diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..3c5dd71
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1 @@
+* @owncloud-docker/maintainer
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index d277f3e..ae63a0d 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -13,17 +13,3 @@ updates:
update-types:
- minor
- patch
-
- - package-ecosystem: docker
- directory: "/"
- schedule:
- interval: weekly
- day: sunday
- time: '22:00'
- timezone: Etc/UTC
- open-pull-requests-limit: 5
- groups:
- minor-and-patch:
- update-types:
- - minor
- - patch
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..e01c188
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,5 @@
+.DS_Store
+*.swp
+*.swo
+.claude/
+docs/
diff --git a/.renovaterc.json b/.renovaterc.json
new file mode 100644
index 0000000..be4b776
--- /dev/null
+++ b/.renovaterc.json
@@ -0,0 +1,4 @@
+{
+ "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+ "extends": ["github>owncloud-ops/renovate-presets:docker"]
+}
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 0000000..ce144bf
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,8 @@
+# Code of Conduct
+
+This project follows the ownCloud Code of Conduct.
+
+Please read the full Code of Conduct at:
+****
+
+By participating in this project, you agree to abide by its terms.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..0ccfd19
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,37 @@
+# Contributing
+
+Thank you for your interest in contributing to this project!
+
+Please read the full contributing guidelines at:
+****
+
+## About this repository
+
+This repository builds the official **oCIS Workflows** Docker image
+([`owncloud/ocis-workflows`](https://hub.docker.com/r/owncloud/ocis-workflows)), an
+AI-powered file workflow automation extension for
+[ownCloud Infinite Scale](https://github.com/owncloud/ocis). It is not the
+ocis-workflows source code — it builds both deployables from source via a
+multi-stage Dockerfile: the Go backend sidecar (the image's entrypoint) and the Vue
+web extension (baked in at `/web/apps/workflows` for oCIS to serve). Bug reports and
+feature requests for the application itself belong in the upstream
+[`owncloud/ocis-workflows`](https://github.com/owncloud/ocis-workflows) repository;
+use this repository's issues only for the Docker packaging. See the
+[README](README.md) for build details, supported tags and usage.
+
+## Pull requests
+
+- **Rebase Early, Rebase Often!** We use a rebase workflow. Rebase on the target
+ branch before submitting a PR; do not create merge commits.
+- **Signed commits**: All commits **must** be PGP/GPG signed. See
+ [GitHub's signing guide](https://docs.github.com/en/authentication/managing-commit-signature-verification).
+- **DCO Sign-off**: Every commit must carry a `Signed-off-by` line:
+ ```
+ git commit -S -s -m "your commit message"
+ ```
+- **Conventional Commits**: PR titles must follow the
+ [Conventional Commits](https://www.conventionalcommits.org/) format — this is
+ enforced by CI, and the PR title becomes the squash-merge commit message.
+- **GitHub Actions Policy**: Workflows may only use actions that are (a) owned by
+ `owncloud`, (b) created by GitHub (`actions/*`), or (c) verified in the GitHub
+ Marketplace. Pin all actions to their full commit SHA.
diff --git a/Dockerfile.multiarch b/Dockerfile.multiarch
index 283fc8d..d7888cd 100644
--- a/Dockerfile.multiarch
+++ b/Dockerfile.multiarch
@@ -1,4 +1,4 @@
-FROM docker.io/node:24-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd AS frontend-builder
+FROM docker.io/node:24-alpine@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43 AS frontend-builder
ARG GIT_REF="main"
# Optional exact commit to build. When set (rolling builds), it pins the clone to
@@ -21,7 +21,7 @@ WORKDIR /build/frontend
RUN pnpm install --frozen-lockfile && pnpm build
-FROM docker.io/golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS go-builder
+FROM docker.io/golang:1.26-alpine@sha256:28d89ee9cc0ff9fec75c82ca201e6bf7fdf9a679d4b7b24dfa04f2bb766bb468 AS go-builder
ARG TARGETARCH
diff --git a/SUPPORT.md b/SUPPORT.md
new file mode 100644
index 0000000..bed05d6
--- /dev/null
+++ b/SUPPORT.md
@@ -0,0 +1,10 @@
+# Support
+
+For support with this project, please use the following channels:
+
+- **Enterprise Support**:
+- **Community discussions**:
+- **Matrix Chat**:
+- **Documentation**:
+
+Please do not use GitHub issues for general support questions.
