docs(ospo): community health rollout v2 — LICENSE, README, agents.md, health files (#97)

* docs(ospo): community health rollout v2 — LICENSE, README, agents.md, health files

This repo superseded the archived per-product docs-* repos but never received
the OSPO community health rollout v2 that the rest of the org got on
2026-06-22 (docs-main 82dbaaf, docs-server dc082e0). owncloud/.github holds no
org-default community health files, so nothing was inherited — most visibly,
a public repo publishing AGPL-3.0-derived documentation with no LICENSE at all.

Added, verbatim from owncloud/docs-main (byte-identical across the docs family):

  LICENSE             GNU AGPL v3, matching docs-main/docs-server/docs-webui,
                      the upstream sources this content was synced from
  CONTRIBUTING.md     -> owncloud.com/contribute/
  CODE_OF_CONDUCT.md  -> owncloud.com/contribute/code-of-conduct/
  SECURITY.md         -> security.owncloud.com + YesWeHack bug bounty
  SUPPORT.md          enterprise / discussions / Matrix / docs channels

Adapted to this monorepo rather than copied:

  agents.md           docs-main's section order, retargeted to the Antora
                      monorepo: content/<product>/<version>/ folders, Pagefind,
                      the local extension dirs, npm scripts, Node 22, main
                      branch, and the versions-are-folders / mirror-retired
                      constraints
  README.md           OSPO v2 marker, licence + OSPO badges, and the template
                      sections (Community & Support, Contributing, Security,
                      License, About the OSPO, Apache-2.0 migration) appended
                      around the existing monorepo design notes, which are kept

Also added .github/workflows/lint-pr-title.yml from docs-main, with an explicit
`permissions: pull-requests: read` to match ci.yml's style. The repo already
uses Conventional Commit PR titles and squash-merges, but nothing enforced it.

Two stale references to the prototype's personal fork are corrected on the way
past: README's live URL and package.json's homepage now point at
owncloud/docs.owncloud.com, and package.json declares "license": "AGPL-3.0"
consistently with the new LICENSE.

Deliberately not included: REUSE.toml/LICENSES/ and SPDX headers (still a
three-repo pilot org-wide), GOVERNANCE.md and MAINTAINERS.md (present in no
ownCloud repo), a DCO file (enforced by rulesets), .github/settings.yml
(superseded by owncloud/admin safe-settings), and issue/PR templates (only
pre-OSPO copies exist, referencing retired labels and dead URLs).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>

* docs(ospo): fix branch model, actions policy, test command and dead link

- README claimed the branch model is `master` only; the default branch is
  `main`, as agents.md already stated in the same change.
- README's GitHub Actions policy omitted the "verified by the ownCloud
  Maintainers" clause that agents.md carries. Under the narrower wording the
  lint-pr-title workflow added alongside it was non-compliant with the policy
  introduced in the same change, since amannn is a personal account and cannot
  hold a Marketplace verified-creator badge.
- The YesWeHack bug bounty URL 404s and no such programme exists on YesWeHack,
  so both occurrences are dropped; security.owncloud.com remains the reporting
  route SECURITY.md points at.
- agents.md documented `npm test` standalone, but 4 of the redirect/alias
  tests skip themselves unless public/ has been built, which reads as a pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>

* chore(license): use the non-deprecated SPDX id AGPL-3.0-or-later

AGPL-3.0 is deprecated in the SPDX licence list, and scanners -- including
the reuse lint pilot this rollout is heading towards -- warn or fail on
deprecated identifiers. AGPL-3.0-or-later matches the identifier
owncloud/core declares in its composer.json.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>

* ci(lint-pr-title): restore the reopened trigger, add a concurrency group

The explicit types list dropped the default `reopened`, so closing and
reopening a PR left the check absent rather than carrying it over, and added a
`synchronize` that cannot change a PR title. Without a concurrency group two
quick title edits race, and a superseded failing run finishing last leaves a
red check on a title that is already valid.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>

* docs(readme): title the project "ownCloud Documentation"

The H1 dated from the prototype phase and read as a caveat rather than a
name. The monorepo/experimental framing already lives in the intro paragraph
and the "What changed vs. the legacy setup" table, so nothing is lost.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>

* docs(ospo): restore the YesWeHack bounty link to match the org baseline

Reverses the "dead link" bullet of 12ab788, which dropped the YesWeHack
paragraph from SECURITY.md and the bounty line from README.md because the URL
404s. The 404 is real, but it is an org-wide baseline problem, not a defect of
this repo: ~157 files across owncloud carry the same URL, and the community
health files exist precisely to be byte-identical copies of the docs-main
baseline. Diverging one repo buys a working link at the cost of that rule.

