Standardise the ChangeGuard showcase and community files

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -3,35 +3,66 @@ description: Report a reproducible ChangeGuard problem
 title: "bug: "
 labels: [bug, needs-triage]
 body:
+  - type: markdown
+    attributes:
+      value: "Use a minimal sanitised example. Never include credentials, tokens, merchant/customer data, private source, or production secrets. For suspected vulnerabilities, use the private reporting link."
   - type: input
-    id: version
+    id: tool-version
     attributes:
-      label: ChangeGuard version
+      label: Tool version
     validations:
       required: true
   - type: input
-    id: node
+    id: runtime
+    attributes:
+      label: Node.js and npm versions
+      placeholder: Node.js 22.x; npm 10.x
+    validations:
+      required: true
+  - type: dropdown
+    id: operating-system
     attributes:
-      label: Node.js version
+      label: Operating system
+      options:
+        - Linux
+        - macOS
+        - Windows
+        - Other
     validations:
       required: true
   - type: dropdown
     id: mode
     attributes:
       label: Execution mode
-      options: [CLI, GitHub Action]
+      options:
+        - CLI
+        - GitHub Action
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal sanitised reproduction
+      description: Use synthetic configuration and source where possible. Remove credentials, merchant data, private URLs, and secrets.
     validations:
       required: true
   - type: textarea
-    id: configuration
+    id: expected
     attributes:
-      label: Minimal anonymised TOML
-      description: Remove secrets, credentials, private URLs, webhook destinations, and customer data.
+      label: Expected behaviour
     validations:
       required: true
   - type: textarea
-    id: behaviour
+    id: actual
     attributes:
-      label: Expected and actual behaviour
+      label: Actual behaviour
     validations:
       required: true
+  - type: textarea
+    id: output
+    attributes:
+      label: Sanitised output
+      description: Optional. Remove private paths and any sensitive values.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/compatibility_report.yml

@@ -0,0 +1,54 @@
+name: Compatibility report
+description: Report a version-specific Shopify or runtime compatibility issue
+title: "compatibility: "
+labels: [needs-triage]
+body:
+  - type: markdown
+    attributes:
+      value: "Use a minimal sanitised example. Do not include credentials, merchant/customer data, private source, or production secrets."
+  - type: input
+    id: tool-version
+    attributes:
+      label: Tool version
+    validations:
+      required: true
+  - type: input
+    id: api-version
+    attributes:
+      label: Shopify API version or runtime/framework version
+      description: Use N/A when this report is not version-specific.
+    validations:
+      required: true
+  - type: input
+    id: surface
+    attributes:
+      label: Affected Shopify surface or integration
+    validations:
+      required: true
+  - type: input
+    id: evidence
+    attributes:
+      label: Official Shopify documentation or release note
+      description: Link the source that describes the expected behaviour.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal sanitised reproduction
+      description: Include only the relevant config/source pattern.
+    validations:
+      required: true
+  - type: textarea
+    id: expected-observed
+    attributes:
+      label: Expected and observed behaviour
+    validations:
+      required: true
+  - type: textarea
+    id: false-positive
+    attributes:
+      label: Similar behaviour that should not be affected
+      description: Optional, but useful when proposing a static-analysis rule.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -5,4 +5,4 @@ contact_links:
     about: Do not report suspected vulnerabilities or include secrets in a public issue.
   - name: Support and usage questions
     url: https://github.com/RexCode-Digital/shopify-app-changeguard/blob/main/SUPPORT.md
-    about: Review the support guide before opening a usage question.
+    about: Use the support guide for safe reproductions and usage questions.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,22 +1,42 @@
 name: Feature request
-description: Propose a useful, evidence-backed improvement
+description: Describe a focused improvement and the developer problem it solves
 title: "feature: "
 labels: [enhancement, needs-triage]
 body:
+  - type: markdown
+    attributes:
+      value: "Do not include credentials, merchant/customer data, private source, or production secrets."
   - type: textarea
     id: problem
     attributes:
-      label: Problem
+      label: Problem and use case
+      description: What task is difficult today, and who needs the change?
     validations:
       required: true
   - type: textarea
     id: proposal
     attributes:
-      label: Proposed behaviour and anonymised example
+      label: Proposed behaviour
+      description: Describe the smallest useful change and an example.
     validations:
       required: true
   - type: input
-    id: documentation
+    id: evidence
+    attributes:
+      label: Official Shopify documentation or other evidence
+      description: Link an official source when the request depends on Shopify behaviour.
+    validations:
+      required: false
+  - type: textarea
+    id: compatibility
     attributes:
-      label: Official Shopify documentation link
-      description: Required when the request depends on Shopify semantics.
+      label: Compatibility considerations
+      description: Note affected API versions, runtimes, frameworks, or existing workflows.
+    validations:
+      required: false
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+    validations:
+      required: false

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,14 +1,30 @@
 ## Summary
 
-Describe the focused change and why it is needed.
+## Motivation
 
-## Safety and semantics
+## Changes
 
-- [ ] This does not imply Shopify affiliation or endorsement.
-- [ ] Sensitive values remain redacted from findings, errors, and summaries.
-- [ ] Shopify semantic claims cite current official documentation where relevant.
-- [ ] No credentials, telemetry, network access, or unsafe shell interpolation was added.
+## Tests performed
 
-## Validation
+- [ ] Add the tests and checks actually run below.
 
