build(deps-dev): bump coverage from 7.16.2 to 7.17.0

.env.example

@@ -1,8 +1,43 @@
 # Put real secrets in ~/.env only (NOT in this repo).
 # Copy nothing from here into tracked files.
+#
+# load_dotenv() drops any key that is not in env_config.ENV_KEYS, so a key set
+# here but absent from that allowlist is silently ignored. Every credential key
+# in this file is in that allowlist and is genuinely loaded. The process-only
+# variables are in their own marked section: they are NOT in the allowlist, so
+# they are read straight from the environment and must be exported instead.
 
 # GitHub personal access token (optional, used for release API rate limits)
 # GITHUB_TOKEN=
+# Aliases accepted: GH_TOKEN, OPENBOX_GITHUB_TOKEN
+# GH_TOKEN=
+# OPENBOX_GITHUB_TOKEN=
+
+# ---------------------------------------------------------------------
+# Process-only variables: read from the environment, NOT from a .env file.
+# load_dotenv() drops them, so set them by exporting before launch:
+#   export OPENBOX_SAFE_MODE=1
+# ---------------------------------------------------------------------
+
+# Data directory override (read at import time, so export before launch)
+# OPENBOX_DATA_DIR=
+
+# Explicit env file path, checked before the data-directory roots
+# OPENBOX_ENV_FILE=
+
+# SQLite read model (optional; self-enables at 5000+ games, explicit 0 opts out)
+# OPENBOX_ENABLE_SQLITE_READ=
+
+# Unsandboxed plugins (disables the bubblewrap sandbox entirely, even when available)
+# OPENBOX_ALLOW_UNSANDBOXED_PLUGINS=
+
+# Safe mode: disables plugin execution process-wide (library and
+# library_source hooks, before_launch/after_session, events) and the webhook
+# dispatcher, and reports safe_mode in the capabilities response
+# OPENBOX_SAFE_MODE=
+
+# Steam shortcut launcher override (executable used for Steam shortcut plans)
+# OPENBOX_EXECUTABLE=
 
 # Stripe secret key (optional, maintainers only; for scripts/create_stripe_donate_link.sh)
 # Never commit real values. Create payment links locally; only the public donate URL goes in README.
@@ -15,11 +50,41 @@
 # RetroAchievements (optional; enables RA matching and progress without the UI form)
 # RETROACHIEVEMENTS_USERNAME=
 # RETROACHIEVEMENTS_API_KEY=
+# Aliases accepted: RA_USERNAME, OPENBOX_RA_USERNAME, RA_API_KEY, OPENBOX_RA_API_KEY, RETROACHIEVEMENTS_KEY
+# RA_USERNAME=
+# OPENBOX_RA_USERNAME=
+# RA_API_KEY=
+# OPENBOX_RA_API_KEY=
+# RETROACHIEVEMENTS_KEY=
+
+# SteamGridDB artwork provider (optional; enables artwork search, apply, and bulk matching)
+# STEAMGRIDDB_API_KEY=
+# Alias accepted: OPENBOX_STEAMGRIDDB_API_KEY
+# OPENBOX_STEAMGRIDDB_API_KEY=
 
 # EmuMovies (optional; licensed account required for media downloads)
 # EMUMOVIES_USERNAME=
 # EMUMOVIES_PASSWORD=
+# Aliases accepted: OPENBOX_EMUMOVIES_USERNAME, OPENBOX_EMUMOVIES_PASSWORD
+# OPENBOX_EMUMOVIES_USERNAME=
+# OPENBOX_EMUMOVIES_PASSWORD=
 
+# ScreenScraper: your account login plus a developer ID and password. The API refuses
+# lookups without the developer pair, so both pairs are required (request a developer ID
+# from ScreenScraper).
+# SCREENSCRAPER_USER=
+# SCREENSCRAPER_PASSWORD=
+# SCREENSCRAPER_DEV_ID=
+# SCREENSCRAPER_DEV_PASSWORD=
+
+# Aliases accepted: OPENBOX_SCREENSCRAPER_USER, OPENBOX_SCREENSCRAPER_PASSWORD, OPENBOX_SCREENSCRAPER_DEV_ID, OPENBOX_SCREENSCRAPER_DEV_PASSWORD
+# OPENBOX_SCREENSCRAPER_USER=
+# OPENBOX_SCREENSCRAPER_PASSWORD=
+# OPENBOX_SCREENSCRAPER_DEV_ID=
+# OPENBOX_SCREENSCRAPER_DEV_PASSWORD=
 
