Standardise the Scope Guard showcase and add coverage gates

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,67 @@
+name: Bug report
+description: Report a reproducible Shopify Scope Guard problem
+title: "bug: "
+body:
+  - type: markdown
+    attributes:
+      value: "Use a minimal sanitised example. Never include credentials, tokens, merchant/customer data, private source, or production secrets. For suspected vulnerabilities, use the private reporting link."
+  - type: input
+    id: tool-version
+    attributes:
+      label: Tool version
+    validations:
+      required: true
+  - type: input
+    id: runtime
+    attributes:
+      label: Node.js and npm versions
+      placeholder: Node.js 22.x; npm 10.x
+    validations:
+      required: true
+  - type: dropdown
+    id: operating-system
+    attributes:
+      label: Operating system
+      options:
+        - Linux
+        - macOS
+        - Windows
+        - Other
+    validations:
+      required: true
+  - type: dropdown
+    id: mode
+    attributes:
+      label: Execution mode
+      options:
+        - CLI
+        - GitHub Action
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal sanitised reproduction
+      description: Use synthetic configuration and source where possible. Remove credentials, merchant data, private URLs, and secrets.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behaviour
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behaviour
+    validations:
+      required: true
+  - type: textarea
+    id: output
+    attributes:
+      label: Sanitised output
+      description: Optional. Remove private paths and any sensitive values.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/compatibility_report.yml

@@ -0,0 +1,53 @@
+name: Compatibility report
+description: Report a version-specific Shopify or runtime compatibility issue
+title: "compatibility: "
+body:
+  - type: markdown
+    attributes:
+      value: "Use a minimal sanitised example. Do not include credentials, merchant/customer data, private source, or production secrets."
+  - type: input
+    id: tool-version
+    attributes:
+      label: Tool version
+    validations:
+      required: true
+  - type: input
+    id: api-version
+    attributes:
+      label: Shopify API version or runtime/framework version
+      description: Use N/A when this report is not version-specific.
+    validations:
+      required: true
+  - type: input
+    id: surface
+    attributes:
+      label: Affected Shopify surface or integration
+    validations:
+      required: true
+  - type: input
+    id: evidence
+    attributes:
+      label: Official Shopify documentation or release note
+      description: Link the source that describes the expected behaviour.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal sanitised reproduction
+      description: Include only the relevant config/source pattern.
+    validations:
+      required: true
+  - type: textarea
+    id: expected-observed
+    attributes:
+      label: Expected and observed behaviour
+    validations:
+      required: true
+  - type: textarea
+    id: false-positive
+    attributes:
+      label: Similar behaviour that should not be affected
+      description: Optional, but useful when proposing a static-analysis rule.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -5,4 +5,4 @@ contact_links:
     about: Do not report suspected vulnerabilities or include secrets in a public issue.
   - name: Support and usage questions
     url: https://github.com/RexCode-Digital/shopify-scope-guard/blob/main/SUPPORT.md
-    about: Review the support guide before opening a usage question.
+    about: Use the support guide for safe reproductions and usage questions.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,24 +1,41 @@
 name: Feature request
-description: Suggest a focused improvement to Scope Guard.
+description: Describe a focused improvement and the developer problem it solves
+title: "feature: "
 body:
+  - type: markdown
+    attributes:
+      value: "Do not include credentials, merchant/customer data, private source, or production secrets."
   - type: textarea
     id: problem
     attributes:
-      label: Problem
-      description: What developer problem would this solve?
+      label: Problem and use case
+      description: What task is difficult today, and who needs the change?
     validations:
       required: true
   - type: textarea
-    id: proposed-behavior
+    id: proposal
     attributes:
-      label: Proposed behavior
-      description: Describe the smallest useful change.
+      label: Proposed behaviour
+      description: Describe the smallest useful change and an example.
     validations:
       required: true
+  - type: input
+    id: evidence
+    attributes:
+      label: Official Shopify documentation or other evidence
+      description: Link an official source when the request depends on Shopify behaviour.
+    validations:
+      required: false
   - type: textarea
-    id: shopify-evidence
+    id: compatibility
     attributes:
-      label: Shopify evidence or source
-      description: If this concerns a scope or API surface, link the relevant official Shopify documentation.
+      label: Compatibility considerations
+      description: Note affected API versions, runtimes, frameworks, or existing workflows.
     validations:
       required: false
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+    validations:
+      required: false

.github/pull_request_template.md

@@ -1,27 +1,30 @@
-## What changed?
+## Summary
 
-<!-- Summarize the focused change. -->
+## Motivation
 
-## Why?
+## Changes
 
-<!-- Explain the user or maintenance problem this addresses. -->
+## Tests performed
 
-## Tests
+- [ ] Add the tests and checks actually run below.
 
-- [ ] `npm test`
-- [ ] `npm run lint`
-- [ ] `npm run typecheck`
-- [ ] `npm run build`
-- [ ] `git diff --check`
+## Compatibility
+
+## Security and privacy
+
+Do not include credentials, merchant/customer data, private source, or production secrets.
 
 ## Shopify source/evidence
 
-<!-- Link official Shopify documentation for new or changed scope evidence, or write N/A. -->
+Link official Shopify documentation for Shopify-specific behaviour, or write N/A.
 
-## Security/privacy impact
+## Release impact
 
-<!-- Explain any impact, or write N/A. Do not include secrets or merchant data. -->
+State whether the change affects package behaviour, Action behaviour, documentation, or release version.
 
-## Documentation impact
+## Checklist
 
-<!-- List updated docs or write N/A. -->
+- [ ] The change is focused and the docs/examples match the implementation.
+- [ ] Relevant regression tests and checks are recorded above.
+- [ ] Generated distributions are up to date where required.
+- [ ] No sensitive or third-party material was added without permission/licence review.

.github/workflows/ci.yml

@@ -1,6 +1,7 @@
 name: CI
 on:
   push:
+    branches: [main]
   pull_request:
 permissions:
   contents: read

.github/workflows/codeql.yml

@@ -1,6 +1,7 @@
 name: CodeQL
 on:
   push:
+    branches: [main]
   pull_request:
   workflow_dispatch:
   schedule:

.github/workflows/scorecard.yml

@@ -6,7 +6,7 @@ on:
     - cron: '17 3 * * 1'
   push:
     branches: [main]
-permissions: read-all
+permissions: {}
 jobs:
   analysis:
     permissions:

CODE_OF_CONDUCT.md

@@ -1,3 +1,5 @@
 # Code of Conduct
 
-Contributors are expected to be respectful, constructive, and inclusive. Harassment and discrimination are not tolerated.
+Contributors and participants are expected to be respectful, constructive, and inclusive. Harassment, discrimination, doxxing, threats, and deliberate exposure of secrets or private customer data are not acceptable.
+
+Report conduct concerns privately to the project maintainer using the contact address listed on the [RexCode Digital organisation profile](https://github.com/RexCode-Digital#readme). Maintainers may remove content or restrict participation when necessary to keep the project safe.