Harden CI with security, governance, and release gates

.editorconfig

@@ -0,0 +1,16 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 2
+
+[*.py]
+indent_size = 4
+
+[Makefile]
+indent_style = tab
+

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -0,0 +1,66 @@
+name: Bug Report
+description: Capture a production bug, defect, or regression with enough detail to reproduce and triage.
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: Describe the bug in one paragraph.
+      placeholder: What broke, where, and how bad is it?
+    validations:
+      required: true
+  - type: dropdown
+    id: severity
+    attributes:
+      label: Severity
+      options:
+        - sev1 - production outage or data risk
+        - sev2 - major user-facing regression
+        - sev3 - limited defect or workaround exists
+        - sev4 - minor issue
+    validations:
+      required: true
+  - type: textarea
+    id: impact
+    attributes:
+      label: User Impact
+      description: State who is affected, how often, and what is blocked.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction Steps
+      description: Provide exact steps, data, and environment.
+      placeholder: |
+        1. Go to ...
+        2. Submit ...
+        3. Observe ...
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected Behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual Behavior
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Evidence
+      description: Logs, screenshots, traces, or failing commit range.
+  - type: input
+    id: rollback
+    attributes:
+      label: Rollback or Mitigation
+      description: Link the rollback, mitigation, or state why none exists.
+

.github/ISSUE_TEMPLATE/change-request.yml

@@ -0,0 +1,42 @@
+name: Change Request
+description: Formal request for an architectural, operational, or production-impacting change.
+title: "[Change]: "
+labels:
+  - change-control
+body:
+  - type: textarea
+    id: scope
+    attributes:
+      label: Scope
+      description: Describe the exact system change.
+    validations:
+      required: true
+  - type: textarea
+    id: risk
+    attributes:
+      label: Risk Assessment
+      description: State the blast radius, failure modes, and user impact if the change goes wrong.
+    validations:
+      required: true
+  - type: textarea
+    id: verification
+    attributes:
+      label: Verification Plan
+      description: Tests, dashboards, smoke checks, and success criteria.
+    validations:
+      required: true
+  - type: textarea
+    id: rollback
+    attributes:
+      label: Rollback Plan
+      description: Exact rollback command, workflow, or environment action.
+    validations:
+      required: true
+  - type: textarea
+    id: approvals
+    attributes:
+      label: Required Approvals
+      description: Engineering, security, product, or operations signoff needed before release.
+    validations:
+      required: true
+

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,6 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Incident Runbooks
+    url: https://github.com/liteshperumalla/smart-tutor-ai-ai-driven-personalized-teaching-support/tree/main/docs/runbooks
+    about: Use the runbooks for live operational response before opening non-actionable incident issues.
+

.github/ISSUE_TEMPLATE/feature-request.yml

@@ -0,0 +1,53 @@
+name: Feature Request
+description: Capture a new capability with business context, acceptance criteria, and release expectations.
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem Statement
+      description: What user or business problem are we solving?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed Change
+      description: Describe the intended behavior, not just implementation details.
+    validations:
+      required: true
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance Criteria
+      placeholder: |
+        - [ ] User can ...
+        - [ ] System records ...
+        - [ ] Rollback path is documented ...
+    validations:
+      required: true
+  - type: textarea
+    id: dependencies
+    attributes:
+      label: Dependencies and Constraints
+      description: APIs, secrets, migrations, data changes, compliance, or rollout blockers.
+  - type: dropdown
+    id: change_type
+    attributes:
+      label: Change Type
+      options:
+        - feature
+        - platform
+        - security
+        - reliability
+        - data
+    validations:
+      required: true
+  - type: input
+    id: target_release
+    attributes:
+      label: Target Release or Milestone
+      description: Sprint, release tag, or milestone.
+

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,38 @@
+## Summary
+
+Describe the change in 2-5 lines.
+
+## Scope
+
+- Change type:
+- User or system impact:
+- Environments affected:
+
+## Requirements and Change Control
+
+- Linked issue or change request:
+- ADR required:
+- Data or schema change:
+- Security impact:
+
+## Verification
+
+- [ ] Backend tests
+- [ ] Frontend tests
+- [ ] Contract or integration tests
+- [ ] Migration validation
+- [ ] Security checks
+- [ ] Deployment or smoke verification
+
+Verification details:
+
+## Rollout and Rollback
+
+- Rollout plan:
+- Rollback plan:
+- Observability signals to watch:
+
+## Reviewer Notes
+
+Anything risky, incomplete, or intentionally deferred.
+

