chore(github): restructure the issue and pull-request templates

[dcotelo]

Summary

Restructures the issue and pull-request templates into the shape used in the
owasp-ctf repository — headed sections, explicit frontmatter, and a config
that turns blank issues off — with the content written for this project instead
of copied. That repository's templates name its own services, Redis keys and
review invariants, none of which exist here.

Type

• chore

Surface(s) touched

• CI and release automation (.github/)

What changed

PULL_REQUEST_TEMPLATE.md — was three lines of testing checkboxes, one of
which had already drifted out of date (its shellcheck command predated the two
demo-stub directories CI lints). It now asks for test evidence, names the
surface touched, and carries a checklist of what has actually gone wrong in
this repository:

• an assertion that passes whether or not the code works, which is why the
  checklist asks for the single change each new assertion would catch, watched
  failing;
• a bash 3.2 construct that behaves differently in 5.x — including the
  cut -d. -f<n> behaviour that shipped in 0.14.0 and was caught in review;
• a new script left out of CI's shellcheck list, so it points at that list
  rather than repeating it and drifting again;
• a missing DCO sign-off;
• an undeclared change to a published contract, with the contracts named: a
  ~/.cprof.json key, a statusline segment or setting name, a subcommand or
  flag, the shape of cprof env output, a cache path.

It also states what the commit type decides, since CI reads the subject to
choose whether merging publishes a release and at what version.

ISSUE_TEMPLATE/bug_report.md — headed sections, and it now asks for
cprof doctor alongside cprof status: since 0.14.0 doctor reports statusline
config problems and version skew, which is most of what a statusline bug report
needs. Keeps the existing warning about what is safe to paste, since status,
list and doctor never print credentials but a config file and keychain
output can.

ISSUE_TEMPLATE/feature_request.md — asks for concrete output rather than a
description ("show the line you want a command to print"), keeps the useful
prompt about why pin/rule/default/env don't cover it, and adds the two
constraints that shape most answers here: whether it must work without git
and without network.

ISSUE_TEMPLATE/config.yml (new) — blank_issues_enabled: false, so a
report arrives with an environment attached, and a contact link routing security
reports to private vulnerability reporting.

Test evidence

No code touched. Ran anyway:

• bash tests/run.sh -> ALL TESTS PASSED (1130 assertions)
• markdown link check over all tracked files -> 43 links, 0 failures
• config.yml asserted to disable blank issues and to carry a resolving
  contact link; both issue templates asserted to keep their labels:
  frontmatter, since that is what applies bug and enhancement on open

Two deliberate omissions

The question contact link. That repository's config offers one; this
repository has Discussions disabled (has_discussions: false), so it would
have shipped a dead link. Enable Discussions and it is two lines to add.

dependabot.yml. That repository has one. This one deliberately does not:
CONTRIBUTING.md states that every third-party action is pinned to a full
commit SHA and that bumps are reviewed like any other change, and that
shellcheck is "bumped by hand, deliberately, in its own commit". Adding
dependabot would contradict a written policy, so it belongs in a decision of
its own rather than riding along here.

Checklist

• bash tests/run.sh passes, and CI is green.
• shellcheck clean over the file list CI uses (no scripts changed).
• New behavior carries an assertion in tests/ — n/a, no behavior change.
• Conventional Commits subject; chore: publishes no release.
• Every commit carries a DCO sign-off.
• No AI attribution anywhere in the commits or this PR.
• Breaking changes declared: None.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: a0bb3d26-da83-4472-8b45-e4de7f66c948

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}