[New Feature]: Support for infusing pull requests best practices

[riverma]

Checked for duplicates

Yes - I've already checked

Alternatives considered

Yes - and alternatives don't suffice

Related problems

We have an updated pull requests guide that now includes a couple new assets / features:

• CODEOWNERS file
• Automated Code Quality and Security Scans
• Versioning best practices

The question now is - how do we apply these at scale to repositories and projects?

Describe the feature request

We need a better way to get our updated pull request best practices (from the guide) into projects easily and at scale.

Proposal

Create a set of "SLIM infusable assets." Teams can then use slim-cli commands to inject these directly into their GitHub repositories. This should help everyone get on board with the proposed changes and understand what's being added.

New Infusable Assets Needed for slim-cli

• Pull Request Template: Standard template for new PRs.
• CODEOWNERS File Template: Template for auto-assigning users in a repo to specific sub-folders.
• Semantic Versioning Enforcement (could be for later):
  • Leverage tools like release-please or semantic-release.
  • Goal: Enforce semantic versioning through consistently named releases.
  • See comment: Release Best Practices Guide slim#149 (comment)
  • Need an update to Versioning section of PR guide to describe semver for commits (push this and existing content to a new guide under Governance) (PR available)
• Infusable Assets for Automating Recurring Checks:
  • GitHub Security (PR available)
  • Secrets Detection
  • Container Vulnerability Scanning
  • SonarQube Cloud

Acceptance Criteria

• slim-cli can successfully infuse each of the new assets.
• Documentation/guidance is available for users on how to infuse these assets in the guide.
• Infused assets correctly implement the intended best practices for sample https://github.com/unity-sds/ repos.

[riverma]

@anilnatha - your assistance here would be wonderful! Thank you for offering to help out - happy to work together on this. FYI - I'm currently working on automation for "GitHub Security" and its almost ready :)