Generate an offline setup plan, require successful current bootstrap PR checks
before applying settings, bind contexts to GitHub Actions, and validate readback.
Preserve conflicting existing protections and stop instead of replacing them.
Propagate the tested human-acknowledged review gate and locked JavaScript tooling
to generated apps, including custom owner replacement and CodeQL coverage.
Exclude node_modules and worktree metadata from template packages. Document
owner bootstrap, least-privilege settings and the remaining live proof.
Validation: 13 setup and four coverage Pester tests, seven review Node tests,
PowerShell analysis, ESLint, workflow/security/documentation lint. npm verifies
83 signatures and 20 attestations. Actual packed CLI/no-CLI variants generate
correct owners and reviewers and pass locked restores and zero-warning builds.
Live repository provisioning requires authorized creation/push and hosted CI.
Refs: KofTwentyTwo/AppKit#10, KofTwentyTwo/AppKit#13,
KofTwentyTwo/AppKit#7, KofTwentyTwo/AppKit#9, KofTwentyTwo/AppKit#20
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Separate the template repository NuGet release from generated apps' Velopack
releases. Pack and install the actual template in CI, then verify renamed
CLI and no-CLI apps. Include a package readme and locked build graph.
Pin all workflow variants to standards 0.1.2, rerun quality and security gates
before release, install pinned hooks, and add PowerShell lint and tested
coverage gates. Document initial restore and repository-specific setup.
Validation: both packaged variants build and format successfully, 54 unit
and 14 UI tests pass sequentially, and core/CLI coverage is 100%. Four Pester
tests, PowerShell analysis, workflow lint, and pre-commit checks pass.
Repository publication and the template NuGet policy remain pending.
Refs: KofTwentyTwo/AppKit#4, KofTwentyTwo/AppKit#6,
KofTwentyTwo/AppKit#7, KofTwentyTwo/AppKit#8,
KofTwentyTwo/AppKit#9, KofTwentyTwo/AppKit#20
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
PR gates, security scans, CodeQL, Scorecard, and .NET CI pinned to KofTwentyTwo/standards main; the Velopack release workflow pinned to KofTwentyTwo/standards#5 until it merges. CODEOWNERS, Dependabot with cooldown, issue forms, and the pull request template.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
james.maes
