chore: hygine

[harshtandiya]

Summary

• Add community health files: CONTRIBUTING.md, SECURITY.md, LICENSE, CODEOWNERS, issue templates, PR template, and Dependabot config
• Fix CI workflows: correct Python version to 3.14, remove paths-ignore so .github/ changes also trigger CI and linters
• Update pyproject.toml to require Python >=3.14 and set ruff target-version = "py314"
• Update .gitignore to cover .env.* variants and local AI tooling settings
• Fix .pre-commit-config.yaml paths to match current frontend structure (frontend/ instead of forms_pro/frontend/)
• Update README and CLAUDE.md to reference Python 3.14+

Testing

• pre-commit run --all-files

Summary by CodeRabbit

• Documentation

  • Added contribution guidelines for the project.
  • Added security vulnerability reporting policy.
  • Updated README with Python version requirements and CI testing information.

• Chores

  • Added GitHub issue templates for bug reports and feature requests.
  • Configured automated dependency update checks.
  • Updated Python version requirements to 3.14+.
  • Added repository code ownership configuration.
  • Enhanced development workflow configuration.

[coderabbitai]

Warning

Rate limit exceeded

@harshtandiya has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 17 minutes and 2 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 17 minutes and 2 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: be51d131-3092-4c49-b4ec-1aee66caec2e

📥 Commits

Reviewing files that changed from the base of the PR and between 0ee29da and 616f9ff.

📒 Files selected for processing (5)

• .github/workflows/ci.yml
• .github/workflows/linter.yml
• CLAUDE.md
• README.md
• pyproject.toml

📝 Walkthrough

Walkthrough

Adds repository governance and automation files: CODEOWNERS, issue/PR templates, Dependabot, workflow trigger changes, pre-commit and .gitignore updates, contribution and security docs, and Python-version metadata updates in project config.

Changes

Cohort / File(s)	Summary
Repository ownership .github/CODEOWNERS	New CODEOWNERS entries assigning ownership for *, /.github/, /frontend/, and /forms_pro/.
Issue & PR templates .github/ISSUE_TEMPLATE/bug_report.yml, .github/ISSUE_TEMPLATE/feature_request.yml, .github/pull_request_template.md	Added bug and feature request issue templates and a PR template with structured fields, labels, and checklists.
Dependency automation .github/dependabot.yml	Dependabot configured for pip (root), yarn (/frontend), and github-actions with weekly checks and label assignments.
Workflows .github/workflows/ci.yml, .github/workflows/linter.yml	Removed .github/** path-ignore so workflows run on changes to .github/*. Linter workflow Python runtime updated from 3.10 → 3.14; CI workflow trigger logic adjusted (no other job/step changes).
Pre-commit & ignores .pre-commit-config.yaml, .gitignore, frontend/.gitignore	Updated pre-commit exclude patterns to match new frontend/generated paths; .gitignore expanded to ignore .env.* (except samples), Claude local settings, and added forms_pro frontend build ignores; removed a parent-app ignore from frontend/.gitignore.
Docs & contribution policy CONTRIBUTING.md, SECURITY.md, README.md, CLAUDE.md	Added CONTRIBUTING and SECURITY docs; README and CLAUDE references updated to Python 3.14+. Security.md describes private disclosure contact and process.
Project metadata pyproject.toml	Updated requires-python from >=3.10 → >=3.14 and Ruff target version from py310 → py313.
Misc .github/ISSUE_TEMPLATE/..., other small files	Minor line additions across new templates and docs; no exported/public API changes.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰
I hopped through files, adjusting the trail,
Templates in pocket and dependabot mail,
CODEOWNERS planted, workflows now wake,
Docs snugly tucked for contributors' sake,
A cheerful hop forward — onward we sail!

