feat(github): add OSS repository governance & supply-chain hardening

.github/CODEOWNERS

@@ -0,0 +1,13 @@
+# This file has NO effect on required reviews today -- "Require review from
+# Code Owners" is intentionally left OFF in branch protection (see
+# docs/superpowers/specs/2026-09-05-oss-repo-governance-hardening-design.md,
+# "Out of Scope": a single-maintainer repo can't satisfy independent
+# code-owner review, so enabling this would either block merges or produce
+# meaningless self-review).
+#
+# This file exists so that turning required review on later (once a second
+# qualified maintainer exists, per project-roadmap.md's "Public and
+# enterprise governance" section) is a one-line branch-protection change,
+# not a design task done under time pressure.
+
+* @SHcommit

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,80 @@
+name: Bug Report
+description: Report something that isn't working as expected
+title: "[Bug]: "
+labels: ["needs-triage", "type:bug"]
+body:
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: "Output of `adr --version` or the release tag you're on"
+      placeholder: "v1.0.1"
+    validations:
+      required: true
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating System
+      options:
+        - Linux
+        - macOS
+        - Windows
+        - Other (specify in Additional context)
+    validations:
+      required: true
+  - type: dropdown
+    id: environment
+    attributes:
+      label: Environment
+      description: How you're running ADR Toolkit
+      options:
+        - Claude Code
+        - Codex CLI
+        - Gemini CLI
+        - Antigravity CLI
+        - Cline CLI
+        - Direct CLI (pip install / python script)
+        - Other (specify in Additional context)
+    validations:
+      required: true
+  - type: input
+    id: component
+    attributes:
+      label: Affected component / adapter
+      description: "e.g. `adr.py check`, `adapters/codex`, ADR index generation"
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Reproduction steps
+      description: Exact commands, in order
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: "Output of the failing command with `--verbose` or `--debug` if available"
+      render: shell
+    validations:
+      required: false
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional context
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/SHcommit/ADR-toolkit/security/policy
+    about: Please report vulnerabilities privately per SECURITY.md, not as a public issue.
+  - name: Question / discussion
+    url: https://github.com/SHcommit/ADR-toolkit/discussions
+    about: For open-ended questions that aren't a bug or a concrete feature proposal.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,54 @@
+name: Feature Request
+description: Propose a new capability or improvement
+title: "[Feature]: "
+labels: ["needs-triage", "type:feature"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What can't you do today, or what's needlessly painful?
+    validations:
+      required: true
+  - type: textarea
+    id: use-case
+    attributes:
+      label: Use case
+      description: The concrete scenario where this problem shows up
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed solution
+    validations:
+      required: false
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+    validations:
+      required: false
+  - type: dropdown
+    id: area
+    attributes:
+      label: Affected area
+      options:
+        - Core / CLI (scripts, adr.py)
+        - Adapter (Claude / Codex / Gemini / Antigravity)
+        - GitHub automation (.github/**)
+        - Documentation
+        - Other
+    validations:
+      required: true
+  - type: dropdown
+    id: contribution
+    attributes:
+      label: Contribution willingness
+      description: Would you be willing to open a PR for this yourself?
+      options:
+        - "Yes, I'd like to implement this"
+        - "Maybe, with guidance"
+        - "No, just proposing the idea"
+    validations:
+      required: true

.github/dependabot.yml

@@ -0,0 +1,23 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    target-branch: "develop"
+    schedule:
+      interval: "weekly"
+    groups:
+      dev-dependencies:
+        patterns:
+          - "*"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    target-branch: "develop"
+    schedule:
+      interval: "weekly"
+    groups:
+      actions:
+        patterns:
+          - "*"
+    open-pull-requests-limit: 5

