chore: align repo with owncloud-docker org conventions and unblock image publishing

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @owncloud-docker/maintainer

.github/dependabot.yml

@@ -13,17 +13,3 @@ updates:
         update-types:
           - minor
           - patch
-
-  - package-ecosystem: docker
-    directory: "/"
-    schedule:
-      interval: weekly
-      day: sunday
-      time: '22:00'
-      timezone: Etc/UTC
-    open-pull-requests-limit: 5
-    groups:
-      minor-and-patch:
-        update-types:
-          - minor
-          - patch

.gitignore

@@ -0,0 +1,5 @@
+.DS_Store
+*.swp
+*.swo
+.claude/
+docs/

.renovaterc.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["github>owncloud-ops/renovate-presets:docker"]
+}

CODE_OF_CONDUCT.md

@@ -0,0 +1,8 @@
+# Code of Conduct
+
+This project follows the ownCloud Code of Conduct.
+
+Please read the full Code of Conduct at:
+**<https://owncloud.com/contribute/code-of-conduct/>**
+
+By participating in this project, you agree to abide by its terms.

CONTRIBUTING.md

@@ -0,0 +1,37 @@
+# Contributing
+
+Thank you for your interest in contributing to this project!
+
+Please read the full contributing guidelines at:
+**<https://owncloud.com/contribute/>**
+
+## About this repository
+
+This repository builds the official **oCIS Workflows** Docker image
+([`owncloud/ocis-workflows`](https://hub.docker.com/r/owncloud/ocis-workflows)), an
+AI-powered file workflow automation extension for
+[ownCloud Infinite Scale](https://github.com/owncloud/ocis). It is not the
+ocis-workflows source code — it builds both deployables from source via a
+multi-stage Dockerfile: the Go backend sidecar (the image's entrypoint) and the Vue
+web extension (baked in at `/web/apps/workflows` for oCIS to serve). Bug reports and
+feature requests for the application itself belong in the upstream
+[`owncloud/ocis-workflows`](https://github.com/owncloud/ocis-workflows) repository;
+use this repository's issues only for the Docker packaging. See the
+[README](README.md) for build details, supported tags and usage.
+
+## Pull requests
+
+- **Rebase Early, Rebase Often!** We use a rebase workflow. Rebase on the target
+  branch before submitting a PR; do not create merge commits.
+- **Signed commits**: All commits **must** be PGP/GPG signed. See
+  [GitHub's signing guide](https://docs.github.com/en/authentication/managing-commit-signature-verification).
+- **DCO Sign-off**: Every commit must carry a `Signed-off-by` line:
+  ```
+  git commit -S -s -m "your commit message"
+  ```
+- **Conventional Commits**: PR titles must follow the
+  [Conventional Commits](https://www.conventionalcommits.org/) format — this is
+  enforced by CI, and the PR title becomes the squash-merge commit message.
+- **GitHub Actions Policy**: Workflows may only use actions that are (a) owned by
+  `owncloud`, (b) created by GitHub (`actions/*`), or (c) verified in the GitHub
+  Marketplace. Pin all actions to their full commit SHA.

Dockerfile.multiarch

@@ -1,4 +1,4 @@
-FROM docker.io/node:24-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd AS frontend-builder
+FROM docker.io/node:24-alpine@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43 AS frontend-builder
 
 ARG GIT_REF="main"
 # Optional exact commit to build. When set (rolling builds), it pins the clone to
@@ -21,7 +21,7 @@ WORKDIR /build/frontend
 RUN pnpm install --frozen-lockfile && pnpm build
 
 
-FROM docker.io/golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS go-builder
+FROM docker.io/golang:1.26-alpine@sha256:28d89ee9cc0ff9fec75c82ca201e6bf7fdf9a679d4b7b24dfa04f2bb766bb468 AS go-builder
 
