Launch hardened Mighty public status page

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Public status configuration, workflows, and incident process
+* @masterfung

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1,11 @@
-blank_issues_enabled: true
+blank_issues_enabled: false
 contact_links:
-  - name: Feature requests and ideas
-    url: https://github.com/orgs/upptime/discussions/new?category=ideas
-    about: Suggest an idea for this project
-  - name: Questions
-    url: https://github.com/orgs/upptime/discussions/new?category=q-a
-    about: Please ask and answer questions here
+  - name: Report a Mighty service problem
+    url: mailto:hi@trymighty.ai
+    about: Contact Mighty support if a problem is not already shown on the status page.
+  - name: Report a security vulnerability privately
+    url: https://github.com/TryMightyAI/status/security/advisories/new
+    about: Do not disclose security vulnerabilities in a public status issue.
+  - name: Upptime project support
+    url: https://github.com/upptime/upptime/issues
+    about: Report bugs in the upstream status-page software to Upptime.

.github/ISSUE_TEMPLATE/scheduled-maintenance.md

@@ -0,0 +1,41 @@
+---
+name: Scheduled maintenance
+about: Announce customer-impacting maintenance or a risky production push
+title: "[Scheduled Maintenance] "
+labels: maintenance
+assignees: ""
+---
+
+> **Required:** Replace both 2000 timestamps with the approved UTC start/end.
+> List only genuinely affected slugs after `expectedDown` or
+> `expectedDegraded`; leave the value empty when that impact is not expected.
+
+<!--
+start: 2000-01-01T00:00:00Z
+end: 2000-01-01T00:30:00Z
+expectedDown:
+expectedDegraded:
+-->
+
+Valid component slugs: `website`, `api`, `scan-gateway`.
+
+## Summary
+
+What work is happening, and why is a public notice appropriate?
+
+## Expected customer impact
+
+Describe affected capabilities, regions if relevant, and whether interruption
+or degraded performance is expected. Do not include sensitive implementation
+details.
+
+## Update plan
+
+State where and when the next update will appear.
+
+## Operator checklist
+
+- [ ] Approved start/end times are in UTC and replace the 2000 placeholders.
+- [ ] Affected component slugs are accurate.
+- [ ] Change/rollback owner and approval exist in the private change record.
+- [ ] Security/privacy/legal review is complete if the notice needs it.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,13 @@
+## Summary
+
+## Status-page risk
+
+- [ ] This change does not make a new SLA, compliance, or availability claim.
+- [ ] Public text contains no customer data, secrets, or exploitable details.
+- [ ] Monitor/component changes were tested from outside the Mighty stack.
+- [ ] Workflow actions remain pinned to full commit SHAs.
+- [ ] `ruby scripts/validate.rb` passes.
+
+## Deployment and rollback
+
+Describe how the static page will be verified and how this change can be reverted.

.github/workflows/response-time.yml

@@ -1,44 +1,38 @@
-#
-# ===============================
-# Do not edit this file directly!
-# ===============================
-#
-# Your changes will be overwritten when the Upptime template updates (by default, weekly)
-# Instead, change .upptimerc.yml configuration and the workflows will be generated accordingly.
-#
-# 🔼 Upptime @v1.43.13
-# GitHub-powered open-source uptime monitor and status page by Anand Chowdhary
-
-# * Source: https://github.com/upptime/upptime
-# * Docs and more: https://upptime.js.org
-# * More by Anand Chowdhary: https://anandchowdhary.com
-
-
+# Hardened from Upptime v1.43.13. Review upgrades through UPSTREAM.md;
+# never replace full commit SHAs with moving tags or branches.
 name: Response Time CI
+
 on:
   schedule:
-    - cron: "0 23 * * *"
-  repository_dispatch:
-    types: [response_time]
+    - cron: "43 23 * * *"
   workflow_dispatch:
+
+permissions:
+  contents: read
+
 concurrency:
-  group: ${{ github.repository }}-${{ github.head_ref || github.ref_name }}-upptime
+  group: ${{ github.repository }}-upptime-main-writer
   cancel-in-progress: false
+
 jobs:
   release:
-    name: Check status
+    permissions:
+      contents: write
+      issues: write
+    name: Record response time
+    if: github.ref == 'refs/heads/main' && vars.STATUS_AUTOMATION_ENABLED == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
-          ref: ${{ github.head_ref || github.ref_name }}
-          token: ${{ secrets.GH_PAT || github.token }}
-      - name: Update response time
-        uses: upptime/uptime-monitor@v1.43.13
+          ref: main
+          token: ${{ github.token }}
+      - name: Record response time
+        uses: upptime/uptime-monitor@4fec88256b5917a2ed07a088df6e205869b424d6 # v1.43.13
         with:
-          command: "response-time"
+          command: response-time
         env:
-          GH_PAT: ${{ secrets.GH_PAT || github.token }}
-          # Configure the secret allowlist in .upptimerc.yml; do not edit this workflow directly.
