docs: add community and security guidelines

b45632 · b45632 · commit f28d6c6a74ea · 2026-07-13T15:34:58.000+02:00
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,82 @@
+name: Bug report
+description: Report a reproducible problem in CodeDeck
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a bug. Remove secrets and private paths from logs and screenshots.
+
+  - type: input
+    id: version
+    attributes:
+      label: CodeDeck version
+      description: The version shown in the app or release name.
+      placeholder: "0.2.0"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: operating-system
+    attributes:
+      label: Operating system
+      options:
+        - Windows 11
+        - Windows 10
+        - macOS
+        - Ubuntu or another Linux distribution
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: architecture
+    attributes:
+      label: Architecture
+      placeholder: "x64, ARM64, Apple Silicon"
+
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      description: Describe the problem and what you expected instead.
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Open ...
+        2. Select ...
+        3. Click ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: Paste relevant output. Remove tokens, usernames and private paths.
+      render: shell
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Add screenshots or anything else that may help.
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Before submitting
+      options:
+        - label: I searched existing issues for the same problem.
+          required: true
+        - label: I removed secrets and private information from this report.
+          required: true
+        - label: This is not a security vulnerability.
+          required: true
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/JadnK/CodeDeck/security/policy
+    about: Do not report security vulnerabilities in a public issue.
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,23 @@
+## What changed?
+
+<!-- Briefly explain the change and the problem it solves. -->
+
+## How was it tested?
+
+<!-- List the commands and manual checks you ran. -->
+
+- [ ] `pnpm build`
+- [ ] `cargo check --locked --manifest-path src-tauri/Cargo.toml`
+- [ ] The affected workflow was tested manually
+
+## Screenshots
+
+<!-- Add before/after screenshots for visible UI changes. Remove this section when it does not apply. -->
+
+## Checklist
+
+- [ ] The pull request contains one focused change
+- [ ] Error and empty states were considered
+- [ ] No secrets or private local paths were added
+- [ ] Commands still require an explicit user action
+- [ ] Documentation or the changelog was updated when needed
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,44 +1,62 @@
 # Changelog
 
-All notable changes to Code Deck are documented here.
+All notable changes to CodeDeck are documented in this file.
 
-## [0.2.0] - 2026-07-13
+The project follows [Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
 
 ### Added
 
-- New-project workflow with clear separation between creating a starter and adding an existing folder.
-- Offline starter templates for Node.js, Node.js + TypeScript, React + Vite, Spring Boot, Python, Rust and empty projects.
-- Reusable custom project templates backed by local folders.
-- Optional Git initialization for newly created projects.
-- Maven, Spring Boot, Gradle, Python and Cargo command detection.
-- Explanations and visible labels for previously ambiguous buttons and settings.
+### Changed
+
+### Fixed
+
+### Security
+
+## [0.2.0]
+
+### Added
+
+- Built-in starters for Node.js, Node.js with TypeScript, React with Vite, Spring Boot, Python and Rust.
+- Custom project templates based on local folders.
+- A clearer project creation flow for starter projects, templates and existing folders.
+- Additional page-by-page documentation for the dashboard, project details, processes, workspaces and settings.
 
 ### Changed
 
-- GitHub Actions now use Node 24-native actions, pinned macOS 15 runners and a lockfile-tolerant install step.
-- Project cards, settings and project creation use clearer action names and inline help.
+- Improved labels, descriptions, empty states and button text across the interface.
+- Updated GitHub Actions for the repository-root project structure.
+- Improved release creation and cross-platform artifact handling.
+- Updated the Windows desktop build so no console window appears in release builds.
 
 ### Fixed
 
-- CI no longer fails inside `actions/setup-node` when `pnpm-lock.yaml` is absent from a commit.
-- Matrix jobs no longer get canceled after the first platform failure.
+- Fixed pnpm installation failures caused by incorrect workflow paths.
+- Fixed release version validation and draft-release lookup.
+- Fixed shell errors while generating release notes.
+- Prevented internal Git commands from opening visible command windows on Windows.
 
-## [0.1.0] - 2026-07-13
+## [0.1.0]
 
 ### Added
 
-- Complete Tauri 2 and React desktop application foundation.
-- Project creation, scanning, search, tags, favorites, editing, archiving and deletion.
+- Tauri 2 and React desktop application foundation.
+- Local project creation, scanning, search, tags, favorites, editing, archiving and removal.
 - Configurable IDE and terminal launchers with project placeholders.
-- Framework, package script, Docker and Git detection.
-- Command runner with live stdout/stderr, stop support and local history.
-- Git branch, dirty-file count, last commit, fetch and pull actions.
-- Workspaces with ordered parallel/sequential actions.
-- Process overview, local JSON import/export, themes and onboarding.
-- Cross-platform release workflows and application icons.
+- Framework, package-script, Docker and Git detection.
+- Command runner with live stdout and stderr, stop support and local history.
+- Git branch, changed-file count and latest-commit information.
+- Workspaces with ordered sequential and parallel actions.
+- Process overview, local JSON import and export, themes and onboarding.
+- Cross-platform build and release workflows.
 
