@plainconceptsplatform/workflows 0.4.34 → 0.5.1

package/loops/templates/ci/app-ci-node-monorepo.yml

@@ -1,178 +1,208 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/templates/ci/app-ci-node-monorepo.yml. Update with `workflows update --force`; consumer edits may be overwritten.
-name: "App: CI (Node monorepo)"
-
-on:
-  pull_request:
-  schedule:
-    - cron: "0 6 * * 1"
-  workflow_dispatch:
-
-env:
-  NODE_VERSION: "22"
-  PNPM_VERSION: "10"
-  WEB_PACKAGE: "@orbion/web"
-  DESKTOP_PACKAGE: "@orbion/desktop"
-  MOBILE_PACKAGE: "@orbion/mobile"
-  WEB_EXPORT_PATH: apps/web/out
-  PLAYWRIGHT_REPORT_PATH: apps/web/playwright-report
-  DESKTOP_MAIN_PATH: apps/desktop/out/main/index.js
-  DESKTOP_PRELOAD_PATH: apps/desktop/out/preload/index.cjs
-  DESKTOP_PRELOAD_BRIDGE_PATTERN: exposeInMainWorld
-  MOBILE_IOS_PATH: apps/mobile/ios
-  MOBILE_ANDROID_PATH: apps/mobile/android
-  WEB_ARTIFACT_NAME: web-export
-  PLAYWRIGHT_ARTIFACT_NAME: playwright-report
-  TRUFFLEHOG_IMAGE: "trufflesecurity/trufflehog:latest"
-  SEMGREP_IMAGE: "semgrep/semgrep:1.168.0"
-  SBOM_ARTIFACT_NAME: orbion-sbom.cyclonedx.json
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ci-${{ github.workflow }}-${{ github.head_ref || github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-jobs:
-  lint:
-    name: Lint (Biome)
-    if: github.event_name != 'schedule'
-    runs-on: RunnerLandingZone
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with: { version: ${{ env.PNPM_VERSION }}, run_install: false }
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm exec biome check .
-
-  web:
-    name: Web (Next.js static export)
-    if: github.event_name != 'schedule'
-    runs-on: RunnerLandingZone
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with: { version: ${{ env.PNPM_VERSION }}, run_install: false }
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm --filter "$WEB_PACKAGE" run typecheck
-      - run: pnpm --filter "$WEB_PACKAGE" run test
-      - run: pnpm --filter "$WEB_PACKAGE" run lint:fsd
-      - run: pnpm --filter "$WEB_PACKAGE" run build
-      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-        with:
-          name: ${{ env.WEB_ARTIFACT_NAME }}
-          path: ${{ env.WEB_EXPORT_PATH }}
-          retention-days: 3
-          if-no-files-found: error
-
-  e2e:
-    name: E2E (Playwright)
-    if: github.event_name != 'schedule'
-    needs: web
-    runs-on: RunnerLandingZone
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with: { version: ${{ env.PNPM_VERSION }}, run_install: false }
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
-      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
-        with:
-          name: ${{ env.WEB_ARTIFACT_NAME }}
-          path: ${{ env.WEB_EXPORT_PATH }}
-      - run: pnpm --filter "$WEB_PACKAGE" exec playwright install --with-deps chromium webkit
-      - run: pnpm --filter "$WEB_PACKAGE" run e2e
-      - if: failure()
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-        with:
-          name: ${{ env.PLAYWRIGHT_ARTIFACT_NAME }}
-          path: ${{ env.PLAYWRIGHT_REPORT_PATH }}
-          retention-days: 7
-
-  desktop:
-    name: Desktop (Electron)
-    if: github.event_name != 'schedule'
-    needs: web
-    runs-on: RunnerLandingZone
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with: { version: ${{ env.PNPM_VERSION }}, run_install: false }
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm --filter "$DESKTOP_PACKAGE" run typecheck
-      - run: pnpm --filter "$DESKTOP_PACKAGE" run build
-      - run: |
-          test -f "$DESKTOP_MAIN_PATH"
-          test -f "$DESKTOP_PRELOAD_PATH"
-          grep -q "$DESKTOP_PRELOAD_BRIDGE_PATTERN" "$DESKTOP_PRELOAD_PATH"
-      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
-        with:
-          name: ${{ env.WEB_ARTIFACT_NAME }}
-          path: ${{ env.WEB_EXPORT_PATH }}
-      - run: pnpm --filter "$DESKTOP_PACKAGE" exec playwright install-deps chromium
-      - run: xvfb-run --auto-servernum pnpm --filter "$DESKTOP_PACKAGE" run e2e
-
-  mobile:
-    name: Mobile (Capacitor)
-    if: github.event_name != 'schedule'
-    runs-on: RunnerLandingZone
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with: { version: ${{ env.PNPM_VERSION }}, run_install: false }
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm --filter "$MOBILE_PACKAGE" run typecheck
-      - run: |
-          if [ -d "$MOBILE_IOS_PATH" ] || [ -d "$MOBILE_ANDROID_PATH" ]; then
-            pnpm --filter "$WEB_PACKAGE" run build
-            pnpm --filter "$MOBILE_PACKAGE" run sync
-          else
-            echo "::notice::Native projects absent; skipping Capacitor sync."
