github-essentials

Activation Contract

Load when the user asks to set up, complete, or audit a .github/ directory: issue templates, pull request template, release workflow, CODEOWNERS, SECURITY.md, or dependabot.

Do not load for README authoring (create-readme), changelog upkeep (changelog-maintenance), or CI pipelines. Only the release workflow is in scope here.

Hard Rules

• Never write a file the user did not approve. Present the plan and STOP first.
• Never leave a placeholder in a written file. Resolve __OWNER__, __REPO__, __CODEOWNER__, __SECURITY_EMAIL__, and __PACKAGE_ECOSYSTEM__ from repository evidence. If a value cannot be resolved, ask instead of guessing.
• Never write test, lint, build, or registry-publish workflows. Release only.
• Use issue forms (.yml), never legacy .md issue templates.
• The release workflow triggers on push: tags only, never on workflow_dispatch or release.
• Write templates in the language the repository already uses; default English.

Decision Gates