Ci:Implement CI-CD for all the repos in the org.

[Viscous106]

Shape (three pipelines per repo)

• Gate — fast (< 10 min), runs on every push, checks every commit individually (rebase-merge contract).
• Verify — heavier (< 30 min), runs once per PR head, cross-platform builds + audits.
• Release — triggered by release-please tags, builds and publishes artifacts.

Per-repo summary

Repo	Gate	Verify	Release
Crownpositor	cargo fmt/clippy/test per commit	release build + cargo-deny + cargo-audit	x86_64 + aarch64 binaries
crowncrate-linux	same Rust pipeline	same	same
CrownCrate	Bun + Biome + tsc + turbo	Tauri matrix + Expo prebuild	Tauri bundles + EAS APK/AAB
crowncrate-android	ktlint + unit + assembleDebug	bundleRelease	signed .aab
crownos-iso	shellcheck + sanity	nightly mkarchiso	GPG-signed ISO on GH Release
crownos-website	Biome + tsc + next build	—	Cloudflare Pages (preview + prod)
crownos-documentations	markdownlint + lychee	—	mdBook → GitHub Pages

Org-wide files to land in every repo

• `.github/CODEOWNERS`
• `.github/pull_request_template.md`
• `.github/ISSUE_TEMPLATE/{bug,feature}.yml`
• `.github/dependabot.yml`
• `.github/workflows/{commit-lint,dco}.yml`
• `commitlint.config.js`
• `release-please-config.json` + `.release-please-manifest.json`

Branch protection (every repo)

Require PR · 1 CODEOWNERS approval · status checks (gate, verify, commit-lint, dco) · linear history · rebase-merge only · no direct push to
main.

6-week rollout

1. Org plumbing (CODEOWNERS, templates, commitlint, DCO, dependabot, branch protection)
2. Gate pipelines live in every repo
3. Verify pipelines + cross-platform matrix
4. `release-please` wired in every repo
5. Release workflows (Tauri bundles, signed APKs, ISO upload)
6. Website preview deploys + docs mdBook site

Total ≈ 35 small PRs. Mostly copy-paste of shared files.

Decisions needed from maintainers

• 1. Self-hosted Arch runner? — default no, revisit if Rust verify > 30 min
• 2. `release-please` per-crate or per-workspace for Crownpositor? — default workspace-wide
• 3. Tauri code signing for macOS/Windows? — default defer, ship unsigned
• 4. ISO GPG signing approach? — default OIDC + Sigstore initially
• 5. Archive `crowncrate-android` (Kotlin) in favor of Expo? — default archive
• 6. When do we stand up `crownos-packages` for PKGBUILDs? — default Phase 3, alongside ISO branding

Next concrete actions

• Lock the 6 decisions above (one maintainer per item)
• PR shared `.github/` files into `crownos-documentations` first, then propagate
• Pilot Gate + Verify on `Crownpositor` (highest signal — Rust workspace + complex deps)
• Verify commitlint + DCO checks on a throwaway PR
• Configure branch protection on each repo

Tagging @marvelxcodes for review.
EOF
)"