-          fi
-
-  secret-scan:
-    name: Secret scan (TruffleHog)
-    runs-on: RunnerLandingZone
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - run: docker run --rm -v "${{ github.workspace }}:/repo" "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --fail --no-update
-
-  deps-and-iac-scan:
-    name: Dependencies and IaC (Trivy)
-    runs-on: RunnerLandingZone
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-        with:
-          scan-type: fs
-          scanners: vuln,misconfig,secret
-          severity: CRITICAL,HIGH
-          ignore-unfixed: true
-          exit-code: "1"
-          format: table
-
-  sast-scan:
-    name: SAST (Semgrep)
-    runs-on: RunnerLandingZone
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - run: docker run --rm -v "${{ github.workspace }}:/src" -w /src "$SEMGREP_IMAGE" semgrep scan --error --metrics=off --oss-only --disable-version-check --config p/default --config p/security-audit --config p/secrets --config p/typescript --config p/react --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
-
-  sbom:
-    name: SBOM (CycloneDX)
-    runs-on: RunnerLandingZone
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
-        with:
-          format: cyclonedx-json
-          artifact-name: ${{ env.SBOM_ARTIFACT_NAME }}
+# Managed by @plainconceptsplatform/workflows. Source: loops/templates/ci/app-ci-node-monorepo.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+name: "App: CI (Node monorepo)"
+
+on:
+  pull_request:
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+env:
+  NODE_VERSION: "22"
+  PNPM_VERSION: "10"
+  WEB_PACKAGE: "@app/web"
+  DESKTOP_PACKAGE: "@app/desktop"
+  MOBILE_PACKAGE: "@app/mobile"
+  WEB_EXPORT_PATH: apps/web/out
+  PLAYWRIGHT_REPORT_PATH: apps/web/playwright-report
+  DESKTOP_MAIN_PATH: apps/desktop/out/main/index.js
+  DESKTOP_PRELOAD_PATH: apps/desktop/out/preload/index.cjs
+  DESKTOP_PRELOAD_BRIDGE_PATTERN: exposeInMainWorld
+  MOBILE_IOS_PATH: apps/mobile/ios
+  MOBILE_ANDROID_PATH: apps/mobile/android
+  WEB_ARTIFACT_NAME: web-export
+  PLAYWRIGHT_ARTIFACT_NAME: playwright-report
+  TRUFFLEHOG_IMAGE: "trufflesecurity/trufflehog:latest"
+  SEMGREP_IMAGE: "semgrep/semgrep:1.168.0"
+  SBOM_ARTIFACT_NAME: app-sbom.cyclonedx.json
+  MUTATION_THRESHOLD: "60"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  lint:
+    name: Lint (Biome)
+    if: github.event_name != 'schedule'
+    runs-on: agents-arc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        with: { version: ${{ env.PNPM_VERSION }}, run_install: false }
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm exec biome check .
+
+  web:
+    name: Web (Next.js static export)
+    if: github.event_name != 'schedule'
+    runs-on: agents-arc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        with: { version: ${{ env.PNPM_VERSION }}, run_install: false }
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm --filter "$WEB_PACKAGE" run typecheck
+      - run: pnpm --filter "$WEB_PACKAGE" run test
+      - run: pnpm --filter "$WEB_PACKAGE" run lint:fsd
+      - run: pnpm --filter "$WEB_PACKAGE" run build
+      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        with:
+          name: ${{ env.WEB_ARTIFACT_NAME }}
+          path: ${{ env.WEB_EXPORT_PATH }}
+          retention-days: 3
+          if-no-files-found: error
+
+  mutation-web:
+    name: Mutation (web, diff)
+    if: github.event_name == 'pull_request'
+    runs-on: agents-arc
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        with: { version: ${{ env.PNPM_VERSION }}, run_install: false }
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
+      - name: Detect web changes
+        id: scope
+        run: |
+          git fetch origin "$GITHUB_BASE_REF" --depth=1
+          if git diff --name-only "origin/$GITHUB_BASE_REF" HEAD | grep -qE "^apps/web/"; then
+            echo "run=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "run=false" >> "$GITHUB_OUTPUT"
+            echo "No apps/web changes in this PR; skipping web mutation."
