chore: establish repository governance

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @P4suta

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,61 @@
+name: Bug report
+description: Report reproducible incorrect behavior or a safety issue.
+title: "[Bug]: "
+labels: ["bug", "needs reproduction"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for helping improve OComment. For vulnerabilities, stop here and use the private security-report link.
+  - type: input
+    id: version
+    attributes:
+      label: OComment version
+      description: Paste `ocomment --version` or the commit SHA.
+      placeholder: ocomment 0.1.0
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: Operating system, architecture, installation method, and relevant Git/editor version.
+    validations:
+      required: true
+  - type: input
+    id: language
+    attributes:
+      label: Language and dialect
+      description: Include how the language was detected or selected.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Include safe input bytes, configuration, command, and exact steps. Redact secrets and private paths.
+      render: text
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior and diagnostics
+      description: Include exit status and sanitized output from `ocomment doctor` when relevant.
+    validations:
+      required: true
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I searched existing issues and discussions.
+          required: true
+        - label: This report does not contain a credential or confidential source file.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Questions and support
+    url: https://github.com/P4suta/OComment/discussions
+    about: Ask configuration, usage, and design questions in Discussions.
+  - name: Private security report
+    url: https://github.com/P4suta/OComment/security/advisories/new
+    about: Report suspected vulnerabilities privately, never in a public issue.

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,48 @@
+name: Feature request
+description: Propose a scoped language, policy, API, CLI, LSP, or plugin improvement.
+title: "[Feature]: "
+labels: ["enhancement", "needs design"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What concrete workflow or compatibility gap should be solved?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+      description: Include examples and the expected CLI/API output where useful.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives and compatibility
+      description: Describe alternatives, lexical ambiguity, safety risks, and migration impact.
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - Core scanner or transformer
+        - CLI or output
+        - Git integration
+        - LSP
+        - Profiles or plugins
+        - OCaml reference implementation
+        - Documentation or repository tooling
+    validations:
+      required: true
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I searched existing issues and discussions.
+          required: true
+        - label: I can help add fixtures or tests for this behavior.

.github/ISSUE_TEMPLATE/performance.yml

@@ -0,0 +1,42 @@
+name: Performance report
+description: Report a reproducible throughput, latency, memory, or binary-size regression.
+title: "[Performance]: "
+labels: ["performance", "needs reproduction"]
+body:
+  - type: input
+    id: version
+    attributes:
+      label: Compared versions or commits
+    validations:
+      required: true
+  - type: textarea
+    id: hardware
+    attributes:
+      label: Hardware and environment
+      description: Include CPU, memory, OS, filesystem, compiler, build profile, and thread count.
+    validations:
+      required: true
+  - type: textarea
+    id: workload
+    attributes:
+      label: Reproduction and workload
+      description: Include commands, warmup, sample count, input size and language, and whether files are cached.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: results
+    attributes:
+      label: Results
+      description: Provide raw measurements and summary statistics, not only percentages.
+    validations:
+      required: true
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: The benchmark input can be shared or independently reproduced.
+          required: true
+        - label: I compared equivalent release builds and configurations.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,19 @@
+## Summary
+
+<!-- What changed, and why is this the smallest useful change? -->
+
+## Compatibility and safety
+
+<!-- Describe byte-layout, language, CLI/API, Git, LSP, or plugin implications. -->
+
+## Verification
+
+<!-- List the exact checks and fixtures run. -->
+
+## Checklist
+
+- [ ] Observable behavior has tests or fixtures.
+- [ ] Rust and OCaml expectations agree when the shared scanner contract changes.
+- [ ] Documentation and generated embedded assets are updated where needed.
+- [ ] The change does not include credentials, build output, or unrelated edits.
+- [ ] Breaking behavior and migration steps are called out explicitly.

.github/dependabot.yml

@@ -4,7 +4,50 @@ updates:
     directory: /rust
     schedule:
       interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Tokyo
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 10
+    labels:
+      - dependencies
+    commit-message:
+      prefix: "chore(deps)"
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
+    groups:
+      rust-non-major:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
+      day: monday
+      time: "09:30"
+      timezone: Asia/Tokyo
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 10
+    labels:
+      - dependencies
+      - "area: ci"
+    commit-message:
+      prefix: "chore(deps)"
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
+    groups:
+      actions-non-major:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch

.github/rulesets/README.md

@@ -0,0 +1,15 @@
+# Repository rulesets
+
+These JSON files mirror the active GitHub repository rulesets and can be
+imported from the repository rules settings page or sent to the repository
+rulesets REST endpoint.
+
+- `main.json` requires pull requests, immutable linear history, signed commits,
+  resolved review threads, and every portable CI job.
+- `release-tags.json` makes version tags immutable and requires their target
+  commits to be signed.
+
+The fixed-runner benchmark is intentionally not a required check because the
+runner may be offline. It is enabled separately with the
+`OCOMMENT_BENCHMARK_ENABLED` repository variable. Update the checked-in JSON in
+the same pull request as any live ruleset change.

.github/rulesets/main.json

@@ -0,0 +1,44 @@
+{
+  "name": "Protect main",
+  "target": "branch",
+  "enforcement": "active",
+  "bypass_actors": [],
+  "conditions": {
+    "ref_name": {
+      "include": ["~DEFAULT_BRANCH"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    {"type": "deletion"},
+    {"type": "non_fast_forward"},
+    {"type": "required_linear_history"},
+    {"type": "required_signatures"},
+    {
+      "type": "pull_request",
+      "parameters": {
+        "allowed_merge_methods": ["squash"],
+        "dismiss_stale_reviews_on_push": false,
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_approving_review_count": 0,
+        "required_review_thread_resolution": true
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "do_not_enforce_on_create": true,
+        "required_status_checks": [
+          {"context": "rust"},
+          {"context": "msrv"},
+          {"context": "reference"},
+          {"context": "host-smoke (ubuntu-latest)"},
+          {"context": "host-smoke (macos-15)"},
+          {"context": "host-smoke (windows-2025)"}
+        ],
+        "strict_required_status_checks_policy": true
+      }
+    }
+  ]
+}

.github/rulesets/release-tags.json

@@ -0,0 +1,17 @@
+{
+  "name": "Protect release tags",
+  "target": "tag",
+  "enforcement": "active",
+  "bypass_actors": [],
+  "conditions": {
+    "ref_name": {
+      "include": ["refs/tags/v*"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    {"type": "deletion"},
+    {"type": "non_fast_forward"},
+    {"type": "required_signatures"}
+  ]
+}

.github/workflows/benchmark.yml

@@ -14,15 +14,21 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: benchmark-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   gate:
+    if: vars.OCOMMENT_BENCHMARK_ENABLED == 'true'
     runs-on: [self-hosted, linux, x64, ocomment-benchmark]
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           clean: true
-      - uses: dtolnay/rust-toolchain@stable
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
       - run: cargo build --manifest-path rust/Cargo.toml --release --locked -p ocomment
       - run: cargo build --manifest-path rust/Cargo.toml --release --locked -p ocomment-core --example throughput
       - run: python3 tools/release_gate.py