docs: prepare community contribution paths

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,40 @@
+name: Bug report
+description: Report incorrect or unsafe release-kit behavior.
+title: "[bug] "
+labels:
+  - bug
+body:
+  - type: dropdown
+    id: stack
+    attributes:
+      label: Affected workflow
+      options:
+        - Node.js / TypeScript
+        - Python
+        - Go
+        - Terraform / IaC
+        - Minimal announcement
+        - Onboarding or secret setup
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: behavior
+    attributes:
+      label: What happened?
+      description: Include sanitized logs and the expected behavior. Never paste credentials.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction steps
+    validations:
+      required: true
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Safety check
+      options:
+        - label: I removed tokens, webhook secrets, and private deployment data.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Questions and design discussion
+    url: https://github.com/bgorzelic/release-kit/discussions
+    about: Discuss a new stack, provider, or workflow before opening implementation work.
+  - name: Report a vulnerability privately
+    url: https://github.com/bgorzelic/release-kit/security/advisories/new
+    about: Do not disclose workflow-injection or credential issues publicly.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,33 @@
+name: Feature request
+description: Propose a release workflow, provider, or safety improvement.
+title: "[feature] "
+labels:
+  - enhancement
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What release problem should this solve?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+      description: Explain the trigger, gate, side effects, failure behavior, and recovery path.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+  - type: checkboxes
+    id: principles
+    attributes:
+      label: Release principles
+      options:
+        - label: The proposal keeps CI as a gate before announcements.
+          required: true
+        - label: External publishing remains opt-in.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,25 @@
+## What changed
+
+Describe the release automation change and the problem it solves.
+
+## Affected paths
+
+- [ ] Node.js / TypeScript
+- [ ] Python
+- [ ] Go
+- [ ] Terraform / IaC
+- [ ] Minimal announcement workflow
+- [ ] Onboarding or secret setup
+- [ ] Documentation only
+
+## Safety and verification
+
+- [ ] No credentials or production configuration are included.
+- [ ] CI remains a required gate before version changes or announcements.
+- [ ] Social publishing remains opt-in and fails without blocking the release.
+- [ ] Changed shell scripts pass ShellCheck.
+- [ ] Changed workflows pass actionlint.
+
+## Related issue
+
+Link the issue or Discussion that established the direction for this change.

CODE_OF_CONDUCT.md

@@ -0,0 +1,26 @@
+# Code of Conduct
+
+## Our pledge
+
+We pledge to make participation in release-kit welcoming and harassment-free for everyone,
+regardless of background, identity, ability, experience, or personal characteristics.
+
+## Expected behavior
+
+- Be respectful, patient, and specific.
+- Critique automation and code, not people.
+- Protect credentials and private deployment information.
+- Accept responsibility, correct mistakes, and favor safe, reversible releases.
+
+Harassment, personal attacks, deliberate intimidation, publication of another person's private
+information, and other unprofessional conduct are not acceptable.
+
+## Enforcement
+
+Report conduct concerns privately through the repository owner's contact information. Reports will
+be reviewed fairly and kept confidential where possible. Maintainers may edit or remove contributions
+or restrict participation when necessary to protect the community.
+
+## Attribution
+
+This policy is adapted from the Contributor Covenant, version 2.1.

CONTRIBUTING.md

@@ -0,0 +1,27 @@
+# Contributing to release-kit
+
+Thanks for helping make releases more repeatable. Contributions should preserve the central promise:
+a release is announced only after its declared verification gate succeeds.
+
+## Start here
+
+1. Read the architecture and onboarding documentation in `docs/`.
+2. Open an issue or Discussion before changing workflow behavior or secret handling.
+3. Branch from `main` and keep the change limited to one concern.
+4. Test changed shell scripts with ShellCheck and changed workflows with actionlint.
+
+## Safety rules
+
+- Never commit tokens, webhook secrets, signing keys, or copied production configuration.
+- Treat repository, tag, release-note, and webhook content as untrusted input.
+- Keep social posting opt-in and non-blocking.
+- Do not weaken the CI gate to make a release pass.
+- Preserve a manual recovery path when automation fails.
+
+## Pull requests
+
+Explain what changed, which stack templates are affected, and how the behavior was verified. Include a
+sample event or dry run for workflow logic where practical. Use Conventional Commits and update the
+documentation whenever contributor-facing behavior changes.
+
+Security vulnerabilities belong in a private GitHub security advisory, not a public issue.