docs(ospo): community health rollout v2 — README, agents.md, health files

CODE_OF_CONDUCT.md

@@ -0,0 +1,8 @@
+# Code of Conduct
+
+This project follows the ownCloud Code of Conduct.
+
+Please read the full Code of Conduct at:
+**<https://owncloud.com/contribute/code-of-conduct/>**
+
+By participating in this project, you agree to abide by its terms.

CONTRIBUTING.md

@@ -0,0 +1,9 @@
+# Contributing
+
+Thank you for your interest in contributing to this project!
+
+Please read the full contributing guidelines at:
+**<https://owncloud.com/contribute/>**
+
+For development setup, coding standards, and pull request process,
+see the README in this repository.

README.md

@@ -1,47 +1,103 @@
-# ownCloud cloud testing toolbox
+# cdperf
 
-This repository contains the tools we use to test and measure the performance of different cloud systems.
+<!-- OSPO-managed README | Generated: 2026-04-16 | v2 -->
 
-For detailed information how to run and write new tests, please read [the cdperf documentation](https://owncloud.dev/cdperf/).
+[![License](https://img.shields.io/badge/License-Apache--2.0-blue.svg)](LICENSE) [![ownCloud OSPO](https://img.shields.io/badge/OSPO-ownCloud-blue)](https://kiteworks.com/opensource) [![Docker Hub](https://img.shields.io/docker/pulls/owncloud)](https://hub.docker.com/r/owncloud/ocis)
 
-## Supported clouds
-* [ownCloud Core](https://github.com/owncloud/core)
-* [Infinite Scale](https://github.com/owncloud/ocis)
-* [Nextcloud](https://github.com/nextcloud/server/)
+cdperf (cloud performance) is a testing toolbox for measuring and benchmarking the performance of different cloud storage systems. It uses [k6](https://k6.io/) as the load testing engine and provides a test development kit (k6-tdk) along with ready-to-use test suites. The toolbox supports testing against ownCloud Infinite Scale (oCIS), ownCloud Server (Classic/OC10), and Nextcloud.
 
-## Package Index
+## Part of oCIS
 
-* [k6-tdk](packages/k6-tdk): Test development kit, look here how to write tests.
-* [k6-tests](packages/k6-tests): Ready to use k6 tests, If you want to start testing right away, look here.
-* [eslint-config](packages/eslint-config): ESLint config shared across the packages, not public facing.
-* [tsconfig](packages/tsconfig): TypeScript config shared across the packages, not public facing.
-* [turbowatch](packages/turbowatch): Turbowatch config shared across the packages, not public facing.
+cdperf is part of the [ownCloud Infinite Scale (oCIS)](https://github.com/owncloud/ocis) ecosystem and is used for continuous performance testing. See the [oCIS documentation](https://owncloud.dev) for more information.
 
-## Security
+This component is part of the [oCIS Docker image](https://hub.docker.com/r/owncloud/ocis).
 
-If you find a security issue please contact [security@owncloud.com](mailto:security@owncloud.com) first
+## Getting Started
 
-## Contributing
+Follow the steps below to build and run performance tests.
 
-Fork -> Patch -> Push -> Pull Request
+### Prerequisites
+
+- [pnpm](https://pnpm.io/) package manager
 