 ARG TARGETARCH
 

SUPPORT.md

@@ -0,0 +1,10 @@
+# Support
+
+For support with this project, please use the following channels:
+
+- **Enterprise Support**: <https://owncloud.com/contact-us/>
+- **Community discussions**: <https://github.com/orgs/owncloud/discussions>
+- **Matrix Chat**: <https://app.element.io/#/room/#owncloud:matrix.org>
+- **Documentation**: <https://doc.owncloud.com>
+
+Please do not use GitHub issues for general support questions.

agents.md

@@ -0,0 +1,130 @@
+# agents.md — ocis-workflows
+
+## Repository Overview
+
+This repository builds the official **oCIS Workflows** Docker image
+(`owncloud/ocis-workflows` on Docker Hub). It does not contain the ocis-workflows
+source code — it builds it **from source** via a multi-stage Dockerfile and ships a
+minimal Alpine runtime image. Images are multi-architecture and built via GitHub
+Actions.
+
+Unlike the other image repos in this organisation, one image carries **two
+deployables**: the Go backend sidecar and the Vue web extension for ownCloud Web.
+They are built from a single upstream checkout so they always ship in lockstep.
+
+- **Classification:** Docker image build (from source)
+- **Activity Status:** Active
+- **License:** Apache-2.0 (with a BSD-2-Clause third-party dependency — see below)
+- **Language:** Dockerfile
+
+## Architecture & Key Paths
+
+- `Dockerfile.multiarch` — three-stage build (build context is the repo root):
+  - **frontend-builder** (`node:24-alpine`) — clones `owncloud/ocis-workflows` at
+    `${GIT_REF}` (optionally pinned to `${GIT_SHA}`) and builds the Vue frontend
+    extension with `pnpm build` from `frontend/`.
+  - **go-builder** (`golang:1.26-alpine`) — compiles `backend/cmd/workflows` with
+    `CGO_ENABLED=0` for `${TARGETARCH}`.
+  - **runtime** (`alpine`) — runs `apk upgrade` so OS security fixes are picked up
+    at build time, adds a non-root `workflows-user` (uid 1000), and copies in the
+    binary (`/usr/local/bin/app`, the `ENTRYPOINT`, `CMD ["server"]`) plus the built
+    frontend assets (`/web/apps/workflows`).
+- `.github/workflows/main.yml` — **active** CI: rolling build of upstream `main`
+- `.github/workflows/lint-pr-title.yml` — Conventional-Commit PR-title enforcement
+- `.github/dependabot.yml` — weekly GitHub Actions dependency updates
+- `.github/CODEOWNERS` — review ownership
+- `.renovaterc.json` — Renovate preset for Docker digest updates
+- `.editorconfig` — formatting rules (2-space indent, LF, trailing newline)
+- `.trivyignore` — accepted-CVE exclusions for the Trivy scan
+- `LICENSE` — Apache-2.0
+- `NOTICE.md`, `LICENSES/BSD-2-Clause.txt` — third-party attribution: the shipped
+  binary links `unraid/apprise-go` (BSD-2-Clause), used by `backend/pkg/notify`
+
+There is **no `CHANGELOG.md`** in this repository.
+
+## The image is not self-serving
+
+The backend binary is the entrypoint — run the container to start the API/automation
+sidecar. The frontend at `/web/apps/workflows` is **not** served by this image; oCIS's
+own web server serves it. Extract that path into the oCIS deployment's
+`WEB_ASSET_APPS_PATH`, e.g. via an `initContainer` that copies it to a shared volume.
+See the [README](README.md) for the manifest.
+
+## Build & CI
+
+CI (`main.yml`) calls the reusable `docker-build-native.yml` workflow hosted in
+[`owncloud-docker/ubuntu`](https://github.com/owncloud-docker/ubuntu) — the per-arch
+native build plus manifest merge, because building from source cross-platform is
+expensive.
+
+- **No version matrix.** Upstream `ocis-workflows` has no release tags yet, so the
+  `prepare` job resolves `owncloud/ocis-workflows` `main` HEAD and the build tracks it
