From 0cba73eb790819e4e1e816b2db57a3c37af24637 Mon Sep 17 00:00:00 2001
From: Steven Welch <steven@makeitwork.cloud>
Date: Sun, 30 Aug 2026 15:49:58 -0600
Subject: [PATCH] Add organization-wide default pull request template

Adds .github/PULL_REQUEST_TEMPLATE.md so every makeitworkcloud
repository without its own template inherits a consistent default:
summary, type of change, CI-based validation, cross-repo impact and
rollout notes, and a secrets/OpenTofu safety checklist.

Individual repositories can override this by adding their own
pull_request_template.md.
---
 .github/PULL_REQUEST_TEMPLATE.md | 50 ++++++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 .github/PULL_REQUEST_TEMPLATE.md

diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..ea94551
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,50 @@
+<!--
+Thanks for the pull request! Fill in the sections that apply and delete the rest.
+Anything inside HTML comments is stripped from the rendered PR.
+-->
+
+## Summary
+
+<!-- What does this change do, and why? Link the driving issue or discussion. -->
+
+Fixes #
+
+## Type of change
+
+- [ ] Bug fix
+- [ ] Feature / enhancement
+- [ ] Documentation
+- [ ] Infrastructure (OpenTofu root or module)
+- [ ] GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
+- [ ] Container image
+- [ ] CI / reusable workflow
+- [ ] Refactor / cleanup
+- [ ] Breaking change
+
+## Validation
+
+<!--
+CI is the validation environment. Link the passing checks and state what they prove.
+Call out anything intentionally not validated here.
+-->
+
+- [ ] Required pull-request checks pass
+- [ ] Generated or centrally distributed files were regenerated by their owning automation, not hand-edited
+
+## Impact and rollout
+
+<!--
+Cross-repository or runtime impact: producers/consumers, version pins, chart or image
+publication, Argo CD reconciliation, follow-up verification. Write "None" for
+self-contained changes.
+-->
+
+## Safety and secrets
+
+- [ ] Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
+- [ ] No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
+- [ ] Breaking or irreversible effects are described above with rollback notes
+
+<!--
+If an AI agent materially produced this change, disclose it here so reviewers can calibrate scrutiny.
+-->