chore(scaffold): community health files, engine dev-stamp alignment

.github/FUNDING.yml

@@ -0,0 +1,14 @@
+# These are supported funding model platforms
+
+github: rennf93
+# patreon: # Replace with a single Patreon username
+# open_collective: # Replace with a single Open Collective username
+# ko_fi: # Replace with a single Ko-fi username
+# tidelift: # not applicable for this ecosystem
+# community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+# liberapay: # Replace with a single Liberapay username
+# issuehunt: # Replace with a single IssueHunt username
+# lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
+# polar: # Replace with a single Polar username
+# buy_me_a_coffee: # Replace with a single Buy Me a Coffee username
+custom: ['https://paypal.me/renzof93']

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,53 @@
+name: Bug report
+description: Guard Core PHP does not behave as documented
+title: "[BUG] "
+labels: [bug]
+body:
+  - type: input
+    id: value
+    attributes:
+      label: Value this delivers
+      description: One sentence a user could witness once this is fixed.
+      placeholder: "Requests whose JSON body contains a URL are no longer flagged on endpoints that disable suspicious-pattern detection."
+    validations:
+      required: true
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened
+      description: What you did, what you expected, what you got. Error messages, tracebacks and logs go here.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Configure Guard Core PHP with '...'
+        2. Send a request to '...'
+        3. See error
+    validations:
+      required: true
+  - type: input
+    id: versions
+    attributes:
+      label: Versions
+      description: guard-core-php version, PHP version, OS.
+      placeholder: "guard-core-php 4.2.0, PHP 8.3.14, Ubuntu 24.04"
+    validations:
+      required: true
+  - type: textarea
+    id: config
+    attributes:
+      label: Configuration
+      description: Your config with secrets masked.
+      render: php
+      placeholder: |
+        use RenzoFranceschini\GuardCore\Config\SecurityConfig;
+
+        $config = new SecurityConfig(...);
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Production or development, consistent or intermittent, workarounds tried.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Guard Core PHP Documentation
+    url: https://rennf93.github.io/guard-core-php/
+    about: Check the documentation for usage information and tutorials
+  - name: Usage Questions
+    url: https://github.com/rennf93/guard-core-php/discussions
+    about: Please ask and answer questions in GitHub Discussions
+  - name: Discord
+    url: https://discord.gg/ZW7ZJbjMkK
+    about: Questions and support in #help, new versions in #releases, development stream in #dev-feed

.github/ISSUE_TEMPLATE/docs.yml

@@ -0,0 +1,31 @@
+name: Documentation
+description: Wrong, missing or unclear Guard Core PHP documentation
+title: "[DOCS] "
+labels: [documentation]
+body:
+  - type: input
+    id: value
+    attributes:
+      label: Value this delivers
+      description: One sentence a reader could witness once this is fixed.
+      placeholder: "The Redis page shows the exact config for a TLS connection."
+    validations:
+      required: true
+  - type: input
+    id: page
+    attributes:
+      label: Page
+      description: URL of the page or section.
+    validations:
+      required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: What is wrong or missing
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed text
+      render: markdown

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,35 @@
+name: Feature request
+description: Suggest an improvement to Guard Core PHP
+title: "[FEATURE] "
+labels: [enhancement]
+body:
+  - type: input
+    id: value
+    attributes:
+      label: Value this delivers
+      description: One sentence a user could witness once this exists.
+      placeholder: "A single decorator disables all detection for one endpoint."
+    validations:
+      required: true
+  - type: textarea
+    id: job
+    attributes:
+      label: The job you are trying to get done
+      description: The outcome you need, not the mechanism you imagine.
+    validations:
+      required: true
+  - type: textarea
+    id: workaround
+    attributes:
+      label: How you work around it today
+  - type: textarea
+    id: example
+    attributes:
+      label: Example usage
+      description: Pseudocode of how you would like to use it.
+      render: php
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Similar features in other libraries, constraints, API implications.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,61 @@
+Delivers issue: #
+
+<!--- Every PR closes an open issue. Chores and dependency bumps take the `no-issue` label instead. -->
+
+Description
+===========
+
+<!--- Describe your changes in detail -->
+
+___
+
+Motivation and Context
+----------------------
+
+<!--- Why is this change required? What problem does it solve? -->
+<!--- If adding a new feature, please describe the motivation for it -->
+
+___
+
+Type of change
+--------------
+
+<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
+
+- [ ] Bug fix (non-breaking change which fixes an issue)
+- [ ] New feature (non-breaking change which adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to change)
+- [ ] Documentation change
+- [ ] Performance improvement
+- [ ] Code cleanup or refactoring
+
+___
+
+How Has This Been Tested
+-------------------------
+
+<!--- Please describe in detail how you tested your changes. -->
+<!--- Include details of your testing environment, and the tests you ran to -->
+<!--- see how your change affects other areas of the code, etc. -->
+
+___
+
+Screenshots (if appropriate)
+-----------------------------
+
+___
+
+Checklist
+---------
+
+<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
+<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
+
+- [ ] My code follows the code style of this project (Mypy, Ruff)
+- [ ] I have added tests to cover my changes
+- [ ] All new and existing tests passed
+- [ ] My change requires a change to the documentation
+- [ ] I have updated the documentation accordingly
+- [ ] I have checked that my changes don't introduce any new warnings or errors
+- [ ] I have updated the version number if necessary
+- [ ] I have added any new dependencies to the appropriate requirements file