+          fi
+      - run: pnpm install --frozen-lockfile
+        if: steps.scope.outputs.run == 'true'
+      - name: StrykerJS (changed files only)
+        if: steps.scope.outputs.run == 'true'
+        run: pnpm --filter "$WEB_PACKAGE" exec stryker run --since="origin/$GITHUB_BASE_REF"
+
+  e2e:
+    name: E2E (Playwright)
+    if: github.event_name != 'schedule'
+    needs: web
+    runs-on: agents-arc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        with: { version: ${{ env.PNPM_VERSION }}, run_install: false }
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        with:
+          name: ${{ env.WEB_ARTIFACT_NAME }}
+          path: ${{ env.WEB_EXPORT_PATH }}
+      - run: pnpm --filter "$WEB_PACKAGE" exec playwright install --with-deps chromium webkit
+      - run: pnpm --filter "$WEB_PACKAGE" run e2e
+      - if: failure()
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        with:
+          name: ${{ env.PLAYWRIGHT_ARTIFACT_NAME }}
+          path: ${{ env.PLAYWRIGHT_REPORT_PATH }}
+          retention-days: 7
+
+  desktop:
+    name: Desktop (Electron)
+    if: github.event_name != 'schedule'
+    needs: web
+    runs-on: agents-arc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        with: { version: ${{ env.PNPM_VERSION }}, run_install: false }
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm --filter "$DESKTOP_PACKAGE" run typecheck
+      - run: pnpm --filter "$DESKTOP_PACKAGE" run build
+      - run: |
+          test -f "$DESKTOP_MAIN_PATH"
+          test -f "$DESKTOP_PRELOAD_PATH"
+          grep -q "$DESKTOP_PRELOAD_BRIDGE_PATTERN" "$DESKTOP_PRELOAD_PATH"
+      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        with:
+          name: ${{ env.WEB_ARTIFACT_NAME }}
+          path: ${{ env.WEB_EXPORT_PATH }}
+      - run: pnpm --filter "$DESKTOP_PACKAGE" exec playwright install-deps chromium
+      - run: xvfb-run --auto-servernum pnpm --filter "$DESKTOP_PACKAGE" run e2e
+
+  mobile:
+    name: Mobile (Capacitor)
+    if: github.event_name != 'schedule'
+    runs-on: agents-arc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        with: { version: ${{ env.PNPM_VERSION }}, run_install: false }
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm --filter "$MOBILE_PACKAGE" run typecheck
+      - run: |
+          if [ -d "$MOBILE_IOS_PATH" ] || [ -d "$MOBILE_ANDROID_PATH" ]; then
+            pnpm --filter "$WEB_PACKAGE" run build
+            pnpm --filter "$MOBILE_PACKAGE" run sync
+          else
+            echo "::notice::Native projects absent; skipping Capacitor sync."
+          fi
+
+  secret-scan:
+    name: Secret scan (TruffleHog)
+    runs-on: agents-arc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - run: docker run --rm -v "${{ github.workspace }}:/repo" "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --fail --no-update
+
+  deps-and-iac-scan:
+    name: Dependencies and IaC (Trivy)
+    runs-on: agents-arc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          scan-type: fs
+          scanners: vuln,misconfig,secret
+          severity: CRITICAL,HIGH
+          ignore-unfixed: true
+          exit-code: "1"
+          format: table
+
+  sast-scan:
+    name: SAST (Semgrep)
+    runs-on: agents-arc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - run: docker run --rm -v "${{ github.workspace }}:/src" -w /src "$SEMGREP_IMAGE" semgrep scan --error --metrics=off --oss-only --disable-version-check --config p/default --config p/security-audit --config p/secrets --config p/typescript --config p/react --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
+
+  sbom:
+    name: SBOM (CycloneDX)
+    runs-on: agents-arc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
+        with:
+          format: cyclonedx-json
+          artifact-name: ${{ env.SBOM_ARTIFACT_NAME }}

package/loops/templates/issues/bug_report.yml

@@ -1,109 +1,109 @@
-name: Bug report
-description: Report a defect
-labels: ["bug"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for reporting. Do **not** include real secrets or production data — use placeholders.
