docs(ospo): community health rollout v2 — README, agents.md, health files

[dj4oC]

Summary

This PR is part of the Kiteworks OSPO community health rollout (kiteworks.com/opensource), applied to all ~110 public ownCloud repositories starting May 5, 2026.

• README.md: Rewritten with v2 OSPO template
  • License-specific OSPO section with Apache 2.0 migration guidance
  • Mandatory Community & Support section: GitHub Discussions, Matrix, docs, enterprise support, OSPO home
  • Contributing workflow: Rebase Early/Often, Dependabot, PGP/GPG-signed commits, DCO sign-off, GitHub Actions policy
  • Security section pointing to security.owncloud.com + YesWeHack bug bounty
  • Translations link to Transifex (owncloud project)
• AGENTS.md (new): AI agent context file with architecture, build commands, OSPO policy constraints
• CLAUDE.md (new): symlink to AGENTS.md
• CODE_OF_CONDUCT.md (new): Redirect to https://owncloud.com/contribute/code-of-conduct/
• CONTRIBUTING.md (new): Redirect to https://owncloud.com/contribute/
• SECURITY.md (new): Redirect to https://security.owncloud.com + YesWeHack
• SUPPORT.md (new): Redirect to https://owncloud.com/contact-us/ and support channels

Changes after review

The generated content was checked against this repository and corrected. Two commits on top of the original one.

agents.md → AGENTS.md, plus a CLAUDE.md symlink

Matches the convention already merged across the organisation (core, oauth2, user_ldap, activity, contacts, …): AGENTS.md as a regular file and CLAUDE.md as a symlink (mode 120000) pointing at it. The file was also reformatted onto the same template as those repos, which resolves both of @phil-davis's comments.

Statements that did not match the repository:

Claimed	Actual
js/ is compiled output	js/documents.js, js/settings-admin.js, js/settings-personal.js, js/viewer/ are hand-written; only js/web/richdocuments.js is generated from src/
src/ is TypeScript/JavaScript	src/editor.vue + src/index.ts, i.e. Vue + TypeScript, built with @ownclouders/extension-sdk
tests/ holds PHPUnit and integration tests	tests/unit/ (PHPUnit) and tests/acceptance/ (Behat webUI); there are no integration tests
Build with make appstore, test with phpunit -c phpunit.xml	make appstore calls occ integrity:sign-app unconditionally and needs release certificates; make dist is the local build. Test targets are make test-php-unit / make test-acceptance-webui
No license detected, pending OSPO audit	AGPL-3.0, declared in appinfo/info.xml and in the header of every source file
Classic (OC10)	master targets ownCloud 11 on PHP 8.3; branch 4.2 targets ownCloud 10.11+ on PHP 7.4

Also added two constraints an agent needs and could not infer: make test-php-unit resolves PHPUnit at ../../lib/composer/bin/phpunit, so it only runs with the app checked out as apps/richdocuments inside a server tree; and js/web/richdocuments.js is a committed build artefact that must be regenerated with pnpm build, never hand-edited.

README license statement

The badge and the ## License section both linked a LICENSE file that does not exist here, and the migration section said "Current license: Not detected." The app is AGPL-3.0. The License section now states that, and the migration section uses the same "Category X per Apache policy" wording as the merged core and oauth2 READMEs. The genuinely missing piece — this repository has no root LICENSE/COPYING file — is now called out as OSPO follow-up work and listed as a migration prerequisite, rather than presented as an unknown license.

No license file was added in this PR; that is the OSPO's call, not a docs change.

README content restored and fixed

The rewrite dropped documentation that existed only in the old README. Restored: registering the connector in the ownCloud Web config.json (external_apps), the Collabora admin interface URL, the Settings -> Admin -> Additional path, the mutual-reachability notes, and the SonarCloud badges. Fixed: the Docker Hub badge was missing its repository segment and rendered as "404: badge not found"; the manual install snippet ran occ from inside apps/, where it does not exist.

Verification

• README renders correctly on GitHub — every badge fetched and confirmed to render a real label (License: AGPL-3.0, docker pulls: 33M, quality gate passed, security A, coverage 0%)
• All relative links in README.md and AGENTS.md resolve to files that exist; no LICENSE link remains
• All external links return 200, with one exception — see below
• AGENTS.md is mode 100644 and CLAUDE.md is mode 120000 pointing at AGENTS.md, matching the other repos
• Every make target and pnpm script named in AGENTS.md exists
• Diff touches documentation only; no source, build or workflow files
• CI green

Notes for a maintainer

Three things found while verifying, deliberately not changed here:

1. https://yeswehack.com/programs/owncloud-bug-bounty-program returns 404. It appears in SECURITY.md and the README security section, byte-identical to the already-merged owncloud/core, so this is org-wide OSPO boilerplate. Left consistent rather than guessing a replacement URL — worth fixing across all repos at once.
2. make appstore will ship these files. It rsyncs the whole tree with an explicit exclude list that drops CONTRIBUTING.md but not the new root files, so AGENTS.md, CLAUDE.md, CODE_OF_CONDUCT.md, SECURITY.md and SUPPORT.md would end up inside the signed marketplace tarball. make dist is unaffected (it copies only $(all_src)). Fixing it means touching the Makefile, which would break this PR's docs-only scope.
3. SonarCloud coverage reads 0%, so the restored coverage badge is honest but unflattering. The PHPUnit suite runs in CI without a coverage report reaching SonarCloud.