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title 'chore: hygine' is vague and uses a misspelled term that doesn't clearly convey the scope or nature of the changes, which span repository configuration, documentation, workflows, and linter settings.	Replace with a more specific title like 'chore: add CI/CD workflows and contribution guidelines' or 'chore: configure repository setup and documentation' to better describe the actual changes.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch hygine

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

SECURITY.md (1)

11-17: Add an explicit response SLA for security reports.

The policy is clear, but adding a concrete acknowledgment window improves reporter expectations and coordination.

Suggested doc patch

 ## Reporting a Vulnerability
 
 Please report vulnerabilities privately to [developers@buildwithhussain.com](mailto:developers@buildwithhussain.com).
 
 - Do not open a public GitHub issue for security reports.
 - Include clear reproduction steps, impact, and any suggested mitigations if you have them.
+- We aim to acknowledge valid reports within 3 business days and share next steps after triage.
 - We will review the report, confirm the issue, and coordinate a fix and disclosure timeline with you.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@SECURITY.md` around lines 11 - 17, The "Reporting a Vulnerability" section in
SECURITY.md lacks an explicit SLA; update that section to state a concrete
acknowledgment and triage timeframe (for example: "We will acknowledge receipt
within 72 hours and provide an initial triage/update within 7 business days"),
include the contact email developers@buildwithhussain.com as the reporting
endpoint, and optionally add a brief escalation path or expected disclosure
coordination timeline so reporters know next steps and expectations.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@CONTRIBUTING.md`:
- Around line 19-23: The documented checklist leaves the shell in the frontend
directory after running "cd frontend && yarn typecheck", causing the subsequent
"bench --site <site> run-tests --app forms_pro" to run from the wrong cwd;
change the frontend step to run in a subshell (replace "cd frontend && yarn
typecheck" with "(cd frontend && yarn typecheck)") so the working directory is
preserved for the later "bench" command and subsequent steps.

---

Nitpick comments:
In `@SECURITY.md`:
- Around line 11-17: The "Reporting a Vulnerability" section in SECURITY.md
lacks an explicit SLA; update that section to state a concrete acknowledgment
and triage timeframe (for example: "We will acknowledge receipt within 72 hours
and provide an initial triage/update within 7 business days"), include the
contact email developers@buildwithhussain.com as the reporting endpoint, and
optionally add a brief escalation path or expected disclosure coordination
timeline so reporters know next steps and expectations.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 73ab11de-4e1a-4880-8eb3-7da18fa41289

📥 Commits

Reviewing files that changed from the base of the PR and between 9ab5744 and 0ee29da.

📒 Files selected for processing (14)

• .github/CODEOWNERS
• .github/ISSUE_TEMPLATE/bug_report.yml
• .github/ISSUE_TEMPLATE/feature_request.yml
• .github/dependabot.yml
• .github/pull_request_template.md
• .github/workflows/ci.yml
• .github/workflows/linter.yml
• .gitignore
• .pre-commit-config.yaml
• CONTRIBUTING.md
• LICENSE
• README.md
• SECURITY.md
• frontend/.gitignore

💤 Files with no reviewable changes (2)

• frontend/.gitignore
• .github/workflows/linter.yml

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Run checks without changing cwd for later commands.

After Line 21, the shell remains in frontend, so Line 22 may fail or run in the wrong location. Wrap the frontend check in a subshell (or add cd ..) so bench runs from the expected root context.

Suggested doc fix

 ```bash
 pre-commit run --all-files
-cd frontend && yarn typecheck
+(cd frontend && yarn typecheck)
 bench --site <site> run-tests --app forms_pro

</details>

<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

```suggestion

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@CONTRIBUTING.md` around lines 19 - 23, The documented checklist leaves the
shell in the frontend directory after running "cd frontend && yarn typecheck",
causing the subsequent "bench --site <site> run-tests --app forms_pro" to run
from the wrong cwd; change the frontend step to run in a subshell (replace "cd
frontend && yarn typecheck" with "(cd frontend && yarn typecheck)") so the
working directory is preserved for the later "bench" command and subsequent
steps.