Go-public readiness + Build/Rebuild/Clean on the solution node

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,75 @@
+name: Bug report
+description: Report a defect in SharpLsp (language server, sidecars, or an editor extension).
+title: "[Bug]: "
+labels: ["bug", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to file a bug. Please do **not** report
+        security vulnerabilities here — use private reporting (see SECURITY.md).
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: A clear description of the bug and what you expected instead.
+      placeholder: When I open a workspace with two solutions, hover stops working…
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: Minimal steps. A link to a sample repo or a minimal project is ideal.
+      placeholder: |
+        1. Open '...'
+        2. Trigger '...'
+        3. Observe '...'
+    validations:
+      required: true
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      description: Which part of SharpLsp is affected?
+      options:
+        - "Not sure"
+        - "Rust LSP host"
+        - "C# sidecar (Roslyn)"
+        - "F# sidecar (FCS)"
+        - "VS Code extension"
+        - "Other editor (Zed/Rider/Neovim/…)"
+    validations:
+      required: true
+  - type: input
+    id: language
+    attributes:
+      label: Language
+      description: C#, F#, or both?
+      placeholder: C#
+    validations:
+      required: false
+  - type: input
+    id: version
+    attributes:
+      label: SharpLsp version
+      description: Extension version or `sharplsp --version`.
+      placeholder: 0.1.0
+    validations:
+      required: true
+  - type: input
+    id: env
+    attributes:
+      label: Editor & OS
+      description: Editor + version, operating system, and .NET SDK version.
+      placeholder: VS Code 1.99.0, macOS 15.5 (arm64), .NET 10.0.203
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs
+      description: Output from the SharpLsp output channel (set `sharplsp.logging.level` to `debug`). Redact anything sensitive.
+      render: shell
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/Nimblesite/SharpLsp/security/advisories/new
+    about: Please report security issues privately, never as a public issue. See SECURITY.md.
+  - name: Question or discussion
+    url: https://github.com/Nimblesite/SharpLsp/discussions
+    about: Ask usage questions or propose ideas in Discussions.
+  - name: Documentation
+    url: https://sharplsp.dev/docs
+    about: Read the SharpLsp documentation.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,39 @@
+name: Feature request
+description: Suggest a capability or improvement for SharpLsp.
+title: "[Feature]: "
+labels: ["enhancement", "triage"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem / motivation
+      description: What are you trying to do, and what's missing or painful today?
+      placeholder: There's no way to … which makes … hard.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: What would you like SharpLsp to do?
+    validations:
+      required: true
+  - type: dropdown
+    id: language
+    attributes:
+      label: Language relevance
+      description: SharpLsp treats F# and C# as equal first-class citizens — which does this affect?
+      options:
+        - "Both C# and F#"
+        - "C# only"
+        - "F# only"
+        - "Editor/tooling (language-agnostic)"
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Other approaches, or how other tools (Visual Studio, Rider, C# Dev Kit) handle this.
+    validations:
+      required: false

.github/SECURITY.md

@@ -0,0 +1,52 @@
+# Security Policy
+
+## Supported versions
+
+SharpLsp is pre-1.0 and ships from a single active line. Security fixes are
+released against the latest published version on the
+[VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=nimblesite.sharplsp)
+and the latest GitHub Release. Please reproduce any report against the most
+recent release before filing.
+
+| Version | Supported |
+| ------- | --------- |
+| Latest release | ✅ |
+| Older releases | ❌ |
+
+## Reporting a vulnerability
+
+**Please do not open public issues, pull requests, or discussions for security
+vulnerabilities.** Public disclosure before a fix is available puts users at
+risk.
+
+Instead, report privately through GitHub's coordinated disclosure flow:
+
+1. Go to the repository's **Security** tab → **Report a vulnerability**
+   (GitHub Private Vulnerability Reporting), or use this direct link:
+   <https://github.com/Nimblesite/SharpLsp/security/advisories/new>.
+2. Include: affected component (Rust host, C#/F# sidecar, or VS Code
+   extension), version, a clear description, reproduction steps, and the
+   impact you observed.
+
+If you are unable to use the GitHub flow, you may instead email the maintainer
+at **cftools@nimblesite.co** with the same details.
+
+## What to expect
+
+- **Acknowledgement:** within 3 business days.
+- **Triage & initial assessment:** within 7 business days.
+- **Fix & disclosure:** we aim to ship a fix and publish an advisory as soon as
+  practical, and will keep you updated on progress. With your agreement we will
+  credit you in the advisory.
+
+## Scope notes
+
+SharpLsp executes language-tooling on the code you open, similar to any IDE
+language server. Reports we are especially interested in:
+
+- Code execution triggered merely by **opening** a workspace (e.g. a workspace
+  trust bypass that runs an attacker-controlled binary).
+- Path traversal or arbitrary file read/write outside the workspace.
+- Memory-safety or denial-of-service issues reachable from untrusted document
+  or project content.
+- Secret/credential exposure in builds, logs, or the published extension.

