docs(ospo): community health rollout v2 — README, agents.md, health files

CODE_OF_CONDUCT.md

@@ -0,0 +1,8 @@
+# Code of Conduct
+
+This project follows the ownCloud Code of Conduct.
+
+Please read the full Code of Conduct at:
+**<https://owncloud.com/contribute/code-of-conduct/>**
+
+By participating in this project, you agree to abide by its terms.

CONTRIBUTING.md

@@ -0,0 +1,9 @@
+# Contributing
+
+Thank you for your interest in contributing to this project!
+
+Please read the full contributing guidelines at:
+**<https://owncloud.com/contribute/>**
+
+For development setup, coding standards, and pull request process,
+see the README in this repository.

README.md

@@ -1,56 +1,119 @@
-# About
-This repository contains a helper script to mak it easier to setup a ownCloud build environment for ownCloud desktop client 2.7 and newer.
+# ownBuild
 
+<!-- OSPO-managed README | Generated: 2026-04-16 | v2 -->
 
-# Required dependencies
-- https://community.kde.org/Craft#Setting_up_Craft
-## On Windows
-### Visual Studio 2022
- - Start `Visual Studio Installer`
-  - Select `Modify`
-  - Select `Desktop development with C++`
-  - Go to `Individual Components`
-  - Select `git`
-  - Select `python2`
-  - Select `python3`
-  - Click the `Modify` button
+[![License](https://img.shields.io/badge/License-BSD--2--Clause-blue.svg)](LICENSE) [![ownCloud OSPO](https://img.shields.io/badge/OSPO-ownCloud-blue)](https://kiteworks.com/opensource)
 
-# Get started
-- `(py.exe|python3) ownbuild.py owncloud-client`
+A Python helper script that simplifies setting up a KDE Craft-based build environment for the ownCloud Desktop Client (version 2.7+). It automates dependency resolution and compilation across Windows, Linux, and macOS using the Craft package manager.
 
-## Build a specific branch configuration
-This will only affect the version of the dependencies.
-- `(py.exe|python3) ownbuild.py --branch 5 -- owncloud-client`
+> **Note:** This repository is in maintenance/legacy mode and is no longer actively developed.
 
-## Build a specific client tag
-- `(py.exe|python3) ownbuild.py --branch 5 -- --set revision=v5.2.1 owncloud-client`
-- `(py.exe|python3) ownbuild.py --branch 5 -- owncloud-client`
+## Getting Started
 
-## Use special craft commands
-- `(py.exe|python3) ownbuild.py --branch 5 -- --package owncloud-client`
-- `(py.exe|python3) ownbuild.py --branch 5 -- --run .\master\windows-cl-msvc2022-x86_64-debug\bin\owncloud.exe`
+Follow the steps below to set up the build environment.
 
+### Prerequisites
 
-## Appendix
-### Run with a specific target configuration
-- `(py.exe|python3) ownbuild.py --branch 5 --target windows-cl-msvc2022-x86_64`
-### Query available targets
-- `(py.exe|python3) ownbuild.py --branch 5 --target help`
+- Python 3
+- [KDE Craft](https://community.kde.org/Craft#Setting_up_Craft)
+- On Windows: Visual Studio 2022 with C++ workload, Git, Python 2/3
+- On Linux: `python3 git g++ gcc`
 
+### Build the Desktop Client
 
-## On Linux
+```bash
+python3 ownbuild.py owncloud-client
+```
 
-Note:
-- ownbuild / craft uses cached binary packages from https://download.owncloud.com/desktop/craft/cache/ to speed up the compilation.
+### Build a Specific Branch
 
-#### Prerequisites
- - `apt install python3 git g++ gcc`
-
-### Build the client with owncloud dependencies
+```bash
+python3 ownbuild.py --branch 5 -- owncloud-client
+```
 
-- `python3 ./ownbuild.py --branch master --target linux-64-gcc owncloud-client`
-- When built, start the client like this: `./master/linux-64-gcc/bin/owncloud -s`
+### Build a Specific Tag
 
-### Build the client with system dependencies
+```bash
+python3 ownbuild.py --branch 5 -- --set revision=v5.2.1 owncloud-client
+```
 
