Add CLI community health and governance

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,79 @@
+name: Bug report
+description: Report reproducible incorrect behavior, a crash, or an installation failure.
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thank you for the report. Do not include vulnerabilities, credentials, tokens, private source, or customer data. Security reports belong in the private advisory form.
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Preflight
+      options:
+        - label: I searched existing issues and did not find this bug.
+          required: true
+        - label: This report does not contain a security vulnerability or sensitive data.
+          required: true
+  - type: input
+    id: version
+    attributes:
+      label: PatchFlow version
+      description: Paste the output of `patchflow version`.
+      placeholder: patchflow v0.1.6 ...
+    validations:
+      required: true
+  - type: dropdown
+    id: installation
+    attributes:
+      label: Installation method
+      options:
+        - Release binary or install script
+        - Homebrew
+        - Scoop
+        - Container
+        - go install
+        - Built from source
+        - Other
+    validations:
+      required: true
+  - type: input
+    id: platform
+    attributes:
+      label: Platform
+      description: Operating system, architecture, and relevant shell.
+      placeholder: Ubuntu 24.04, amd64, bash
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Provide exact redacted commands and the smallest public fixture or repository that reproduces the problem.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Redacted diagnostics
+      description: Include relevant output only after removing tokens, credentials, source, private paths, and personal data.
+      render: text
+  - type: textarea
+    id: regression
+    attributes:
+      label: Regression information
+      description: If known, identify the last working version or commit.

.github/ISSUE_TEMPLATE/community_question.yml

@@ -0,0 +1,42 @@
+name: Community question
+description: Ask for non-sensitive help with installation, configuration, usage, or contribution.
+title: "[Question]: "
+labels:
+  - question
+body:
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Preflight
+      options:
+        - label: I checked README.md, SUPPORT.md, and the command documentation.
+          required: true
+        - label: This question contains no vulnerability details, secrets, tokens, private source, or personal data.
+          required: true
+  - type: input
+    id: version
+    attributes:
+      label: PatchFlow version
+      placeholder: Output of patchflow version, or not installed yet
+    validations:
+      required: true
+  - type: input
+    id: platform
+    attributes:
+      label: Platform and installation method
+      placeholder: macOS arm64 / Homebrew
+    validations:
+      required: true
+  - type: textarea
+    id: goal
+    attributes:
+      label: What are you trying to accomplish?
+    validations:
+      required: true
+  - type: textarea
+    id: attempted
+    attributes:
+      label: What have you tried?
+      description: Include redacted commands and output.
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Private security report
+    url: https://github.com/Patchflow-security/patchflow-cli/security/advisories/new
+    about: Report vulnerabilities privately. Do not disclose exploit details in a public issue.
+  - name: Support guide
+    url: https://github.com/Patchflow-security/patchflow-cli/blob/main/SUPPORT.md
+    about: Choose the correct channel for questions, bugs, false positives, and commercial support.

.github/ISSUE_TEMPLATE/false_positive.yml

@@ -0,0 +1,73 @@
+name: False positive
+description: Report a finding that is incorrect or creates avoidable scanner noise.
+title: "[False positive]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use synthetic or public code only. Never paste private source, real secrets, or an undisclosed vulnerability.
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Preflight
+      options:
+        - label: I searched for an existing report with the same rule and pattern.
+          required: true
+        - label: The reproducer is safe to publish and contains no sensitive data.
+          required: true
+  - type: input
+    id: version
+    attributes:
+      label: PatchFlow version
+      placeholder: Output of patchflow version
+    validations:
+      required: true
+  - type: input
+    id: rule
+    attributes:
+      label: Rule or finding ID
+      placeholder: G404, PY001, framework rule ID, CVE, or secret pattern
+    validations:
+      required: true
+  - type: input
+    id: command
+    attributes:
+      label: Command and profile
+      placeholder: patchflow scan run --profile standard
+    validations:
+      required: true
+  - type: textarea
+    id: fixture
+    attributes:
+      label: Minimal public fixture
+      description: Provide the smallest vulnerable-looking but safe example and its language/framework.
+      render: text
+    validations:
+      required: true
+  - type: textarea
+    id: reasoning
+    attributes:
+      label: Why this is a false positive
+      description: Identify the sanitizer, safe API, control flow, context, or rule assumption that makes the finding incorrect.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected detection behavior
+      description: Explain what should be suppressed and what nearby genuinely vulnerable pattern must still be detected.
+    validations:
+      required: true
+  - type: textarea
+    id: noise
+    attributes:
+      label: Noise impact
+      description: Estimate frequency or provide redacted counts if this affects more than one finding.
+  - type: checkboxes
+    id: suppression
+    attributes:
+      label: Temporary suppression
+      options:
+        - label: I confirmed whether a documented `patchflow:ignore` directive is an acceptable temporary workaround.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,51 @@
+name: Feature request
+description: Propose a user outcome or workflow improvement for PatchFlow CLI.
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Preflight
+      options:
+        - label: I searched existing issues and the current command documentation.
+          required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: Describe the user problem without prescribing an implementation.
+    validations:
+      required: true
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Desired outcome
+      description: What should a user be able to accomplish, and how would success be measured?
+    validations:
+      required: true
+  - type: textarea
+    id: workflow
+    attributes:
+      label: Current workflow and alternatives
+      description: Show the current commands or workarounds and why they are insufficient.
+    validations:
+      required: true
+  - type: textarea
+    id: interface
+    attributes:
+      label: Proposed CLI or output contract
+      description: Optional example flags, JSON/SARIF fields, exit codes, or configuration.
+  - type: textarea
+    id: privacy
+    attributes:
+      label: Local-first, privacy, and security impact
+      description: Identify any source upload, network call, credential, sandbox, or trust-boundary change.
+    validations:
+      required: true
+  - type: textarea
+    id: compatibility
+    attributes:
+      label: Compatibility and performance impact
+      description: Note platform, schema, runtime, binary-size, benchmark, or migration concerns.

