docs(ospo): community health rollout v2 — README, agents.md, health files

[dj4oC]

Summary

This PR is part of the Kiteworks OSPO community health rollout (kiteworks.com/opensource), applied to all ~110 public ownCloud repositories starting May 5, 2026.

• README.md: Rewritten with v2 OSPO template
  • License-specific OSPO section with Apache 2.0 migration guidance
  • Mandatory Community & Support section: GitHub Discussions, Matrix, docs, enterprise support, OSPO home
  • Contributing workflow: Rebase Early/Often, Dependabot, PGP/GPG-signed commits, DCO sign-off, GitHub Actions policy
  • Security section pointing to security.owncloud.com + YesWeHack bug bounty
  • Translations link to Transifex (owncloud project)
• agents.md (new): AI agent context file with architecture, build commands, OSPO policy constraints
• CODE_OF_CONDUCT.md (new): Redirect to https://owncloud.com/contribute/code-of-conduct/
• CONTRIBUTING.md (new): Redirect to https://owncloud.com/contribute/
• SECURITY.md (new): Redirect to https://security.owncloud.com + YesWeHack
• SUPPORT.md (new): Redirect to https://owncloud.com/contact-us/ and support channels

Test plan

• README renders correctly on GitHub (badges, sections, links)
• All health file links resolve (CODE_OF_CONDUCT, CONTRIBUTING, SECURITY, SUPPORT)
• agents.md loads correctly in Claude Code and GitHub Copilot
• License referenced in README matches actual LICENSE file in repo

---

🤖 Generated with Claude Code as part of the ownCloud OSPO rollout.
Kiteworks OSPO: https://kiteworks.com/opensource

[DeepDiver1975]

🤖 Automated review by Claude Code review agent.

Overview

This PR applies the Kiteworks OSPO community health rollout (v2) to docs-webui: a rewritten README.md plus four new community health files (CODE_OF_CONDUCT.md, CONTRIBUTING.md, SECURITY.md, SUPPORT.md) and a new agents.md. The content is well-structured, and I verified the key technical claims against the master branch of the repository — most are accurate. Findings below, ordered by importance.

Documentation accuracy (verified against repo)

Confirmed correct:

• License is consistent and accurate. The repo's LICENSE is AGPL-3.0; the README badge, License section, OSPO section, and agents.md all state AGPL-3.0. The PR's own test-plan item ("License referenced in README matches actual LICENSE file") passes.
• Build commands exist. npm run antora-local, npm run serve, npm run antora, and npm run linkcheck are all present in package.json. npm install → antora-local → serve is a valid local-preview flow.
• All referenced paths exist. antora.yml, site.yml, package.json, ext-antora/, ext-asciidoc/, and modules/ are all present at the repo root, matching the agents.md "Architecture & Key Paths" section.
• docs/the-branching-workflow.md link resolves — the file exists on master.
• Dependabot claim is accurate. .github/dependabot.yml exists, so the README/agents.md statements about Dependabot being configured are correct.

Issues found:

1. Repo identity mismatch (worth a sanity check). The README title was changed to "ownCloud Web UI Documentation," but the GitHub repository description still reads "ownCloud Server Documentation." Not part of this diff, but since this PR is establishing canonical metadata it would be a good moment to fix the repo description too.
2. Dropped reference to docs/new-version-branch.md. The old README linked to "Create a New Version Branch" (docs/new-version-branch.md), which still exists on master. The new README's "Documentation" section only links the branching workflow. If new-version-branch guidance is still relevant, consider keeping a link so the doc isn't orphaned.

Code quality / style

• Markdown is clean and renders well. Health files follow a consistent redirect-stub pattern.
• The HTML comment <!-- OSPO-managed README | Generated: 2026-04-16 | v2 --> is fine, but note the date (2026-04-16) predates the stated rollout start (May 5, 2026) mentioned in the body and OSPO section — minor inconsistency in the generated-date metadata.
• Bare URL in SUPPORT.md: the "Community discussions" line uses a raw https://... URL while the others use angle-bracket autolinks (<...>). Wrap it in <> for consistency: <https://github.com/orgs/owncloud/discussions>.

