chore(community): contributor infrastructure for the public release

[Leo310]

What

Repo hygiene for the moment the plugin goes public: a working CI gate, a human-facing CONTRIBUTING.md (with the AI-assistance policy), code of conduct, security policy, PR template, and issue templates that match v2.

Branch model as agreed: PRs target main after the release (dev is merged and retired). CONTRIBUTING says so, with a one-line note about dev that can be deleted at release time.

Changes

• .github/workflows/ci.yml (new): on every PR and on pushes to main/dev, run Biome format + lint checks, bun run check, bun run test, bun run build. Uses biome format / biome lint in check mode rather than biome ci, because biome ci additionally enforces import ordering that neither bun run format nor bun run lint applies; dev currently has 20+ files that would fail on that alone.
• .github/workflows/logs.yml removed: npm ci plus a create-check.js that no longer exists.
• .github/workflows/release.yml: drop the papa-ts injection (no longer a dependency), actions/checkout@v4, setup-bun@v2, --frozen-lockfile.
• CONTRIBUTING.md: ways to contribute (including non-code: skills, agents, docs), dev setup, branch/PR expectations, the AI-assistance policy, provider and skill recipes, docs-site pointer.
• CODE_OF_CONDUCT.md: Contributor Covenant 2.1. SECURITY.md: what counts, how to report. .github/PULL_REQUEST_TEMPLATE.md: testing + AI-assistance disclosure.
• Issue templates: current settings path for console logging, platform/provider fields, no hard-coded assignees, config.yml routes questions to Discussions.
• README links to CONTRIBUTING; AGENTS.md gets a Contributing pointer and stops mentioning de.json.

Also done outside the diff: labels provider and skill created; #324, #312, #288, #289 tagged good first issue + help wanted; #324 and #447 tagged provider.

How I tested it

All four gates pass locally on this branch after bun install --frozen-lockfile: check (0 errors), format/lint (clean), test (110 files, 1630 tests), build. Workflow and template YAML parse. No plugin code changed.

Needs a maintainer (repo settings, not in the diff)

• Enable private vulnerability reporting (Settings → Code security). SECURITY.md and the code of conduct link to it; the link 404s until it's on.
• Branch protection for the PR-target branch: require the CI / Format, lint, types, tests, build check; consider dropping required signed commits (blocks most first-time contributors) — the GitGuardian check can stay.

AI assistance

Drafted with Claude Code; the maintainer reviewed every file.

[greptile-apps]

Greptile Summary

The PR adds contributor-facing policies, templates, and a required CI workflow for the public release.

• Adds contribution, conduct, and security documentation.
• Adds and updates pull-request and issue templates.
• Replaces the obsolete logging workflow with format, lint, type-check, test, and build gates.
• Updates the release workflow with immutable action references, a pinned Bun runtime, frozen dependency installation, and draft-release behavior.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Adds the required CI gate; the previously reported mutable action and Bun references are now pinned.
.github/workflows/release.yml	Modernizes release setup, removes obsolete dependency injection, and uses the same pinned actions and Bun runtime as CI.
.bun-version	Pins Bun 1.3.3 for reproducible CI and release execution.
CONTRIBUTING.md	Documents contribution workflows, local development, AI-assistance expectations, and provider and skill recipes.
SECURITY.md	Defines supported security-report categories and directs reporters to private vulnerability reporting.

_{Reviews (5): Last reviewed commit: "chore(community): drop the pre-release d..." | Re-trigger Greptile}