feat(docs): add GOVERNANCE.md for OSSF Silver Badge compliance by WilliamBerryiii · Pull Request #235 · microsoft/hve-core

WilliamBerryiii · 2026-01-21T23:37:49Z

Description

Add project governance documentation to meet OSSF Best Practices Badge Silver-level requirements. The new GOVERNANCE.md establishes a corporate-sponsored maintainer model, defines contributor roles and responsibilities, documents decision-making processes, and provides role progression paths.

Add GOVERNANCE.md with governance model, role definitions (Maintainers, Triage Contributors, Contributors), decision-making tiers, role progression, dispute resolution, and contribution authorization
Add consolidated responsibilities matrix showing capabilities by role
Update README.md with governance link in Legal section
Update CONTRIBUTING.md with governance reference after Code of Conduct section

Related Issue(s)

Closes #227
Closes #228

Type of Change

Select all that apply:

Code & Documentation:

Bug fix (non-breaking change fixing an issue)
New feature (non-breaking change adding functionality)
Breaking change (fix or feature causing existing functionality to change)
Documentation update

Infrastructure & Configuration:

AI Artifacts:

Reviewed contribution with prompt-builder agent and addressed all feedback
Copilot instructions (.github/instructions/*.instructions.md)
Copilot prompt (.github/prompts/*.prompt.md)
Copilot agent (.github/agents/*.agent.md)

> Note for AI Artifact Contributors:
>
> - Agents: Research, indexing/referencing other project (using standard VS Code GitHub Copilot/MCP tools), planning, and general implementation agents likely already exist. Review .github/agents/ before creating new ones.
> - Model Versions: Only contributions targeting the latest Anthropic and OpenAI models will be accepted. Older model versions (e.g., GPT-3.5, Claude 3) will be rejected.
> - See Agents Not Accepted and Model Version Requirements.

Other:

Script/automation (.ps1, .sh, .py)
Other (please describe):

Sample Prompts (for AI Artifact Contributions)

N/A - Documentation update only.

Testing

Markdown lint passes (npm run lint:md)
Spell check passes (npm run spell-check)
Technical claims verified against repository (maintainer team, publishing method, CLA process)

Checklist

Required Checks

Documentation is updated (if applicable)
Files follow existing naming conventions
Changes are backwards compatible (if applicable)

AI Artifact Contributions

N/A - Documentation update only.

Required Automated Checks

The following validation commands must pass before merging:

Markdown linting: npm run lint:md
Spell checking: npm run spell-check
Frontmatter validation: npm run lint:frontmatter
Link validation: npm run lint:md-links
PowerShell analysis: npm run lint:ps

Security Considerations

This PR does not contain any sensitive or NDA information
Any new dependencies have been reviewed for security issues
Security-related scripts follow the principle of least privilege

Additional Notes

The governance document establishes:

Corporate-sponsored maintainer model with Microsoft stewardship
Three-tier role structure: Maintainers → Triage Contributors → Contributors
Consolidated responsibilities matrix showing capabilities by role
Decision-making process scaled by impact (routine, significant, breaking, governance)
Role progression paths with clear nomination and consensus processes
Access continuity through Microsoft infrastructure

📜 - Generated by Copilot

- add governance model, roles, and decision-making process - update README.md with governance link - update CONTRIBUTING.md with governance reference Closes #227 📜 - Generated by Copilot

github-actions · 2026-01-21T23:38:03Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

Copilot

Pull request overview

This PR introduces a formal governance document and wires it into the main contributor-facing docs to satisfy OSSF Best Practices Silver-level requirements.

Changes:

Add GOVERNANCE.md with a corporate-sponsored maintainer model, role definitions, decision-making tiers, role progression, dispute resolution, and contribution authorization details.
Update README.md Legal section to link to the governance document alongside licensing and security information.
Update CONTRIBUTING.md to reference the governance document for maintainer authority, decision-making, and role definitions.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
README.md	Adds a Governance entry in the Legal section that links to `GOVERNANCE.md`.
GOVERNANCE.md	Introduces a new governance document with frontmatter, role definitions, decision-making processes, and amendment rules, aligned with repository markdown conventions.
CONTRIBUTING.md	References `GOVERNANCE.md` after the Code of Conduct to direct contributors to governance details.

