docs(governance): maintainers, governance and support files

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,52 @@
+name: Bug report
+description: DjangoAPI Guard does not behave as documented
+title: "[BUG] "
+labels: [bug]
+body:
+  - type: input
+    id: value
+    attributes:
+      label: Value this delivers
+      description: One sentence a user could witness once this is fixed.
+      placeholder: "Requests whose JSON body contains a URL are no longer flagged on endpoints that disable suspicious-pattern detection."
+    validations:
+      required: true
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened
+      description: What you did, what you expected, what you got. Error messages, tracebacks and logs go here.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Configure DjangoAPI Guard with '...'
+        2. Send a request to '...'
+        3. See error
+    validations:
+      required: true
+  - type: input
+    id: versions
+    attributes:
+      label: Versions
+      description: DjangoAPI Guard version, Python version, framework and version, OS.
+      placeholder: "djapi-guard x.y.z, guard-core 4.4.0, Python 3.13, Django 5.2, Ubuntu 24.04"
+    validations:
+      required: true
+  - type: textarea
+    id: config
+    attributes:
+      label: Configuration
+      description: Your config with secrets masked.
+      render: python
+      placeholder: |
+        from djangoapi_guard import SecurityConfig
+        config = SecurityConfig(...)
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Production or development, consistent or intermittent, workarounds tried.

.github/ISSUE_TEMPLATE/docs.yml

@@ -0,0 +1,31 @@
+name: Documentation
+description: Wrong, missing or unclear DjangoAPI Guard documentation
+title: "[DOCS] "
+labels: [documentation]
+body:
+  - type: input
+    id: value
+    attributes:
+      label: Value this delivers
+      description: One sentence a reader could witness once this is fixed.
+      placeholder: "The Redis page shows the exact config for a TLS connection."
+    validations:
+      required: true
+  - type: input
+    id: page
+    attributes:
+      label: Page
+      description: URL of the page or section.
+    validations:
+      required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: What is wrong or missing
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed text
+      render: markdown

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,35 @@
+name: Feature request
+description: Suggest an improvement to DjangoAPI Guard
+title: "[FEATURE] "
+labels: [enhancement]
+body:
+  - type: input
+    id: value
+    attributes:
+      label: Value this delivers
+      description: One sentence a user could witness once this exists.
+      placeholder: "A single decorator disables all detection for one endpoint."
+    validations:
+      required: true
+  - type: textarea
+    id: job
+    attributes:
+      label: The job you are trying to get done
+      description: The outcome you need, not the mechanism you imagine.
+    validations:
+      required: true
+  - type: textarea
+    id: workaround
+    attributes:
+      label: How you work around it today
+  - type: textarea
+    id: example
+    attributes:
+      label: Example usage
+      description: Pseudocode of how you would like to use it.
+      render: python
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Similar features in other libraries, constraints, API implications.

.github/PULL_REQUEST_TEMPLATE.md

@@ -54,7 +54,7 @@ Checklist
 ---------
 
 <!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
-<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
+<!--- If you're unsure about any of these, ask in the pull request. -->
 
 - [ ] My code follows the code style of this project (Mypy, Ruff)
 - [ ] I have added tests to cover my changes

GOVERNANCE.md

@@ -0,0 +1,29 @@
+# Governance
+
+DjangoAPI Guard is part of the [Guard Core](https://github.com/Guard-Core) ecosystem. I maintain it alone; [MAINTAINERS.md](MAINTAINERS.md) lists who I am and how to check it.
+
+## Decisions
+
+I make the final call on every change: features, releases, security fixes and repository access. A proposal starts as an issue, so the reasoning is public before any code is written.
+
+## How a change lands
+
+1. Every change is a pull request to `master`.
+2. The branch ruleset requires signed commits, linear history, passing status checks and two approvals, one of them from a code owner ([CODEOWNERS](CODEOWNERS)). As the only maintainer I cannot get those approvals, so I merge my own pull requests with admin rights. That skips the approval count only: I never merge with a failing check.
+3. A pull request closes an open issue (`Closes #N`), or carries the `no-issue` label when it is a small fix with nothing to discuss.
+
+## Releases
+
+Versions follow semantic versioning. Adapters version on their own, because each one follows its framework, and declare the engine versions they support. Releases are cut from tags and recorded in [CHANGELOG.md](CHANGELOG.md).
+
+## Security
+
+Vulnerabilities go through [SECURITY.md](SECURITY.md), never through public issues.
+
+## New maintainers
+
+Contributors with a record of reviewed and merged work can be invited as maintainers. A new maintainer is added to MAINTAINERS.md and CODEOWNERS in a pull request.
+
+## Conduct
+
+The [Code of Conduct](CODE_OF_CONDUCT.md) applies to every space of this project.

MAINTAINERS.md

@@ -0,0 +1,21 @@
+# Maintainers
+
+DjangoAPI Guard has one maintainer.
+
+| Name | GitHub | Email | Role |
+|---|---|---|---|
+| Renzo Franceschini | [@rennf93](https://github.com/rennf93) | rennf93@guard-core.com | Lead maintainer: reviews and merges every change, publishes every release, handles security reports |
+
+## Identity
+
+- GitHub profile [@rennf93](https://github.com/rennf93): name Renzo Franceschini, website guard-core.com.
+- [guard-core.com/company](https://guard-core.com/company) names Renzo Franceschini and links to @rennf93.
+- The [Guard-Core](https://github.com/Guard-Core) GitHub organization has guard-core.com as a verified domain.
+- PyPI: the [djapi-guard](https://pypi.org/project/djapi-guard/) metadata names `Renzo Franceschini <rennf93@guard-core.com>`.
+
+## Related files
+
+- Code ownership: [CODEOWNERS](CODEOWNERS)
+- How decisions are made: [GOVERNANCE.md](GOVERNANCE.md)
+- Security reports: [SECURITY.md](SECURITY.md)
+- Getting help: [SUPPORT.md](SUPPORT.md)