chore: harden repository collaboration

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,54 @@
+name: Bug report
+description: Report a reproducible problem in a Navanem project.
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: Thanks for helping improve this project. Do not include credentials, personal data, or private customer information.
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      description: Describe the problem and what you expected instead.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction steps
+      placeholder: |
+        1. Install or open …
+        2. Run or select …
+        3. Observe …
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version or commit
+      placeholder: v1.2.3 or commit SHA
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      placeholder: Windows 11, Node.js 22, .NET 8, browser version, or other relevant details
+    validations:
+      required: true
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Add sanitized logs or screenshots when useful.
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I searched existing issues and did not find a duplicate.
+          required: true
+        - label: This report contains no credentials, personal data, or private customer information.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: false

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,34 @@
+name: Feature request
+description: Suggest a focused improvement to a Navanem project.
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem to solve
+      description: Explain the user need rather than only the proposed implementation.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: Describe the smallest useful change.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: List workarounds or smaller approaches you considered.
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I searched existing issues and did not find a duplicate.
+          required: true
+        - label: This request does not require publishing private or personal data.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,14 @@
+## Summary
+
+Describe the problem and the focused change that solves it.
+
+## Verification
+
+- [ ] I ran the checks documented by this repository.
+- [ ] I added or updated tests when behavior changed, or tests are not applicable.
+- [ ] I updated documentation for user-visible changes, or documentation is not applicable.
+- [ ] The change contains no credentials, personal data, private URLs, exports, or generated caches.
+
+## Additional context
+
+Link related issues and include safe screenshots when they materially help review.

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: Europe/Zurich
+    open-pull-requests-limit: 3
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch

.github/workflows/ci.yml

@@ -0,0 +1,48 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    name: Quality
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Validate organization profile and community files
+        shell: bash
+        run: |
+          set -euo pipefail
+          required=(
+            README.md
+            profile/README.md
+            profile/assets/navanem-header.svg
+            CODE_OF_CONDUCT.md
+            CONTRIBUTING.md
+            SECURITY.md
+            SUPPORT.md
+            .github/PULL_REQUEST_TEMPLATE.md
+            .github/ISSUE_TEMPLATE/bug_report.yml
+            .github/ISSUE_TEMPLATE/feature_request.yml
+            .github/ISSUE_TEMPLATE/config.yml
+          )
+          for path in "${required[@]}"; do
+            test -s "$path" || { echo "Missing or empty: $path"; exit 1; }
+          done
+          grep -Fq 'https://www.navanem.com/' profile/README.md
+          grep -Fq 'https://github.com/navanem' profile/README.md

CODE_OF_CONDUCT.md

@@ -0,0 +1,27 @@
+# Code of Conduct
+
+## Our commitment
+
+Navanem welcomes contributors of every background and experience level. We are committed to a respectful, harassment-free community focused on improving open-source software together.
+
+## Expected behavior
+
+- Be constructive, patient, and specific.
+- Critique ideas and changes, not people.
+- Respect differing experience, language, and viewpoints.
+- Keep discussions relevant and do not publish private information.
+- Accept maintainer decisions gracefully and help newcomers participate.
+
+## Unacceptable behavior
+
+Harassment, threats, discrimination, sexualized content, personal attacks, deliberate intimidation, doxxing, spam, and sustained disruption are not tolerated. This applies in issues, pull requests, and every other Navanem project space.
+
+## Reporting and enforcement
+
+Report conduct concerns privately to `tools@navanem.com`. Include links or screenshots when safe, but do not redistribute private information.
+
+Maintainers may edit or remove content and may warn, temporarily restrict, or permanently ban participants when necessary. Reports will be handled as confidentially and promptly as practical.
+
+## Scope
+
+This Code of Conduct applies in all project spaces and when someone is publicly representing a Navanem project.

CONTRIBUTING.md

@@ -0,0 +1,24 @@
+# Contributing to Navanem projects
+
+Thanks for helping improve a Navanem project. Focused bug fixes, documentation, accessibility improvements, tests, and well-scoped features are welcome.
+
+By participating, you agree to follow the [Code of Conduct](CODE_OF_CONDUCT.md). Report suspected vulnerabilities according to [SECURITY.md](SECURITY.md), never through a public issue.
+
+## Before you start
+
+- Read the target repository's README and contribution notes.
+- Search existing issues and pull requests before opening a duplicate.
+- Use the repository's issue templates when available.
+- Discuss large or breaking changes in an issue before implementation.
+- Never commit credentials, private data, environment files, exports, or generated caches.
+- Submit only work that you have the right to license under the target repository's licence.
+
+## Contribution workflow
+
+1. Fork the repository and create a short, descriptive branch from its default branch.
+2. Make one focused change and add or update tests when behavior changes.
+3. Run the checks documented by the repository.
+4. Push the branch to your fork and open a pull request.
+5. Explain the motivation, verification performed, and user-visible impact.
+
+Maintainers normally squash pull requests. Pull requests must pass required checks and resolve review conversations before merge.

SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Supported versions
+
+Security fixes are applied to the latest maintained release or the current default branch of each Navanem project. Check the target repository's releases and README for project-specific support information.
+
+## Reporting a vulnerability
+
+Do not open a public issue for a suspected vulnerability.
+
+Use **Security → Report a vulnerability** in the affected repository to submit a private GitHub Security Advisory. If private reporting is unavailable, email `tools@navanem.com` with the repository name.
+
+A useful report includes:
+
+- the affected repository, version, package, file, or workflow;
+- clear reproduction steps;
+- expected impact;
+- a safe proof of concept that does not expose personal data or attack third-party systems;
+- any suggested mitigation, if known.
+
+Do not test denial-of-service scenarios against live services, access data that is not yours, or publicly disclose an unresolved vulnerability.

SUPPORT.md

@@ -0,0 +1,10 @@
+# Support
+
+For setup and usage questions, start with the target repository's README and existing issues.
+
+- Use a **bug report** for a reproducible problem.
+- Use a **feature request** for a focused improvement.
+- Include the project version, environment, reproduction steps, and relevant logs.
+- Remove credentials, personal data, private URLs, and customer information before posting.
+
+Security vulnerabilities must be reported privately according to [SECURITY.md](SECURITY.md), not through a public support request.