From 5e376541bf54df10a924d829393fc8af7c4828d4 Mon Sep 17 00:00:00 2001
From: Ruben Romero Montes <rromerom@redhat.com>
Date: Thu, 9 Jul 2026 11:20:41 +0200
Subject: [PATCH] docs(templates): add canonical security matrix template

Captures the required structure (sections, table columns, placeholder
rows) shared by all security-matrix-*.md files so new version streams
can be scaffolded consistently and the triage-security skill can
validate existing matrices against a known-good format.

Refs: TC-5135
Assisted-by: Claude Code
---
 docs/templates/security-matrix.template.md | 49 ++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 docs/templates/security-matrix.template.md

diff --git a/docs/templates/security-matrix.template.md b/docs/templates/security-matrix.template.md
new file mode 100644
index 00000000..e1a877fb
--- /dev/null
+++ b/docs/templates/security-matrix.template.md
@@ -0,0 +1,49 @@
+# Security Matrix — {stream} Stream
+
+<!-- Canonical template for security matrix files. Copy this file to the path
+     specified in your Security Configuration's Version Streams table
+     (e.g., docs/security-matrix-2.2.x.md) and replace placeholders with
+     concrete values. The triage-security skill validates existing matrices
+     against this structure. -->
+
+## Version Stream
+
+<!-- Identifies which product version stream this matrix covers. -->
+
+This Konflux release repo covers the **{stream}** product version stream.
+
+## Supportability Matrix
+
+<!-- One row per product version built from this release stream.
+     trustify and trustify-ui columns contain the tag or commit hash
+     pinned in the Konflux build. -->
+
+| RHTPA Version | Build | Build Date | trustify | trustify-ui | Notes |
+|---|---|---|---|---|---|
+| {version} | {build} | {build-date} | `{trustify-ref}` | `{trustify-ui-ref}` | |
+
+### Source Pinning Method
+
+<!-- How each source repository's commit or tag is pinned in the Konflux
+     release repo. Common methods: git submodule, artifacts.lock.yaml,
+     or tag reference in a build config file. -->
+
+- **trustify**: {trustify-pinning-method}
+- **trustify-ui**: {trustify-ui-pinning-method}
+
+## Ecosystem Mappings
+
+<!-- Maps each dependency ecosystem to its lock file and inspection command.
+     Used by triage-security to check whether a specific package version
+     is present in a given product build. -->
+
+| Ecosystem | Repository | Lock File | Check Command | Upstream Branch |
+|---|---|---|---|---|
+| {ecosystem} | {repository} | `{lock-file}` | `{check-command}` | `{upstream-branch}` |
+
+## Forward Pointer
+
+<!-- Points to the next version stream's matrix, or "None" for the latest
+     development stream. Helps navigation across streams. -->
+
+{forward-pointer}