From 8926d3d9230d3234c4efb65ed2a617d46d1d7e08 Mon Sep 17 00:00:00 2001
From: Carlos Panato <ctadeu@gmail.com>
Date: Fri, 9 Oct 2026 18:05:50 +0200
Subject: [PATCH] Add a security policy and issue templates

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Carlos Panato <ctadeu@gmail.com>
---
 .github/ISSUE_TEMPLATE/bug_report.yml      | 41 ++++++++++++++++++++++
 .github/ISSUE_TEMPLATE/config.yml          |  5 +++
 .github/ISSUE_TEMPLATE/feature_request.yml | 22 ++++++++++++
 SECURITY.md                                | 23 ++++++++++++
 4 files changed, 91 insertions(+)
 create mode 100644 .github/ISSUE_TEMPLATE/bug_report.yml
 create mode 100644 .github/ISSUE_TEMPLATE/config.yml
 create mode 100644 .github/ISSUE_TEMPLATE/feature_request.yml
 create mode 100644 SECURITY.md

diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
new file mode 100644
index 0000000..192fcaa
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -0,0 +1,41 @@
+name: Bug report
+description: Something is not working as expected
+labels: ["bug"]
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      description: What did you expect to happen, and what happened instead?
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Exporter version
+      description: Output of `github_actions_exporter --version` or the container image tag.
+    validations:
+      required: true
+  - type: dropdown
+    id: deployment
+    attributes:
+      label: How do you run the exporter?
+      options:
+        - Binary
+        - Container image
+        - Helm chart
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: config
+    attributes:
+      label: Flags and configuration
+      description: The flags/environment variables you use. **Remove tokens and secrets.**
+      render: shell
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: Relevant logs, ideally with `--log.level=debug`. **Remove tokens and secrets.**
+      render: text
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000..b54771a
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/cpanato/github_actions_exporter/security/advisories/new
+    about: Please report security issues privately, not in a public issue.
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
new file mode 100644
index 0000000..2c7071d
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -0,0 +1,22 @@
+name: Feature request
+description: Suggest a new metric or improvement
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: use-case
+    attributes:
+      label: What do you want to achieve?
+      description: Describe the use case, e.g. the question you want to answer with the metrics.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: The metric, flag or behaviour you would like, and the GitHub API or webhook event it could come from.
+  - type: checkboxes
+    id: contribute
+    attributes:
+      label: Contribution
+      options:
+        - label: I would be willing to open a pull request for this
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..1131c07
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,23 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are released in the latest version of the exporter. Please make sure you can reproduce
+the problem with the [latest release](https://github.com/cpanato/github_actions_exporter/releases/latest) before reporting it.
+
+## Reporting a Vulnerability
+
+Please **do not** open a public issue for security vulnerabilities.
+
+Report them privately using GitHub's
+[private vulnerability reporting](https://github.com/cpanato/github_actions_exporter/security/advisories/new)
+(Security tab → *Report a vulnerability*).
+
+Please include:
+
+- the affected version and how you run the exporter (binary, container image, Helm chart)
+- a description of the issue and its impact
+- steps or a proof of concept to reproduce it
+
+You can expect an initial response within a few days. Once the issue is confirmed, a fix is prepared
+privately, released, and the advisory is published.