Standardize OSS templates, secure routes, and prepare release 2.0.0

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,109 @@
+name: Bug report
+description: Report a reproducible bug with enough detail to investigate it quickly
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the report.
+
+        Please include a minimal reproduction whenever possible.
+        For security vulnerabilities, do not open a public issue. Use the repository security policy instead.
+  - type: input
+    id: package_name
+    attributes:
+      label: Affected package
+      description: Which package or module is affected?
+      placeholder: "@ochairo/beat"
+    validations:
+      required: true
+  - type: input
+    id: package_version
+    attributes:
+      label: Package version
+      description: Include the exact published version or commit when possible
+      placeholder: 1.6.6
+    validations:
+      required: true
+  - type: dropdown
+    id: regression
+    attributes:
+      label: Regression?
+      description: Did this work in an earlier version?
+      options:
+        - "Yes"
+        - "No"
+        - "Not sure"
+    validations:
+      required: true
+  - type: dropdown
+    id: impact
+    attributes:
+      label: Impact
+      description: How severe is this for your workflow?
+      options:
+        - Blocks usage or release
+        - Major incorrect behavior
+        - Limited workaround exists
+        - Minor issue or polish problem
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Runtime, OS, browser, framework, bundler, package manager, and anything else that matters
+      placeholder: |
+        Node 20.19.1
+        pnpm 10.11.0
+        macOS 15.4
+        Chrome 136
+        Vite 6
+    validations:
+      required: true
+  - type: input
+    id: reproduction_link
+    attributes:
+      label: Reproduction link
+      description: Link to a repo, StackBlitz, CodeSandbox, or gist if available
+      placeholder: https://github.com/...
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: Provide the shortest sequence that reproduces the bug
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Stack traces, screenshots, failing assertions, bisect notes, or workarounds
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I searched the existing issues for duplicates
+          required: true
+        - label: I reproduced this on a current release or current `develop`
+          required: true
+        - label: I included a minimal reproduction or explained why I could not
+          required: true
+        - label: This is not a security vulnerability or private disclosure issue
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability report
+    url: https://github.com/ochairo/beat/security/policy
+    about: Report vulnerabilities privately instead of opening a public issue.

.github/ISSUE_TEMPLATE/documentation.yml

@@ -0,0 +1,51 @@
+name: Documentation improvement
+description: Report missing, confusing, or incorrect documentation
+title: "[Docs]: "
+labels:
+  - documentation
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this form for documentation gaps, unclear explanations, incorrect examples, or missing migration notes.
+  - type: input
+    id: package_name
+    attributes:
+      label: Package
+      placeholder: "@ochairo/beat"
+    validations:
+      required: true
+  - type: input
+    id: page
+    attributes:
+      label: Page, file, or section
+      description: Link or path to the docs page, README section, or source file
+      placeholder: README.md#usage
+  - type: textarea
+    id: problem
+    attributes:
+      label: What is wrong or missing?
+      description: Describe the confusing, outdated, or missing content
+    validations:
+      required: true
+  - type: textarea
+    id: improvement
+    attributes:
+      label: Proposed improvement
+      description: What should the docs say or show instead?
+    validations:
+      required: true
+  - type: textarea
+    id: examples
+    attributes:
+      label: Example or reference material
+      description: Sample wording, code, screenshots, or links to similar docs
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I searched existing issues for related documentation requests
+          required: true
+        - label: I included the page, file, or section when known
+          required: true

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,78 @@
+name: Feature request
+description: Propose a new capability or improvement with clear user value and scope
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the suggestion.
+
+        Start with the problem you are solving, then describe the proposed API or behavior.
+        Strong requests usually explain why the change belongs in this package instead of app-level code.
+  - type: input
+    id: package_name
+    attributes:
+      label: Target package
+      placeholder: "@ochairo/beat"
+    validations:
+      required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem statement
+      description: What limitation, friction, or missing capability are you hitting?
+    validations:
+      required: true
+  - type: textarea
+    id: use_case
+    attributes:
+      label: Use case
+      description: What are you trying to build or enable?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: Describe the API, behavior, ergonomics, or workflow you want
+    validations:
+      required: true
+  - type: textarea
+    id: api_sketch
+    attributes:
+      label: API sketch or example
+      description: Optional example showing the desired usage
+      render: ts
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Existing workarounds, competing designs, or reasons not to do this
+  - type: dropdown
+    id: breaking_change
+    attributes:
+      label: Breaking change risk
+      options:
+        - "No"
+        - Possibly
+        - "Yes"
+    validations:
+      required: true
+  - type: textarea
+    id: impact
+    attributes:
+      label: Ecosystem impact
+      description: Effects on users, docs, examples, integrations, or migration paths
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I searched the existing issues for related requests
+          required: true
+        - label: I described the problem before proposing a solution
+          required: true
+        - label: I explained why this should live in the package rather than app code
+          required: true

.github/ISSUE_TEMPLATE/support_request.yml

@@ -0,0 +1,60 @@
+name: Support request
+description: Ask for usage guidance or troubleshooting help
+title: "[Support]: "
+labels:
+  - question
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this form for troubleshooting, API usage questions, or help choosing an approach.
+
+        For security vulnerabilities, do not open a public issue. Use the repository security policy instead.
+  - type: input
+    id: package_name
+    attributes:
+      label: Package
+      placeholder: "@ochairo/beat"
+    validations:
+      required: true
+  - type: input
+    id: package_version
+    attributes:
+      label: Package version
+      placeholder: 1.6.6
+  - type: textarea
+    id: goal
+    attributes:
+      label: What are you trying to do?
+      description: Describe the outcome you want, not only the API you tried first
+    validations:
+      required: true
+  - type: textarea
+    id: tried
+    attributes:
+      label: What have you tried already?
+      description: Include relevant code, docs you followed, and where the result diverged
+      render: ts
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Runtime, OS, browser, framework, bundler, package manager, and related package versions
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Error output, screenshots, repository links, or constraints
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I read the README and relevant docs first
+          required: true
+        - label: I searched existing issues for related questions
+          required: true
+        - label: This is not a security vulnerability or private disclosure issue
+          required: true

.github/pull_request_template.md

@@ -0,0 +1,27 @@
+## Summary
+
+-
+
+## Linked Issue
+
+- Closes #
+
+## Validation
+
+List the checks you ran and the result. If a command was skipped, explain why.
+
+```sh
+pnpm validate
+```
+
+- [ ] `pnpm validate`
+- [ ] `pnpm test`
+- [ ] `pnpm typecheck`
+- [ ] `pnpm build`
+- [ ] Manual verification
+- [ ] Not applicable
+
+## Release Notes
+
+- User-facing summary:
+- Migration or breaking-change notes:

.github/workflows/publish.yml

@@ -15,22 +15,25 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
-          version: 10
+          version: 10.34.7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 24
+          node-version: "24.x"
+          check-latest: true
           cache: pnpm
           registry-url: https://registry.npmjs.org
 
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --frozen-lockfile --ignore-scripts
 
       - name: Verify tag matches package version
         run: |