docs: add GitHub community-standard files

Code of conduct, contributing guide, security policy, issue templates, and PR
template. Security policy and issue/PR templates warn against pasting FedEx
credentials.

Author: noctisreus

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,76 @@
+name: Bug report
+description: Something isn't working as expected
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the report! **Do not paste FedEx API keys, secret keys, account numbers, or
+        OAuth tokens** anywhere in this issue — redact them first.
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: What did you expect, and what happened instead?
+      placeholder: When I run "Get Rates" with…, I expected… but got…
+    validations:
+      required: true
+  - type: dropdown
+    id: operation
+    attributes:
+      label: Which operation?
+      options:
+        - Track (Tracking)
+        - Get Rates (Shipping)
+        - Create shipment / label (Shipping)
+        - Validate address (Shipping)
+        - Credential setup / OAuth
+        - Other / not sure
+    validations:
+      required: true
+  - type: dropdown
+    id: environment
+    attributes:
+      label: FedEx environment
+      options:
+        - Sandbox
+        - Production
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Add a FedEx node…
+        2. Set operation to…
+        3. Run…
+    validations:
+      required: true
+  - type: textarea
+    id: error
+    attributes:
+      label: Error message / output
+      description: Paste the error from n8n. Redact any credentials or account numbers first.
+      render: text
+  - type: input
+    id: node-version
+    attributes:
+      label: n8n-nodes-fedex version
+      placeholder: e.g. 0.2.0
+    validations:
+      required: true
+  - type: input
+    id: n8n-version
+    attributes:
+      label: n8n version
+      placeholder: e.g. 2.25.7
+    validations:
+      required: true
+  - type: checkboxes
+    id: no-secrets
+    attributes:
+      label: Confirmation
+      options:
+        - label: I have removed all credentials, secret keys, and account numbers from this report.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/nodrel-dev/n8n-fedex-node/security/advisories/new
+    about: Please report security issues privately, not as a public issue. See SECURITY.md.
+  - name: Question / usage help
+    url: https://github.com/nodrel-dev/n8n-fedex-node/discussions
+    about: For setup and usage questions, please start a discussion.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,35 @@
+name: Feature request
+description: Suggest a new operation or improvement
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem would this solve?
+      description: The use case or limitation you're hitting.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: What should the node do? If it maps to a specific FedEx API, link or name it.
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - New FedEx operation (e.g. Pickup, Locations, Service Availability)
+        - Existing operation — more fields/options
+        - Credentials / auth
+        - Output shape / binary handling
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives or workarounds
+      description: Anything you've tried or considered.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,26 @@
+<!-- Thanks for contributing! Please fill this out so it can be reviewed quickly. -->
+
+## What does this change?
+
+<!-- Brief summary and the motivation. Link any related issue: Closes #__ -->
+
+## Type of change
+
+- [ ] Bug fix (`fix:`)
+- [ ] New feature / operation (`feat:`)
+- [ ] Breaking change (`feat!:` / `BREAKING CHANGE:`)
+- [ ] Docs / chore / refactor / tests
+
+## Checklist
+
+- [ ] `pnpm build` passes
+- [ ] `pnpm lint` passes (ESLint config left unchanged)
+- [ ] `pnpm test` passes
+- [ ] Verified manually against the FedEx **sandbox** (if behavior changed)
+- [ ] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/)
+- [ ] **No credentials or secrets** (FedEx API keys, secret keys, account numbers, tokens) appear in
+      the diff, tests, screenshots, or description
+
+## Notes for reviewers
+
+<!-- Anything tricky, trade-offs, or follow-ups. -->

CODE_OF_CONDUCT.md

@@ -0,0 +1,49 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our community a
+harassment-free experience for everyone, regardless of age, body size, visible or invisible
+disability, ethnicity, sex characteristics, gender identity and expression, level of experience,
+education, socio-economic status, nationality, personal appearance, race, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive,
+and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment include demonstrating empathy and
+kindness, being respectful of differing opinions and experiences, giving and gracefully accepting
+constructive feedback, accepting responsibility and apologizing to those affected by our mistakes,
+and focusing on what is best for the overall community.
+
+Examples of unacceptable behavior include the use of sexualized language or imagery and unwelcome
+sexual attention or advances; trolling, insulting or derogatory comments, and personal or political
+attacks; public or private harassment; publishing others' private information without explicit
+permission; and other conduct which could reasonably be considered inappropriate in a professional
+setting.
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior
+and will take appropriate and fair corrective action in response to any behavior that they deem
+inappropriate, threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when an individual is
+officially representing the community in public spaces.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community
+leaders responsible for enforcement at **kytully@gmail.com**. All complaints will be reviewed and
+investigated promptly and fairly. Community leaders are obligated to respect the privacy and
+security of the reporter of any incident.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org),
+version 2.1, available at
+https://www.contributor-covenant.org/version/2/1/code_of_conduct.html.

