feat: launch PreviewShield v1.0.0

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,110 @@
+name: Bug report
+description: Report reproducible incorrect behavior in PreviewShield.
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thank you for helping improve PreviewShield. Search existing issues first.
+        Do not include secrets, internal URLs, private IP addresses, or unredacted response data.
+        Security vulnerabilities belong in the private reporting channel linked below.
+
+  - type: input
+    id: version
+    attributes:
+      label: PreviewShield version
+      description: Paste the output of `previewshield --version`.
+      placeholder: PreviewShield 1.0.0
+    validations:
+      required: true
+
+  - type: dropdown
+    id: interface
+    attributes:
+      label: Interface
+      options:
+        - CLI scan
+        - CLI diff
+        - Policy validation
+        - GitHub Action
+        - Python API
+        - Reporter
+        - Packaging or installation
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: Operating system, Python version, and CI provider/runner when applicable.
+      placeholder: Ubuntu 24.04, Python 3.12, GitHub-hosted runner
+    validations:
+      required: true
+
+  - type: textarea
+    id: command
+    attributes:
+      label: Redacted command or integration
+      description: Show the smallest invocation. Replace hostnames and all secrets.
+      render: shell
+    validations:
+      required: true
+
+  - type: textarea
+    id: policy
+    attributes:
+      label: Minimal redacted policy
+      description: Include only policy fields needed to reproduce the problem.
+      render: yaml
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What result, finding, diff classification, output, or exit code did you expect?
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: What happened instead? Include the exact redacted error and exit code.
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction steps
+      description: Provide a deterministic sequence using a target you own or a local fixture.
+      placeholder: |
+        1. Create ...
+        2. Run ...
+        3. Observe ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Add sanitized logs, screenshots, or related issue links if they help.
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checklist
+      options:
+        - label: I searched existing issues for this problem.
+          required: true
+        - label: I removed credentials, customer data, and internal network details.
+          required: true
+        - label: I am authorized to scan every target used in this report.
+          required: true
+        - label: This is not a security vulnerability in PreviewShield itself.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/devUmut35/PreviewShield/security/advisories/new
+    about: Report vulnerabilities in PreviewShield privately. Do not open a public issue.
+  - name: Documentation
+    url: https://github.com/devUmut35/PreviewShield/tree/main/docs
+    about: Read setup, policy, Action, output, rule, and security-model guides.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,93 @@
+name: Feature request
+description: Propose a focused improvement, rule, integration, or report format.
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Describe the user problem before prescribing an implementation. For a new security rule,
+        include an authoritative reference, default severity rationale, and false-positive risks.
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - Security rule
+        - Policy schema
+        - Baseline comparison
+        - Network safety
+        - GitHub Action or CI
+        - Report format
+        - Python API
+        - Documentation
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What cannot be done today, and who is affected?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed outcome
+      description: Describe observable behavior, configuration, and output rather than only code.
+    validations:
+      required: true
+
+  - type: textarea
+    id: example
+    attributes:
+      label: Example
+      description: Show a safe command, policy snippet, API call, or expected finding if useful.
+      render: shell
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: How do users handle this today, and why is that insufficient?
+
+  - type: textarea
+    id: compatibility
+    attributes:
+      label: Compatibility and security considerations
+      description: Note schema, rule-ID, exit-code, network-boundary, or secret-handling impact.
+
+  - type: textarea
+    id: references
+    attributes:
+      label: References
+      description: For rules, link to OWASP, MDN, a standard, or another authoritative source.
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checklist
+      options:
+        - label: I searched existing issues and the rule catalog.
+          required: true
+        - label: This request is focused on one user problem.
+          required: true
+        - label: I have not included secrets or unauthorized target data.
+          required: true
+
+  - type: dropdown
+    id: contribution
+    attributes:
+      label: Contribution
+      description: Would you like to help implement this after design agreement?
+      options:
+        - Yes
+        - Maybe, with guidance
+        - No
+    validations:
+      required: true

.github/dependabot.yml

@@ -0,0 +1,31 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: Europe/Istanbul
+    open-pull-requests-limit: 5
+    labels: [dependencies, python]
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:15"
+      timezone: Europe/Istanbul
+    open-pull-requests-limit: 5
+    labels: [dependencies, github-actions]
+
+  - package-ecosystem: docker
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:30"
+      timezone: Europe/Istanbul
+    open-pull-requests-limit: 3
+    labels: [dependencies, docker]

.github/pull_request_template.md

@@ -0,0 +1,31 @@
+# Pull request
+
+## Summary
+
+<!-- What user problem does this change solve? Keep this focused. -->
+
+## Behavior and security impact
+
+<!-- Describe observable behavior and any policy, rule-ID, schema, exit-code, network, secret,
+or compatibility impact. Write "None" where appropriate. -->
+
+## Validation
+
+<!-- List the exact checks you ran and relevant results. -->
+
+- [ ] `python -m ruff format --check .`
+- [ ] `python -m ruff check .`
+- [ ] `python -m mypy`
+- [ ] `python -m bandit -c pyproject.toml -r src`
+- [ ] `python -m pytest`
+
+## Checklist
+
+- [ ] The change is focused and linked to an issue when design discussion was needed.
+- [ ] Tests cover new behavior, edge cases, and failure paths.
+- [ ] Documentation and `CHANGELOG.md` reflect user-visible changes.
+- [ ] Stable rule IDs, JSON schema, SARIF fingerprints, and exit codes remain compatible, or the
+      breaking impact is explicitly justified.
+- [ ] Examples, fixtures, logs, and reports contain no credentials or unauthorized target data.
+- [ ] Network or renderer changes include adversarial tests for the affected trust boundary.
+- [ ] I have read and agree to follow the [Code of Conduct](../CODE_OF_CONDUCT.md).

.github/workflows/action-test.yml

@@ -0,0 +1,70 @@
+name: Docker Action Test
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - action.yml
+      - Dockerfile
+      - pyproject.toml
+      - "src/**"
+      - ".github/workflows/action-test.yml"
+  pull_request:
+    branches: [main]
+    paths:
+      - action.yml
+      - Dockerfile
+      - pyproject.toml
+      - "src/**"
+      - ".github/workflows/action-test.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: action-test-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  docker-action:
+    name: Build and exercise Docker action
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      # Local development does not require Docker; this job is the canonical
+      # Dockerfile validation on the same runner type used by consumers.
+      - name: Build container image
+        run: docker build --tag previewshield-action:test .
+      - name: Scan a public fixture
+        id: scan
+        uses: ./
+        with:
+          target: https://example.com
+          paths: /
+          fail-on: critical
+          format: json
+          output: previewshield-action-report.json
+      - name: Verify reports and outputs
+        env:
+          REPORT_PATH: ${{ steps.scan.outputs.report }}
+          SCORE: ${{ steps.scan.outputs.score }}
+          GRADE: ${{ steps.scan.outputs.grade }}
+          PASSED: ${{ steps.scan.outputs.passed }}
+        run: |
+          python - <<'PY'
+          import os
+          from pathlib import Path
+
+          report = Path(os.environ["REPORT_PATH"])
+          if not report.is_file():
+              raise SystemExit(f"Missing action report: {report}")
+          if not os.environ["SCORE"] or not os.environ["GRADE"]:
+              raise SystemExit("Action did not publish score and grade outputs")
+          if os.environ["PASSED"] not in {"true", "false"}:
+              raise SystemExit("Action published an invalid passed output")
+          PY