translations][translations].
-
-[homepage]: https://www.contributor-covenant.org
-[v2.0]: https://www.contributor-covenant.org/version/2/0/code_of_conduct.html
-[mozilla coc]: https://github.com/mozilla/diversity
-[faq]: https://www.contributor-covenant.org/faq
-[translations]: https://www.contributor-covenant.org/translations
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org/version/2/0/code_of_conduct.html), version 2.0.

.github/CONTRIBUTING.md

@@ -1,29 +1,39 @@
-# Contributing
+# Contributing to Atlas Commons
 
-When contributing to this repository, please first discuss the change you wish
-to make via issue, email, or any other method with the owners of this repository
-before making a change.
+Thank you for contributing to [Atlas Commons](https://github.com/Atlas-Commons) open-source projects.
 
-Please note we have a code of conduct, please follow it in all your interactions
-with the project.
+## Before you start
 
-## Issues and feature requests
+1. Search [existing issues](https://github.com/Atlas-Commons) for duplicates.
+2. For large changes, open an issue first to discuss approach.
+3. Read our [Code of Conduct](CODE_OF_CONDUCT.md).
 
-You've found a bug in the source code, a mistake in the documentation or maybe
-you'd like a new feature? You can help us by submitting an issue to our
-[GitHub Repository][github]. Before you create an issue, make sure you search
-the archive, maybe your question was already answered.
+## Developer Certificate of Origin (DCO)
 
-Even better: You could submit a pull request with a fix / new feature!
+**Every commit in a pull request must be signed off.**
+
+Use `-s` when committing:
+
+```bash
+git commit -s -m "Describe your change"
+```
+
+This adds a `Signed-off-by:` line certifying you wrote the code or have the right to submit it under the project license. See [developercertificate.org](https://developercertificate.org/).
+
+The [DCO GitHub App](https://github.com/apps/dco) blocks merges when sign-off is missing.
 
 ## Pull request process
 
-1. Search our repository for open or closed [pull requests][prs] that relates
-   to your submission. You don't want to duplicate effort.
+1. Fork the repository and create a branch from `main`.
+2. Make focused changes with tests where applicable.
+3. Ensure CI passes locally before opening the PR.
+4. Open a pull request against `main` with a clear description.
+5. Address review feedback; maintainers will merge when checks are green.
+
+## Local development
+
+See each repository's `README.md` for setup instructions. Most projects document install, test, and lint commands there.
 
-1. You may merge the pull request in once you have the sign-off of two other
-   developers, or if you do not have permission to do that, you may request
-   the second reviewer to merge it for you.
+## Questions
 
-[github]: https://github.com/Amateur-God/Hassio-Addons/issues
-[prs]: https://github.com/Amateur-God/Hassio-Addons/pulls
+Open a [GitHub Discussion](https://github.com/orgs/Atlas-Commons/discussions) or issue in the relevant repository.

.github/FUNDING.yml

@@ -1,2 +1,2 @@
 ---
-github: Amateur-God
+github: Atlas-Commons

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,39 @@
+name: Bug report
+description: Report something that is broken or incorrect
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report a bug. Please search existing issues first.
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      description: Describe the bug and what you expected instead.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      description: Minimal steps to reproduce the behavior.
+      placeholder: |
+        1. ...
+        2. ...
+        3. ...
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version or commit
+      placeholder: e.g. v1.2.0 or main @ abc1234
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: OS, runtime versions, relevant configuration.
+      placeholder: e.g. Ubuntu 24.04, Python 3.12, Docker 27

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/Atlas-Commons/.github/blob/main/SECURITY.md
+    about: Report security issues privately — do not use public issues.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,29 @@
+name: Feature request
+description: Suggest an improvement or new capability
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Describe the problem you want solved and how you imagine the feature working.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem or use case
+      description: What problem does this solve?
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed solution
+      description: How would you like this to work?
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Other approaches you thought about.

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,9 +1,15 @@
-# Proposed Changes
+## Summary
 
-> (Describe the changes and rationale behind them)
+<!-- What changed and why? -->
 
-## Related Issues
+## Related issues
 
-> ([Github link][autolink-references] to related issues or pull requests)
+<!-- Link issues: Fixes #123 -->
 
-[autolink-references]: https://help.github.com/articles/autolinked-references-and-urls/
+## Checklist
+
+- [ ] I have read [CONTRIBUTING.md](.github/CONTRIBUTING.md)
+- [ ] Every commit is signed off (`git commit -s`) for [DCO](https://developercertificate.org/)
+- [ ] CI passes locally (or I explain why not applicable)
+- [ ] Documentation updated if user-facing behavior changed
+- [ ] Tests added or updated where applicable