+  (a rolling-style build). Tags published: `latest`, `YYYYMMDD`, `sha-<short>`. Once
+  upstream cuts semver releases, extend `build` with a matrix following
+  [`owncloud-docker/ocis`](https://github.com/owncloud-docker/ocis)'s `main.yml`.
+- `GIT_SHA` is passed the resolved full SHA, which busts the clone layer's cache so
+  the rolling build stays fresh.
+- Weekly rebuild on `0 0 * * 0`, plus `workflow_dispatch`.
+- Smoke test: start `/usr/local/bin/app server` and poll
+  `http://localhost:9109/healthz`.
+- Trivy vulnerability scan (`.trivyignore`), `exit-code: 1` — a HIGH/CRITICAL finding
+  fails the job, so nothing vulnerable is pushed.
+- On non-PR events: push to Docker Hub and sync the README as the image description.
+
+To build locally:
+
+```bash
+docker buildx build -f Dockerfile.multiarch --build-arg GIT_REF=main -t ocis-workflows:test .
+```
+
+The image exposes ports `9105` (API) and `9109` (health/debug), and uses volume `/data`.
+
+## Development Conventions
+
+- **No CHANGELOG** — do not create one.
+- Conventional-Commit PR titles, enforced by `lint-pr-title.yml`.
+- `.editorconfig` governs formatting; `LICENSE` and `LICENSES/*` are exempt from the
+  indent rules.
+- GitHub Actions are pinned to full commit SHAs.
+- Workflows declare a least-privilege `permissions:` block.
+- Bug reports for the application itself go upstream to
+  [`owncloud/ocis-workflows`](https://github.com/owncloud/ocis-workflows); this repo
+  tracks only the Docker packaging.
+- Adding a non-Apache-2.0 third-party dependency to the shipped binary means updating
+  `NOTICE.md` and adding its licence text under `LICENSES/`.
+
+## OSPO Policy Constraints
+
+### GitHub Actions
+- **Only** use actions owned by `owncloud`, created by GitHub (`actions/*`),
+  verified on the GitHub Marketplace, or verified by the ownCloud Maintainers.
+- Pin all actions to their full commit SHA (not tags): `uses: actions/checkout@<SHA> # vX.Y.Z`.
+- Never introduce actions from unverified third parties.
+
+### Dependency Management
+- Dependabot is configured for GitHub Actions updates; Renovate handles Docker
+  base-image digest updates. Do **not** add a `docker` ecosystem to
+  `.github/dependabot.yml` — that duplicates Renovate and lets digest pins drift.
+- Review and merge dependency PRs as part of regular maintenance. A stale
+  `golang:*-alpine` digest surfaces as Go `stdlib` CVEs failing the Trivy gate; the
+  fix is bumping the digest, not adding `.trivyignore` entries.
+
+### Git Workflow
+- **Rebase policy**: Always rebase; never create merge commits.
+- **Signed commits**: All commits **must** be PGP/GPG signed (`git commit -S`).
+- **DCO sign-off**: Every commit needs a `Signed-off-by` line (`git commit -s`).
+- **Conventional Commits & Squash Merge**: PR titles must follow
+  [Conventional Commits](https://www.conventionalcommits.org/); the PR title
+  becomes the squash-merge commit message and is enforced by CI.
+
+## Context for AI Agents
+
+- This is a Docker-image build repo that compiles ocis-workflows from source — not the
+  application codebase. Application changes belong upstream.
+- One image, two deployables. A change to how the frontend assets are laid out affects
+  consumers' `initContainer` copy step, so it is a breaking change for deployments.
+- The build tracks upstream `main`; there is deliberately no version matrix yet.
+- The README is published verbatim as the Docker Hub image description — keep it
+  accurate and self-contained.
+- License is **Apache-2.0**, the OSPO's ecosystem-wide target; no relicensing needed.
+  The BSD-2-Clause dependency is attribution-only and does not change that.