 ### Building
 
-- You need pnpm
-- Run `pnpm install`
-- Run `pnpm build`
+```bash
+pnpm install
+pnpm build
+```
+
+### Running Tests
+
+```bash
+pnpm test
+```
+
+### Package Index
+
+- [k6-tdk](packages/k6-tdk) - Test development kit for writing k6 performance tests
+- [k6-tests](packages/k6-tests) - Ready-to-use k6 test suites
+- [eslint-config](packages/eslint-config) - Shared ESLint configuration
+- [tsconfig](packages/tsconfig) - Shared TypeScript configuration
+- [turbowatch](packages/turbowatch) - Shared Turbowatch configuration
+
+## Documentation
+
+- [cdperf documentation](https://owncloud.dev/cdperf/)
+- [k6 documentation](https://k6.io/docs/)
+
+## Community & Support
+
+**[Star](https://github.com/owncloud/cdperf)** this repo and **Watch** for release notifications!
+
+- [ownCloud Website](https://owncloud.com)
+- [Community Discussions](https://github.com/orgs/owncloud/discussions)
+- [Matrix Chat](https://app.element.io/#/room/#owncloud:matrix.org)
+- [Documentation](https://doc.owncloud.com)
+- [Enterprise Support](https://owncloud.com/contact-us/)
+- [OSPO Home](https://kiteworks.com/opensource)
+
+## Contributing
+
+We welcome contributions! Please read the [Contributing Guidelines](CONTRIBUTING.md)
+and our [Code of Conduct](CODE_OF_CONDUCT.md) before getting started.
+
+### Workflow
+
+- **Rebase Early, Rebase Often!** We use a rebase workflow. Always rebase on the target branch before submitting a PR.
+- **Dependabot**: Automated dependency updates are managed via Dependabot. Review and merge dependency PRs promptly.
+- **Signed Commits**: All commits **must** be PGP/GPG signed. See [GitHub's signing guide](https://docs.github.com/en/authentication/managing-commit-signature-verification).
+- **DCO Sign-off**: Every commit must carry a `Signed-off-by` line:
+  ```
+  git commit -s -S -m "your commit message"
+  ```
+- **GitHub Actions Policy**: Workflows may only use actions that are (a) owned by `owncloud`, (b) created by GitHub (`actions/*`), or (c) verified in the GitHub Marketplace.
+
+## Security
+
+**Do not open a public GitHub issue for security vulnerabilities.**
+
+Report vulnerabilities at **<https://security.owncloud.com>** -- see [SECURITY.md](SECURITY.md).
+
+Bug bounty: [YesWeHack ownCloud Program](https://yeswehack.com/programs/owncloud-bug-bounty-program)
 
 ## License
 
-Apache-2.0
+This project is licensed under the [Apache-2.0](LICENSE).
 
-## Dictonary
+## About the ownCloud OSPO
 
-* **oCis**: [ownCloud Infinite Scale](https://github.com/owncloud/ocis)
-* **k6-tdk**: k6 test development kit
-* **cdPerf**: cloud performance
+The [Kiteworks Open Source Program Office](https://kiteworks.com/opensource), operating under
+the [ownCloud](https://owncloud.com) brand, launched on May 5, 2026, to steward the open source
+ecosystem around ownCloud's products. The OSPO ensures transparent governance, license compliance,
+community health, and sustainable collaboration between the open source community and
+[Kiteworks](https://www.kiteworks.com), which acquired ownCloud in 2023.
 
-## Copyright
-```console
-Copyright (c) 2023 ownCloud GmbH <https://owncloud.com>
-```
+- **OSPO Home**: <https://kiteworks.com/opensource>
+- **GitHub**: <https://github.com/owncloud>
+- **ownCloud**: <https://owncloud.com>
+
+For questions about the OSPO or licensing, contact ospo@kiteworks.com.
+
+> **License status:** This repository is already licensed under Apache-2.0 -- the OSPO target license.
+> No migration is required.

SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+**Do NOT open a public GitHub issue for security vulnerabilities.**
+
+Please report security issues responsibly via:
+**<https://security.owncloud.com>**
+
+You can also report vulnerabilities through our YesWeHack bug bounty program:
+**<https://yeswehack.com/programs/owncloud-bug-bounty-program>**

SUPPORT.md

@@ -0,0 +1,10 @@
+# Support
+
+For support with this project, please use the following channels:
+
+- **Enterprise Support**: <https://owncloud.com/contact-us/>
+- **Community discussions**: https://github.com/orgs/owncloud/discussions
+- **Matrix Chat**: <https://app.element.io/#/room/#owncloud:matrix.org>
+- **Documentation**: <https://doc.owncloud.com>
+
+Please do not use GitHub issues for general support questions.

