From 705b51cbb0cc70ae27e16ee52fe835a988972afa Mon Sep 17 00:00:00 2001 From: Diego Cotelo Date: Fri, 18 Sep 2026 14:46:42 -0300 Subject: [PATCH] chore(github): restructure the issue and pull-request templates MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adopts the shape used in the owasp-ctf repository — headed sections, explicit frontmatter, and a config that turns off blank issues — with the content written for this project rather than copied. The pull-request template is where the difference is real. It now asks for test evidence, names the surfaces a change can touch, and carries a checklist of the things that have actually gone wrong here: an assertion that cannot fail, a bash 3.2 construct that works in 5.x, a missing DCO sign-off, a new script left out of CI's shellcheck list, and an undeclared change to a published contract. The `cut -d. -f` note is there because that exact mistake shipped in 0.14.0 and was caught in review. It also states what the commit type decides, since CI reads the subject to choose whether merging publishes a release. The bug report asks for both `cprof status` and `cprof doctor`, which since 0.14.0 reports statusline config problems and version skew, and keeps the warning about what is safe to paste. The feature request asks for concrete output instead of a description, and for whether the idea has to work without `git` or without network. New: ISSUE_TEMPLATE/config.yml, disabling blank issues so a report arrives with an environment, and routing security reports to private vulnerability reporting. The question link that repository carries was left out: this one has Discussions disabled, so it would have been a dead link. Signed-off-by: Diego Cotelo --- .github/ISSUE_TEMPLATE/bug_report.md | 54 ++++++++++++------ .github/ISSUE_TEMPLATE/config.yml | 5 ++ .github/ISSUE_TEMPLATE/feature_request.md | 24 ++++++-- .github/PULL_REQUEST_TEMPLATE.md | 69 +++++++++++++++++++++-- 4 files changed, 125 insertions(+), 27 deletions(-) create mode 100644 .github/ISSUE_TEMPLATE/config.yml diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index 69a472a..acfe5c6 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -1,28 +1,50 @@ --- name: Bug report -about: Something behaves wrong +about: Something cprof does wrong +title: '' labels: bug +assignees: '' --- -**What happened** + -**What you expected** +## Environment -**Reproduce** +- **cprof version:** +- **Install method:** +- **Plugin installed:** +- **macOS version:** +- **bash version:** +- **jq version:** + +## Steps to reproduce + +1. +2. +3. + +## Expected behavior + + + +## Actual behavior + + + +## Diagnostics + + ```console $ cprof status -# paste output — it shows resolution, config path, and active profile + +$ cprof doctor + ``` -**Environment** -- macOS version: -- `bash --version` (first line): -- `cprof version`: -- Install method: brew / downloaded installer (install.sh) / plugin - -**Notes** -`cprof status` and `cprof list` output never contains credentials, but check -before pasting anyway. Never paste keychain output or config JSON containing -tokens. Security issues go to [private reporting](../../security/advisories/new), -not here. + diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..f6ebf8e --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,5 @@ +blank_issues_enabled: false +contact_links: + - name: Report a security vulnerability + url: https://github.com/dcotelo/cprof/security/advisories/new + about: cprof handles credentials and the macOS keychain. Report vulnerabilities through GitHub private vulnerability reporting — see SECURITY.md. Do not open a public issue. diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md index 4cf766a..957f879 100644 --- a/.github/ISSUE_TEMPLATE/feature_request.md +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -1,13 +1,27 @@ --- name: Feature request about: Something cprof should do +title: '' labels: enhancement +assignees: '' --- -**Problem** -What you are trying to do and where cprof gets in the way. +## Problem -**Proposed behavior** + -**Alternatives considered** -Including why the existing commands (`pin`, `rule`, `default`, `env`) don't cover it. +## Proposed behavior + + + +## Alternatives considered + + + +## Additional context + + diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index 09621cc..79f3b84 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -1,9 +1,66 @@ -## What +## Summary -## Why + -## Testing +## Type -- [ ] `bash tests/run.sh` passes -- [ ] `shellcheck -x -P scripts -P tests scripts/cprof scripts/lib/*.sh hooks/*.sh statusline/*.sh tests/*.sh .github/scripts/*.sh docs/demo/*.sh docs/demo/bin/* install.sh` is clean -- [ ] New behavior carries an assertion in `tests/` + + +- [ ] feat +- [ ] fix +- [ ] perf +- [ ] docs +- [ ] test +- [ ] chore +- [ ] ci +- [ ] refactor + +## Surface(s) touched + +- [ ] CLI (`scripts/cprof`, `scripts/lib/*.sh`) +- [ ] statusline (`scripts/lib/statusline.sh`, `statusline/segment.sh`) +- [ ] plugin (`hooks/`, `commands/`, manifests) +- [ ] installer (`install.sh`) +- [ ] docs (`README.md`, `docs/`, `CONTRIBUTING.md`) +- [ ] CI and release automation (`.github/`) + +## Test evidence + + + +## Checklist + +- [ ] `bash tests/run.sh` passes, and CI is green. +- [ ] shellcheck is clean over the file list CI uses + (`.github/workflows/ci.yml`; a new script must be added to it). +- [ ] New behavior carries an assertion in `tests/`. +- [ ] **My tests can FAIL**: I can name the single change to the code that + each new or changed assertion would catch, and I have watched it fail. + An assertion that passes whether or not the code works has tested + nothing — this has been caught here more than once. +- [ ] **bash 3.2**: no associative arrays, no `${var,,}`, nothing newer than + the macOS system shell. `cut -d. -f` without `-s` prints the whole + line when the delimiter is absent; prefer `IFS=. read -r -a`. +- [ ] Conventional Commits subject on every commit, matching the Type above. +- [ ] Every commit carries a DCO sign-off (`git commit -s`). +- [ ] No AI attribution anywhere in the commits or this PR (no "Generated + with", no `Co-authored-by:` trailers for an AI tool or agent). +- [ ] Docs updated if this changes user-facing behavior, output or commands — + including the topic doc under `docs/`, not only the README. +- [ ] User-facing output follows the conventions: diagnostics to stderr via + `cp_warn`, `cprof env` stdout reserved for shell-eval output, paths + through `cp_path_display`. +- [ ] Nothing that renders inside a Claude Code session can fail it: a missing + `jq`, an unreadable config, an absent `git` or a missing CLI prints + nothing, or as much as it can, and exits 0. +- [ ] **Breaking changes declared**: if this changes a published contract — a + `~/.cprof.json` key, a `statusline` segment or setting name, a + subcommand or flag, the shape of `cprof env` output, or a cache path — + the summary says so explicitly and gives the upgrade note. Write "None" + if there are none.