chore: harden QA release and repo process

.distignore

@@ -0,0 +1,30 @@
+# Runtime package is built by bin/build.sh; this file documents the intended
+# WordPress.org exclusions for any tooling that packages from the repo root.
+/.claude
+/.distignore
+/.git
+/.github
+/.gitignore
+/.planning
+/.wordpress-org/source
+/.wp-env.json
+/build
+/docs
+/node_modules
+/test-results
+/tests
+/vendor
+
+*.cache
+.DS_Store
+composer.json
+composer.lock
+package.json
+package-lock.json
+phpcs.xml.dist
+phpstan.neon.dist
+phpunit-*.xml.dist
+playwright.config.ts
+SPEC.md
+TESTING.md
+bin

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Default owner for all changes.
+* @dknauss

.github/ISSUE_TEMPLATE/01-bug-report.yml

@@ -0,0 +1,60 @@
+name: Bug report
+description: Report a reproducible Maestro bug
+title: "[Bug]: "
+labels: ["bug", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a bug. Do not include security vulnerabilities here; use SECURITY.md instead.
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: What went wrong?
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Activate Maestro.
+        2. Click Edit Menu.
+        3. ...
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected result
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual result
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: WordPress version, PHP version, browser, active plugins/themes if relevant.
+      placeholder: |
+        WordPress:
+        PHP:
+        Browser:
+        Maestro:
+        Other admin-menu/capability plugins:
+    validations:
+      required: true
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Pre-submit checks
+      options:
+        - label: I confirmed this is not a security report.
+          required: true
+        - label: I tested with Maestro's latest release or current main branch.
+          required: false

.github/ISSUE_TEMPLATE/02-feature-request.yml

@@ -0,0 +1,39 @@
+name: Feature request
+description: Suggest an improvement for Maestro
+title: "[Feature]: "
+labels: ["enhancement", "triage"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem or use case
+      description: What are you trying to do, and why is the current behavior insufficient?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: Describe the simplest behavior that would solve the problem.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Existing plugins, workarounds, or simpler options.
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - Admin menu editing
+        - Icons
+        - Role visibility
+        - Accessibility
+        - Localization
+        - Testing / QA
+        - Documentation
+        - Release / WordPress.org
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security reports
+    url: https://github.com/dknauss/Maestro/security/advisories/new
+    about: Please report vulnerabilities privately, not in public issues.
+  - name: WordPress.org support
+    url: https://wordpress.org/support/plugin/maestro-menu-editor/
+    about: Get support for the released plugin.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,27 @@
+## Summary
+
+-
+
+## Type of change
+
+- [ ] Bug fix
+- [ ] Feature
+- [ ] Documentation
+- [ ] Tooling / CI
+- [ ] Release / packaging
+
+## Verification
+
+- [ ] `composer test:unit`
+- [ ] `composer lint`
+- [ ] `composer analyse:phpstan`
+- [ ] `npm run test:js`
+- [ ] `npm run check:doc-links`
+- [ ] `npm run test:php`
+- [ ] `npm run test:e2e`
+- [ ] `bash bin/build.sh`
+
+## Notes
+
+- Related issue/phase:
+- Screenshots/video for UI changes:

.github/dependabot.yml

@@ -0,0 +1,37 @@
+version: 2
+updates:
+  - package-ecosystem: composer
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "10:00"
+      timezone: America/Edmonton
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - php
+
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "10:30"
+      timezone: America/Edmonton
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - javascript
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "11:00"
+      timezone: America/Edmonton
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - github-actions

.github/workflows/ci.yml

@@ -18,6 +18,58 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  dependency-health:
+    name: Dependency metadata + audits
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          tools: composer
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+
+      - name: Validate Composer metadata
+        run: composer validate --strict
+
+      - name: Install Composer dependencies
+        run: composer install --no-progress --prefer-dist --no-interaction
+
+      - name: Composer security audit
+        run: composer audit
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      - name: npm security audit with repo allowlist
+        run: npm run audit:npm
+
+  php-lint:
+    name: PHP syntax (PHP ${{ matrix.php }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ['7.4', '8.0', '8.1', '8.2', '8.3']
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up PHP ${{ matrix.php }}
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          coverage: none
+
+      - name: Lint PHP files
+        run: find maestro-menu-editor.php uninstall.php includes tests -name '*.php' -print0 | xargs -0 -n1 php -l
+
   lint:
     name: Coding standards (WPCS)
     runs-on: ubuntu-latest
@@ -34,7 +86,26 @@ jobs:
         run: composer install --no-progress --prefer-dist --no-interaction
 
       - name: Run phpcs (WordPress standard + PHP compatibility)
-        run: vendor/bin/phpcs
+        run: composer lint
+
+  phpstan:
+    name: Static analysis (PHPStan)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          tools: composer
+          coverage: none
+
+      - name: Install Composer dependencies
+        run: composer install --no-progress --prefer-dist --no-interaction
+
+      - name: Run PHPStan
+        run: composer analyse:phpstan
 
   unit:
     name: Unit tests (PHP ${{ matrix.php }})
@@ -58,6 +129,27 @@ jobs:
       - name: Run pure unit tests
         run: composer test:unit
 
+  node-quality:
+    name: JavaScript unit tests + docs links
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      - name: JavaScript unit tests
+        run: npm run test:js
+
+      - name: Documentation link hygiene
+        run: npm run check:doc-links
+
   integration-e2e:
     name: Integration + E2E (wp-env, WP 7.0)
     runs-on: ubuntu-latest
@@ -99,3 +191,41 @@ jobs:
       - name: Stop wp-env
         if: always()
         run: npm run env:stop
+
+  package-check:
+    name: Runtime package + Plugin Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      - name: Build runtime ZIP
+        run: bash bin/build.sh
+
+      - name: Upload runtime ZIP artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: maestro-menu-editor
+          path: build/maestro-menu-editor.zip
+          if-no-files-found: error
+
+      - name: Start wp-env (Docker)
+        run: npm run env:start
+
+      - name: Install Plugin Check
+        run: npx wp-env run cli wp plugin install plugin-check --activate
+
+      - name: Run Plugin Check on runtime tree
+        run: npx wp-env run cli wp plugin check /var/www/html/wp-content/plugins/maestro-menu-editor/build/maestro-menu-editor --format=json
+
+      - name: Stop wp-env
+        if: always()
+        run: npm run env:stop