docs: add org-wide community health defaults - #2
Conversation
GitHub applies files in this repo's .github/ to every repo in the org that doesn't have its own. Right now protocol, analytics and edge each got their own in the recent public-facing pass — but backend, research and icons have nothing at all, and any repo added later starts bare. These cover all of them at once. * CONTRIBUTING.md — leads with the thing that most often misroutes a PR: which of the repos a change belongs in, including backend and research which aren't in the per-repo files. Then the rules that hold everywhere (never fabricate a value, cite the published method, the honest ceilings that read like bugs but aren't) and a provenance section: several projects in this space are unlicensed or non-commercial-only, and this one stays cleanly MIT. * SECURITY.md — private reporting, plus an exact statement of where the data is, since that determines what's worth reporting at all. States the qualifications rather than rounding to "everything is on-device": diagnostics on by default in GitHub builds, opt-in contribution uploading the DB, and BYOK AI prompts containing metrics. * CODE_OF_CONDUCT.md — the usual, plus two things specific to this project: issues are public so health data gets redacted and nobody is asked to post theirs to debug something, and no medical advice in issues, because these numbers aren't clinical measurements. * SUPPORT.md — where to ask what, and the pairing answer that resolves most "it won't connect" reports (quit the official app first). * ISSUE_TEMPLATE/config.yml — a router, deliberately with no bug form. A form asking for app version and band model is right in edge and nonsense in research or icons, so the org-wide default just points people at the correct repo. edge keeps its own forms, which override this. * FUNDING.yml — Sponsor button org-wide, pointing at edge's DONATE.md (GitHub's config takes URLs, not wallet addresses). Per-repo files always win, so this changes nothing for protocol, analytics or edge.
|
Warning Review limit reached
Next review available in: 7 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
1 participant
Follow-up to #1. Covers the org-level gap that the per-repo pass left behind.
Why
GitHub applies files in this repo's
.github/as defaults to every repo in the org that lacks its own.protocol,analyticsandedgeeach got their ownCONTRIBUTING/SECURITY/templates in the recent pass — butbackend,researchandiconshave none, and any repo created later starts bare.Per-repo files always take precedence, so this changes nothing for the three main repos. It's purely a floor for everything else.
What's here
CONTRIBUTING.mdbackendandresearch, which the per-repo files don't cover. Then the rules that hold everywhere, and a provenance section.SECURITY.mdCODE_OF_CONDUCT.mdSUPPORT.mdISSUE_TEMPLATE/config.ymlFUNDING.ymledge/DONATE.md.Two deliberate choices worth flagging
No org-wide bug form. I initially copied edge's, then removed it: a form asking for app version, TestFlight vs sideload, and which band is exactly right in
edgeand nonsense inresearchoricons. The org default just routes people to the correct repo; edge keeps its own two forms, which override this.The Code of Conduct has two clauses that aren't boilerplate, because they're specific to a health project:
SECURITY.mdalso states the privacy boundary with its qualifications rather than rounding to "everything is on-device" — diagnostics on by default in GitHub builds, opt-in contribution uploading the DB, BYOK AI prompts containing metrics. Same standard as the README fix in edge#154.Not included
iconsand this repo still have no LICENSE, which means all-rights-reserved in public and sits oddly against "MIT licensed" elsewhere.iconsis no longer a dependency ofedge(os_icons.dartsays so), so it's low-stakes — but it's a loose end. Happy to add MIT to both in a follow-up if you want it.