Add a security policy and issue templates

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,41 @@
+name: Bug report
+description: Something is not working as expected
+labels: ["bug"]
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      description: What did you expect to happen, and what happened instead?
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Exporter version
+      description: Output of `github_actions_exporter --version` or the container image tag.
+    validations:
+      required: true
+  - type: dropdown
+    id: deployment
+    attributes:
+      label: How do you run the exporter?
+      options:
+        - Binary
+        - Container image
+        - Helm chart
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: config
+    attributes:
+      label: Flags and configuration
+      description: The flags/environment variables you use. **Remove tokens and secrets.**
+      render: shell
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: Relevant logs, ideally with `--log.level=debug`. **Remove tokens and secrets.**
+      render: text

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/cpanato/github_actions_exporter/security/advisories/new
+    about: Please report security issues privately, not in a public issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,22 @@
+name: Feature request
+description: Suggest a new metric or improvement
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: use-case
+    attributes:
+      label: What do you want to achieve?
+      description: Describe the use case, e.g. the question you want to answer with the metrics.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: The metric, flag or behaviour you would like, and the GitHub API or webhook event it could come from.
+  - type: checkboxes
+    id: contribute
+    attributes:
+      label: Contribution
+      options:
+        - label: I would be willing to open a pull request for this

SECURITY.md

@@ -0,0 +1,23 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are released in the latest version of the exporter. Please make sure you can reproduce
+the problem with the [latest release](https://github.com/cpanato/github_actions_exporter/releases/latest) before reporting it.
+
+## Reporting a Vulnerability
+
+Please **do not** open a public issue for security vulnerabilities.
+
+Report them privately using GitHub's
+[private vulnerability reporting](https://github.com/cpanato/github_actions_exporter/security/advisories/new)
+(Security tab → *Report a vulnerability*).
+
+Please include:
+
+- the affected version and how you run the exporter (binary, container image, Helm chart)
+- a description of the issue and its impact
+- steps or a proof of concept to reproduce it
+
+You can expect an initial response within a few days. Once the issue is confirmed, a fix is prepared
+privately, released, and the advisory is published.