Feat/mvp

.editorconfig

@@ -0,0 +1,22 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.go]
+indent_style = tab
+indent_size = 4
+
+[*.{yml,yaml,json,toml,md}]
+indent_style = space
+indent_size = 2
+
+[*.g4]
+indent_style = space
+indent_size = 4
+
+[Makefile]
+indent_style = tab

.env.example

@@ -0,0 +1,13 @@
+# Copy to .env and adjust. The file is never committed, and opendba itself does
+# not read it: the development tooling loads it and hands the values to the
+# program it starts. Relative XDG paths are resolved against the repository root.
+
+# Keep connection profiles, settings and history inside the repository instead
+# of your home directory, so local experiments leave nothing behind.
+XDG_CONFIG_HOME=.local/config
+XDG_STATE_HOME=.local/state
+
+# Passwords belong in your keychain or in the encrypted vault, which is what the
+# setup wizard uses. Only put one here for a throwaway local database, and only
+# because a profile can point at it with secret = "env:OPENDBA_DEMO_PASSWORD".
+# OPENDBA_DEMO_PASSWORD=hunter2

.github/CODEOWNERS

@@ -0,0 +1,6 @@
+* @sonquer
+
+/src/cli/pkg/sqlguard/   @sonquer
+/src/cli/pkg/sqldialect/ @sonquer
+/src/cli/pkg/secretref/  @sonquer
+/.github/                @sonquer

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,38 @@
+name: Bug report
+description: Something behaves differently than it should
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        If the bug lets a write reach a READ ONLY connection, or exposes a secret,
+        please report it through a private security advisory instead.
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened
+      description: What you did, what happened, what you expected instead.
+    validations:
+      required: true
+  - type: textarea
+    id: statement
+    attributes:
+      label: The statement, if SQL is involved
+      description: Paste the exact SQL and the verdict OPENDBA gave it.
+      render: sql
+  - type: input
+    id: driver
+    attributes:
+      label: Driver and server version
+      placeholder: PostgreSQL 16.3
+  - type: input
+    id: version
+    attributes:
+      label: OPENDBA version or commit
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Operating system and terminal
+      placeholder: macOS 15, Ghostty

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/sonquer/opendba/security/advisories/new
+    about: Report privately, not in a public issue.
+  - name: Question or idea
+    url: https://github.com/sonquer/opendba/discussions
+    about: Ask and discuss before opening an issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,21 @@
+name: Feature request
+description: Suggest something OPENDBA should do
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem
+      description: What are you trying to do that OPENDBA makes hard today?
+    validations:
+      required: true
+  - type: textarea
+    id: idea
+    attributes:
+      label: What you have in mind
+  - type: checkboxes
+    id: scope
+    attributes:
+      label: Scope
+      options:
+        - label: This does not require OPENDBA to write to a database on its own.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,10 @@
+## What and why
+
+<!-- What changes, and what problem it solves. The diff already shows how. -->
+
+## Checklist
+
+- [ ] `go run ./src/tools/cmd/dev check --ci` passes
+- [ ] No comment explains code; anything new that is exported is documented
+- [ ] Tests were written with the code, not after it
+- [ ] Changes to the SQL classifier come with new golden table cases

.github/dependabot.yml

@@ -0,0 +1,33 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /src/cli
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 10
+    groups:
+      go-dependencies:
+        patterns: ["*"]
+
+  - package-ecosystem: gomod
+    directory: /src/tools
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 10
+    groups:
+      go-dependencies:
+        patterns: ["*"]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns: ["*"]