CONTRIBUTING.md

@@ -0,0 +1,69 @@
+# Contributing to n8n-nodes-fedex
+
+Thanks for your interest! This is an [n8n community node](https://docs.n8n.io/integrations/community-nodes/)
+that talks directly to the FedEx REST API. Contributions — bug reports, fixes, new operations — are
+welcome.
+
+By participating you agree to abide by the [Code of Conduct](./CODE_OF_CONDUCT.md).
+
+## Getting set up
+
+**Use [pnpm](https://pnpm.io/).** npm installs are blocked (the toolchain enforces it with an
+`only-allow` postinstall). Node.js **22.22+** is required.
+
+```bash
+pnpm install
+pnpm build      # n8n-node build — compile + copy assets
+pnpm lint       # n8n-node lint
+pnpm test       # vitest (unit tests for the pure assembly cores)
+pnpm dev        # n8n-node dev — runs n8n locally with the node loaded + live rebuild
+```
+
+## Testing your change
+
+There are unit tests (`vitest`) for the pure helper "cores", but most behavior is verified
+**manually against the FedEx sandbox**:
+
+1. `pnpm dev` to launch n8n with the node loaded.
+2. Add a FedEx credential, select the **Sandbox** environment, and use FedEx's sandbox test
+   tracking numbers / test account.
+3. Exercise the operation you changed end to end.
+
+Please confirm `pnpm build`, `pnpm lint`, and `pnpm test` all pass before opening a PR.
+
+## How the node is organized
+
+- One node, `nodes/Fedex/Fedex.node.ts`, with **two resources that mirror the two FedEx
+  developer-portal projects** (and their separate credentials):
+  - **Tracking** → Track (uses the Track API credential)
+  - **Shipping** → Get Rates, Create, Validate (uses the shipping-project credential: Rate + Ship +
+    Address Validation)
+- Per-resource descriptions live in `nodes/Fedex/resources/<resource>/`; reusable, context-free
+  logic lives in `nodes/Fedex/cores/` (these are what the unit tests cover).
+- Architecture decisions are documented in [`docs/adr/`](./docs/adr/). Skim them before larger
+  changes.
+
+> Some reference material (FedEx's captured API specs and the commercial brief) lives in a private
+> companion repo and isn't needed to contribute code. The public ADRs and `documentation.yaml`
+> cover the API shapes you'll need.
+
+## Commits & releases
+
+- Follow [Conventional Commits](https://www.conventionalcommits.org/): `feat:`, `fix:`, `docs:`,
+  `chore:`, `refactor:`, `test:`, `ci:`, and `feat!:` / `BREAKING CHANGE:` for breaking changes.
+- Releases are automated by **release-please** from those commit messages, then published to npm
+  with provenance — no manual version bumps. Don't edit `package.json` `version` or `CHANGELOG.md`.
+- **Don't modify the ESLint config** — CI verifies it is unchanged from the n8n default.
+
+## Pull requests
+
+1. Branch from `main`, make focused commits.
+2. Ensure build, lint, and tests pass and you've sandbox-tested the change.
+3. Fill out the PR template, including confirming **no credentials/secrets** are included.
+4. Link any related issue.
+
+## Security & credentials
+
+Never commit or paste FedEx API keys, secret keys, or account numbers anywhere in the repo, issues,
+or PRs. See [SECURITY.md](./SECURITY.md). Keep secrets in n8n's credential store or a local
+`.env.local` (gitignored).

SECURITY.md

@@ -0,0 +1,34 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+**Please do not open a public issue for security vulnerabilities.**
+
+Report privately via GitHub's [private vulnerability reporting](https://github.com/nodrel-dev/n8n-fedex-node/security/advisories/new),
+or by email to **kytully@gmail.com**. Include a description, affected version, and reproduction
+steps. You'll get an acknowledgement within a few days, and a fix or mitigation as quickly as is
+practical.
+
+## Supported versions
+
+This is a pre-1.0 package; only the latest published `0.x` release on npm receives security fixes.
+Always run the newest version.
+
+## Credential safety (important)
+
+This node talks to the FedEx REST API using **your own** FedEx API Key / Secret Key and account
+number, supplied through n8n's encrypted credential store. To keep them safe:
+
+- **Never paste API keys, secret keys, OAuth tokens, or account numbers** into GitHub issues,
+  pull requests, discussions, logs, or screenshots. Redact them first.
+- Keep credentials in n8n's credential manager (or a local `.env.local` for development) — never
+  hardcode them in workflows, code, or committed files.
+- The credential defaults to the **sandbox** environment so a half-configured connection cannot
+  hit a live account. Switch to production only when you intend to.
+- If you believe a key has been exposed, rotate it in the FedEx Developer Portal immediately.
+
+## Supply-chain integrity
+
+Releases are published to npm from GitHub Actions with **npm provenance** (SLSA attestation) over
+OIDC Trusted Publishing — no long-lived tokens. You can verify a published version's provenance on
+its npm page.