agents.md

@@ -0,0 +1,86 @@
+# AI Agent Guidelines for cdperf
+
+This file provides context for AI coding agents (Claude Code, GitHub Copilot, Cursor, etc.) working in this repository.
+
+## Repository Overview
+- **Product family:** oCIS
+- **Primary language(s):** TypeScript
+- **Build system:** pnpm, Turbo (monorepo)
+- **Test framework:** Turbo test runner
+- **CI system:** GitHub Actions
+
+## Architecture & Key Paths
+- `packages/k6-tdk/` - k6 test development kit
+- `packages/k6-tests/` - Ready-to-use k6 performance tests
+- `packages/eslint-config/` - Shared ESLint configuration
+- `packages/tsconfig/` - Shared TypeScript configuration
+- `packages/turbowatch/` - Shared Turbowatch configuration
+- `docs/` - Documentation (VitePress)
+- `package.json` - Root package definition
+- `pnpm-workspace.yaml` - pnpm workspace configuration
+- `pnpm-lock.yaml` - Lockfile
+- `turbo.json` - Turbo monorepo configuration
+
+## Development Conventions
+- **Branching:** main
+- **Commit messages:** DCO sign-off required (`git commit -s`)
+- **Code style:** ESLint, Prettier
+- **PR process:** Open a PR against main. All CI checks must pass.
+
+## Build & Test Commands
+```bash
+# Install dependencies
+pnpm install
+
+# Build
+pnpm build
+
+# Test
+pnpm test
+
+# Lint
+pnpm lint
+
+# Fix lint issues
+pnpm lint:fix
+
+# Development mode
+pnpm dev
+
+# Documentation (dev server)
+pnpm docs:dev
+```
+
+## Important Constraints
+- All code contributions must be compatible with the **Apache-2.0** license
+- Do not introduce new **copyleft-licensed dependencies** (GPL, AGPL, LGPL, MPL) without explicit discussion in an issue first. This is especially important for repos migrating to Apache 2.0.
+- Do not introduce new dependencies without discussion in an issue first
+- This is a pnpm workspace monorepo - respect package boundaries
+- Performance tests target k6 - follow k6 patterns and APIs
+
+
+## OSPO Policy Constraints
+
+### GitHub Actions
+- **Only** use actions owned by `owncloud`, created by GitHub (`actions/*`), verified on the GitHub Marketplace, or verified by the ownCloud Maintainers.
+- Pin all actions to their full commit SHA (not tags): `uses: actions/checkout@<SHA> # vX.Y.Z`
+- Never introduce actions from unverified third parties.
+
+### Dependency Management
+- Dependabot is configured for automated dependency updates.
+- Review and merge Dependabot PRs as part of regular maintenance.
+- Do not introduce new dependencies without discussion in an issue first.
+
+### Git Workflow
+- **Rebase policy**: Always rebase; never create merge commits. Use `git pull --rebase` and `git rebase` before pushing.
+- **Signed commits**: All commits **must** be PGP/GPG signed (`git commit -S -s`).
+- **DCO sign-off**: Every commit needs a `Signed-off-by` line (`git commit -s`).
+- **Conventional Commits & Squash Merge**: Use the [Conventional Commits](https://www.conventionalcommits.org/) format where the repository enforces it. Many repos use squash merge, where the PR title becomes the commit message on the default branch — apply Conventional Commits format to PR titles as well. A reusable GitHub Actions workflow enforces this.
+
+## Context for AI Agents
+- Match existing code style
+- Do not refactor unrelated code in the same PR
+- Write tests for new functionality
+- Keep PRs focused and atomic
+- This is a monorepo - changes should be scoped to the relevant package
+- Follow existing k6 test patterns when adding new performance tests