Per the earlier bot comment, the AGENTS.md content should get an explicit human read before merge, since agents will load it as instructions. That review is the point of this PR now.

[dj4oC]

• Security: no findings — see note below
• Stability: no findings
• Performance: no findings
• Test coverage: N/A (docs-only PR)
• TODOs found: none
• Dependency touched: no
• CI status: not evaluated (see below)
• Stale review: no

Policy hit — root-directory edits. This PR adds/rewrites root-level files (README.md, agents.md, CODE_OF_CONDUCT.md, CONTRIBUTING.md, SECURITY.md, SUPPORT.md). Per this bot's operating rules, root-directory edits are never auto-processed — commenting and stopping; a maintainer must review and merge manually.

Separately flagging for human attention: this PR introduces agents.md, described in the PR body as an "AI agent context file" meant to load into Claude Code / GitHub Copilot, applied identically across ~110 repos org-wide and opened under this bot's own account. Given that future AI coding agents (including this one) will read that file automatically as instructions, please have a maintainer explicitly read and sign off on its contents before merge rather than relying on automated review.

---

Generated by Claude Code

[phil-davis]

Suggested change

	- `tests/` — PHPUnit and integration tests
	- `tests/` — PHPUnit and acceptance tests

[oc-tmueller]

Applied. The file is now AGENTS.md and says:

- `tests/` - PHPUnit and acceptance tests (`tests/unit/`, `tests/acceptance/`)

Confirmed against the tree: tests/unit/ holds the PHPUnit suite (the only suite in phpunit.xml) and tests/acceptance/features/webUISecureView/ the Behat webUI feature. There are no integration tests, so the original wording was wrong on both counts.

[phil-davis]

Should we list the make commands here, like was done in the agent files in other repos?

# Test (PHPunit)
make test-php-unit

# Test (WebUI Acceptance)
make test-acceptance-webui

[oc-tmueller]

Yes — done, and the whole file is now on the same template as the other agent files (# AI Agent Guidelines for ..., ## Repository Overview bullets, make targets with # labels), so it reads the same as core, oauth2, activity etc.

The build/test block is now:

# Show all available targets
make help

# Build distribution tarball
make dist

# Install PHP dependencies
composer install

# Build the ownCloud Web connector (src/ -> js/web/)
pnpm install
pnpm build

# Test (PHPUnit)
make test-php-unit

# Test (WebUI Acceptance)
make test-acceptance-webui

# Lint (PHP code style)
make test-php-style

# Fix code style
make test-php-style-fix

# Lint (JavaScript/TypeScript)
pnpm lint

# Static analysis
make test-php-phan
make test-php-phpstan

# Clean build artifacts and dependencies
make clean

Every target above was checked to exist in the Makefile. Three things I deliberately did not copy from the other repos, because they do not hold here:

• No bare make. .DEFAULT_GOAL := help, so make only prints the help text. make dist is the build.
• No make appstore. The original file listed it as the build command, but it calls occ integrity:sign-app unconditionally and needs a key and certificate in ~/.owncloud/certificates/, so it only works for releases. make dist skips signing when no certificate is present. This is now called out under Important Constraints.
• No make test-acceptance-api. The target exists, but tests/acceptance/features/ only contains the webUI feature, and CI only runs do-webui-tests: true. Listing it would send agents at an empty suite.

I also added the gotcha that make test-php-unit resolves PHPUnit at ../../lib/composer/bin/phpunit, so it only runs with the app checked out as apps/richdocuments inside a server tree — not from a standalone clone.

[oc-tmueller]

Correction to note 2 in the description above, now filed as #622.

I wrote that the new root files "would end up inside the signed marketplace tarball". That overstates it. Releases are unaffected: release.yml sets artifact-glob: build/dist/richdocuments.tar.gz and the reusable workflow runs make dist, which copies only $(all_src) and so excludes all of them. make appstore writes to build/richdocuments.tar.gz instead, and nothing in CI consumes it.

So the leak is confined to a legacy target that the release pipeline no longer uses. #622 covers it with the accurate scope, including the 18 root entries appstore currently packages beyond all_src.