🩹 [Patch]: New module repositories ship the required community and governance files

[Marius Storhaug (MariusStorhaug)]

Repositories created from this template now ship the community and governance files that the PSModule Repository Defaults standard requires, so a new module repository is compliant on its first commit instead of starting with a manual cleanup task. The template previously relied on the organization .github fallback, which is only surfaced in GitHub's web UI — agents, linters, and local tooling never see it.

New: Security policy

SECURITY.md states that only the latest released version is supported and routes vulnerability reports to a private security advisory, with psmodule@psmodule.io as the fallback. It is deliberately worded so a reporter never opens a public issue for a vulnerability.

New: Support routing

SUPPORT.md tells users where to go: repository issues for the module, psmodule@psmodule.io for anything that does not belong in public, and the PowerShell Gallery maintainers for Gallery problems. It points at SECURITY.md for vulnerabilities and CONTRIBUTING.md for people who want to fix it themselves.

New: Code of conduct

CODE_OF_CONDUCT.md is Contributor Covenant 2.1, matching the organization-level file, with psmodule@psmodule.io filled in as the enforcement contact instead of the [INSERT CONTACT METHOD] placeholder the org copy still carries.

New: Pull request template

.github/pull_request_template.md prompts for the PR Manager format from PR Format: the title pattern with its icon and change type, a user-facing summary, the New/Changed/Fixed/Breaking Changes sections, a technical section for reviewers, and a collapsible related-issues block. All guidance is in HTML comments so it disappears from the rendered description and never leaks into generated release notes.

Changed: Setup instructions name a placeholder that exists

The README told new module authors to replace {{ NAME }} and {{ DESCRIPTION }}, but the template only ships {{ NAME }} (in examples/General.ps1). The step now names only the placeholder that is actually there.

Technical Details

• .github/copilot-instructions.md was added and then removed again during this work. Repository Defaults still lists it as required, but AGENTS.md at the repository root is the agent entry point and is read natively by the runtimes, so a Copilot-only pointer file is duplication that drifts. The stale table entry is tracked in Align Repository Defaults with the agent onboarding model, workflow filename, and supported Dependabot ecosystems docs#102.
• Custo: none of these files are distributed by MSXOrg/Custo today. Custo currently contains only a README and a LICENSE, and its bootstrap work is still in draft. Its predecessor, PSModule/Distributor, manages CODEOWNERS, LICENSE, linter settings, PSModule.yml, dependabot.yml, .gitattributes, .gitignore, instructions, hooks, and prompts for module repositories — it does not manage any of the files in this pull request. The template is therefore the right home for them right now. When Custo starts distributing community files, these copies become the seed for the managed source and further wording changes belong in Custo, not here.
• Rest of the template was checked against the Repository Defaults required-files and layout tables. Everything else required is present, and @PSModule/module-maintainers in CODEOWNERS resolves to a real team.
• Two remaining mismatches are docs problems rather than template problems and are covered by Align Repository Defaults with the agent onboarding model, workflow filename, and supported Dependabot ecosystems docs#102, both confirmed against a 24-repository survey of the organization:
  • The layout table names .github/workflows/workflow.yml, but all 24 surveyed module repositories use Process-PSModule.yml and none has a workflow.yml. workflow.yml is the called reusable workflow inside PSModule/Process-PSModule, not the caller.
  • The supply-chain section publishes a fixed configuration block containing package-ecosystem: "powershell", which does not exist in Dependabot — dependabot-core@dc2e4422d ships 33 ecosystems and none of them cover PowerShell or the PowerShell Gallery. Adding it breaks the entire Dependabot configuration, including the github-actions entry. All 24 surveyed repositories configure github-actions, and only Sodium adds a second one (nuget, for its .NET assembly). The issue asks for the guidance to be restated as a rule — configure github-actions plus whichever additional ecosystems apply and are supported by the current version of Dependabot — instead of a copy-paste block that goes stale.

Related issues

• Fixes Ship the full required baseline file set in the module template #36
• Align Repository Defaults with the agent onboarding model, workflow filename, and supported Dependabot ecosystems docs#102

[github-actions]

No Significant Changes Detected

This PR does not contain changes to files that would trigger a new release:

Pattern	Description
^src/	Matches files where path matches this pattern
^README\.md$	Matches files where path matches this pattern

Build, test, and publish stages will be skipped for this PR.

If you believe this is incorrect, please verify that your changes are in the correct locations.

[github-actions]

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
MARKDOWN	Pass ✅
NATURAL_LANGUAGE	Pass ✅
POWERSHELL	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter