From 5cee1f145e601d1899e92522985e0d341d92606b Mon Sep 17 00:00:00 2001
From: Dan Allaire <dan@chezlepro.ca>
Date: Sat, 18 Oct 2025 22:32:55 -0400
Subject: [PATCH] =?UTF-8?q?gov/docs:=20constitution=20+=20r=C3=A8gles=20de?=
 =?UTF-8?q?=20contribution/s=C3=A9curit=C3=A9=20+=20CODEOWNERS=20+=20CI?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .forgejo/workflows/ci.yml                | 18 +++++++++++++++++-
 .gitea/CODEOWNERS                        |  5 +++++
 .gitea/ISSUE_TEMPLATE/bug_report.md      | 11 +++++++++++
 .gitea/ISSUE_TEMPLATE/feature_request.md |  7 +++++++
 .gitea/pull_request_template.md          |  5 +++++
 CONTRIBUTING.md                          |  6 ++++++
 GOVERNANCE.md                            |  6 ++++++
 Makefile                                 | 20 ++++++++++++++++++++
 SECURITY.md                              |  5 +++++
 9 files changed, 82 insertions(+), 1 deletion(-)
 create mode 100644 .gitea/CODEOWNERS
 create mode 100644 .gitea/ISSUE_TEMPLATE/bug_report.md
 create mode 100644 .gitea/ISSUE_TEMPLATE/feature_request.md
 create mode 100644 .gitea/pull_request_template.md
 create mode 100644 CONTRIBUTING.md
 create mode 100644 GOVERNANCE.md
 create mode 100644 Makefile
 create mode 100644 SECURITY.md

diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index bfe0017..ab31444 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -9,7 +9,23 @@ jobs:
       - uses: actions/checkout@v4
       - name: yamllint
         uses: ibiqlik/action-yamllint@v3
-  build-docs:
+  ssot-export:
+    runs-on: docker
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: '20' }
+      - run: cd configure && npm ci || npm i
+      - run: node configure/export.mjs
+  tests:
+    runs-on: docker
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: '20' }
+      - run: cd configure && npm ci || npm i
+      - run: node configure/tests/test.mjs
+  docs:
     runs-on: docker
     steps:
       - uses: actions/checkout@v4
diff --git a/.gitea/CODEOWNERS b/.gitea/CODEOWNERS
new file mode 100644
index 0000000..fbae4bf
--- /dev/null
+++ b/.gitea/CODEOWNERS
@@ -0,0 +1,5 @@
+# CODEOWNERS — réviseurs par défaut
+*                 @danallaire
+docs/**           @danallaire
+specs/**          @danallaire
+configure/**      @danallaire
diff --git a/.gitea/ISSUE_TEMPLATE/bug_report.md b/.gitea/ISSUE_TEMPLATE/bug_report.md
new file mode 100644
index 0000000..db72cd5
--- /dev/null
+++ b/.gitea/ISSUE_TEMPLATE/bug_report.md
@@ -0,0 +1,11 @@
+---
+name: Bug
+about: Rapport de bogue
+---
+**Comportement attendu**
+**Comportement observé**
+**Reproduire**
+1.
+2.
+3.
+**Contexte** (OS, version, logs)
diff --git a/.gitea/ISSUE_TEMPLATE/feature_request.md b/.gitea/ISSUE_TEMPLATE/feature_request.md
new file mode 100644
index 0000000..c9661d7
--- /dev/null
+++ b/.gitea/ISSUE_TEMPLATE/feature_request.md
@@ -0,0 +1,7 @@
+---
+name: Demande de fonctionnalité
+about: Proposition d'amélioration
+---
+**Problème à résoudre**
+**Solution proposée**
+**Impacts (doc, SSOT, CI)**
diff --git a/.gitea/pull_request_template.md b/.gitea/pull_request_template.md
new file mode 100644
index 0000000..955a748
--- /dev/null
+++ b/.gitea/pull_request_template.md
@@ -0,0 +1,5 @@
+# Objet
+- [ ] Code/Docs conformes aux standards (DNS/PKI, IP v3)
+- [ ] SSOT export ok (`node configure/export.mjs`)
+- [ ] Doc mise à jour
+**Explication courte**
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..bcb9c6a
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,6 @@
+# Contribuer
+1. Fork/branche: `feat/...`, `fix/...`, `docs/...`.
+2. Respecter la charte DNS/PKI et le plan IP v3.
+3. Mettre à jour la doc (`docs/`) si comportement/standard change.
+4. Lint YAML: `yamllint` (via CI), SSOT: `node configure/export.mjs`.
+5. Tests: `node configure/tests/test.mjs`.
diff --git a/GOVERNANCE.md b/GOVERNANCE.md
new file mode 100644
index 0000000..30996cc
--- /dev/null
+++ b/GOVERNANCE.md
@@ -0,0 +1,6 @@
+# Gouvernance — Alliance Boréale
+- Le présent dépôt fait foi. Toute évolution se fait par PR et revue.
+- Décision: consensus simple; en cas d’égalité, maintien du statu quo.
+- Versions: tags `vYYYY.M` (ex: v2025.1) publiés après ratification.
+- Sécurité: gestion PKI fédérative; rotation régulière; CRL partagées.
+- Transversal: neutralité, interopérabilité, souveraineté, traçabilité.
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..23a14f1
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,20 @@
+SHELL := /bin/bash
+.PHONY: all ssot docs test release
+
+all: ssot docs
+
+ssot:
+	@node configure/export.mjs || (echo "Run: npm -C configure i"; exit 1)
+	@echo "✅ SSOT exports → ./out"
+
+docs:
+	@mkdocs build --strict
+	@echo "✅ Docs build → site/"
+
+test:
+	@node configure/tests/test.mjs
+
+release:
+	@[ -n "$$V" ] || (echo "Usage: make release V=2025.1"; exit 1)
+	git tag -a "v$$V" -m "release v$$V"
+	git push origin "v$$V"
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..6e51ca6
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,5 @@
+# Sécurité
+- Signaler une vulnérabilité: ouvrir un ticket privé ou contacter l’équipe sécurité.
+- Secrets: jamais dans le dépôt; utiliser un coffre (ex: Vault).
+- Certificats: autorité PKI fédérative + ACME si public.
+- Rotation clés/certificats: semestrielle (au minimum).