 # Webhooks reject plain HTTP by default. Set this only for trusted local test targets.
-# OPENBOX_ALLOW_HTTP_WEBHOOKS=1
+# OPENBOX_ALLOW_HTTP_WEBHOOKS=1
+
+# Gameyfin plain HTTP is blocked by default. Set this only for trusted local servers.
+# OPENBOX_ALLOW_HTTP_GAMEYFIN=1

.github/FUNDING.yml

@@ -0,0 +1 @@
+buy_me_a_coffee: haydenopenbox

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -7,36 +7,55 @@ body:
   - type: markdown
     attributes:
       value: |
-        Thanks for taking the time to report an issue. Please search [existing issues](https://github.com/vindeckyy/OpenBoxGL/issues) first. The current release is [v1.2.0](https://github.com/vindeckyy/OpenBoxGL/releases/latest).
+        Thanks for taking the time to report an issue. Please search [existing issues](https://github.com/vindeckyy/OpenBoxGL/issues) first. The current release is [v2.1.0](https://github.com/vindeckyy/OpenBoxGL/releases/latest).
 
   - type: input
     id: version
     attributes:
       label: OpenBox version
       description: Release tag, AppImage version, or git commit hash
-      placeholder: v1.2.0
+      placeholder: v2.1.0
     validations:
       required: true
 
+  - type: input
+    id: library_format
+    attributes:
+      label: Library format
+      description: The library format and path mode shown in Settings > About, for example "7, portable". Leave it blank if the library does not open at all.
+      placeholder: "7, portable"
+    validations:
+      required: false
+
   - type: dropdown
     id: interface
     attributes:
       label: Interface
       options:
         - Web UI
         - Native window
+    validations:
+      required: true
+
+  - type: dropdown
+    id: install
+    attributes:
+      label: Install method
+      options:
         - AppImage
         - Flatpak
         - Source install
+        - Windows portable install
+        - macOS app bundle
     validations:
       required: true
 
   - type: input
     id: environment
     attributes:
       label: Environment
-      description: Distro, desktop environment, and Python version if running from source
-      placeholder: Fedora 42, KDE Plasma, Python 3.12
+      description: Operating system and version (Linux distro and desktop, Windows build, or macOS version), and Python version if running from source
+      placeholder: Fedora 41, KDE Plasma, Python 3.12; or macOS 15 on Apple Silicon; or Windows 11 x86_64
     validations:
       required: true
 
@@ -70,7 +89,7 @@ body:
     id: diagnostic
     attributes:
       label: Diagnostic report
-      description: Paste the output of Settings -> Library Audit -> the diagnostic log, or the "Copy details" output from an error banner. It is redacted automatically.
+      description: Paste the output of Settings -> Advanced -> Copy diagnostic log, or the "Copy details" output from an error banner. It is redacted automatically.
     validations:
       required: false
 

.github/dependabot.yml

@@ -1,17 +1,27 @@
 version: 2
 updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
+  - package-ecosystem: pip
+    directory: /
     schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-  - package-ecosystem: "npm"
-    directory: "/scripts"
+      interval: weekly
+    target-branch: master
+    labels:
+      - dependencies
+  - package-ecosystem: npm
+    directory: /scripts
     schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-  - package-ecosystem: "pip"
-    directory: "/"
+      interval: weekly
+    target-branch: master
+    labels:
+      - dependencies
+  - package-ecosystem: github-actions
+    directory: /
     schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
+      interval: weekly
+    target-branch: master
+    labels:
+      - dependencies
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/pull_request_template.md

@@ -22,7 +22,7 @@ Describe how you verified the change.
 
 ## Checklist
 
-- [ ] I read [CONTRIBUTING.md](../CONTRIBUTING.md)
+- [ ] I read [CONTRIBUTING.md](../docs/CONTRIBUTING.md)
 - [ ] I updated documentation when user-facing behavior changed
 - [ ] I added or updated tests when behavior changed
 - [ ] I did not commit secrets, tokens, ROMs, or personal library data