feat(ci): add PR lint gate, issue automation, and monorepo governance workflows

.github/CODEOWNERS

@@ -0,0 +1,24 @@
+# =============================================================================
+# CODEOWNERS — automatic review request on pull requests
+#
+# GitHub requests a review from the listed owners whenever a PR touches
+# the matched path. Combined with Branch Protection "Require review from
+# Code Owners", this enforces sub-project ownership.
+#
+# Syntax: <pattern>  <@github-user> ...
+# Patterns are evaluated top-to-bottom; the LAST matching rule wins.
+# =============================================================================
+
+# Global fallback — catches anything not matched below
+*                               @casparant
+
+# Sub-project owners
+/src/copilot-shell/             @kongche-jbw @samchu-zsl
+/src/agent-sec-core/            @1570005763
+/src/os-skills/                 @Ziqi002
+/src/agentsight/                @chengshuyi
+
+# CI / project-wide config — always require lead review
+/.github/                       @kongche-jbw
+/cliff.toml                     @samchu-zsl
+/Makefile                       @samchu-zsl

.github/commitlint.config.json

@@ -1,8 +1,30 @@
 {
-  "extends": ["@commitlint/config-conventional"],
+  "extends": [
+    "@commitlint/config-conventional"
+  ],
   "rules": {
-    "scope-enum": [2, "always", ["cosh", "agent-sec-core", "os-skills", "agentsight", "deps", "ci", "docs"]],
-    "scope-empty": [2, "never"],
-    "header-max-length": [2, "always", 120]
+    "scope-enum": [
+      2,
+      "always",
+      [
+        "cosh",
+        "agent-sec-core",
+        "os-skills",
+        "agentsight",
+        "deps",
+        "ci",
+        "docs",
+        "chore"
+      ]
+    ],
+    "scope-empty": [
+      2,
+      "never"
+    ],
+    "header-max-length": [
+      2,
+      "always",
+      120
+    ]
   }
-}
+}

.github/maintainers.json

@@ -0,0 +1,46 @@
+{
+    "scopes": [
+        {
+            "label": "component:cosh",
+            "maintainers": [
+                {
+                    "github": "kongche-jbw"
+                },
+                {
+                    "github": "samchu-zsl"
+                }
+            ]
+        },
+        {
+            "label": "component:sec-core",
+            "maintainers": [
+                {
+                    "github": "1570005763"
+                }
+            ]
+        },
+        {
+            "label": "component:skill",
+            "maintainers": [
+                {
+                    "github": "Ziqi002"
+                }
+            ]
+        },
+        {
+            "label": "component:sight",
+            "maintainers": [
+                {
+                    "github": "chengshuyi"
+                }
+            ]
+        }
+    ],
+    "default": {
+        "maintainers": [
+            {
+                "github": "kongche-jbw"
+            }
+        ]
+    }
+}

.github/pull_request_template.md

@@ -4,9 +4,19 @@
 
 ## Related Issue
 
-<!-- Link the related issue. Required for new features and non-trivial changes. -->
+<!--
+  REQUIRED: Every PR must be linked to an existing issue.
+  Use one of the closing keywords so the issue closes automatically on merge:
 
-- [ ] Related issue linked (recommended for new features and non-trivial changes)
+    closes #<number>
+    fixes #<number>
+    resolves #<number>
+
+  If this is a trivial typo / doc-only fix with no issue, write:
+    no-issue: <reason>
+-->
+
+closes #
 
 ## Type of Change
 

.github/workflows/ci.yaml

@@ -2,9 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, 'release/**']
   pull_request:
-    branches: [main]
+    branches: [main, 'release/**']
   workflow_dispatch:
     inputs:
       run_copilot_shell:
@@ -32,7 +32,7 @@ jobs:
   # =========================================================================
   detect-changes:
     name: Detect Changes
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     outputs:
       copilot_shell: ${{ steps.changes.outputs.copilot_shell }}
       agent_sec_core: ${{ steps.changes.outputs.agent_sec_core }}
@@ -101,7 +101,7 @@ jobs:
     name: Build copilot-shell
     needs: detect-changes
     if: needs.detect-changes.outputs.copilot_shell == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
 
@@ -145,7 +145,7 @@ jobs:
     name: Test copilot-shell/cli
     needs: [detect-changes, build-copilot-shell]
     if: needs.detect-changes.outputs.copilot_shell == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
 
@@ -175,7 +175,7 @@ jobs:
     name: Test copilot-shell/core
     needs: [detect-changes, build-copilot-shell]
     if: needs.detect-changes.outputs.copilot_shell == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
 
@@ -208,7 +208,7 @@ jobs:
     name: Test agent-sec-core
     needs: detect-changes
     if: needs.detect-changes.outputs.agent_sec_core == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
 
@@ -249,7 +249,7 @@ jobs:
     name: Test agentsight
     needs: detect-changes
     if: needs.detect-changes.outputs.agentsight == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/issue-automation.yml

@@ -0,0 +1,69 @@
+###############################################################################
+# Issue Automation — Parse Issue Form and apply component label
+#
+# Triggered when a new issue is opened.
+# Reads the "Component" dropdown from the Issue Form body and maps it to a
+# component:xxx label. The label addition then triggers issue-triage.yml,
+# which handles assignee routing and notifications.
+###############################################################################
+
+name: 🤖 Issue Automation
+
+on:
+  issues:
+    types: [opened]
+
+permissions:
+  issues: write
+
+jobs:
+  auto-label:
+    name: 🏷️ Auto Label
+    runs-on: ubuntu-22.04
+
+    steps:
+      # -----------------------------------------------------------------------
+      # Parse Issue Form body → map Component dropdown value to a label
+      # -----------------------------------------------------------------------
+      - name: 🔍 Parse component and apply label
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const body = context.payload.issue.body || '';
+
+            // Skip if a component label is already present (e.g. applied via API or Issue Form)
+            const existingLabels = context.payload.issue.labels.map(l => l.name);
+            const alreadyLabeled = existingLabels.some(l => l.startsWith('component:'));
+            if (alreadyLabeled) {
+              console.log(`Issue already has a component label: ${existingLabels.filter(l => l.startsWith('component:')).join(', ')} — skipping.`);
+              return;
+            }
+
+            // Issue Form renders dropdown fields as: "### FieldName\n\nValue"
+            const componentMatch = body.match(/###\s*Component\s*\n\n(.+)/i);
+            const component = componentMatch ? componentMatch[1].trim() : '';
+
+            console.log(`Parsed component: "${component}"`);
+
+            // Map dropdown display value → label name
+            const labelMap = {
+              'copilot-shell (cosh)': 'component:cosh',
+              'agent-sec-core':       'component:sec-core',
+              'os-skills':            'component:skill',
+              'agentsight':           'component:sight',
+            };
+
+            const label = labelMap[component];
+            if (!label) {
+              console.log('No matching component label found — skipping.');
+              return;
+            }
+
+            console.log(`Applying label: ${label}`);
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              labels: [label],
+            });
+            // Label addition will trigger issue-triage.yml for assign + notify