.github/ISSUE_TEMPLATE/rule_request.yml

@@ -0,0 +1,74 @@
+name: Security rule request
+description: Propose a new vulnerability pattern, framework rule, source, sink, or sanitizer.
+title: "[Rule]: "
+labels:
+  - enhancement
+body:
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Preflight
+      options:
+        - label: I searched existing rules and requests for this behavior.
+          required: true
+        - label: All examples are synthetic or public and safe to disclose.
+          required: true
+  - type: input
+    id: ecosystem
+    attributes:
+      label: Language and framework
+      placeholder: Python / FastAPI
+    validations:
+      required: true
+  - type: input
+    id: weakness
+    attributes:
+      label: Weakness classification
+      description: CWE, OWASP category, or a concise vulnerability class.
+      placeholder: CWE-89 SQL Injection
+    validations:
+      required: true
+  - type: textarea
+    id: threat
+    attributes:
+      label: Threat and user impact
+      description: Explain the trust boundary, attacker-controlled input, sink, and realistic impact.
+    validations:
+      required: true
+  - type: textarea
+    id: vulnerable
+    attributes:
+      label: Vulnerable fixture
+      render: text
+    validations:
+      required: true
+  - type: textarea
+    id: safe
+    attributes:
+      label: Safe control fixture
+      description: Show a sanitizer, safe API, or pattern that must not produce a finding.
+      render: text
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed detection contract
+      description: Suggest sources, sinks, sanitizers, file types, severity, message, and limitations.
+    validations:
+      required: true
+  - type: textarea
+    id: references
+    attributes:
+      label: Authoritative references
+      description: Link vendor documentation, a CWE, advisory, or framework security guidance.
+  - type: dropdown
+    id: contribution
+    attributes:
+      label: Contribution interest
+      options:
+        - I can open a pull request with rule and fixtures
+        - I can help test a proposed rule
+        - I am requesting maintainer implementation
+    validations:
+      required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,43 @@
+## Outcome
+
+Describe the user/developer problem and the outcome delivered by this pull request.
+
+## Scope
+
+- Included:
+- Explicitly not included:
+- Compatibility or migration notes:
+
+## Verification
+
+List exact commands and results. Explain every intentional skip.
+
+- [ ] `go mod tidy` leaves `go.mod` and `go.sum` unchanged.
+- [ ] `gofmt` produces no diff.
+- [ ] `go vet ./...` passes.
+- [ ] Relevant focused tests pass.
+- [ ] `go test ./... -timeout 10m` passes.
+- [ ] `go build ./...` passes.
+- [ ] User-facing documentation is updated when behavior or output changes.
+
+## Rule, noise, and benchmark impact
+
+- Finding/rule IDs affected:
+- Vulnerable fixture added or updated:
+- Safe control fixture added or updated:
+- False-positive/false-negative impact:
+- Runtime, memory, binary-size, or benchmark impact:
+- If not applicable, explain why:
+
+## Security and privacy
+
+- [ ] No real secrets, tokens, private source, customer data, or personal data are included.
+- [ ] New network calls, credential access, source upload, and trust-boundary changes are documented.
+- [ ] Machine-readable output remains valid and logs do not corrupt stdout.
+- [ ] Security-sensitive details were reported privately instead of included here.
+
+## Contribution
+
+- [ ] Commits include a DCO `Signed-off-by` trailer (`git commit -s`).
+- [ ] I have read `CONTRIBUTING.md` and followed the Code of Conduct.
+- [ ] Related issue(s):