-List the commands run and their results, including tests and Action/package checks.
+## Compatibility
+
+## Security and privacy
+
+Preserve sensitive-value redaction and offline review. Do not add credentials, telemetry, Shopify network calls, or unsafe shell interpolation. Do not imply Shopify affiliation or endorsement.
+
+## Shopify source/evidence
+
+Link official Shopify documentation for Shopify-specific behaviour, or write N/A.
+
+## Release impact
+
+State whether the change affects package behaviour, Action behaviour, documentation, or release version.
+
+## Checklist
+
+- [ ] The change is focused and the docs/examples match the implementation.
+- [ ] Relevant regression tests and checks are recorded above.
+- [ ] Generated distributions are up to date where required.
+- [ ] No sensitive or third-party material was added without permission/licence review.

CODE_OF_CONDUCT.md

@@ -1,3 +1,5 @@
 # Code of Conduct
 
-Contributors are expected to be respectful, constructive, and inclusive. Harassment, discrimination, doxxing, threats, and deliberate exposure of secrets or private customer data are not acceptable. Maintainers may remove content or restrict participation when necessary to keep the project safe.
+Contributors and participants are expected to be respectful, constructive, and inclusive. Harassment, discrimination, doxxing, threats, and deliberate exposure of secrets or private customer data are not acceptable.
+
+Report conduct concerns privately to the project maintainer using the contact address listed on the [RexCode Digital organisation profile](https://github.com/RexCode-Digital#readme). Maintainers may remove content or restrict participation when necessary to keep the project safe.

CONTRIBUTING.md

@@ -1,32 +1,13 @@
 # Contributing to ChangeGuard
 
-Thanks for helping improve ChangeGuard.
+Contributions are welcome around semantic Shopify app configuration review, risk explanations, path/ref safety, privacy-preserving redaction, and deterministic fixtures.
 
-The project deliberately prefers **small, deterministic, privacy-safe review semantics** over a large noisy rule catalogue. ChangeGuard should help a human reviewer understand meaningful Shopify app configuration changes without exposing sensitive values.
+This project is MIT licensed. You retain copyright in your contributions and confirm you have the right to submit them. Identify third-party code and assets with their applicable licences.
 
-## Good contribution areas
+Use Node.js 22 or newer. Install the locked dependencies and run the relevant checks before opening a pull request:
 
-- Additional high-value Shopify app configuration semantics backed by current official documentation
-- Redaction hardening
-- False-positive reductions
-- Privacy-safe fixture coverage
-- Deterministic risk rationale improvements
-- Cross-platform Git/ref handling
-- GitHub Action and CLI reliability
-- Documentation and reproducible examples
-
-Browse the [open issues](https://github.com/RexCode-Digital/shopify-app-changeguard/issues) for current work.
-
-## Contribution terms
-
-You retain copyright in your contributions. By submitting a contribution, you agree that it is provided under the same MIT licence that applies to this project. You confirm that you have the right to submit the contribution. Disclose any third-party code or assets and identify their applicable licences before including them.
-
-## Development
-
-Requires Node.js 22 or newer. CI covers Node.js 22 and 24; the bundled GitHub Action uses the Node.js 24 runtime.
-
-```bash
-npm ci --ignore-scripts
+```sh
+npm ci
 npm test
 npm run coverage
 npm run lint
@@ -37,55 +18,8 @@ npm run action:check
 npm run format:check
 ```
 
-Use `npm run build` when source changes affect generated output. After rebuilding, ensure the committed Action bundle is deterministic and clean.
-
-## Semantic-change checklist
-
-For comparison or rule changes, include:
-
-1. the Shopify configuration behaviour being reviewed
-2. current official Shopify documentation where relevant
-3. a positive change fixture
-4. an unchanged or negative case
-5. ordering/set behaviour where relevant
-6. sensitive-value redaction coverage
-7. stable rule/risk behaviour where applicable
-
-Unsupported or malformed configuration must never be silently reported as clean.
-
-## Safety principles
-
-Do not add:
-
-- telemetry
-- Shopify credentials
-- Shopify network/API calls for ordinary review
-- unsafe shell interpolation
-- execution of repository configuration
-- raw sensitive values in findings, errors, summaries, or tests
-
-Never commit real merchant configuration, credentials, customer data, private URLs, webhook destinations, or access tokens.
-
-## Pull requests
-
-Keep PRs focused. Explain:
-
-- the problem
-- the intended reviewer behaviour
-- any Shopify documentation relied on
-- privacy/redaction implications
-- commands run and their results
-
-AI-assisted contributions are welcome, but the human submitter must review and understand the change.
-
-These repositories use a solo-maintainer review model. Keep changes in pull requests and merge only after the required automated checks pass. CODEOWNERS may route review requests, but human approval is not a merge requirement.
-
-## Coverage
-
-Current coverage gates protect comparison and redaction paths. Do not weaken them to land a change.
-
-## Security
+Add a regression test for each behaviour change. Keep fixtures synthetic and sanitised. Link current official Shopify evidence for Shopify-specific rules or mappings, and include a negative case where static detection could otherwise produce a false positive. Keep output deterministic and preserve the product's uncertainty and privacy boundaries.
 
-Use [GitHub private vulnerability reporting](https://github.com/RexCode-Digital/shopify-app-changeguard/security/advisories/new) for suspected vulnerabilities. Do not disclose security-sensitive details in public issues.
+The project follows a solo-maintainer review model. Use a focused pull request and record the checks actually run. Human approval is not a branch-protection requirement; automated checks remain required. AI-assisted contributions are welcome. Contributors are responsible for reviewing and understanding every submitted change.
 
-ChangeGuard does not certify Shopify compliance, security, or deployment safety.
+Read the shared [RexCode Open Source standards](https://github.com/RexCode-Digital/.github/blob/main/docs/oss/standards.md). For security reports, use [SECURITY.md](SECURITY.md); for safe usage questions, use [SUPPORT.md](SUPPORT.md).