.github/labeler.yml

@@ -0,0 +1,41 @@
+"area:core":
+  - changed-files:
+      - any-glob-to-any-file:
+          - "skills/adr-toolkit/scripts/core/**"
+          - "skills/adr-toolkit/scripts/evidence/**"
+          - "skills/adr-toolkit/scripts/rules/**"
+          - "scripts/**"
+
+"area:cli":
+  - changed-files:
+      - any-glob-to-any-file:
+          - "skills/adr-toolkit/scripts/adr.py"
+          - "skills/adr-toolkit/scripts/commands/**"
+
+"area:adapter":
+  - changed-files:
+      - any-glob-to-any-file:
+          - "adapters/**"
+          - ".claude-plugin/**"
+
+"area:github":
+  - changed-files:
+      - any-glob-to-any-file:
+          - ".github/**"
+
+"area:docs":
+  - changed-files:
+      - any-glob-to-any-file:
+          - "docs/**"
+          - "*.md"
+
+"type:test":
+  - changed-files:
+      - any-glob-to-any-file:
+          - "tests/**"
+
+"type:docs":
+  - changed-files:
+      - any-glob-to-any-file:
+          - "docs/**"
+          - "*.md"

.github/labels.yml

@@ -0,0 +1,94 @@
+# Label taxonomy for ADR Toolkit. Synced to the live repo by
+# .github/workflows/labels.yml via EndBug/label-sync. Add or edit labels
+# here, not in the GitHub UI — UI-only edits are overwritten on the next
+# sync run.
+
+# --- type: what kind of change/report ---
+- name: "type:bug"
+  color: "d73a4a"
+  description: "Something isn't working"
+- name: "type:feature"
+  color: "a2eeef"
+  description: "New feature or request"
+- name: "type:docs"
+  color: "0075ca"
+  description: "Documentation only"
+- name: "type:refactor"
+  color: "cfd3d7"
+  description: "Code change with no behavior change"
+- name: "type:test"
+  color: "bfdadc"
+  description: "Test-only change"
+- name: "type:epic"
+  color: "3fb950"
+  description: "Umbrella/tracking issue that groups related work"
+
+# --- area: which part of the repo ---
+- name: "area:core"
+  color: "5319e7"
+  description: "skills/adr-toolkit/scripts core and CLI commands"
+- name: "area:cli"
+  color: "5319e7"
+  description: "adr.py entrypoint and command wiring"
+- name: "area:adapter"
+  color: "5319e7"
+  description: "adapters/** and .claude-plugin/** harness integrations"
+- name: "area:github"
+  color: "5319e7"
+  description: ".github/** workflows, templates, and repo automation"
+- name: "area:docs"
+  color: "5319e7"
+  description: "docs/**, README, CONTRIBUTING, and other project documentation"
+
+# --- priority ---
+- name: "priority:P0"
+  color: "b60205"
+  description: "Drop everything -- breaks release, security, or data integrity"
+- name: "priority:P1"
+  color: "d93f0b"
+  description: "Should land in the next release"
+- name: "priority:P2"
+  color: "fbca04"
+  description: "Normal priority, no target release yet"
+
+# --- workflow state ---
+- name: "needs-triage"
+  color: "ededed"
+  description: "Not yet reviewed by a maintainer"
+- name: "blocked"
+  color: "000000"
+  description: "Waiting on an external dependency or decision"
+
+# --- size (applied manually at review time, not automated in this plan) ---
+- name: "size:XS"
+  color: "c2e0c6"
+  description: "Trivial change"
+- name: "size:S"
+  color: "c2e0c6"
+  description: "Small, single-concern change"
+- name: "size:M"
+  color: "fef2c0"
+  description: "Moderate change, multiple files"
+- name: "size:L"
+  color: "f9d0c4"
+  description: "Large change, review carefully"
+- name: "size:XL"
+  color: "e99695"
+  description: "Very large -- consider splitting"
+
+# --- kept from GitHub's defaults: still useful, not replaced ---
+- name: "good first issue"
+  color: "7057ff"
+  description: "Good for newcomers"
+- name: "help wanted"
+  color: "008672"
+  description: "Extra attention is needed"
+- name: "duplicate"
+  color: "cfd3d7"
+  description: "This issue or pull request already exists"
+- name: "invalid"
+  color: "e4e669"
+  description: "This doesn't seem right"
+- name: "wontfix"
+  color: "ffffff"
+  description: "This will not be worked on"