Create a .github repo

[Trott]

Per the GitHub Org Management Policy, I'm requesting that we create a .github repo so that we can put a SECURITY.md file there that will appear in the GitHub interface for all nodejs org repos that do not already have a SECURITY.md repo.

Ref: nodejs/security-wg#776 (comment)

@nodejs/tsc @nodejs/security-triage

Policy says this is automatically approved after 72 hours if there are no TSC member objections.

Thanks.

[Trott]

Also: @bnb @rcowsill

[nschonni]

There may be a few other files that make sense in the repo too https://docs.github.com/en/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file

[bnb]

SGTM. Might want to consider also migrating our CoC to just live there eventually, since most checked in CoC files already point to this repo rather than actually checking in the CoC.

[Qard]

To be clear, is this suggesting a shared template or just generating a file that points to the equivalent on nodejs/node? Because a template added automatically at repo creation time could get out-of-sync over time, if I'm understanding right?

[ljharb]

Things in a .github repo transparently apply to any repos that lack shadowing files, so it would never get out of sync.

[bnb]

yep, the files aren't templates so much as context for GitHub's UI (for example, in the sidebar of the main repo page and in issues/PRs).

[mhdawson]

I'm +1 for adding the template. One issue though that I think we discussed earlier in the pkgjs repo is that if you clone the repo you don't get a copy of those files. At least my understanding is that you only see them in the UI. We ended deciding we needed to keep a copy of things like the CoC in the repo as well so that you would have a copy in local clonse.

[bnb]

Yep, that is a tradeoff. The one caveat I'd present is that our current CoC isn't actually a CoC: it's a link to our CoC. We've not actually got a CoC in any repo except nodejs/admin right now, and I'm not sure if the impact of the one/two links is the same as having a full CoC checked in to the source.

[ljharb]

Additionally, I'm not sure how important a use case it is for people to explore the local clone; if you're only working locally, you have no way to convey any conduct in the first place.

[Trott]

For things like a code of conduct, I think it makes sense to have a link in the README to the canonical document in the .github repo. And the CODE_OF_CONDUCT.md in the .github repo shows up in the UI. Same for SECURITY.md. We'll want to test this with a small number of repos first, but I feel like that's probably the way to handle it for all repos.

[bnb]

given that it's been a... lot longer than 72 hours, I've created the repo @Trott.

https://github.com/nodejs/.github