.github/dependabot.yml

@@ -0,0 +1,71 @@
+# Dependabot keeps the Rust, .NET, npm, and GitHub Actions dependency trees
+# patched. Minor/patch bumps are grouped per-ecosystem to keep PR noise low;
+# major bumps still arrive as individual PRs so they get deliberate review.
+version: 2
+updates:
+  # ── Rust: host crate ────────────────────────────────────────────────
+  - package-ecosystem: cargo
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      rust-host:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+
+  # ── Rust: Zed extension crate ───────────────────────────────────────
+  - package-ecosystem: cargo
+    directory: "/editors/zed"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      rust-zed:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+
+  # ── .NET: C#/F# sidecars solution ───────────────────────────────────
+  - package-ecosystem: nuget
+    directory: "/sidecars"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      dotnet-sidecars:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+
+  # ── npm: VS Code extension ──────────────────────────────────────────
+  - package-ecosystem: npm
+    directory: "/editors/vscode"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      vscode-extension:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+
+  # ── npm: website ────────────────────────────────────────────────────
+  - package-ecosystem: npm
+    directory: "/website"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      website:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+
+  # ── GitHub Actions: all workflows ───────────────────────────────────
+  # Keeps the SHA-pinned actions current (Dependabot bumps the pin and the
+  # trailing version comment together).
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      github-actions:
+        patterns: ["*"]

.github/workflows/ci.yml

@@ -18,8 +18,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-node@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with:
         node-version: '24'
     - name: Validate shipwright.json
@@ -36,22 +36,23 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-    - uses: actions/checkout@v4
-    - uses: dtolnay/rust-toolchain@stable
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+    - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
       with:
+        toolchain: stable
         components: clippy, rustfmt
-    - uses: Swatinem/rust-cache@v2
-    - uses: actions/setup-dotnet@v4
+    - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+    - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
       with:
         dotnet-version: |
           9.0.x
           10.0.203
-    - uses: actions/cache@v4
+    - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         path: "~/.nuget/packages"
         key: "${{ runner.os }}-nuget-${{ hashFiles('sidecars/**/*.csproj', 'sidecars/Directory.Build.props') }}"
         restore-keys: "${{ runner.os }}-nuget-"
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with:
         node-version: '20'
         cache: npm
@@ -86,19 +87,24 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-    - uses: actions/checkout@v4
-    - uses: dtolnay/rust-toolchain@stable
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+    - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
       with:
+        toolchain: stable
         components: llvm-tools-preview
-    - uses: Swatinem/rust-cache@v2
-    - uses: taiki-e/install-action@cargo-llvm-cov
-    - uses: taiki-e/install-action@nextest
-    - uses: actions/setup-dotnet@v4
+    - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+    - uses: taiki-e/install-action@0631aa6515c7d545823c67cfae7ef4fc7f490154 # v2
+      with:
+        tool: cargo-llvm-cov
+    - uses: taiki-e/install-action@0631aa6515c7d545823c67cfae7ef4fc7f490154 # v2
+      with:
+        tool: nextest
+    - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
       with:
         dotnet-version: |
           9.0.x
           10.0.203
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with:
         node-version: '20'
     - name: Install .NET diagnostic tools
@@ -118,7 +124,7 @@ jobs:
         ./target/release/sharplsp --version | grep -Fx "sharplsp ${VERSION}"
         ./target/release/sharplsp --version --json | VERSION="${VERSION}" node -e 'const fs=require("node:fs"); const actual=JSON.parse(fs.readFileSync(0,"utf8")); const expected={name:"sharplsp",version:process.env.VERSION,kind:"lsp",language:"rust",product:"sharplsp"}; for (const [key,value] of Object.entries(expected)) { if (actual[key] !== value) throw new Error(`${key}: expected ${value}, got ${actual[key]}`); }'
     - name: Upload coverage
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: coverage-rust
         path: |
@@ -131,8 +137,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-dotnet@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+    - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
       with:
         dotnet-version: |
           9.0.x
@@ -148,7 +154,7 @@ jobs:
         target/sidecar-csharp/SharpLsp.Sidecar.CSharp --version | grep -Fx "sharplsp-sidecar-csharp ${CS_VERSION}"
         target/sidecar-fsharp/SharpLsp.Sidecar.FSharp --version | grep -Fx "sharplsp-sidecar-fsharp ${FS_VERSION}"
     - name: Upload coverage
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: coverage-dotnet
         path: coverage-thresholds.json
@@ -163,15 +169,17 @@ jobs:
     # real solutions). 10 minutes is too tight for the end-to-end run.
     timeout-minutes: 20
     steps:
-    - uses: actions/checkout@v4
-    - uses: dtolnay/rust-toolchain@stable
-    - uses: Swatinem/rust-cache@v2
-    - uses: actions/setup-dotnet@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+    - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+      with:
+        toolchain: stable
+    - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+    - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
       with:
         dotnet-version: |
           9.0.x
           10.0.203
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with:
         node-version: '20'
         cache: npm
@@ -197,7 +205,7 @@ jobs:
         platform="$(node -e 'process.stdout.write(`${process.platform}-${process.arch}`)')"
         unzip -l sharplsp.vsix | grep -F "bin/${platform}/sharplsp"
     - name: Upload coverage
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: coverage-vsix
         path: coverage-thresholds.json