diff --git a/agents.md b/agents.md
new file mode 100644
index 0000000..3448d86
--- /dev/null
+++ b/agents.md
@@ -0,0 +1,130 @@
+# agents.md — ocis-workflows
+
+## Repository Overview
+
+This repository builds the official **oCIS Workflows** Docker image
+(`owncloud/ocis-workflows` on Docker Hub). It does not contain the ocis-workflows
+source code — it builds it **from source** via a multi-stage Dockerfile and ships a
+minimal Alpine runtime image. Images are multi-architecture and built via GitHub
+Actions.
+
+Unlike the other image repos in this organisation, one image carries **two
+deployables**: the Go backend sidecar and the Vue web extension for ownCloud Web.
+They are built from a single upstream checkout so they always ship in lockstep.
+
+- **Classification:** Docker image build (from source)
+- **Activity Status:** Active
+- **License:** Apache-2.0 (with a BSD-2-Clause third-party dependency — see below)
+- **Language:** Dockerfile
+
+## Architecture & Key Paths
+
+- `Dockerfile.multiarch` — three-stage build (build context is the repo root):
+ - **frontend-builder** (`node:24-alpine`) — clones `owncloud/ocis-workflows` at
+ `${GIT_REF}` (optionally pinned to `${GIT_SHA}`) and builds the Vue frontend
+ extension with `pnpm build` from `frontend/`.
+ - **go-builder** (`golang:1.26-alpine`) — compiles `backend/cmd/workflows` with
+ `CGO_ENABLED=0` for `${TARGETARCH}`.
+ - **runtime** (`alpine`) — runs `apk upgrade` so OS security fixes are picked up
+ at build time, adds a non-root `workflows-user` (uid 1000), and copies in the
+ binary (`/usr/local/bin/app`, the `ENTRYPOINT`, `CMD ["server"]`) plus the built
+ frontend assets (`/web/apps/workflows`).
+- `.github/workflows/main.yml` — **active** CI: rolling build of upstream `main`
+- `.github/workflows/lint-pr-title.yml` — Conventional-Commit PR-title enforcement
+- `.github/dependabot.yml` — weekly GitHub Actions dependency updates
+- `.github/CODEOWNERS` — review ownership
+- `.renovaterc.json` — Renovate preset for Docker digest updates
+- `.editorconfig` — formatting rules (2-space indent, LF, trailing newline)
+- `.trivyignore` — accepted-CVE exclusions for the Trivy scan
+- `LICENSE` — Apache-2.0
+- `NOTICE.md`, `LICENSES/BSD-2-Clause.txt` — third-party attribution: the shipped
+ binary links `unraid/apprise-go` (BSD-2-Clause), used by `backend/pkg/notify`
+
+There is **no `CHANGELOG.md`** in this repository.
+
+## The image is not self-serving
+
+The backend binary is the entrypoint — run the container to start the API/automation
+sidecar. The frontend at `/web/apps/workflows` is **not** served by this image; oCIS's
+own web server serves it. Extract that path into the oCIS deployment's
+`WEB_ASSET_APPS_PATH`, e.g. via an `initContainer` that copies it to a shared volume.
+See the [README](README.md) for the manifest.
+
+## Build & CI
+
+CI (`main.yml`) calls the reusable `docker-build-native.yml` workflow hosted in
+[`owncloud-docker/ubuntu`](https://github.com/owncloud-docker/ubuntu) — the per-arch
+native build plus manifest merge, because building from source cross-platform is
+expensive.
