[csnitker-godaddy]

Related issue

Fixes #14

Summary

Routine PRs may reference an issue without closing it or explain why no issue is needed. Normative, explicitly breaking and issue-required changes require deliberate tracking references, including Dependabot PRs; incidental numbers in changelogs do not satisfy the check.

Provide shared Safe Settings labels, organization-default proposal/nomination/specification-tracking forms, GitVote profiles, and inactive-PR automation. The forms live in .github/ISSUE_TEMPLATE/ and become available on merge wherever repositories have no local issue forms. Their labels are provisioned across the maintained repositories, and links to unpublished governance rules are optional. Existing onboarding PRs align repository contribution guides with this shared policy.

Inactivity automation defaults to dry-run. Active mode records the current commit in one reusable bot comment when starting or resetting a 60-day author-response period, warns before a further 30-day period, and rechecks the PR before closing. A missed push or missing period marker starts a fresh period. The caller serializes runs, and the reusable workflow checks out its own commit.

Safe Settings maintains labels for enrolled repositories. Organization-default forms are inherited automatically; workflow callers still require installation. GitVote requires its App and the eligible TSC team. Governance-only forms and quarterly health checks belong in the governance repository.

Testing

• 51 JavaScript tests and 17 Python tests pass; configuration validation and whitespace checks pass.
• Regression cases cover incidental references, missed push events, bot-generated label events, forged/missing markers, dry-run behavior and form deployment.
• The real Dependabot chore(deps): bump js-yaml from 4.3.1 to 5.5.0 #9/chore(deps): bump js-yaml from 4.3.1 to 4.3.2 #10 bodies pass for routine updates and fail with issue-required unless a tracking reference is added.
• Readback confirmed all 14 shared labels on all 14 maintained repositories; existing labels were preserved.
• Actionlint has two schema gaps for the documented job.workflow_sha and concurrency.queue fields; no other lint diagnostics remain.

AI assistance

Assisted-by: OpenAI Codex (GPT-6)

Checklist

• The PR title follows Conventional Commits.
• Tests cover the change.
• The shared work has a tracking issue.
• Every commit carries an authorized human DCO sign-off.

[kperry-godaddy]

The dry-run-first default and the insistence on server timestamps in the inactivity sweep are the right instincts, and the GitVote thresholds hold for every TSC size from one to nine against GitVote's own >= comparison. Two things I'd settle before merge: the issue-required gate can be satisfied by any #N in a PR body (so it isn't a gate for Dependabot, which the description says it is), and the sweep can close a PR after a push it never observed.

Nine inline comments, six with suggestions you can commit as-is, plus three notes below that sit outside the diff.

Outside this diff

• Scope. By the criteria this PR adds to CONTRIBUTING, a new capability that needs agreement on ongoing support and spans nine repositories is proposal-class work; it ships here under No issue needed:. It also bundles four independent concerns across 18 files (conditional issue policy, governance forms and labels, GitVote profiles, inactivity automation). The policy change plus its docs is a small, clean PR on its own and shouldn't wait on the sweep fixes; I'd land that first and give the automation its own review.
• Repository CONTRIBUTING files. All nine contributor-facing repos still say to link an issue with a closing keyword, so after merge their docs contradict the shared check until a follow-up sweep updates them.
• Governance links. The proposal, nomination and spec-tracking forms require contributors to link the applicable governance process and eligibility rules, and the governance repository doesn't publish those yet. Either land that first or make those fields optional until it exists.

Locally at 4e3f432: npm test (45), python3 -m unittest (16), npm run validate, actionlint and git diff --check are all green.

[csnitker-godaddy]

The review points outside the inline diff are covered as follows:

• Scope: Track shared contribution and governance tooling #14 now tracks the requested combined shared-tooling work. I kept that scope together; the inactivity blockers are fixed and forms/workflow adoption remain separate from publishing the tooling.
• Repository guides: updated the existing onboarding PRs to point at the shared .github/CONTRIBUTING.md rather than a separate governance copy: chore: adopt ANS governance and contribution licensing ans#147, chore: adopt ANS governance and clarify Apache licensing ans-spec#88, chore: adopt ANS governance and contribution licensing ans-sdk-go#98, chore: adopt ANS governance and contribution licensing ans-sdk-rust#129, chore: adopt ANS governance and contribution licensing ans-sdk-java#122, chore: adopt ANS governance and contribution licensing agent-trust-discovery#38, chore: adopt ANS governance and clarify Apache licensing trust-index-spec#3, chore: adopt ANS governance and contribution licensing ans-openshell#14, chore: adopt ANS governance and contribution licensing ans-gateway-auth#5. Those PRs already remove the blanket closing-keyword rule. Published repository-local requirements remain authoritative until their onboarding changes land.
• Governance availability: new forms stay opt-in and do not require links to unpublished rules.

The updated head is fba48acd42701bc59eea04d847eb9b99812e5750. All GitHub checks and DCO pass; the nine inline threads have fixes and regression coverage. Ready for another review.

[kperry-godaddy]

Approving at d9f02da. Every thread from the first round is fixed with regression coverage, and I re-verified each against the code and live state rather than the replies: replayed the real bodies of #9 and #10 against the new reference check (pass plain, rejected once issue-required is applied), re-ran the missed-push and bot-cleanup scenarios against the new sweep (day-30 missed push now restarts at day 60 and closes no earlier than day 150; a premature manual stale no longer shifts the reminder), confirmed all 14 shared labels exist on every maintained repository, and spot-checked four of the onboarding PRs for the CONTRIBUTING alignment. Locally: 49 Node tests, 17 Python tests, validate and git diff --check green; actionlint reports only the two known schema lags (job.workflow_sha, queue).

Non-blocking follow-up for before any repository flips dry_run: false: restart() now posts a new bot comment every time it runs, and it runs on every author reply, push, and new change request while a PR is waiting. Two author replies plus one push over five days produced four bot comments in a run-through; a normal review cycle lands ten or more. Editing the single period marker comment in place (find the existing github-actions[bot] comment carrying the waiting head: marker, issues.updateComment it with the new head, create only when none exists) keeps one bot comment per PR with the head check intact. The sweep's marker lookup then selects by updated_at rather than created_at >= startedAt, since an edited comment keeps its original created_at and since already filters on updated_at. I prototyped that locally and the existing 49 tests pass unchanged with an updateComment stub in the fixture. Fine as its own small PR against #14.

[csnitker-godaddy]

Included the remaining timer-comment improvement in this PR as fec26fa. Resets edit the existing github-actions[bot] period comment and the sweep uses its server updated_at timestamp; a new marker is created only when none exists. Regression tests reproduce two replies plus a push without adding bot comments, cover reuse after reviewer handoff, preserve the full 60/30-day timing, and forbid comment edits during dry-run. All 51 JavaScript and 17 Python tests pass locally; the commit has the human DCO sign-off.