SECURITY.md is byte-identical to owncloud/docs-main again (345 bytes, sha256
3e6f3d8ddaf75f6876dcec389587eec9ef31c0fd4dbdab94a15f0ca3f911de9c), and the
README Security section matches the upstream template. Fixing the URL belongs
to the OSPO as a single org-wide change.

The other three bullets of 12ab788 (branch model, Actions policy, npm test)
stand unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>

---------

Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: DeepDiver1975

.github/workflows/lint-pr-title.yml

@@ -0,0 +1,27 @@
+name: Lint PR title
+
+on:
+  pull_request:
+    # `reopened` is required: without it, closing and reopening a PR leaves the
+    # check absent rather than carrying it over. `synchronize` is deliberately
+    # omitted -- a push cannot change the title, so it can only re-run a lint
+    # whose outcome is already known.
+    types: [opened, edited, reopened]
+
+permissions:
+  pull-requests: read
+
+# Scoped per ref, as in ci.yml. Two quick title edits would otherwise race, and
+# a superseded failing run finishing last would leave a red check on a title
+# that is already valid.
+concurrency:
+  group: lint-pr-title-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

CODE_OF_CONDUCT.md

@@ -0,0 +1,8 @@
+# Code of Conduct
+
+This project follows the ownCloud Code of Conduct.
+
+Please read the full Code of Conduct at:
+**<https://owncloud.com/contribute/code-of-conduct/>**
+
+By participating in this project, you agree to abide by its terms.

CONTRIBUTING.md

@@ -0,0 +1,9 @@
+# Contributing
+
+Thank you for your interest in contributing to this project!
+
+Please read the full contributing guidelines at:
+**<https://owncloud.com/contribute/>**
+
+For development setup, coding standards, and pull request process,
+see the README in this repository.

LICENSE

@@ -1,18 +1,22 @@
-# ownCloud Docs — Monorepo (experimental)
+# ownCloud Documentation
+
+<!-- OSPO-managed README | Generated: 2026-08-21 | v2 -->
+
+[![License](https://img.shields.io/badge/License-AGPL--3.0-blue.svg)](LICENSE) [![ownCloud OSPO](https://img.shields.io/badge/OSPO-ownCloud-blue)](https://kiteworks.com/opensource)
 
 Consolidated, single-repository prototype of the ownCloud documentation. It
 replaces the previous 9-repo setup (1 orchestrator + 7 content repos + a custom
 UI repo) with **one monorepo** built by Antora.
 
-Live (GitHub Pages): https://deepdiver1975.github.io/owncloud-docs-monorepo/
+Live (GitHub Pages): https://doc.owncloud.com
 
