diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index 3d88be1..8b786d8 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -5,7 +5,7 @@ labels: ["bug"] body: - type: markdown attributes: - value: Do not include invite links, tokens, passwords, private roadmap data, or vulnerabilities. + value: Do not include credentials, invite links, tokens, passwords, private roadmap data, or vulnerabilities. Report security vulnerabilities privately through the security contact below. - type: textarea id: summary attributes: @@ -18,6 +18,12 @@ body: label: Reproduction steps validations: required: true + - type: textarea + id: actual + attributes: + label: Actual behavior + validations: + required: true - type: textarea id: expected attributes: @@ -28,11 +34,27 @@ body: id: environment attributes: label: Environment - description: Browser, OS, deployment mode, and commit/version. + description: Include only what is relevant, such as browser, OS, deployment mode, and RoadForge version or commit. + validations: + required: true + - type: textarea + id: screenshots_logs + attributes: + label: Screenshots or logs + description: Optional. Remove any sensitive data before sharing. + - type: textarea + id: regression + attributes: + label: Regression information + description: Optional. Did this work previously, and if known, which version or commit changed it? - type: checkboxes - id: security + id: report_checks attributes: - label: Security check + label: Report checks options: + - label: This report contains no credentials or private roadmap data. + required: true - label: This report does not contain a security vulnerability. required: true + validations: + required: true diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml index 3699464..3b9846c 100644 --- a/.github/ISSUE_TEMPLATE/feature_request.yml +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -16,14 +16,46 @@ body: label: Desired outcome validations: required: true + - type: textarea + id: beneficiaries + attributes: + label: Who benefits + description: Which RoadForge users or workflows would benefit? + validations: + required: true + - type: textarea + id: workaround + attributes: + label: Current workaround + description: How do you handle this today? Optional. + - type: textarea + id: behavior + attributes: + label: Proposed behavior + description: Optional. Describe the desired behavior without assuming a specific implementation. - type: dropdown id: scope attributes: label: Scope options: - - Accountless beta - - Self-hosting - - Future accounts/workspaces - - Integrations and automation + - Roadmap planning + - Tasks, phases, tags, and dependencies + - Collaboration and sharing + - Import and export + - Accessibility and responsive UX + - Self-hosting and deployment + - Documentation and contributor experience + - Other validations: required: true + - type: textarea + id: alternatives + attributes: + label: Alternatives considered + description: Optional. What other approaches or workflows did you consider? + - type: checkboxes + id: contribution + attributes: + label: Contribution + options: + - label: I am willing to contribute this change. diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md deleted file mode 100644 index 29fc59e..0000000 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ /dev/null @@ -1,19 +0,0 @@ -## Summary - -## Behavior and risk - -## Validation - -- [ ] Focused tests -- [ ] Lint/typecheck -- [ ] Build -- [ ] Migration checks, if applicable -- [ ] Manual QA - -List anything not run and why. - -## Safety - -- [ ] No secrets, real invite URLs, private roadmap data, logs, or generated output -- [ ] Docs and environment examples updated when behavior changed -- [ ] Backward compatibility or migration path reviewed diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 0000000..c761dab --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,34 @@ +## Summary + + + +## Why this change is needed + + + +## Changes + + + +## Validation + + + +## Risk and compatibility + + + +## Screenshots + + + +## Checklist + +- [ ] This change is focused and avoids unrelated cleanup. +- [ ] Relevant tests were added or updated, or this is not applicable. +- [ ] Applicable automated checks were run, or the unrun checks are explained above. +- [ ] Manual QA was performed when behavior or UI changed, or this is not applicable. +- [ ] Documentation was updated when contracts or behavior changed, or this is not applicable. +- [ ] No credentials, invite links, tokens, passwords, private roadmaps, or generated artifacts were committed. +- [ ] Backward compatibility for portable roadmap imports is preserved or explicitly handled. +- [ ] Security-sensitive changes were reviewed carefully, or this is not applicable. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 82b01fa..0edc108 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -8,10 +8,17 @@ license; commercial use is not granted by contributing. - Read `README.md` and the relevant architecture, API, security, or QA documentation. - Keep changes small, reviewable, and focused on one behavior. -- Open an issue before broad feature work, schema redesign, authentication changes, - or deployment architecture changes. -- Never include real invite links, session tokens, passwords, private roadmaps, or - production data. +- Open an issue before implementing a feature, broad refactor, schema redesign, + authentication change, or deployment architecture change. Small bug fixes and + documentation corrections can go directly to a pull request. +- Never include credentials, invite links, session tokens, passwords, private + roadmaps, production data, or local tooling artifacts. + +## Issues and security + +- [Report a bug](../../issues/new?template=bug_report.yml) with reproducible details. +- [Request a feature](../../issues/new?template=feature_request.yml) around a focused user problem. +- Report vulnerabilities privately through [GitHub security advisories](../../security/advisories/new), not a public issue. ## Development @@ -29,7 +36,7 @@ when a validation step was not run and why. ## Pull requests -- Explain the user-visible behavior and risk. +- Use the [pull request template](.github/pull_request_template.md) and explain the user-visible behavior and risk. - List changed contracts, migrations, environment variables, and documentation. - Include focused tests for bug fixes and shared behavior. - Preserve backward compatibility for roadmap imports unless the change includes an @@ -37,4 +44,5 @@ when a validation step was not run and why. - Do not commit generated build output, local databases, logs, private planning material, or secrets. -Security issues must follow `SECURITY.md`, not a public issue. +Public contributions are accepted under the repository's [PolyForm Noncommercial License 1.0.0](LICENSE). +Security issues must follow [SECURITY.md](SECURITY.md), not a public issue.