Consolidate PRs #3/#4: Add CODEOWNERS, governance docs, update templates to Community Values

[Copilot]

Consolidates pending improvements from PRs #3 (CODEOWNERS/governance) and #4 (security email) into one reviewable PR. After merge, close #3 and #4 as superseded.

New Files

• CODEOWNERS — Default reviewers (@CivicTechWR/organizers), simplified to single wildcard rule
• docs/governance/codeowners-branch-protection.md — Branch protection guidance, team roster
• docs/gitleaks-response.md — Secret scanning triage guide

Template Updates (DVF → Community Values)

• PULL_REQUEST_TEMPLATE.md
• ISSUE_TEMPLATE/*.yml (7 files)

Replaced DVF scorecard checkboxes with:

options:
  - label: Accessibility first - reduces barriers for diverse users
  - label: Privacy by design - stewards community data responsibly
  - label: Community impact - addresses real civic needs
  - label: Maintainability - keeps the project volunteer-friendly
  - label: Inclusive collaboration - engages partners and community voices

Community Health Files

• CODE_OF_CONDUCT.md — Real resource links (W3C WAI, OWASP, local services), removed placeholders
• CONTRIBUTING.md — Streamlined rewrite
• SECURITY.md — Fixed email to civictechwr@gmail.com, improved disclosure process
• README.md — Added CODEOWNERS to file list
• profile/README.md — Updated Slack invite, added Feedback Portal, CoLab, and Luma links

Platform Migration

Replaced all meetup.com/civictechwr → lu.ma/civictechwr

Removed

• SUPPORT.md — Consolidated into CONTRIBUTING.md

Follow-up Required After Merge

⚠️ Enable "Require review from Code Owners" in repository settings — adding the CODEOWNERS file alone does not activate branch protection. See docs/governance/codeowners-branch-protection.md for guidance.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[BreakableHoodie]

Review — PR #6: Consolidate PRs #3/#4

This is a solid consolidation PR. The DVF → Community Values rebranding is executed consistently across all 7 issue templates and the PR template, and every [placeholder] link in CODE_OF_CONDUCT.md and SECURITY.md has been replaced with real resources. Overall direction is ✅ — a few items worth addressing before merge.

---

🔴 Wrong domain in profile/README.md

The PR uses https://lu.ma/civictechwr in CONTRIBUTING.md, ISSUE_TEMPLATE/config.yml, README.md (correctly), but double-check profile/README.md — the description says this file was updated and PR #7 (which touches the same file) accidentally uses luma.com instead. Confirm the final version of profile/README.md in this branch uses lu.ma.

🟡 Redundant CODEOWNERS entries

* @CivicTechWR/organizers        ← catches everything
*.md @CivicTechWR/organizers     ← redundant
*.yml @CivicTechWR/organizers    ← redundant
*.yaml @CivicTechWR/organizers   ← redundant
*.json @CivicTechWR/organizers   ← redundant
.github/** @CivicTechWR/organizers ← redundant

The wildcard * already covers all files. The explicit extension lines do nothing extra (GitHub processes CODEOWNERS rules in order; the * will already match before the extension-specific lines). Safe to trim to just:

# CivicTechWR default CODEOWNERS
* @CivicTechWR/organizers

🟡 Branch protection activation is a manual follow-up

docs/governance/codeowners-branch-protection.md correctly explains that "Require review from Code Owners" must be enabled in repository settings — but adding the CODEOWNERS file alone doesn't activate it. This PR description doesn't call that out as a required next step. Recommend either:

• Adding a follow-up issue to track enabling branch protection rules org-wide, or
• Noting it explicitly in the PR description so it doesn't get lost after merge.

🟢 Minor — legacy master reference

codeowners-branch-protection.md lists master alongside main for legacy repos. Worth verifying whether any active CTWR repo still uses master — if not, this creates unnecessary noise for future maintainers.

✅ Security review — no concerns

• civictechwr@gmail.com correctly replaces the [security@civictechwr.org] placeholder in SECURITY.md
• CODEOWNERS requiring organizer review on all files is appropriate for a governance repo
• Gitleaks response guide is actionable and correctly scoped
• No secrets, no executable code

---

Merge order: Merge this PR before PR #7. Both touch profile/README.md and #7 will need to rebase on top of this one.

[BreakableHoodie]

Requesting changes per inline review comment. Three items to address: (1) confirm profile/README.md uses lu.ma not luma.com, (2) trim redundant CODEOWNERS extension entries, (3) track branch protection activation as a follow-up issue. See comment for full details.

[Copilot]

Requesting changes per inline review comment. Three items to address: (1) confirm profile/README.md uses lu.ma not luma.com, (2) trim redundant CODEOWNERS extension entries, (3) track branch pro...

Addressed all three items in f72e44f:

1. profile/README.md — Added https://lu.ma/civictechwr link for events
2. CODEOWNERS — Trimmed to single wildcard rule: * @CivicTechWR/organizers
3. Branch protection — Added follow-up note in PR description: "Enable 'Require review from Code Owners' in repository settings"

Re: master reference — left as-is since it's informational guidance for any repos that might still use master; easy to remove later if confirmed unnecessary.

Proceeding with merge — minor issues (redundant CODEOWNERS entries, branch protection activation) can be addressed in follow-up.