-          SECRETS_CONTEXT: '{"DYNAMIC_STRING_LENGTH":${{ toJson(secrets.DYNAMIC_STRING_LENGTH) }},"GLOBALPING_TOKEN":${{ toJson(secrets.GLOBALPING_TOKEN) }},"NOTIFICATIONS_DOWN_MESSAGE":${{ toJson(secrets.NOTIFICATIONS_DOWN_MESSAGE) }},"NOTIFICATIONS_UP_MESSAGE":${{ toJson(secrets.NOTIFICATIONS_UP_MESSAGE) }},"NOTIFICATION_CUSTOM_WEBHOOK":${{ toJson(secrets.NOTIFICATION_CUSTOM_WEBHOOK) }},"NOTIFICATION_CUSTOM_WEBHOOK_URL":${{ toJson(secrets.NOTIFICATION_CUSTOM_WEBHOOK_URL) }},"NOTIFICATION_DISCORD_WEBHOOK_URL":${{ toJson(secrets.NOTIFICATION_DISCORD_WEBHOOK_URL) }},"NOTIFICATION_EMAIL":${{ toJson(secrets.NOTIFICATION_EMAIL) }},"NOTIFICATION_EMAIL_FROM":${{ toJson(secrets.NOTIFICATION_EMAIL_FROM) }},"NOTIFICATION_EMAIL_MAILGUN":${{ toJson(secrets.NOTIFICATION_EMAIL_MAILGUN) }},"NOTIFICATION_EMAIL_MAILGUN_API_KEY":${{ toJson(secrets.NOTIFICATION_EMAIL_MAILGUN_API_KEY) }},"NOTIFICATION_EMAIL_MAILGUN_DOMAIN_NAME":${{ toJson(secrets.NOTIFICATION_EMAIL_MAILGUN_DOMAIN_NAME) }},"NOTIFICATION_EMAIL_SENDGRID":${{ toJson(secrets.NOTIFICATION_EMAIL_SENDGRID) }},"NOTIFICATION_EMAIL_SENDGRID_API_KEY":${{ toJson(secrets.NOTIFICATION_EMAIL_SENDGRID_API_KEY) }},"NOTIFICATION_EMAIL_SES":${{ toJson(secrets.NOTIFICATION_EMAIL_SES) }},"NOTIFICATION_EMAIL_SES_ACCESS_KEY_ID":${{ toJson(secrets.NOTIFICATION_EMAIL_SES_ACCESS_KEY_ID) }},"NOTIFICATION_EMAIL_SES_REGION":${{ toJson(secrets.NOTIFICATION_EMAIL_SES_REGION) }},"NOTIFICATION_EMAIL_SES_SECRET_ACCESS_KEY":${{ toJson(secrets.NOTIFICATION_EMAIL_SES_SECRET_ACCESS_KEY) }},"NOTIFICATION_EMAIL_SES_SESSION_TOKEN":${{ toJson(secrets.NOTIFICATION_EMAIL_SES_SESSION_TOKEN) }},"NOTIFICATION_EMAIL_SMTP":${{ toJson(secrets.NOTIFICATION_EMAIL_SMTP) }},"NOTIFICATION_EMAIL_SMTP_HOST":${{ toJson(secrets.NOTIFICATION_EMAIL_SMTP_HOST) }},"NOTIFICATION_EMAIL_SMTP_PASSWORD":${{ toJson(secrets.NOTIFICATION_EMAIL_SMTP_PASSWORD) }},"NOTIFICATION_EMAIL_SMTP_PORT":${{ toJson(secrets.NOTIFICATION_EMAIL_SMTP_PORT) }},"NOTIFICATION_EMAIL_SMTP_USERNAME":${{ toJson(secrets.NOTIFICATION_EMAIL_SMTP_USERNAME) }},"NOTIFICATION_EMAIL_SPARKPOST":${{ toJson(secrets.NOTIFICATION_EMAIL_SPARKPOST) }},"NOTIFICATION_EMAIL_SPARKPOST_API_KEY":${{ toJson(secrets.NOTIFICATION_EMAIL_SPARKPOST_API_KEY) }},"NOTIFICATION_EMAIL_STRATEGY":${{ toJson(secrets.NOTIFICATION_EMAIL_STRATEGY) }},"NOTIFICATION_EMAIL_TO":${{ toJson(secrets.NOTIFICATION_EMAIL_TO) }},"NOTIFICATION_GOOGLE_CHAT_WEBHOOK_URL":${{ toJson(secrets.NOTIFICATION_GOOGLE_CHAT_WEBHOOK_URL) }},"NOTIFICATION_GOTIFY":${{ toJson(secrets.NOTIFICATION_GOTIFY) }},"NOTIFICATION_GOTIFY_PRIORITY":${{ toJson(secrets.NOTIFICATION_GOTIFY_PRIORITY) }},"NOTIFICATION_GOTIFY_TITLE":${{ toJson(secrets.NOTIFICATION_GOTIFY_TITLE) }},"NOTIFICATION_GOTIFY_TOKEN":${{ toJson(secrets.NOTIFICATION_GOTIFY_TOKEN) }},"NOTIFICATION_GOTIFY_URL":${{ toJson(secrets.NOTIFICATION_GOTIFY_URL) }},"NOTIFICATION_LARK":${{ toJson(secrets.NOTIFICATION_LARK) }},"NOTIFICATION_LARK_BOT_WEBHOOK":${{ toJson(secrets.NOTIFICATION_LARK_BOT_WEBHOOK) }},"NOTIFICATION_MASTODON":${{ toJson(secrets.NOTIFICATION_MASTODON) }},"NOTIFICATION_MASTODON_API_KEY":${{ toJson(secrets.NOTIFICATION_MASTODON_API_KEY) }},"NOTIFICATION_MASTODON_INSTANCE_URL":${{ toJson(secrets.NOTIFICATION_MASTODON_INSTANCE_URL) }},"NOTIFICATION_MASTODON_TOOT_VISIBILITY":${{ toJson(secrets.NOTIFICATION_MASTODON_TOOT_VISIBILITY) }},"NOTIFICATION_MISSKEY":${{ toJson(secrets.NOTIFICATION_MISSKEY) }},"NOTIFICATION_MISSKEY_API_KEY":${{ toJson(secrets.NOTIFICATION_MISSKEY_API_KEY) }},"NOTIFICATION_MISSKEY_CHAT":${{ toJson(secrets.NOTIFICATION_MISSKEY_CHAT) }},"NOTIFICATION_MISSKEY_CHAT_USER_ID":${{ toJson(secrets.NOTIFICATION_MISSKEY_CHAT_USER_ID) }},"NOTIFICATION_MISSKEY_INSTANCE_URL":${{ toJson(secrets.NOTIFICATION_MISSKEY_INSTANCE_URL) }},"NOTIFICATION_MISSKEY_NOTE":${{ toJson(secrets.NOTIFICATION_MISSKEY_NOTE) }},"NOTIFICATION_MISSKEY_NOTE_VISIBILITY":${{ toJson(secrets.NOTIFICATION_MISSKEY_NOTE_VISIBILITY) }},"NOTIFICATION_MISSKEY_NOTE_VISIBLE_USER_IDS":${{ toJson(secrets.NOTIFICATION_MISSKEY_NOTE_VISIBLE_USER_IDS) }},"NOTIFICATION_SLACK":${{ toJson(secrets.NOTIFICATION_SLACK) }},"NOTIFICATION_SLACK_STRATEGY":${{ toJson(secrets.NOTIFICATION_SLACK_STRATEGY) }},"NOTIFICATION_SLACK_WEBHOOK_URL":${{ toJson(secrets.NOTIFICATION_SLACK_WEBHOOK_URL) }},"NOTIFICATION_SMS_46ELKS":${{ toJson(secrets.NOTIFICATION_SMS_46ELKS) }},"NOTIFICATION_SMS_46ELKS_API_PASSWORD":${{ toJson(secrets.NOTIFICATION_SMS_46ELKS_API_PASSWORD) }},"NOTIFICATION_SMS_46ELKS_API_USERNAME":${{ toJson(secrets.NOTIFICATION_SMS_46ELKS_API_USERNAME) }},"NOTIFICATION_SMS_CALLR":${{ toJson(secrets.NOTIFICATION_SMS_CALLR) }},"NOTIFICATION_SMS_CALLR_LOGIN":${{ toJson(secrets.NOTIFICATION_SMS_CALLR_LOGIN) }},"NOTIFICATION_SMS_CALLR_PASSWORD":${{ toJson(secrets.NOTIFICATION_SMS_CALLR_PASSWORD) }},"NOTIFICATION_SMS_CLICKATELL":${{ toJson(secrets.NOTIFICATION_SMS_CLICKATELL) }},"NOTIFICATION_SMS_CLICKATELL_API_KEY":${{ toJson(secrets.NOTIFICATION_SMS_CLICKATELL_API_KEY) }},"NOTIFICATION_SMS_FROM":${{ toJson(secrets.NOTIFICATION_SMS_FROM) }},"NOTIFICATION_SMS_INFOBIP":${{ toJson(secrets.NOTIFICATION_SMS_INFOBIP) }},"NOTIFICATION_SMS_INFOBIP_PASSWORD":${{ toJson(secrets.NOTIFICATION_SMS_INFOBIP_PASSWORD) }},"NOTIFICATION_SMS_INFOBIP_USERNAME":${{ toJson(secrets.NOTIFICATION_SMS_INFOBIP_USERNAME) }},"NOTIFICATION_SMS_NEXMO":${{ toJson(secrets.NOTIFICATION_SMS_NEXMO) }},"NOTIFICATION_SMS_NEXMO_API_KEY":${{ toJson(secrets.NOTIFICATION_SMS_NEXMO_API_KEY) }},"NOTIFICATION_SMS_NEXMO_API_SECRET":${{ toJson(secrets.NOTIFICATION_SMS_NEXMO_API_SECRET) }},"NOTIFICATION_SMS_OVH":${{ toJson(secrets.NOTIFICATION_SMS_OVH) }},"NOTIFICATION_SMS_OVH_ACCOUNT":${{ toJson(secrets.NOTIFICATION_SMS_OVH_ACCOUNT) }},"NOTIFICATION_SMS_OVH_APP_KEY":${{ toJson(secrets.NOTIFICATION_SMS_OVH_APP_KEY) }},"NOTIFICATION_SMS_OVH_APP_SECRET":${{ toJson(secrets.NOTIFICATION_SMS_OVH_APP_SECRET) }},"NOTIFICATION_SMS_OVH_CONSUMER_KEY":${{ toJson(secrets.NOTIFICATION_SMS_OVH_CONSUMER_KEY) }},"NOTIFICATION_SMS_OVH_HOST":${{ toJson(secrets.NOTIFICATION_SMS_OVH_HOST) }},"NOTIFICATION_SMS_PLIVO":${{ toJson(secrets.NOTIFICATION_SMS_PLIVO) }},"NOTIFICATION_SMS_PLIVO_AUTH_ID":${{ toJson(secrets.NOTIFICATION_SMS_PLIVO_AUTH_ID) }},"NOTIFICATION_SMS_PLIVO_AUTH_TOKEN":${{ toJson(secrets.NOTIFICATION_SMS_PLIVO_AUTH_TOKEN) }},"NOTIFICATION_SMS_STRATEGY":${{ toJson(secrets.NOTIFICATION_SMS_STRATEGY) }},"NOTIFICATION_SMS_TO":${{ toJson(secrets.NOTIFICATION_SMS_TO) }},"NOTIFICATION_SMS_TWILIO":${{ toJson(secrets.NOTIFICATION_SMS_TWILIO) }},"NOTIFICATION_SMS_TWILIO_ACCOUNT_SID":${{ toJson(secrets.NOTIFICATION_SMS_TWILIO_ACCOUNT_SID) }},"NOTIFICATION_SMS_TWILIO_AUTH_TOKEN":${{ toJson(secrets.NOTIFICATION_SMS_TWILIO_AUTH_TOKEN) }},"NOTIFICATION_TEAMS":${{ toJson(secrets.NOTIFICATION_TEAMS) }},"NOTIFICATION_TEAMS_WEBHOOK_URL":${{ toJson(secrets.NOTIFICATION_TEAMS_WEBHOOK_URL) }},"NOTIFICATION_TELEGRAM":${{ toJson(secrets.NOTIFICATION_TELEGRAM) }},"NOTIFICATION_TELEGRAM_BOT_KEY":${{ toJson(secrets.NOTIFICATION_TELEGRAM_BOT_KEY) }},"NOTIFICATION_TELEGRAM_CHAT_ID":${{ toJson(secrets.NOTIFICATION_TELEGRAM_CHAT_ID) }},"NOTIFICATION_ZULIP_API_EMAIL":${{ toJson(secrets.NOTIFICATION_ZULIP_API_EMAIL) }},"NOTIFICATION_ZULIP_API_KEY":${{ toJson(secrets.NOTIFICATION_ZULIP_API_KEY) }},"NOTIFICATION_ZULIP_MESSAGE_URL":${{ toJson(secrets.NOTIFICATION_ZULIP_MESSAGE_URL) }},"RANDOM_MAX":${{ toJson(secrets.RANDOM_MAX) }},"RANDOM_MIN":${{ toJson(secrets.RANDOM_MIN) }},"SECRET_SITE":${{ toJson(secrets.SECRET_SITE) }},"USER_AGENT":${{ toJson(secrets.USER_AGENT) }}}'
+          GITHUB_TOKEN: ${{ github.token }}
+          SECRETS_CONTEXT: "{}"