Add open-source readiness infrastructure and documentation

.coderabbit.yaml

@@ -0,0 +1,20 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+language: en-US
+reviews:
+  profile: chill
+  request_changes_workflow: false
+  high_level_summary: true
+  poem: false
+  review_status: true
+  auto_review:
+    enabled: true
+    drafts: false
+  # Skip generated artifacts and fixtures so reviews focus on hand-written code.
+  path_filters:
+    - "!docs/CONFIG_REFERENCE.md"
+    - "!docs/SUPPORT_MATRIX.md"
+    - "!docs/schemas/**"
+    - "!**/*.golden.json"
+    - "!**/testdata/**"
+chat:
+  auto_reply: true

.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# Default owner for everything in the repo.
+# Order matters: the last matching pattern takes precedence.
+* @bomly-guy

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,47 @@
+name: Bug report
+description: Report incorrect behavior in the Bomly CLI
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to file a bug. Please fill out the sections below so we can reproduce and fix it quickly.
+
+        Do **not** report security vulnerabilities here — see the repository's Security tab for private reporting.
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: A clear description of the bug and what you expected instead.
+      placeholder: Running `bomly scan` on a Go module reported no dependencies, but go.mod has several.
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: The exact command(s) and, if possible, a minimal project or public repo + ref that triggers it.
+      placeholder: |
+        1. `git clone https://github.com/example/repo && cd repo`
+        2. `bomly scan --json`
+        3. Observe ...
+    validations:
+      required: true
+  - type: textarea
+    id: version
+    attributes:
+      label: Bomly version and platform
+      description: Output of `bomly version` plus your OS/arch.
+      placeholder: |
+        bomly v0.2.3
+        macOS 14.5 arm64
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant output
+      description: Paste relevant output. Re-run with `-vv` for debug logs if helpful. Scrub anything sensitive.
+      render: shell
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Question or discussion
+    url: https://github.com/bomly-dev/bomly-cli/discussions
+    about: Ask questions, share ideas, and discuss usage with the community.
+  - name: Report a security vulnerability
+    url: https://github.com/bomly-dev/bomly-cli/security/advisories/new
+    about: Please report security issues privately, not as a public issue.
+  - name: Contact the maintainers
+    url: mailto:[email protected]
+    about: Reach the Bomly team for anything that doesn't fit an issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,25 @@
+name: Feature request
+description: Suggest a new capability or improvement for Bomly
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem are you trying to solve?
+      description: Describe the use case or pain point, not just the proposed solution.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: What would you like Bomly to do? Include example commands, flags, or output if you have them in mind.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Other approaches you've tried or considered, including existing workarounds.
+    validations:
+      required: false

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,32 @@
+<!--
+Thanks for contributing to Bomly! Please complete the sections below.
+Commit messages follow Conventional Commits (feat:, fix:, docs:, refactor:, ...),
+since they drive the automated release version bump.
+-->
+
+## Summary
+
+<!-- What does this change do, and why? Link any related issue (e.g. Closes #123). -->
+
+## Changes
+
+<!-- Bullet the notable changes. -->
+
+-
+
+## Checklist
+
+- [ ] `make test` passes.
+- [ ] `make lint` passes.
+- [ ] `make generate` run and committed if I changed `internal/config/config.go`, `internal/output/*`, `sdk/catalog.go`, `sdk/support_matrix.go`, or `internal/registry/support.go`.
+- [ ] Smoke goldens regenerated (`make smoke ARGS="-update"`) and committed if behavior changed.
+- [ ] Docs updated (feature page, `docs/ARCHITECTURE.md`, `CLAUDE.md`/`AGENTS.md`) where relevant.
+
+### For a new user-visible feature (new flag / component / pipeline stage)
+
+<!-- Delete this section if not applicable. See the Feature Checklist in CLAUDE.md. -->
+
+- [ ] CLI flag, config field, and validation wired up.
+- [ ] Reachable from the matching MCP tool.
+- [ ] Surfaced in `bomly plugin` listing (for a new component kind).
+- [ ] Smoke test added against a pinned public repo.

.github/workflows/ci.yml

@@ -1,4 +1,4 @@
-name: CI
+name: Build & Test
 
 on:
   pull_request:
@@ -10,48 +10,105 @@ permissions:
   contents: read
 
 concurrency:
-  group: ci-${{ github.workflow }}-${{ github.ref }}
+  group: build-test-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  validate:
+  lint:
+    name: Lint
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
         uses: actions/checkout@v5
-
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           cache: true
-          cache-dependency-path: |
-            go.sum
-
+          cache-dependency-path: go.sum
       - name: Run golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:
           version: v2.12.0
 
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+          cache-dependency-path: go.sum
       - name: Run unit and integration tests
         run: make test
 
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+          cache-dependency-path: go.sum
       - name: Build default Bomly binary
         run: go build -o /tmp/bomly ./cmd/bomly
-
       - name: Build lite Bomly binary
         run: go build -tags "bomly_external_syft,bomly_external_grype" -o /tmp/bomly-lite ./cmd/bomly
 
+  format:
+    name: Format
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+          cache-dependency-path: go.sum
       - name: Check Go formatting
         run: make fmt-check
 
+  modules:
+    name: Module drift
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+          cache-dependency-path: go.sum
       - name: Check module metadata drift
         shell: bash
         run: |
           set -euo pipefail
           go mod tidy
           git diff --exit-code -- go.mod go.sum
 
+  generated-docs:
+    name: Generated docs drift
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+          cache-dependency-path: go.sum
       - name: Check generated documentation drift
         shell: bash
         run: |

.github/workflows/codeql.yml

@@ -0,0 +1,52 @@
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: "27 4 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (Go)
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+          cache-dependency-path: |
+            go.sum
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: go
+          queries: security-and-quality
+
+      - name: Build
+        run: go build ./...
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:go"

.github/workflows/dependency-review.yml

@@ -0,0 +1,27 @@
+name: Dependency review
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dependency-review-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  review:
+    name: Dependency review
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+
+      - name: Review dependencies
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high
+          comment-summary-in-pr: on-failure

.github/workflows/release.yml

@@ -60,7 +60,7 @@ jobs:
 
           Each archive includes `LICENSE`, `NOTICE`, and a `licenses/` directory with the full license text for every bundled dependency.
 
-          GitHub-native artifact attestations are intentionally deferred while the repository remains private on a non-Enterprise plan.
+          GitHub-native artifact attestations are planned and will be added in a future release.
           EOF
 
       - name: Create draft prerelease