.github — the vul-os organisation repository

This repository is GitHub's special organisation-level .github repository for github.com/vul-os. It ships no product code. It does exactly two jobs:

1. profile/README.md renders as the organisation's public profile page at https://github.com/vul-os. It is the only thing GitHub reads from profile/, and it is not inherited by anything.
2. Everything else here is a default. GitHub falls back to a file in this repository whenever a public repo in the organisation does not carry its own copy. One file here, thirty repos covered — and any repo that wants to disagree just adds its own, which always wins.

Why the directory on disk is called dotgithub

The repository must be named literally .github on GitHub — that is how the feature is keyed, and no other name works. It is:

$ git remote -v
origin	git@github.com:vul-os/.github.git (fetch)
origin	git@github.com:vul-os/.github.git (push)

The local checkout is in a directory called dotgithub only because a dot-prefixed directory is hidden by default in shells, editors and Finder, which makes a repo you are actively editing easy to lose. The directory name is local and has no effect on GitHub. The remote above is the thing that matters, and it is correct. Do not "fix" the folder name by renaming the repository.

The sibling checkout dotgithub-exo is the same arrangement for a different organisation (exo-lution/.github) and is unrelated to this one.

What is here

Path	Inherited by member repos?	Purpose
profile/README.md	no	The org profile page at github.com/vul-os
CONTRIBUTING.md	yes	How to contribute to any Vulos repo
CODE_OF_CONDUCT.md	yes	Contributor Covenant 2.1, org-wide
SECURITY.md	yes	Where to report a vulnerability
SUPPORT.md	yes	Where to ask a question that is not a bug
.github/ISSUE_TEMPLATE/	yes	Bug report, feature request, docs, and the chooser config
.github/PULL_REQUEST_TEMPLATE.md	yes	The PR checklist

What GitHub does and does not inherit

Getting this wrong wastes real time, so it is written down.

Inherited (when the member repo has no file of its own, and the member repo is public): CODE_OF_CONDUCT, CONTRIBUTING, GOVERNANCE, SECURITY, SUPPORT, FUNDING.yml, ISSUE_TEMPLATE/ (including config.yml), and PULL_REQUEST_TEMPLATE. GitHub looks in the repository root, in .github/, and in docs/.

Never inherited — a default here does nothing, and believing otherwise is the trap:

• LICENSE. Licensing is per repo. Every Vulos product carries its own LICENSE, or LICENSE-MIT + LICENSE-APACHE for the dual-licensed ones.
• Workflows (.github/workflows/). CI is never inherited. Each repo has its own, and it has to, because each repo has a different toolchain.
• CODEOWNERS, dependabot.yml, repository settings, branch protection, and labels.

Private repos do not inherit from a public .github repository.

Deliberately absent

FUNDING.yml. A funding file puts a "Sponsor" button on every repo in the organisation and points it at a payment destination. That is an owner decision about where money goes, not a hygiene default, so it is not invented here. Add it if and when there is a real destination.

GOVERNANCE.md. Vulos is currently one maintainer. A governance document describing committees that do not exist would be fiction.

Issue-template assignees. The templates deliberately do not auto-assign. Auto-assignment on a 30-repo organisation with one maintainer produces a wall of notifications and no extra information.

Editing

Changing a file here changes the default for every public repo in the organisation that has not overridden it. Before adding something, check whether the member repos already carry their own:

# from a directory holding the sibling checkouts
for r in */; do
  printf '%-16s %s\n' "${r%/}" \
    "$(git -C "$r" ls-files 2>/dev/null | grep -icE '^(\.github/)?CONTRIBUTING')"
done

A default is worth adding when most repos lack the file. It is worth removing when nearly all of them carry a better, repo-specific version.