-
-        For security vulnerabilities, contact the team directly instead of filing a public issue.
-  - type: dropdown
-    id: severity
-    attributes:
-      label: Severity
-      options:
-        - Production-down / data loss
-        - Major — broken core flow
-        - Minor — broken edge case
-        - Cosmetic / polish
-    validations:
-      required: true
-  - type: dropdown
-    id: frequency
-    attributes:
-      label: Frequency
-      description: How often does this happen?
-      options:
-        - Always
-        - Intermittent
-        - Only once
-    validations:
-      required: true
-  - type: textarea
-    id: what-happened
-    attributes:
-      label: What happened?
-      description: A clear description of the bug and its impact.
-    validations:
-      required: true
-  - type: textarea
-    id: repro
-    attributes:
-      label: Steps to reproduce
-      description: How can a maintainer reproduce it?
-      placeholder: |
-        1. Go to ...
-        2. Do ...
-        3. See error
-    validations:
-      required: true
-  - type: textarea
-    id: expected
-    attributes:
-      label: Expected behavior
-    validations:
-      required: true
-  - type: dropdown
-    id: area
-    attributes:
-      label: Where does it occur?
-      options:
-        - Backend
-        - Frontend
-        - Both
-        - CLI / tooling
-        - Configuration / deployment
-        - Documentation
-        - Other
-    validations:
-      required: true
-  - type: textarea
-    id: acceptance
-    attributes:
-      label: Acceptance criteria
-      description: How will we know it's fixed? A checklist a reviewer can verify (include the test that should turn green).
-      placeholder: |
-        - [ ] ...
-        - [ ] A test that fails before the fix and passes after
-    validations:
-      required: false
-  - type: textarea
-    id: open-questions
-    attributes:
-      label: Open questions
-      description: Decisions a maintainer must make before this can be planned. Leave blank if none.
-    validations:
-      required: false
-  - type: textarea
-    id: environment
-    attributes:
-      label: Environment
-      description: Local vs deployed, branch/commit, OS, runtime versions if relevant.
-    validations:
-      required: false
-  - type: textarea
-    id: logs
-    attributes:
-      label: Logs / screenshots
-      description: Paste relevant logs or screenshots. Redact secrets and PII.
-      render: shell
-    validations:
-      required: false
-  - type: textarea
-    id: related
-    attributes:
-      label: Related links
-      description: Links to related issues, PRs, discussions, or docs. Leave blank if none.
-    validations:
-      required: false
+name: Bug report
+description: Report a defect
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting. Do **not** include real secrets or production data — use placeholders.
+
+        For security vulnerabilities, contact the team directly instead of filing a public issue.
+  - type: dropdown
+    id: severity
+    attributes:
+      label: Severity
+      options:
+        - Production-down / data loss
+        - Major — broken core flow
+        - Minor — broken edge case
+        - Cosmetic / polish
+    validations:
+      required: true
+  - type: dropdown
+    id: frequency
+    attributes:
+      label: Frequency
+      description: How often does this happen?
+      options:
+        - Always
+        - Intermittent
+        - Only once
+    validations:
+      required: true
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: A clear description of the bug and its impact.
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: How can a maintainer reproduce it?
+      placeholder: |
+        1. Go to ...
+        2. Do ...
+        3. See error
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Where does it occur?
+      options:
+        - Backend
+        - Frontend
+        - Both
+        - CLI / tooling
+        - Configuration / deployment
+        - Documentation
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance criteria
+      description: How will we know it's fixed? A checklist a reviewer can verify (include the test that should turn green).
+      placeholder: |
+        - [ ] ...
+        - [ ] A test that fails before the fix and passes after
+    validations:
+      required: false
+  - type: textarea
+    id: open-questions
+    attributes:
+      label: Open questions
+      description: Decisions a maintainer must make before this can be planned. Leave blank if none.
+    validations:
+      required: false
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Local vs deployed, branch/commit, OS, runtime versions if relevant.
+    validations:
+      required: false
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs / screenshots
+      description: Paste relevant logs or screenshots. Redact secrets and PII.
+      render: shell
+    validations:
+      required: false
+  - type: textarea
+    id: related
+    attributes:
+      label: Related links
+      description: Links to related issues, PRs, discussions, or docs. Leave blank if none.
+    validations:
+      required: false