ci: harden CI and releases, refresh governance docs

.cargo/audit.toml

@@ -0,0 +1,9 @@
+# cargo-audit reads this file directly from the repository root context.
+#
+# RUSTSEC-2026-0194 / RUSTSEC-2026-0195 are denial-of-service advisories in
+# quick-xml. quick-xml is transitive only through self_update's GitHub backend
+# (`self_update -> quick-xml`) and parses trusted GitHub release metadata fetched
+# over TLS, not user-controlled XML. self_update 0.44 still constrains quick-xml
+# to ^0.38; remove these exceptions as soon as it accepts quick-xml >=0.41.
+[advisories]
+ignore = ["RUSTSEC-2026-0194", "RUSTSEC-2026-0195"]

.githooks/pre-push

@@ -1,59 +1,8 @@
 #!/usr/bin/env bash
-#
-# pre-push hook — push-time quality gate
-#
-# Runs ONLY on `git push`, never on `git commit`: commit freely to save WIP;
-# the full gate runs only when you actually push.
-#
-# The checks mirror .github/workflows/ci.yml exactly, so "local pre-push green"
-# implies "CI will be green":
-#   1. cargo fmt --all --check        (rustfmt)
-#   2. cargo clippy ... -D warnings    (lint, warnings are errors)
-#   3. cargo test --workspace          (incl. golden oracle + sync equivalence)
-#   4. scripts/guardrail.sh            (no AI/vector/LLM crates + no release
-#                                       asset-name drift)
-#
-# Enable once per clone:
-#   make hooks            # == git config core.hooksPath .githooks
-#
+# Version-controlled pre-push gate. Keep this as a thin call to the canonical
+# Makefile contract so local pushes, CI, and release verification cannot drift.
 set -euo pipefail
-
-REPO_ROOT="$(git rev-parse --show-toplevel)"
-cd "$REPO_ROOT"
-
-echo "==> [pre-push] running push gate (fmt → clippy → test → guardrail)..."
-
-echo "==> [1/4] cargo fmt --all --check"
-if ! cargo fmt --all --check; then
-    echo "" >&2
-    echo "❌ Format check failed. Run 'cargo fmt --all' (and 'make fmt' for docs)," >&2
-    echo "   commit the result, then push again. Push aborted." >&2
-    exit 1
-fi
-
-echo "==> [2/4] cargo clippy --workspace --all-targets -- -D warnings"
-if ! cargo clippy --workspace --all-targets -- -D warnings; then
-    echo "" >&2
-    echo "❌ Clippy failed (warnings are denied). Fix the lints above and push again." >&2
-    echo "   Push aborted." >&2
-    exit 1
-fi
-
-echo "==> [3/4] cargo test --workspace"
-if ! cargo test --workspace; then
-    echo "" >&2
-    echo "❌ Tests failed. Fix the failing tests above and push again. Push aborted." >&2
-    exit 1
-fi
-
-echo "==> [4/4] scripts/guardrail.sh (no AI/vector/LLM crates + asset-name drift)"
-if ! bash scripts/guardrail.sh; then
-    echo "" >&2
-    echo "❌ Scope guardrail failed: a forbidden AI/vector/LLM crate was detected," >&2
-    echo "   or the release workflow and the installers disagree on asset names." >&2
-    echo "   Read the diagnostics above; push aborted." >&2
-    exit 1
-fi
-
-echo "==> [pre-push] ✅ all checks passed, push allowed."
-exit 0
+repo_root="$(git rev-parse --show-toplevel)"
+cd "$repo_root"
+echo "==> [pre-push] make pre-ci"
+exec make pre-ci

.github/CODEOWNERS

@@ -0,0 +1,7 @@
+# Routing only while the repository has one maintainer. The ruleset must not
+# require code-owner approval until a second maintainer can review changes.
+* @sunerpy
+/.github/workflows/ @sunerpy
+/.github/scripts/ @sunerpy
+/scripts/ @sunerpy
+/reference/golden/ @sunerpy

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,59 @@
+name: Bug report
+description: Report incorrect indexing, querying, CLI, MCP, installer, or runtime behavior
+title: "bug: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not report vulnerabilities here. Use the private channel in SECURITY.md.
+  - type: input
+    id: version
+    attributes:
+      label: CodeGraph version
+      description: Output of `codegraph --version` and installation method.
+    validations:
+      required: true
+  - type: input
+    id: platform
+    attributes:
+      label: Platform
+      placeholder: OS, architecture, filesystem, shell
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Include the smallest source tree and exact commands. Remove secrets.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: observed
+    attributes:
+      label: Observed behavior
+      description: Include complete error text and whether the result is deterministic.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: status
+    attributes:
+      label: Index status and diagnostics
+      description: Paste `codegraph status <project> --json`; attach opt-in diagnostics when relevant.
+      render: json
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I searched existing issues and the upstream ledger.
+          required: true
+        - label: This report contains no secrets or confidential vulnerability details.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/sunerpy/codegraph-rust/security/advisories/new
+    about: Report vulnerabilities privately; do not open a public issue.
+  - name: Documentation
+    url: https://github.com/sunerpy/codegraph-rust/blob/main/docs/README.md
+    about: Read the CLI, MCP, language, architecture, and troubleshooting references.