 ## What changed vs. the legacy setup
 
 | Area | Legacy | Here |
 |------|--------|------|
 | Repos | 9 | 1 (this repo) |
 | Versions | git branches + backporting | **folders** under `content/<product>/<version>/` |
-| Branch model | `master` + N version branches per repo | `master` only |
+| Branch model | `master` + N version branches per repo | `main` only |
 | Search | Elasticsearch + custom index extension + CI secrets | **Pagefind** (static, build-time) |
 | UI | custom Gulp/Browserify/jQuery `docs-ui` + `ui-bundle.zip` | **stock Antora default UI** + `ui/supplemental/` |
 | Content sources | 7 remote GitHub repos × branches | local folders, authored here (upstream mirror retired) |
@@ -164,3 +168,74 @@ npm run serve      # http-server on :8080
 ```
 
 Node 22 is recommended (matches CI).
+
+## Community & Support
+
+**[Star](https://github.com/owncloud/docs.owncloud.com)** this repo and **Watch** for release notifications!
+
+- [ownCloud Website](https://owncloud.com)
+- [Community Discussions](https://github.com/orgs/owncloud/discussions)
+- [Matrix Chat](https://app.element.io/#/room/#owncloud:matrix.org)
+- [Documentation](https://doc.owncloud.com)
+- [Enterprise Support](https://owncloud.com/contact-us/)
+- [OSPO Home](https://kiteworks.com/opensource)
+
+## Contributing
+
+We welcome contributions! Please read the [Contributing Guidelines](CONTRIBUTING.md)
+and our [Code of Conduct](CODE_OF_CONDUCT.md) before getting started.
+
+### Workflow
+
+- **Rebase Early, Rebase Often!** We use a rebase workflow. Always rebase on the target branch before submitting a PR.
+- **Dependabot**: Automated dependency updates are managed via Dependabot. Review and merge dependency PRs promptly.
+- **Signed Commits**: All commits **must** be PGP/GPG signed. See [GitHub's signing guide](https://docs.github.com/en/authentication/managing-commit-signature-verification).
+- **DCO Sign-off**: Every commit must carry a `Signed-off-by` line:
+  ```
+  git commit -s -S -m "your commit message"
+  ```
+- **GitHub Actions Policy**: Workflows may only use actions that are (a) owned by `owncloud`, (b) created by GitHub (`actions/*`), (c) verified in the GitHub Marketplace, or (d) verified by the ownCloud Maintainers. Pin every action to its full commit SHA.
+
+## Security
+
+**Do not open a public GitHub issue for security vulnerabilities.**
+
+Report vulnerabilities at **<https://security.owncloud.com>** -- see [SECURITY.md](SECURITY.md).
+
+Bug bounty: [YesWeHack ownCloud Program](https://yeswehack.com/programs/owncloud-bug-bounty-program)
+
+## License
+
+This project is licensed under the [AGPL-3.0](LICENSE).
+
+## About the ownCloud OSPO
+
+The [Kiteworks Open Source Program Office](https://kiteworks.com/opensource), operating under
+the [ownCloud](https://owncloud.com) brand, launched on May 5, 2026, to steward the open source
+ecosystem around ownCloud's products. The OSPO ensures transparent governance, license compliance,
+community health, and sustainable collaboration between the open source community and
+[Kiteworks](https://www.kiteworks.com), which acquired ownCloud in 2023.
+
+- **OSPO Home**: <https://kiteworks.com/opensource>
+- **GitHub**: <https://github.com/owncloud>
+- **ownCloud**: <https://owncloud.com>
+
+For questions about the OSPO or licensing, contact ospo@kiteworks.com.
+
+### License Migration to Apache 2.0
+
+The OSPO is driving a strategic relicensing of ownCloud repositories toward the
+[Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0), following
+the [Apache Software Foundation's third-party license policy](https://www.apache.org/legal/resolved.html).
+
+Individual repositories will migrate as their audit is completed. The LICENSE file
+in each repo reflects its **current** license status (not the target).
+
+**Current license: AGPL-3.0** (Category X per Apache policy -- cannot be included in Apache-2.0 works).
+
+Migration prerequisites for this repository:
+
+- **CLA/DCO coverage**: All past contributors must have signed agreements permitting relicensing
+- **Copyleft dependency audit**: All AGPL/GPL dependencies must be replaced or isolated
+- **KDE heritage review**: Any code with KDE-era copyrights requires legal analysis
+- **Complete relicensing**: AGPL-3.0 is a strong copyleft license; migration requires full relicensing of all files, not just a header change

README.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+**Do NOT open a public GitHub issue for security vulnerabilities.**
+
+Please report security issues responsibly via:
+**<https://security.owncloud.com>**
+
+You can also report vulnerabilities through our YesWeHack bug bounty program:
+**<https://yeswehack.com/programs/owncloud-bug-bounty-program>**

SECURITY.md

@@ -0,0 +1,10 @@
+# Support
+
+For support with this project, please use the following channels:
+
+- **Enterprise Support**: <https://owncloud.com/contact-us/>