-- TODO: find the relevant info e.g. docker image from kdeorg/ubuntu-1804-craft
+## Documentation
+
+- [KDE Craft Documentation](https://community.kde.org/Craft)
+- [ownCloud Desktop Client](https://github.com/owncloud/client)
+
+## Part of ownCloud Infrastructure
+
+This tool supports building the [ownCloud Desktop Client](https://github.com/owncloud/client) from source.
+
+> **Note:** This repository is archived/legacy.
+
+## Community & Support
+
+**[Star](https://github.com/owncloud/ownbuild)** this repo and **Watch** for release notifications!
+
+- [ownCloud Website](https://owncloud.com)
+- [Community Discussions](https://github.com/orgs/owncloud/discussions)
+- [Matrix Chat](https://app.element.io/#/room/#owncloud:matrix.org)
+- [Documentation](https://doc.owncloud.com)
+- [Enterprise Support](https://owncloud.com/contact-us/)
+- [OSPO Home](https://kiteworks.com/opensource)
+
+## Contributing
+
+We welcome contributions! Please read the [Contributing Guidelines](CONTRIBUTING.md)
+and our [Code of Conduct](CODE_OF_CONDUCT.md) before getting started.
+
+### Workflow
+
+- **Rebase Early, Rebase Often!** We use a rebase workflow. Always rebase on the target branch before submitting a PR.
+- **Dependabot**: Automated dependency updates are managed via Dependabot. Review and merge dependency PRs promptly.
+- **Signed Commits**: All commits **must** be PGP/GPG signed. See [GitHub's signing guide](https://docs.github.com/en/authentication/managing-commit-signature-verification).
+- **DCO Sign-off**: Every commit must carry a `Signed-off-by` line:
+  ```
+  git commit -s -S -m "your commit message"
+  ```
+- **GitHub Actions Policy**: Workflows may only use actions that are (a) owned by `owncloud`, (b) created by GitHub (`actions/*`), or (c) verified in the GitHub Marketplace.
+
+## Security
+
+**Do not open a public GitHub issue for security vulnerabilities.**
+
+Report vulnerabilities at **<https://security.owncloud.com>** -- see [SECURITY.md](SECURITY.md).
+
+Bug bounty: [YesWeHack ownCloud Program](https://yeswehack.com/programs/owncloud-bug-bounty-program)
+
+## License
+
+This project is licensed under the [BSD-2-Clause](LICENSE).
+
+## About the ownCloud OSPO
+
+The [Kiteworks Open Source Program Office](https://kiteworks.com/opensource), operating under
+the [ownCloud](https://owncloud.com) brand, launched on May 5, 2026, to steward the open source
+ecosystem around ownCloud's products. The OSPO ensures transparent governance, license compliance,
+community health, and sustainable collaboration between the open source community and
+[Kiteworks](https://www.kiteworks.com), which acquired ownCloud in 2023.
+
+- **OSPO Home**: <https://kiteworks.com/opensource>
+- **GitHub**: <https://github.com/owncloud>
+- **ownCloud**: <https://owncloud.com>
+
+For questions about the OSPO or licensing, contact ospo@kiteworks.com.
+
+### License Migration to Apache 2.0
+
+The OSPO is driving a strategic relicensing of ownCloud repositories toward the
+[Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0), following
+the [Apache Software Foundation's third-party license policy](https://www.apache.org/legal/resolved.html).
+
+Individual repositories will migrate as their audit is completed. The LICENSE file
+in each repo reflects its **current** license status (not the target).
+
+**Current license: BSD-2-Clause** (Category A per Apache policy -- permissive, compatible with Apache-2.0).
+
+Migration prerequisites for this repository:
+
+- **CLA/DCO coverage**: All past contributors must have signed agreements permitting relicensing
+- **Header updates**: All source file headers must be updated to Apache-2.0 notice
+- **Dependency audit**: Verify no incompatible transitive dependencies

SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+**Do NOT open a public GitHub issue for security vulnerabilities.**
+
+Please report security issues responsibly via:
+**<https://security.owncloud.com>**
+
+You can also report vulnerabilities through our YesWeHack bug bounty program:
+**<https://yeswehack.com/programs/owncloud-bug-bounty-program>**

SUPPORT.md

@@ -0,0 +1,10 @@
+# Support
+
+For support with this project, please use the following channels:
+
+- **Enterprise Support**: <https://owncloud.com/contact-us/>
+- **Community discussions**: https://github.com/orgs/owncloud/discussions
+- **Matrix Chat**: <https://app.element.io/#/room/#owncloud:matrix.org>
+- **Documentation**: <https://doc.owncloud.com>
+
+Please do not use GitHub issues for general support questions.

agents.md

@@ -0,0 +1,51 @@
+# agents.md -- ownBuild
+
+## Repository Overview
+
+Archived/legacy Python helper script for setting up a KDE Craft build environment for the ownCloud Desktop Client (2.7+). Licensed under BSD-2-Clause.
+
+## Architecture & Key Paths
+
+- `ownbuild.py` -- Main build script
+
+## Development Conventions
+
+- Single Python script
+- Uses KDE Craft as the underlying build system
+
+## Build & Test Commands
+
+```bash
+python3 ownbuild.py owncloud-client                   # Build client
+python3 ownbuild.py --branch 5 -- owncloud-client     # Build specific branch
+```
+
+## Important Constraints
+
+- Licensed under BSD-2-Clause. The OSPO target is Apache 2.0.
+- Archived/legacy -- no active development expected.
+- All contributions require a DCO sign-off.
+- Do not introduce new **copyleft-licensed dependencies** (GPL, AGPL, LGPL, MPL) without explicit discussion in an issue first. This is especially important for repos that are migrating to or already under Apache 2.0, as copyleft dependencies would block or complicate that migration.
+
+
+## OSPO Policy Constraints
+
+### GitHub Actions
+- **Only** use actions owned by `owncloud`, created by GitHub (`actions/*`), verified on the GitHub Marketplace, or verified by the ownCloud Maintainers.
+- Pin all actions to their full commit SHA (not tags): `uses: actions/checkout@<SHA> # vX.Y.Z`
+- Never introduce actions from unverified third parties.
+
+### Dependency Management
+- Dependabot is configured for automated dependency updates.
+- Review and merge Dependabot PRs as part of regular maintenance.
+- Do not introduce new dependencies without discussion in an issue first.
+
+### Git Workflow
+- **Rebase policy**: Always rebase; never create merge commits. Use `git pull --rebase` and `git rebase` before pushing.
+- **Signed commits**: All commits **must** be PGP/GPG signed (`git commit -S -s`).
+- **DCO sign-off**: Every commit needs a `Signed-off-by` line (`git commit -s`).
+- **Conventional Commits & Squash Merge**: Use the [Conventional Commits](https://www.conventionalcommits.org/) format where the repository enforces it. Many repos use squash merge, where the PR title becomes the commit message on the default branch — apply Conventional Commits format to PR titles as well. A reusable GitHub Actions workflow enforces this.
+
+## Context for AI Agents
+
+This is a single-file Python utility. It wraps KDE Craft to automate building the ownCloud Desktop Client. The script handles platform detection and dependency resolution.