- add capability matrix showing permissions by role at top of Roles section - clarifies code review, merge, release, architecture, triage, and label capabilities 📜 - Generated by Copilot

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

The test incorrectly assumed non-markdown changes would always exist. 🤖 - Generated by Copilot

codecov-commenter · 2026-01-22T20:18:01Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@a34822a). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #235   +/-   ##
=======================================
  Coverage        ?   28.81%           
=======================================
  Files           ?       14           
  Lines           ?     2735           
  Branches        ?        0           
=======================================
  Hits            ?      788           
  Misses          ?     1947           
  Partials        ?        0

Flag	Coverage Δ
pester	`28.81% <ø> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

🤖 I have created a release *beep* *boop* --- ## [2.0.0](hve-core-v1.1.0...hve-core-v2.0.0) (2026-01-28) ### ⚠ BREAKING CHANGES * **agents:** add Task Reviewer and expand RPI to 4-phase workflow ([#277](#277)) ### ✨ Features * **agents:** add hve-core-installer agent to extension package ([#297](#297)) ([c0e48c6](c0e48c6)) * **agents:** add Task Reviewer and expand RPI to 4-phase workflow ([#277](#277)) ([ae76cab](ae76cab)) * **build:** add code coverage reporting to Pester workflow ([#230](#230)) ([a34822a](a34822a)) * **docs:** add GOVERNANCE.md for OSSF Silver Badge compliance ([#235](#235)) ([b0e752c](b0e752c)) * **docs:** add ROADMAP.md for OSSF Silver badge compliance ([#238](#238)) ([4a41c16](4a41c16)) * **mcp:** add MCP server configuration guidance and installer enhancements ([#225](#225)) ([0bce418](0bce418)) * **scripts:** add YAML linting with actionlint ([#234](#234)) ([d9301f9](d9301f9)) * **security:** add OpenSSF Scorecard workflow and badge ([#271](#271)) ([7c6d788](7c6d788)) * **skills:** add video-to-gif conversion skill with FFmpeg two-pass optimization ([#247](#247)) ([8d65c42](8d65c42)) * **tests:** add Pester tests for LintingHelpers and Validate-MarkdownFrontmatter ([#197](#197), [#198](#198)) ([#205](#205)) ([51ae563](51ae563)) ### 🐛 Bug Fixes * **build:** detect table formatting changes via git diff ([#261](#261)) ([985eee0](985eee0)) * **build:** disable MD024 lint rule in CHANGELOG for release-please ([#220](#220)) ([971df94](971df94)) * **build:** quote shell variables and group redirects in workflow files ([#299](#299)) ([3372509](3372509)) * **build:** resolve scorecard badge and workflow security issues ([#301](#301)) ([aeaed13](aeaed13)) * **extension:** remove frontmatter from README and exclude from markdown linting ([#223](#223)) ([4272529](4272529)) * **instructions:** quote applyTo glob pattern for YAML compatibility ([#216](#216)) ([085199c](085199c)) * **scripts:** add FooterExcludePaths parameter to frontmatter validation ([#334](#334)) ([64db98d](64db98d)) * **scripts:** add GHSA word and logs/ exclusion to cspell config ([#214](#214)) ([5c99b3f](5c99b3f)) * **scripts:** correct type assertions in Invoke-YamlLint.Tests.ps1 ([#332](#332)) ([af7050d](af7050d)) * **scripts:** eliminate false positives in dependency pinning npm pattern ([#273](#273)) ([ccbdfa3](ccbdfa3)) * **security:** add artifact attestation for signed releases ([#257](#257)) ([c52d6e2](c52d6e2)) * standardize markdown footers and complete frontmatter ([#217](#217)) ([b4e7556](b4e7556)) ### 📚 Documentation * add OpenSSF Best Practices Passing badge to README ([#239](#239)) ([91bc529](91bc529)) * **architecture:** add architecture documentation and value proposition ([#252](#252)) ([0e4b02f](0e4b02f)) * **contributing:** add testing requirements for OSSF compliance ([#254](#254)) ([4db1a18](4db1a18)) * **docs:** add enterprise status badges to README header ([#270](#270)) ([ccb68a4](ccb68a4)) * **security:** add security assurance case and threat model for OSSF Silver ([#259](#259)) ([a390e26](a390e26)) ### ♻️ Refactoring * **application:** wrap execution with try blocks, ensure proper … ([#296](#296)) ([35c4417](35c4417)) * **scripts:** extract frontmatter validation to testable module ([#293](#293)) ([4e8707e](4e8707e)) * **scripts:** extract pure functions for Pester testability ([#221](#221)) ([d40e742](d40e742)) ### 🔧 Maintenance * **deps-dev:** bump cspell from 9.4.0 to 9.6.0 in the npm-dependencies group ([#208](#208)) ([855914b](855914b)) * **deps-dev:** bump cspell from 9.6.0 to 9.6.1 in the npm-dependencies group ([#294](#294)) ([1e45ad6](1e45ad6)) * **deps:** bump actions/setup-node from 6.1.0 to 6.2.0 in the github-actions group ([#209](#209)) ([c4c69e2](c4c69e2)) * **deps:** bump the github-actions group with 4 updates ([#295](#295)) ([d8337b8](d8337b8)) * remove step-security/harden-runner from workflows ([#246](#246)) ([c5708d8](c5708d8)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: hve-core-release-please[bot] <254602402+hve-core-release-please[bot]@users.noreply.github.com>