.github/actions/send-slack-notification/action.yml

@@ -49,8 +49,17 @@ runs:
     - name: Set status metadata
       id: meta
       shell: bash
+      env:
+        INPUT_STATUS: ${{ inputs.status }}
+        INPUT_RUN_URL: ${{ inputs.run_url }}
+        INPUT_ACTOR: ${{ inputs.actor }}
+        INPUT_VERBIAGE: ${{ inputs.verbiage }}
+        INPUT_WORKFLOW_NAME: ${{ inputs.workflow_name }}
+        GH_REPOSITORY: ${{ github.repository }}
+        GH_RUN_ID: ${{ github.run_id }}
+        GH_ACTOR: ${{ github.actor }}
       run: |
-        case "${{ inputs.status }}" in
+        case "${INPUT_STATUS}" in
           success)  echo "emoji=:white_check_mark:" >> "$GITHUB_OUTPUT"
                     echo "color=#2EB67D" >> "$GITHUB_OUTPUT"
                     echo "status_label=SUCCESS" >> "$GITHUB_OUTPUT" ;;
@@ -62,21 +71,21 @@ runs:
                     echo "status_label=WARNING" >> "$GITHUB_OUTPUT" ;;
         esac
 
-        run_url="${{ inputs.run_url }}"
+        run_url="${INPUT_RUN_URL}"
         if [ -z "${run_url}" ]; then
-          run_url="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          run_url="https://github.com/${GH_REPOSITORY}/actions/runs/${GH_RUN_ID}"
         fi
         echo "run_url=${run_url}" >> "$GITHUB_OUTPUT"
 
-        actor="${{ inputs.actor }}"
+        actor="${INPUT_ACTOR}"
         if [ -z "${actor}" ]; then
-          actor="${{ github.actor }}"
+          actor="${GH_ACTOR}"
         fi
         echo "actor=${actor}" >> "$GITHUB_OUTPUT"
 
-        verbiage="${{ inputs.verbiage }}"
+        verbiage="${INPUT_VERBIAGE}"
         if [ -z "${verbiage}" ]; then
-          verbiage="${{ inputs.workflow_name }}"
+          verbiage="${INPUT_WORKFLOW_NAME}"
         fi
         echo "verbiage=${verbiage}" >> "$GITHUB_OUTPUT"
 

.github/workflows/_slack-notify.yml

@@ -55,8 +55,17 @@ jobs:
     steps:
       - name: Set status metadata
         id: meta
+        env:
+          INPUT_STATUS: ${{ inputs.status }}
+          INPUT_RUN_URL: ${{ inputs.run_url }}
+          INPUT_ACTOR: ${{ inputs.actor }}
+          INPUT_VERBIAGE: ${{ inputs.verbiage }}
+          INPUT_WORKFLOW_NAME: ${{ inputs.workflow_name }}
+          GH_REPOSITORY: ${{ github.repository }}
+          GH_RUN_ID: ${{ github.run_id }}
+          GH_ACTOR: ${{ github.actor }}
         run: |
-          case "${{ inputs.status }}" in
+          case "${INPUT_STATUS}" in
             success)  echo "emoji=:white_check_mark:" >> "$GITHUB_OUTPUT"
                       echo "color=#2EB67D" >> "$GITHUB_OUTPUT"
                       echo "status_label=SUCCESS" >> "$GITHUB_OUTPUT" ;;
@@ -68,21 +77,21 @@ jobs:
                       echo "status_label=WARNING" >> "$GITHUB_OUTPUT" ;;
           esac
 
-          run_url="${{ inputs.run_url }}"
+          run_url="${INPUT_RUN_URL}"
           if [ -z "${run_url}" ]; then
-            run_url="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+            run_url="https://github.com/${GH_REPOSITORY}/actions/runs/${GH_RUN_ID}"
           fi
           echo "run_url=${run_url}" >> "$GITHUB_OUTPUT"
 
-          actor="${{ inputs.actor }}"
+          actor="${INPUT_ACTOR}"
           if [ -z "${actor}" ]; then
-            actor="${{ github.actor }}"
+            actor="${GH_ACTOR}"
           fi
           echo "actor=${actor}" >> "$GITHUB_OUTPUT"
 
-          verbiage="${{ inputs.verbiage }}"
+          verbiage="${INPUT_VERBIAGE}"
           if [ -z "${verbiage}" ]; then
-            verbiage="${{ inputs.workflow_name }}"
+            verbiage="${INPUT_WORKFLOW_NAME}"
           fi
           echo "verbiage=${verbiage}" >> "$GITHUB_OUTPUT"