+
+- **No version matrix.** Upstream `ocis-workflows` has no release tags yet, so the
+ `prepare` job resolves `owncloud/ocis-workflows` `main` HEAD and the build tracks it
+ (a rolling-style build). Tags published: `latest`, `YYYYMMDD`, `sha-`. Once
+ upstream cuts semver releases, extend `build` with a matrix following
+ [`owncloud-docker/ocis`](https://github.com/owncloud-docker/ocis)'s `main.yml`.
+- `GIT_SHA` is passed the resolved full SHA, which busts the clone layer's cache so
+ the rolling build stays fresh.
+- Weekly rebuild on `0 0 * * 0`, plus `workflow_dispatch`.
+- Smoke test: start `/usr/local/bin/app server` and poll
+ `http://localhost:9109/healthz`.
+- Trivy vulnerability scan (`.trivyignore`), `exit-code: 1` — a HIGH/CRITICAL finding
+ fails the job, so nothing vulnerable is pushed.
+- On non-PR events: push to Docker Hub and sync the README as the image description.
+
+To build locally:
+
+```bash
+docker buildx build -f Dockerfile.multiarch --build-arg GIT_REF=main -t ocis-workflows:test .
+```
+
+The image exposes ports `9105` (API) and `9109` (health/debug), and uses volume `/data`.
+
+## Development Conventions
+
+- **No CHANGELOG** — do not create one.
+- Conventional-Commit PR titles, enforced by `lint-pr-title.yml`.
+- `.editorconfig` governs formatting; `LICENSE` and `LICENSES/*` are exempt from the
+ indent rules.
+- GitHub Actions are pinned to full commit SHAs.
+- Workflows declare a least-privilege `permissions:` block.
+- Bug reports for the application itself go upstream to
+ [`owncloud/ocis-workflows`](https://github.com/owncloud/ocis-workflows); this repo
+ tracks only the Docker packaging.
+- Adding a non-Apache-2.0 third-party dependency to the shipped binary means updating
+ `NOTICE.md` and adding its licence text under `LICENSES/`.
+
+## OSPO Policy Constraints
+
+### GitHub Actions
+- **Only** use actions owned by `owncloud`, created by GitHub (`actions/*`),
+ verified on the GitHub Marketplace, or verified by the ownCloud Maintainers.
+- Pin all actions to their full commit SHA (not tags): `uses: actions/checkout@ # vX.Y.Z`.
+- Never introduce actions from unverified third parties.
+
+### Dependency Management
+- Dependabot is configured for GitHub Actions updates; Renovate handles Docker
+ base-image digest updates. Do **not** add a `docker` ecosystem to
+ `.github/dependabot.yml` — that duplicates Renovate and lets digest pins drift.
+- Review and merge dependency PRs as part of regular maintenance. A stale
+ `golang:*-alpine` digest surfaces as Go `stdlib` CVEs failing the Trivy gate; the
+ fix is bumping the digest, not adding `.trivyignore` entries.
+
+### Git Workflow
+- **Rebase policy**: Always rebase; never create merge commits.
+- **Signed commits**: All commits **must** be PGP/GPG signed (`git commit -S`).
+- **DCO sign-off**: Every commit needs a `Signed-off-by` line (`git commit -s`).
+- **Conventional Commits & Squash Merge**: PR titles must follow
+ [Conventional Commits](https://www.conventionalcommits.org/); the PR title
+ becomes the squash-merge commit message and is enforced by CI.
+
+## Context for AI Agents
+
+- This is a Docker-image build repo that compiles ocis-workflows from source — not the
+ application codebase. Application changes belong upstream.
+- One image, two deployables. A change to how the frontend assets are laid out affects
+ consumers' `initContainer` copy step, so it is a breaking change for deployments.
+- The build tracks upstream `main`; there is deliberately no version matrix yet.
+- The README is published verbatim as the Docker Hub image description — keep it
+ accurate and self-contained.
+- License is **Apache-2.0**, the OSPO's ecosystem-wide target; no relicensing needed.
+ The BSD-2-Clause dependency is attribution-only and does not change that.