[coldsofttech]

Summary

Prepares release 0.1.1: repository community files, a security review with fixes, and a Windows fix for large batches.

Community and project files

• Issue templates (bug report, feature request), pull request template, SECURITY.md, CODE_OF_CONDUCT.md, CONTRIBUTING.md.
• dependabot.yml for Python (uv), GitHub Actions and pre-commit hooks.
• README badges and a fuller description of what CommitRocket is for.
• Version bumped to 0.1.1 (pyproject.toml, __init__.py, uv.lock); changelog updated.

Security hardening

• A config file found inside a repository can no longer set force, remote, branch, report, log-file, notify-webhook, include-from or exclude-from; they are ignored with a warning unless the file is passed with --config.
• File names are treated literally in git commands, so names such as [ab].txt no longer stage other files.
• --remote / --branch values that look like git options are rejected, and -- is used before the remote in push, ls-remote and remote get-url.
• Credentials embedded in URLs are hidden in logs, errors, push output, reports, notifications and the displayed push target; log and report files are restricted to the owner.
• File names with control characters are refused when creating LFS rules.
• The report is written through a random, exclusively created temporary file.
• File names and git output are shown literally instead of as Rich markup, so brackets can no longer crash or hide output.

Fix

• Files are staged in chunks, so batches with thousands of files no longer fail on Windows with "The filename or extension is too long". Very long commands are shortened in logs and errors.

Notes for review

• Existing users who keep remote, force or similar in a repository commitrocket.toml will now see a warning and need --config commitrocket.toml for those settings (documented in the README).
• After merging, tagging v0.1.1 runs the release workflow, which needs the PYPI_API_TOKEN secret and a pypi environment.
• Still to do outside this PR: pin Actions to commit SHAs, consider PyPI trusted publishing, enable private vulnerability reporting, secret scanning and Dependabot alerts, and add a dependency audit to CI.

Test plan

• uv run ruff check .
• Full suite locally: 152 passed, 2 skipped (POSIX permission checks on Windows), including integration tests
• Pre-commit hooks (ruff, unit tests) passed on commit
• CI matrix on GitHub (Ubuntu 3.11-3.15, Windows and macOS 3.11)
• Manual run of the Windows fix against a project with thousands of files