Specific suggestions

1. agents.md "Lint" section says Not detected (Prettier config present for formatting), yet .prettierrc exists in the repo. Consider stating the Prettier command (e.g. npx prettier --check .) rather than "Not detected," since the config is present.
2. agents.md lists Test framework: broken-link-checker and npm run linkcheck — both correct. Good.
3. The README "Getting Started" claims the local build "generates a standalone preview at http://localhost:8080." antora-local does set --url http://localhost:8080, and serve runs http-server public/. http-server's default port is 8080, so this is accurate as long as the default port is free — fine to leave, but the 8080 claim depends on no port override.
4. Consider matching agents.md filename casing to ecosystem conventions. Both agents.md and the more common AGENTS.md are seen in the wild; GitHub Copilot/most tooling look for AGENTS.md (uppercase). Worth confirming the agent tools you target actually load lowercase agents.md.

Potential issues / risks

• External link liveness (not verifiable from the diff): https://security.owncloud.com, https://kiteworks.com/opensource, the YesWeHack program URL, the Matrix app.element.io room link, and the Transifex link should be spot-checked once before/after merge — the PR test plan flags this but leaves the boxes unchecked.
• No actual relicensing risk here. The OSPO section correctly states the LICENSE file reflects the current (AGPL-3.0) status, not the Apache-2.0 target — this is accurate and avoids implying a license change that hasn't happened.
• Low risk overall. Changes are documentation-only (+186/-23), no code or CI behavior is altered.

Net: accurate, consistent, and safe to merge after addressing the minor markdown-consistency and agents.md "Lint"/casing nits, and ideally syncing the repo description.

[DeepDiver1975]

🤖 Automated review by Claude Code review agent.

Overview

Re-review of the OSPO community health rollout v2 PR at its current head. The change rewrites README.md and adds five files (agents.md, CODE_OF_CONDUCT.md, CONTRIBUTING.md, SECURITY.md, SUPPORT.md). Documentation-only (+186/-23), no code or CI behavior changes. I re-verified the technical claims against master — they hold up. However, none of the minor issues raised in the prior review have been addressed in the new commits; they are repeated below.

Verification against the repo (re-confirmed)

• License consistent. Repo LICENSE is AGPL-3.0; README badge, License section, OSPO section, and agents.md all agree.
• npm scripts exist. antora, antora-local (--url http://localhost:8080), serve (http-server public/), and linkcheck (broken-link-checker) are all present in package.json. The Getting Started flow is valid.
• Paths exist. antora.yml, site.yml, package.json, ext-antora/, ext-asciidoc/, modules/ all present — matches agents.md.
• docs/the-branching-workflow.md, docs/new-version-branch.md, .github/dependabot.yml, .prettierrc all exist on master.

Items from the prior review — still NOT addressed

1. Dropped docs/new-version-branch.md link. The old README linked "Create a New Version Branch"; the new README's Documentation section still omits it, even though the file still exists on master. The doc is now orphaned from the README. Recommend re-adding the link.
2. agents.md "Lint" says Not detected while .prettierrc exists in the repo. Suggest stating the actual command, e.g. npx prettier --check ..
3. agents.md filename casing. Still lowercase agents.md. Most tooling (GitHub Copilot, etc.) looks for AGENTS.md (uppercase). Confirm the targeted agents actually load the lowercase name, or rename.
4. Bare URL in SUPPORT.md. The "Community discussions" line still uses a raw https://... while every other entry uses angle-bracket autolinks (<...>). Wrap for consistency: <https://github.com/orgs/owncloud/discussions>.
5. Generated-date metadata. The HTML comment <!-- OSPO-managed README | Generated: 2026-04-16 | v2 --> still predates the stated rollout start (May 5, 2026) referenced in the body and OSPO section. Minor, but worth aligning.

Items external to the diff

• Repo description mismatch. README title is now "ownCloud Web UI Documentation," but the GitHub repository description still reads "ownCloud Server Documentation." Not part of this diff, but since this PR establishes canonical metadata, a good moment to sync the repo description.

Code quality / style

• Markdown is clean and renders well; health files follow a consistent redirect-stub pattern (apart from the one bare URL noted above).
• The OSPO section correctly states the LICENSE reflects the current (AGPL-3.0) status, not the Apache-2.0 target — no implied license change. Good.

Potential issues / risks

• External link liveness (not verifiable from the diff): https://security.owncloud.com, https://kiteworks.com/opensource, the YesWeHack program URL, the Matrix app.element.io room link, and the Transifex link should be spot-checked once. The PR test plan flags this but the boxes remain unchecked.
• Low risk overall. Documentation-only; safe to merge once the markdown-consistency and agents.md Lint/casing nits are addressed (and ideally the orphaned new-version-branch link restored and repo description synced).