.github/workflows/ecosystem-gate.yml

@@ -70,12 +70,27 @@ jobs:
           ref: ${{ github.event.inputs.consumer_ref }}
           path: ${{ matrix.consumer.path }}
 
+      # slim-guard 1.2.0 added the rennf93/psr15-guard path repository and
+      # its composer.lock pins psr15-guard at the CI-only 1.2.99 path
+      # version, which Packagist cannot satisfy: without the sibling the
+      # install fails with "Source path ../psr15-guard is not found". Check
+      # the sibling out next to the consumer (same pattern as slim-guard's
+      # own ci.yml); the patch step below stamps it.
+      - name: Checkout the psr15-guard path sibling (slim-guard)
+        if: matrix.consumer.repo == 'rennf93/slim-guard'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: rennf93/psr15-guard
+          ref: master
+          path: psr15-guard
+          persist-credentials: false
+
       # guard-core-php v4.1.0 was yanked: the tag is deleted and Packagist
       # no longer lists it, so ^4.1.0 cannot resolve from Packagist and the
       # consumer's github VCS fallback hard-fails (anonymous GitHub API auth).
       # CI-only patch, runner filesystem only, published files untouched:
       # stamp a version onto this checkout's composer.json so the consumer's
-      # path repository supplies a ^4.1.0 version without git (shallow
+      # path repository supplies a ^4.2.0 version without git (shallow
       # detached checkout, dubious ownership inside the container), and drop
       # the engine VCS repo entry so composer never eagerly clones github.
       - name: Resolve the engine from this checkout (CI-only patch)
@@ -87,19 +102,31 @@ jobs:
           engine = "guard-core-php/composer.json"
           with open(engine) as f:
               d = json.load(f)
-          d["version"] = "4.1.99"
+          d["version"] = "4.2.99"
           with open(engine, "w") as f:
               json.dump(d, f, indent=4)
               f.write("\n")
 
+          # The slim-guard sibling gets the same CI-only version stamp: a
+          # detached checkout carries no version a path repository can
+          # infer, and the consumer's lock pins psr15-guard at 1.2.99.
+          psr15 = "psr15-guard/composer.json"
+          if os.path.isfile(psr15):
+              with open(psr15) as f:
+                  d = json.load(f)
+              d["version"] = "1.2.99"
+              with open(psr15, "w") as f:
+                  json.dump(d, f, indent=4)
+                  f.write("\n")
+
           consumer = "${{ matrix.consumer.path }}/composer.json"
           with open(consumer) as f:
               d = json.load(f)
           # Drop every VCS repo entry (any github fallback hard-fails on
           # anonymous API auth now) and every path entry whose directory is
-          # not checked out in this workspace (slim-guard also carries a
-          # psr15-guard pair whose sibling does not exist here; it resolves
-          # from Packagist instead).
+          # not checked out in this workspace; those resolve from Packagist.
+          # The slim-guard job checks the psr15-guard sibling out above, so
+          # its path pair is kept and installs from the workspace.
           d["repositories"] = [
               repo
               for repo in d.get("repositories", [])

.github/workflows/semgrep.yml

@@ -0,0 +1,38 @@
+name: Semgrep
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - 'src/**'
+      - '.github/workflows/semgrep.yml'
+  pull_request:
+    paths:
+      - 'src/**'
+      - '.github/workflows/semgrep.yml'
+  schedule:
+    - cron: '0 7 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  semgrep:
+    name: Security audit (semgrep)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    container:
+      image: semgrep/semgrep:1.177.0
+    env:
+      SEMGREP_SEND_METRICS: off
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Scan src with the security-audit and secrets rulesets
+        run: semgrep scan --config p/security-audit --config p/secrets --metrics=off --error --quiet src