 ### Security
 
-- Commands only execute after explicit user actions.
-- Imported project commands are marked untrusted and can require confirmation.
-- Project inspection does not modify project files.
+- Commands only execute after an explicit user action.
+- Imported commands are never started automatically.
+- Project inspection does not modify project source files.
+
+[Unreleased]: https://github.com/JadnK/CodeDeck/compare/v0.2.0...HEAD
+[0.2.0]: https://github.com/JadnK/CodeDeck/compare/v0.1.0...v0.2.0
+[0.1.0]: https://github.com/JadnK/CodeDeck/releases/tag/v0.1.0
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
@@ -0,0 +1,37 @@
+# Code of Conduct
+
+CodeDeck should be a useful and welcoming project for people with different backgrounds and levels of experience.
+
+## Expected behavior
+
+When participating in issues, discussions, pull requests or other project spaces:
+
+- be respectful and constructive
+- focus feedback on the code or idea, not the person
+- explain technical decisions clearly
+- accept that others may have different experience or priorities
+- give new contributors enough context to participate
+- respect privacy and do not publish personal information
+
+## Unacceptable behavior
+
+The following is not accepted:
+
+- harassment, insults or personal attacks
+- discriminatory or sexualized comments
+- threats or intimidation
+- deliberate disruption of project discussions
+- publishing someone else's private information
+- repeated bad-faith behavior after being asked to stop
+
+## Reporting a problem
+
+Report conduct problems privately to the repository maintainer through their GitHub profile. Do not open a public issue containing private details.
+
+Include links, screenshots or other relevant context where possible. Reports will be reviewed in context and handled as fairly as possible.
+
+## Enforcement
+
+Project maintainers may edit or remove comments, close discussions, reject contributions or temporarily or permanently restrict participation when behavior harms the project or its contributors.
+
+This code of conduct applies to all official CodeDeck project spaces.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -1,9 +1,107 @@
-# Contributing
+# Contributing to CodeDeck
 
-1. Create a branch named `feature/<short-name>` or `fix/<short-name>`.
-2. Run `pnpm build` before opening a pull request.
-3. Run `cargo check` in `src-tauri` when changing Rust code.
-4. Keep desktop actions explicit and never auto-run imported commands.
-5. Update the README or changelog when user-visible behavior changes.
+Thanks for taking the time to contribute. CodeDeck is a local desktop application built with Tauri, React, TypeScript and Rust.
 
-A feature is complete when errors are handled, empty/loading states exist, local data survives a restart and the affected workflow has been smoke-tested.
+## Before you start
+
+- Search the existing issues before opening a new one.
+- Open an issue before starting a large feature or architectural change.
+- Keep pull requests focused. Unrelated changes should be submitted separately.
+- Never include API keys, passwords, private paths, `.env` files or other secrets.
+
+## Local setup
+
+You need:
+
+- Node.js 24
+- pnpm 10
+- the Rust toolchain
+- the platform requirements for Tauri 2
+
+Install dependencies:
+
+```bash
+pnpm install --frozen-lockfile
+```
+
+Start the desktop app:
+
+```bash
+pnpm tauri:dev
+```
+
+Build the frontend:
+
+```bash
+pnpm build
+```
+
+Check the Rust code:
+
+```bash
+cargo check --locked --manifest-path src-tauri/Cargo.toml
+```
+
+Create a release build:
+
+```bash
+pnpm tauri:build
+```
+
+## Branches
+
+Use a short, descriptive branch name:
+
+```text
+feature/project-import
+feature/workspace-actions
+fix/windows-terminal-launch
+docs/project-guide
+refactor/process-runner
+```
+
+## Commit messages
+
+Use clear commit messages that describe one logical change:
+
+```text
+feat: add custom project templates
+fix: prevent terminal window from opening on Windows
+docs: explain workspace actions
+refactor: separate project detection from storage
+chore: update Tauri dependencies
+```
+
+## Pull requests
+
+A pull request should include:
+
+- a short explanation of the problem
+- a summary of the chosen solution
+- testing steps
+- screenshots for visible UI changes
+- documentation updates when behavior changes
+
+Before opening a pull request, run:
+
+```bash
+pnpm build
+cargo check --locked --manifest-path src-tauri/Cargo.toml
+```
+
+Also perform a short manual check for the affected workflow. For example, a change to project creation should be tested by creating a project, opening it and running one generated command.
+
+## Project rules
+
+CodeDeck interacts with local files and executable commands, so these rules are important:
+
+- Commands must only run after an explicit user action.
+- Imported commands must never run automatically.
+- Project source files must not be changed without a clear user action.
+- Sensitive files such as `.env` must not be displayed or added to logs automatically.
+- Errors should explain what failed and how the user can fix it.
+- New pages and dialogs should include useful empty and error states.
+
+## Reporting security issues
+
+Do not report security vulnerabilities in a public issue. Follow the instructions in [SECURITY.md](SECURITY.md).
diff --git a/README.md b/README.md
@@ -17,22 +17,22 @@
 
 ![Code Deck dashboard](docs/screenshots/dashboard.png)
 
-## What Code Deck does
+## What CodeDeck does
 
-I made Code Deck because opening a project was usually the same routine: find the folder, open the right IDE, start a terminal and look up the command I used last time.
+- Keep local projects in one searchable dashboard
+- Open projects in the correct IDE
+- Run and stop development commands
+- Create projects from built-in or custom templates
+- Start complete multi-project workspaces
 
-Code Deck keeps that setup with the project. You can:
+The current interface is in German. This README uses the exact German button names where that makes the app easier to find.
 
-- add existing projects or create new ones from a starter
-- open a project in its preferred IDE
-- open its terminal or folder
-- save and run project commands
-- see live command output and stop running processes
-- view basic Git information such as branch, changed files and the last commit
-- group several actions into a workspace
-- keep everything local and export the configuration as JSON
+## Download
 
-The current interface is in German. This README uses the exact German button names where that makes the app easier to find.
+Download the latest version from
+[GitHub Releases](../../releases/latest).
+
+__Dont forget giving the Star :)__
 
 ## Where everything is
 
diff --git a/SECURITY.md b/SECURITY.md
