diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml new file mode 100644 index 0000000..79b7ddd --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -0,0 +1,40 @@ +name: Bug report +description: Report incorrect or unsafe release-kit behavior. +title: "[bug] " +labels: + - bug +body: + - type: dropdown + id: stack + attributes: + label: Affected workflow + options: + - Node.js / TypeScript + - Python + - Go + - Terraform / IaC + - Minimal announcement + - Onboarding or secret setup + - Other + validations: + required: true + - type: textarea + id: behavior + attributes: + label: What happened? + description: Include sanitized logs and the expected behavior. Never paste credentials. + validations: + required: true + - type: textarea + id: reproduce + attributes: + label: Reproduction steps + validations: + required: true + - type: checkboxes + id: safety + attributes: + label: Safety check + options: + - label: I removed tokens, webhook secrets, and private deployment data. + required: true diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..a017cf7 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,8 @@ +blank_issues_enabled: false +contact_links: + - name: Questions and design discussion + url: https://github.com/bgorzelic/release-kit/discussions + about: Discuss a new stack, provider, or workflow before opening implementation work. + - name: Report a vulnerability privately + url: https://github.com/bgorzelic/release-kit/security/advisories/new + about: Do not disclose workflow-injection or credential issues publicly. diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml new file mode 100644 index 0000000..865199c --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -0,0 +1,33 @@ +name: Feature request +description: Propose a release workflow, provider, or safety improvement. +title: "[feature] " +labels: + - enhancement +body: + - type: textarea + id: problem + attributes: + label: Problem + description: What release problem should this solve? + validations: + required: true + - type: textarea + id: proposal + attributes: + label: Proposed behavior + description: Explain the trigger, gate, side effects, failure behavior, and recovery path. + validations: + required: true + - type: textarea + id: alternatives + attributes: + label: Alternatives considered + - type: checkboxes + id: principles + attributes: + label: Release principles + options: + - label: The proposal keeps CI as a gate before announcements. + required: true + - label: External publishing remains opt-in. + required: true diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..e12d265 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,25 @@ +## What changed + +Describe the release automation change and the problem it solves. + +## Affected paths + +- [ ] Node.js / TypeScript +- [ ] Python +- [ ] Go +- [ ] Terraform / IaC +- [ ] Minimal announcement workflow +- [ ] Onboarding or secret setup +- [ ] Documentation only + +## Safety and verification + +- [ ] No credentials or production configuration are included. +- [ ] CI remains a required gate before version changes or announcements. +- [ ] Social publishing remains opt-in and fails without blocking the release. +- [ ] Changed shell scripts pass ShellCheck. +- [ ] Changed workflows pass actionlint. + +## Related issue + +Link the issue or Discussion that established the direction for this change. diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..4b0f0c6 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,26 @@ +# Code of Conduct + +## Our pledge + +We pledge to make participation in release-kit welcoming and harassment-free for everyone, +regardless of background, identity, ability, experience, or personal characteristics. + +## Expected behavior + +- Be respectful, patient, and specific. +- Critique automation and code, not people. +- Protect credentials and private deployment information. +- Accept responsibility, correct mistakes, and favor safe, reversible releases. + +Harassment, personal attacks, deliberate intimidation, publication of another person's private +information, and other unprofessional conduct are not acceptable. + +## Enforcement + +Report conduct concerns privately through the repository owner's contact information. Reports will +be reviewed fairly and kept confidential where possible. Maintainers may edit or remove contributions +or restrict participation when necessary to protect the community. + +## Attribution + +This policy is adapted from the Contributor Covenant, version 2.1. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..e961eef --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,27 @@ +# Contributing to release-kit + +Thanks for helping make releases more repeatable. Contributions should preserve the central promise: +a release is announced only after its declared verification gate succeeds. + +## Start here + +1. Read the architecture and onboarding documentation in `docs/`. +2. Open an issue or Discussion before changing workflow behavior or secret handling. +3. Branch from `main` and keep the change limited to one concern. +4. Test changed shell scripts with ShellCheck and changed workflows with actionlint. + +## Safety rules + +- Never commit tokens, webhook secrets, signing keys, or copied production configuration. +- Treat repository, tag, release-note, and webhook content as untrusted input. +- Keep social posting opt-in and non-blocking. +- Do not weaken the CI gate to make a release pass. +- Preserve a manual recovery path when automation fails. + +## Pull requests + +Explain what changed, which stack templates are affected, and how the behavior was verified. Include a +sample event or dry run for workflow logic where practical. Use Conventional Commits and update the +documentation whenever contributor-facing behavior changes. + +Security vulnerabilities belong in a private GitHub security advisory, not a public issue.