docs: add GOVERNANCE.md for OSSF Silver Badge compliance

c5a57eb

- add governance model, roles, and decision-making process - update README.md with governance link - update CONTRIBUTING.md with governance reference Closes #227 📜 - Generated by Copilot

WilliamBerryiii requested a review from a team as a code owner January 21, 2026 23:37

Copilot AI review requested due to automatic review settings January 21, 2026 23:37

Copilot started reviewing on behalf of WilliamBerryiii January 21, 2026 23:38 View session

Copilot AI reviewed Jan 21, 2026

View reviewed changes

WilliamBerryiii changed the title ~~docs: add GOVERNANCE.md for OSSF Silver Badge compliance~~ feat(docs): add GOVERNANCE.md for OSSF Silver Badge compliance Jan 21, 2026

feat(docs): add consolidated responsibilities matrix to GOVERNANCE.md

2f7a13a

- add capability matrix showing permissions by role at top of Roles section - clarifies code review, merge, release, architecture, triage, and label capabilities 📜 - Generated by Copilot

katriendg approved these changes Jan 22, 2026

View reviewed changes

Merge branch 'main' into docs/227-add-governance

22e4fae

Copilot AI review requested due to automatic review settings January 22, 2026 20:06

Copilot started reviewing on behalf of WilliamBerryiii January 22, 2026 20:07 View session

Copilot AI reviewed Jan 22, 2026

View reviewed changes

fix(tests): handle markdown-only diffs in Get-DiffOutput test

939f220

The test incorrectly assumed non-markdown changes would always exist. 🤖 - Generated by Copilot

WilliamBerryiii merged commit b0e752c into main Jan 22, 2026
16 checks passed

WilliamBerryiii deleted the docs/227-add-governance branch January 22, 2026 20:19

hve-core-release-please bot mentioned this pull request Jan 22, 2026

chore(main): release hve-core 2.0.0 #212

Merged

WilliamBerryiii mentioned this pull request Jan 22, 2026

[Issue]: Add Pester code coverage on main branch pushes for Codecov baseline #249

Closed

This was referenced Jan 28, 2026

chore(main): release hve-core 3.0.0 #341

Closed

chore(main): release hve-core 3.0.0 #417

Closed

This was referenced Feb 6, 2026

chore(main): release hve-core 3.0.0 #441

Closed

chore(main): release hve-core 3.0.0 #530

Closed

chore(main): release hve-core 3.0.0 #532

Closed

chore(main): release hve-core 3.0.0 #534

Closed

This was referenced Feb 13, 2026

chore(main): release hve-core 3.0.0 #539

Closed

chore(main): release hve-core 3.0.0 #540

Closed

chore(main): release hve-core 3.0.0 #542

Closed

chore(main): release hve-core 3.0.0 #547

Closed

This was referenced Feb 14, 2026

chore(main): release hve-core 3.0.0 #556

Closed

chore(main): release hve-core 3.0.0 #558

Closed

chore(main): release hve-core 3.0.0 #641

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(docs): add GOVERNANCE.md for OSSF Silver Badge compliance#235

feat(docs): add GOVERNANCE.md for OSSF Silver Badge compliance#235
WilliamBerryiii merged 4 commits intomainfrom
docs/227-add-governance

WilliamBerryiii commented Jan 21, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Jan 21, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

codecov-commenter commented Jan 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

WilliamBerryiii commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related Issue(s)

Type of Change

Sample Prompts (for AI Artifact Contributions)

Testing

Checklist

Required Checks

AI Artifact Contributions

Required Automated Checks

Security Considerations

Additional Notes

Uh oh!

github-actions bot commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Scanned Files

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

codecov-commenter commented Jan 22, 2026

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

WilliamBerryiii commented Jan 21, 2026 •

edited

Loading

github-actions bot commented Jan 21, 2026 •

edited

Loading