+- **Community discussions**: https://github.com/orgs/owncloud/discussions
+- **Matrix Chat**: <https://app.element.io/#/room/#owncloud:matrix.org>
+- **Documentation**: <https://doc.owncloud.com>
+
+Please do not use GitHub issues for general support questions.

SUPPORT.md

@@ -0,0 +1,76 @@
+# AI Agent Guidelines for ownCloud Docs
+
+This file provides context for AI coding agents (Claude Code, GitHub Copilot, Cursor, etc.) working in this repository.
+
+## Repository Overview
+- **Product family:** Documentation
+- **Primary language(s):** JavaScript, AsciiDoc
+- **Build system:** npm (Antora + Pagefind)
+- **Test framework:** `node --test` (`npm test`), plus the Antora build itself (`npm run antora`)
+- **CI system:** GitHub Actions (build & deploy to GitHub Pages)
+
+## Architecture & Key Paths
+
+This is the consolidated documentation **monorepo**. It supersedes the previous
+9-repo setup (1 orchestrator + 7 content repos + a custom UI repo).
+
+- `site.yml` -- Antora playbook; all content sources are local
+- `content/<product>/<version>/` -- documentation content; products are `main`, `server`, `webui`, `ocis`, `desktop`, `android`, `ios`
+- `antora-extensions/` -- custom Antora extensions (`comp-version`, `latest-alias`, `sitemap-cleanup`, `load-global-site-attributes`)
+- `asciidoc-extensions/` -- custom AsciiDoc extensions (`tabs`, `remote-include-processor`)
+- `ui/supplemental/` -- supplemental files layered onto the stock Antora default UI
+- `global-attributes.yml` -- site-wide AsciiDoc attributes
+- `sync/` -- the retired upstream import tooling (`manifest.yml`, `patches/`); kept for provenance
+- `test/` -- Node test suite
+- `package.json` -- npm scripts
+
+## Development Conventions
+- **Branching:** `main`
+- **Commit messages:** Conventional Commits; DCO sign-off required (`git commit -s`)
+- **PR process:** Open a PR against `main`. All CI checks must pass. PR titles are linted for Conventional Commits format.
+
+## Build & Test Commands
+```bash
+# Build
+npm run antora          # Antora site build only
+npm run build           # Antora build + Pagefind search index
+
+# Test -- build first: 4 of the redirect/alias tests skip themselves without public/
+npm run antora && npm test
+
+# Preview
+npm run antora-local && npm run serve   # http://localhost:8080
+```
+
+Node 22 is used in CI.
+
+## Important Constraints
+- All contributions must be compatible with the **AGPL-3.0** license
+- Do not introduce new **copyleft-licensed dependencies** (GPL, AGPL, LGPL, MPL) without explicit discussion in an issue first. This is especially important for repos migrating to Apache 2.0.
+- Do not introduce new dependencies without discussion in an issue first
+- **Versions are folders, not branches.** A new documentation version is a new directory under `content/<product>/<version>/` -- never a git branch, and never a backport.
+- **The upstream mirror is retired.** Content is authored in this repository. Do not re-introduce a sync from the archived `docs-*` repos.
+
+## OSPO Policy Constraints
+
+### GitHub Actions
+- **Only** use actions owned by `owncloud`, created by GitHub (`actions/*`), verified on the GitHub Marketplace, or verified by the ownCloud Maintainers.
+- Pin all actions to their full commit SHA (not tags): `uses: actions/checkout@<SHA> # vX.Y.Z`
+- Never introduce actions from unverified third parties.
+
+### Dependency Management
+- Dependabot is configured for automated dependency updates.
+- Review and merge Dependabot PRs as part of regular maintenance.
+- Do not introduce new dependencies without discussion in an issue first.
+
+### Git Workflow
+- **Rebase policy**: Always rebase; never create merge commits. Use `git pull --rebase` and `git rebase` before pushing.
+- **Signed commits**: All commits **must** be PGP/GPG signed (`git commit -S -s`).
+- **DCO sign-off**: Every commit needs a `Signed-off-by` line (`git commit -s`).
+- **Conventional Commits & Squash Merge**: Use the [Conventional Commits](https://www.conventionalcommits.org/) format. This repository squash-merges, so the PR title becomes the commit message on `main` -- apply Conventional Commits format to PR titles as well. A GitHub Actions workflow enforces this.
+
+## Context for AI Agents
+- Match existing code style
+- Do not refactor unrelated code in the same PR
+- Write tests for new functionality
+- Keep PRs focused and atomic

agents.md

@@ -1,7 +1,8 @@
 {
   "private": true,
   "description": "The ownCloud documentation (consolidated monorepo)",
-  "homepage": "https://github.com/DeepDiver1975/owncloud-docs-monorepo#readme",
+  "homepage": "https://github.com/owncloud/docs.owncloud.com#readme",
+  "license": "AGPL-3.0-or-later",
   "scripts": {
     "antora": "antora --stacktrace site.yml",
     "antora-local": "antora --stacktrace --url http://localhost:8080 site.yml",