chore: org hardening — SHA-pinned actions, governance docs, Scorecard, issue forms

.github/CODEOWNERS

@@ -0,0 +1,14 @@
+# Code owners for goceleris/celeris.
+#
+# Every pull request needs an approving review from a code owner of the
+# files it touches before it can merge (see GOVERNANCE.md, "How changes
+# get merged"). The last matching pattern wins, so keep the catch-all
+# first and add narrower delegations below it.
+#
+# Syntax: https://docs.github.com/articles/about-code-owners
+
+* @FumingPower3925
+
+# Area delegation example — uncomment and adjust when a contributor
+# takes ownership of a subtree:
+# /middleware/ @FumingPower3925 @WdnLiu

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,65 @@
+name: Bug report
+description: Report a bug in celeris
+title: "[bug]: "
+labels: ["bug", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report a bug. Please fill in the
+        environment fields — engine and architecture matter a lot for
+        celeris, since the io_uring, epoll and std engines take different
+        code paths.
+
+        **Security vulnerabilities must not be reported here.** Use the
+        repository's Security tab → "Report a vulnerability" instead (see
+        [SECURITY.md](../blob/main/SECURITY.md)).
+  - type: dropdown
+    id: engine
+    attributes:
+      label: Engine
+      description: Which engine were you running when the bug occurred?
+      options:
+        - std
+        - epoll
+        - io_uring
+        - adaptive
+    validations:
+      required: true
+  - type: dropdown
+    id: arch
+    attributes:
+      label: Architecture
+      options:
+        - amd64
+        - arm64
+        - other
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: celeris version
+      description: Output of `go list -m github.com/goceleris/celeris`, or the commit SHA.
+      placeholder: v1.6.0
+    validations:
+      required: true
+  - type: input
+    id: os
+    attributes:
+      label: OS / kernel
+      description: Distribution and kernel version (`uname -sr`). Kernel matters for io_uring.
+      placeholder: Ubuntu 24.04, Linux 6.8.0
+  - type: textarea
+    id: repro
+    attributes:
+      label: Minimal reproduction
+      description: A self-contained Go program (or test) that reproduces the problem. The smaller, the faster we can fix it.
+      render: go
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected vs actual
+      description: What did you expect to happen, and what happened instead? Include logs, panics or `-race` output if you have them.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/goceleris/celeris/security/advisories/new
+    about: Report a vulnerability privately. Never open a public issue for security problems.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,29 @@
+name: Feature request
+description: Suggest a new feature or an improvement
+title: "[feature]: "
+labels: ["enhancement", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Large or breaking proposals are best discussed here before any
+        code is written (see [GOVERNANCE.md](../blob/main/GOVERNANCE.md)).
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What problem does this feature solve? Who hits it, and how often?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: Describe the API or behaviour you have in mind. Sketches of Go code are welcome.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives
+      description: Other approaches you considered, including "do nothing", and why they fall short.

.github/PULL_REQUEST_TEMPLATE.md

@@ -2,6 +2,8 @@
 
 Brief description of the changes.
 
+Closes #
+
 ## Changes
 
 -
@@ -11,3 +13,10 @@ Brief description of the changes.
 - [ ] Unit tests added/updated
 - [ ] `mage check` passes
 - [ ] Tested on Linux (if engine changes)
+
+Tested on: [ ] std [ ] epoll [ ] io_uring — [ ] amd64 [ ] arm64
+
+## Release notes
+
+- [ ] Breaking change? (label `breaking`)
+- [ ] Labeled for release notes (`bug` / `enhancement` / `performance` / `security` / `breaking` / `dependencies`)

.github/release.yml

@@ -0,0 +1,30 @@
+# Automatically generated release notes (GitHub Releases is the
+# changelog — there is no CHANGELOG.md). PRs are grouped by label; label
+# every PR with exactly one of the category labels below so it lands in
+# the right section. Dependency bumps are excluded from the notes.
+#
+# https://docs.github.com/repositories/releasing-projects-on-github/automatically-generated-release-notes
+changelog:
+  exclude:
+    labels:
+      - dependencies
+      - github_actions
+  categories:
+    - title: Breaking changes
+      labels:
+        - breaking
+    - title: Security
+      labels:
+        - security
+    - title: Fixes
+      labels:
+        - bug
+    - title: Performance
+      labels:
+        - performance
+    - title: Features
+      labels:
+        - enhancement
+    - title: Other
+      labels:
+        - "*"

.github/workflows/ci.yml

@@ -24,58 +24,72 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "1.27.0"
       # Magefiles carry `//go:build mage`, so `go vet ./...`, `go build` and
       # `go test` ALL skip them — only mage itself compiles them, which means a
       # broken magefile can reach main green. Compile them here.
       - name: Install mage
         run: |
-          go install github.com/magefile/mage@latest
+          go install github.com/magefile/mage@v1.17.2
           echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
       - name: mage compiles
         run: mage -compile /tmp/mage-compile-check
 
       - name: Lint root module
-        uses: golangci/golangci-lint-action@v9
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
           version: v2.13
       - name: Lint middleware/compress
-        uses: golangci/golangci-lint-action@v9
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
           version: v2.13
           working-directory: middleware/compress
       - name: Lint middleware/metrics
-        uses: golangci/golangci-lint-action@v9
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
           version: v2.13
           working-directory: middleware/metrics
       - name: Lint middleware/otel
-        uses: golangci/golangci-lint-action@v9
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
           version: v2.13
           working-directory: middleware/otel
       - name: Lint middleware/protobuf
-        uses: golangci/golangci-lint-action@v9
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
           version: v2.13
           working-directory: middleware/protobuf
       - name: actionlint
         # Workflow-YAML lint: catches script-injection vectors, unknown
         # runner labels, malformed shell, action input misuse — the
-        # whole class golangci-lint can't see.
+        # whole class golangci-lint can't see. Pinned to an exact version
+        # so a new actionlint release cannot turn main red on its own.
         run: |
-          go install github.com/rhysd/actionlint/cmd/actionlint@latest
+          go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
           actionlint -color
+      - name: zizmor
+        # Workflow security audit (unpinned actions, persisted credentials,
+        # template injection, excessive permissions). Complements
+        # actionlint, which checks syntax rather than security posture.
+        # Needs only the ephemeral job token (read) for the online audits;
+        # no repository secrets. Pinned to an exact version.
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: pipx run --spec zizmor==1.30.0 zizmor --color always .github/workflows
 
   unit:
     name: Unit (root + middleware sub-modules)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "1.27.0"
       # Excludes ./test/... to keep this job deterministic — those
@@ -117,8 +131,10 @@ jobs:
     name: Conformance
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "1.27.0"
       - name: Conformance matrix (engines × protocols)
@@ -154,8 +170,10 @@ jobs:
       CELERIS_PG_DSN: postgres://celeris:celeris@127.0.0.1:5432/celeristest?sslmode=disable
       CELERIS_REDIS_ADDR: 127.0.0.1:6379
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "1.27.0"
       - name: Postgres conformance
@@ -182,8 +200,10 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "1.27.0"
       - name: Build root module
@@ -205,8 +225,10 @@ jobs:
     name: Vulnerability Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "1.27.0"
       - name: Install govulncheck