.github

Organization-level profile and default community health files for Darkroom Engineering.

This is GitHub's special organization repository. It configures the org's public presence, provides fallback community health files, and hosts explicitly adopted CI components. Workflows and actions are not inherited by other repositories.

Contents

Path	Purpose
profile/README.md	Renders as the org landing page at github.com/darkroomengineering.
SECURITY.md	Default vulnerability-disclosure policy.
CONTRIBUTING.md	Default contribution guidelines.
PULL_REQUEST_TEMPLATE.md	Default PR template.
.github/ISSUE_TEMPLATE/	Default bug and feature issue templates, plus chooser config.
.github/FUNDING.yml	Sponsor button configuration.
actions/bun-web-ci/action.yml	Shared Bun installation, production build and project checks.
.github/workflows/dependabot-merge.yml	Guarded merge workflow for explicitly selected Dependabot policies.

Shared CI components

Callers must pin these components to a reviewed full commit SHA. Publishing a component does not enable it anywhere. Verify a real pull request and its observed check names before changing required checks or adopting merge automation.

The Bun web action expects a root package.json with an exact stable packageManager pin such as bun@1.3.5, a text bun.lock, and working build and check scripts. It installs with --frozen-lockfile, caches .next/cache, builds, and runs bun run check. The project's check script must retain its lint, typecheck and test coverage; absent or failing scripts fail the job.

Input	Accepted values	Default
node-version-file	Empty, or .node-version to set Node before installation.	Empty
oxlint-annotations	true to run the existing Oxlint annotation command, or false.	false

Use darkroomengineering/.github/actions/bun-web-ci@<reviewed-full-commit-sha> as a step after checkout. The caller owns its triggers, job names, read-only permissions, runner, timeout and cancellation policy. Keep browser tests and advisory jobs in the caller. For Satus, pass both inputs; for Lenis Showcase Admin, use the defaults. This action does not skip tests or accept arbitrary commands.

Dependabot merge policy

Call darkroomengineering/.github/.github/workflows/dependabot-merge.yml@<reviewed-full-commit-sha> as a job from a workflow_run caller listening for completion of its verified CI workflow. Pass the required update-policy input:

Policy	Eligible updates
stable-dependencies	Individual stable patch/minor dependency or Actions bumps using the existing Dependabot titles.
actions-only	Individual stable patch/minor Actions bumps that change only top-level .github/workflows/*.yml or *.yaml files. Application updates remain manual.

Major, 0.x, prerelease, grouped and unrecognized titles remain manual. The workflow requires a unique open, nondraft Dependabot PR from the same repository to main, the exact current head, and a successful latest run and attempt of the triggering CI workflow. Actions-only changes require the complete paginated file list, including previous paths for renames. Merge uses --match-head-commit without an administrative bypass.

The caller grants actions: read, contents: write and pull-requests: write. The workflow uses the caller's automatic GITHUB_TOKEN; do not pass a token or use secrets: inherit. Only darkroomengineering callers are eligible. The privileged job performs API requests and does not check out or execute PR code. Success proves the triggering workflow passed, not that every possible check is required. Preserve repository branch rules and verify actual caller runs.

Bun security updates

Native Bun Dependabot currently supports scheduled version updates, not automated security updates. Keep an explicit manual security-update process; setting open-pull-requests-limit: 0 does not create a Bun security-only updater. See GitHub's supported ecosystems.

For a security patch, verify current upstream advisories and releases, update the manifest and Bun lockfile together using the pinned runtime, and prove frozen installation, build and checks before merging. Refresh alerts after the dependency graph processes the merged commit. A stale or empty alert list alone does not establish that the installed dependencies are current or patched.

Notes

• Inheritance. A repository that ships its own SECURITY.md, CONTRIBUTING.md, issue templates, etc. overrides the default here. Inheritance covers community health files only. It does not cover FUNDING.yml, which GitHub reads per repository (each repo needs its own .github/FUNDING.yml for the Sponsor button to appear on it).
• Sponsors block. The <!-- sponsors --> markers in profile/README.md fence an auto-generated region. Leave the markers in place and edit content outside them.