.github/ISSUE_TEMPLATE/extraction.yml

@@ -0,0 +1,67 @@
+name: Language or extraction gap
+description: Report a missing, wrong, or fabricated symbol/edge for a minimal source fixture
+title: "fix(extraction): "
+labels: ["bug", "extraction"]
+body:
+  - type: input
+    id: language
+    attributes:
+      label: Language and extension
+      placeholder: TypeScript (.ts)
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: CodeGraph version
+      description: Output of `codegraph --version`.
+    validations:
+      required: true
+  - type: textarea
+    id: fixture
+    attributes:
+      label: Minimal source fixture
+      description: Include every file needed to reproduce and no private code.
+      render: text
+    validations:
+      required: true
+  - type: textarea
+    id: commands
+    attributes:
+      label: Commands and observed graph
+      description: Show init/sync plus search, callers, export, or MCP calls that demonstrate the gap.
+      render: shell
+    validations:
+      required: true
+  - type: dropdown
+    id: problem_kind
+    attributes:
+      label: Problem kind
+      options:
+        - Missing symbol or edge
+        - Fabricated symbol or edge
+        - Wrong owner or target
+        - Wrong location or signature
+        - Import/path resolution
+        - Parser error or unsupported syntax
+        - Incremental/full-index mismatch
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected static-analysis result
+      description: Explain ambiguity and any dynamic behavior that should remain unresolved.
+    validations:
+      required: true
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I reduced this to a non-confidential fixture.
+          required: true
+        - label: I checked docs/languages.md for the documented boundary.
+          required: true
+        - label: I searched existing issues and the upstream ledger.
+          required: true

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,53 @@
+name: Feature request
+description: Propose a new query, workflow, integration, or product behavior
+title: "feat: "
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What user task cannot be completed reliably today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+      description: Describe inputs, outputs, failure cases, and static/runtime boundary.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Primary surface
+      options:
+        - Extraction or resolution
+        - Graph or search
+        - CLI
+        - MCP
+        - Installer or agent integration
+        - Daemon or watcher
+        - Documentation or tooling
+        - Other
+    validations:
+      required: true
+  - type: checkboxes
+    id: compatibility
+    attributes:
+      label: Compatibility considerations
+      options:
+        - label: This may change graph output or require golden updates.
+        - label: This may change a public CLI, JSON, MCP, or installer contract.
+        - label: This may require a schema or extraction-version migration.
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I searched existing issues and the upstream ledger.
+          required: true

.github/dependabot.yml

@@ -0,0 +1,20 @@
+version: 2
+
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      cargo:
+        patterns:
+          - "*"
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/pull_request_template.md

@@ -0,0 +1,30 @@
+## Summary
+
+<!-- What changes, and why? -->
+
+## Evidence
+
+<!-- Reproduction, issue, upstream reference, logs, or source-backed reason. -->
+
+## Compatibility impact
+
+- [ ] No node/edge/reference/file-classification change
+- [ ] Extraction version reviewed (state the decision below)
+- [ ] Schema/migration impact reviewed
+- [ ] CLI/MCP/installer output compatibility reviewed
+- [ ] Golden changes are intentional and explained
+
+Details:
+
+## Validation
+
+<!-- List commands actually run and their results. -->
+
+- [ ] Focused tests
+- [ ] `make check`
+- [ ] `git diff --check`
+- [ ] Documentation updated or not applicable
+
+## Risks and deferred work
+
+<!-- Static/runtime boundary, ambiguity behavior, platform gaps, follow-ups. -->

.github/scaffold.json

@@ -0,0 +1,25 @@
+{
+  "profile": "rust",
+  "addons": ["codecov"],
+  "placeholders": {
+    "BINARY": "codegraph",
+    "CRATE": "codegraph-rs",
+    "CURRENT_VERSION": "0.50.3",
+    "DEFAULT_BRANCH": "main",
+    "OWNER": "sunerpy",
+    "PACKAGE_NAME": "codegraph-rs",
+    "REPO": "codegraph-rust",
+    "RUST_TOOLCHAIN": "1.96.0"
+  },
+  "drift_allow": [
+    ".github/workflows/ci.yml",
+    ".github/workflows/release.yml",
+    "release-please-config.json",
+    "Makefile",
+    "scripts/install.sh",
+    "scripts/install.ps1",
+    ".oxfmtignore",
+    "codecov.yml",
+    ".github/dependabot.yml"
+  ]
+}

.github/scripts/install-actionlint.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Install the pinned actionlint release binary on a Linux x86_64 runner.
+#
+# taiki-e/install-action has no actionlint manifest, so the binary comes from
+# the upstream GitHub release and is accepted only when its SHA-256 matches the
+# digest pinned here. The version must equal ACTIONLINT_VERSION in the Makefile,
+# which `make tools-check` enforces locally.
+set -euo pipefail
+
+version="1.7.12"
+sha256="8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8"
+
+makefile_version="$(sed -n 's/^ACTIONLINT_VERSION := //p' Makefile)"
+if [ "$makefile_version" != "$version" ]; then
+    printf 'install-actionlint: Makefile pins %s but this script pins %s\n' \
+        "${makefile_version:-<none>}" "$version" >&2
+    exit 1
+fi
+
+archive="actionlint_${version}_linux_amd64.tar.gz"
+dest="${RUNNER_TEMP:?}/actionlint-${version}"
+mkdir -p "$dest"
+curl --proto '=https' --tlsv1.2 -fsSL --retry 3 -o "$dest/$archive" \
+    "https://github.com/rhysd/actionlint/releases/download/v${version}/${archive}"
+printf '%s  %s\n' "$sha256" "$dest/$archive" | sha256sum -c -
+tar -xzf "$dest/$archive" -C "$dest" actionlint
+"$dest/actionlint" -version
+printf '%s\n' "$dest" >> "${GITHUB_PATH:?}"