Add community files, security hardening and Windows batch fix (0.1.1)

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,65 @@
+name: Bug report
+description: Something did not work as expected
+title: "[Bug]: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a bug. Please check the [README](https://github.com/coldsofttech/CommitRocket#readme)
+        and existing issues first. Do not include secrets, tokens or private file names.
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: What did you expect, and what happened instead?
+    validations:
+      required: true
+  - type: textarea
+    id: command
+    attributes:
+      label: Command you ran
+      description: The full `commitrocket` command, including options.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: output
+    attributes:
+      label: Output or error
+      description: Paste the terminal output. The log file path is printed at the end of every run.
+      render: text
+  - type: textarea
+    id: log
+    attributes:
+      label: Relevant log lines
+      description: Re-run with `--level DEBUG` and paste the relevant part of the log file, with any private paths removed.
+      render: text
+  - type: input
+    id: version
+    attributes:
+      label: CommitRocket version
+      description: Output of `commitrocket --version`
+    validations:
+      required: true
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      options:
+        - Windows
+        - macOS
+        - Linux
+        - Other
+    validations:
+      required: true
+  - type: input
+    id: tooling
+    attributes:
+      label: Python, Git and git-lfs versions
+      description: For example `Python 3.12, git 2.47, git-lfs 3.6`. `commitrocket doctor` shows these.
+  - type: input
+    id: host
+    attributes:
+      label: Git host
+      description: For example GitHub, GitLab, Bitbucket, self-hosted.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/coldsofttech/CommitRocket/security/advisories/new
+    about: Please report security problems privately, not in a public issue.
+  - name: Questions and ideas
+    url: https://github.com/coldsofttech/CommitRocket/discussions
+    about: Ask a question or float an idea before opening an issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,30 @@
+name: Feature request
+description: Suggest an improvement or a new option
+title: "[Feature]: "
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem are you trying to solve?
+      description: Describe the situation, not only the solution.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What would you like to happen?
+      description: For example a new option, a change in behavior, or a new output.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives you considered
+      description: Workarounds you use today, or other designs.
+  - type: checkboxes
+    id: contribute
+    attributes:
+      label: Contributing
+      options:
+        - label: I would be willing to open a pull request for this.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,17 @@
+## What does this change?
+
+<!-- A short summary, and why it is needed. Link the issue it closes, e.g. "Closes #123". -->
+
+## How was it tested?
+
+<!-- Commands you ran and anything you checked by hand. -->
+
+## Checklist
+
+- [ ] `uv run ruff check .` passes
+- [ ] `uv run pytest -m "not integration"` passes
+- [ ] `uv run pytest -m integration` passes (if the change touches the run flow, Git handling or LFS)
+- [ ] Tests added or updated for the change
+- [ ] `CHANGELOG.md` has a short entry under `[Unreleased]` (what changed for the reader, in one or two lines)
+- [ ] `README.md` updated if user-facing behavior or options changed; technical details go in `docs/`
+- [ ] No secrets, tokens or private paths in the code, tests or logs

.github/dependabot.yml

@@ -0,0 +1,33 @@
+version: 2
+
+updates:
+  # Python dependencies and the uv.lock file
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      python-dependencies:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+
+  # Actions used in .github/workflows
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore(ci)"
+    groups:
+      github-actions:
+        patterns: ["*"]
+
+  # Hook versions in .pre-commit-config.yaml
+  - package-ecosystem: "pre-commit"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore(deps)"

CHANGELOG.md

@@ -2,6 +2,23 @@
 
 ## [Unreleased]
 
+## [0.1.1] - 2026-10-24
+
+### Added
+- Issue and pull request templates, a security policy, a code of conduct and contributing guidelines.
+- Dependabot keeps dependencies, GitHub Actions and pre-commit hooks up to date.
+
+### Fixed
+- Batches with thousands of files no longer fail on Windows with "The filename or extension is too long".
+
+### Security
+- A config file found inside a repository can no longer turn on `force`, set the remote or branch, write reports or logs, or read pattern files; use `--config` for those.
+- File names with characters like `[` or `*` are treated literally, so they no longer pull other files into a batch.
+- `--remote` and `--branch` values that look like Git options are rejected.
+- Credentials inside remote URLs are hidden in logs, errors and reports, and log and report files are readable only by you.
+- File names with line breaks are refused when creating LFS rules.
+- Square brackets in file names and Git messages no longer break or hide output.
+
 ## [0.1.0] - 2026-10-24
 
 ### Added

CODE_OF_CONDUCT.md

@@ -0,0 +1,131 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official email address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement privately through
+GitHub, at
+<https://github.com/coldsofttech/CommitRocket/security/advisories/new>
+(choose a title that makes clear it is a conduct report). All complaints will be
+reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+<https://www.contributor-covenant.org/version/2/1/code_of_conduct.html>.
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at
+<https://www.contributor-covenant.org/faq>. Translations are available at
+<https://www.contributor-covenant.org/translations>.
+
+[homepage]: https://www.contributor-covenant.org
+[Mozilla CoC]: https://github.com/mozilla/diversity

CONTRIBUTING.md

@@ -0,0 +1,62 @@
+# Contributing to CommitRocket
+
+Thanks for helping out! Bug reports, ideas, documentation fixes and code are all welcome.
+By taking part you agree to follow the [Code of Conduct](CODE_OF_CONDUCT.md).
+
+## Reporting bugs and suggesting features
+
+- Search the existing issues first.
+- Use the issue templates. For a bug, include the exact command, the output, your
+  versions (`commitrocket --version`, `commitrocket doctor`), and the relevant lines from
+  the log file (re-run with `--level DEBUG`). Remove secrets and private paths.
+- **Security problems:** do not open an issue. Follow the [Security Policy](SECURITY.md).
+
+## Setting up
+
+You need Python 3.11+, [Git](https://git-scm.com/) and [uv](https://docs.astral.sh/uv/).
+
+```
+git clone https://github.com/coldsofttech/CommitRocket.git
+cd CommitRocket
+uv sync
+uv run pre-commit install
+```
+
+`uv run commitrocket --help` runs the tool from your checkout.
+
+## Making a change
+
+1. Create a branch from `main`, for example `feat/short-name`, `fix/short-name` or
+   `chore/short-name`.
+2. Make the change, with tests. New behavior needs a test; a bug fix needs a test that
+   fails without the fix.
+3. Run the checks:
+
+   ```
+   uv run ruff check .
+   uv run pytest -m "not integration"
+   uv run pytest -m integration
+   ```
+
+   Pre-commit runs the first two on every commit. The integration tests drive the real
+   CLI against a local bare repository and run in CI, so run them yourself when you touch
+   the run flow, Git handling or LFS. Details are in [docs/development.md](docs/development.md).
+4. Update the docs:
+   - `README.md` is for users: describe options and behavior from a user's point of view.
+   - Technical notes belong in `docs/`.
+   - Add a short entry under `[Unreleased]` in `CHANGELOG.md`: one or two lines saying
+     what changed for the reader, without file or function names.
+5. Open a pull request against `main` and fill in the template. Keep it focused; separate
+   unrelated changes into separate pull requests.
+
+## Tests that touch Git
+
+Tests create temporary repositories and never touch your real ones. Do not point a test at
+a real remote. Keep any log or report files a test writes outside the repository the test
+is operating on.
+
+## Releases
+
+Maintainers release by bumping the version in `pyproject.toml` and
+`src/commitrocket/__init__.py`, moving the changelog entries under the new version, and
+pushing a `v*.*.*` tag. See [docs/development.md](docs/development.md).