chore(deps): bump github/codeql-action from 4.36.0 to 4.36.2

.api.env.example

@@ -1,8 +1,34 @@
 EVYDENCE_ADDR=:8080
 EVYDENCE_API_KEY_PEPPER=change-me-long-random-pepper
 EVYDENCE_DATABASE_URL=postgres://evydence:change-me@localhost:5432/evydence?sslmode=disable
+# Local default is snapshot_preferred. Production defaults to relational_only when unset.
+# EVYDENCE_POSTGRES_LOAD_MODE=relational_only
 EVYDENCE_OBJECT_STORE=filesystem
 EVYDENCE_OBJECT_DIR=./tmp/objects
+EVYDENCE_RATE_LIMIT_REQUESTS_PER_MINUTE=0
+# Optional hardening mode for parser-backed uploads. When true, the API stores
+# accepted records and the outbox worker writes parser-derived fields and
+# OpenVEX-derived vulnerability decisions.
+EVYDENCE_WORKER_OWNED_PARSER_SIDE_EFFECTS=false
+EVYDENCE_SIGNING_KEY_MODE=external
+# Optional external signing gateway. Use HTTPS outside localhost.
+# EVYDENCE_SIGNING_EXECUTOR_URL=https://signer.example.test/sign
+# EVYDENCE_SIGNING_EXECUTOR_TOKEN=replace-with-signing-gateway-token
+# EVYDENCE_SIGNING_EXECUTOR_TIMEOUT_SECONDS=10
+# Optional AWS KMS signing executor. Set EVYDENCE_SIGNING_KEY_MODE=aws-kms.
+# EVYDENCE_AWS_REGION=eu-north-1
+# EVYDENCE_AWS_KMS_KEY_ID=alias/evydence-release
+# EVYDENCE_AWS_KMS_SIGNING_ALGORITHM=ECDSA_SHA_256
+# EVYDENCE_AWS_KMS_TIMEOUT_SECONDS=10
+# Optional OIDC discovery refresh tuning. HTTP is allowed only for localhost when explicitly enabled.
+# EVYDENCE_OIDC_DISCOVERY_TIMEOUT_SECONDS=10
+# EVYDENCE_OIDC_DISCOVERY_ALLOW_INSECURE_LOCALHOST=false
+# Optional OIDC UserInfo live validation tuning. HTTP is allowed only for localhost when explicitly enabled.
+# EVYDENCE_OIDC_USERINFO_TIMEOUT_SECONDS=10
+# EVYDENCE_OIDC_USERINFO_ALLOW_INSECURE_LOCALHOST=false
+# Optional public transparency proof fetch tuning. HTTP is allowed only for localhost when explicitly enabled.
+# EVYDENCE_TRANSPARENCY_FETCH_TIMEOUT_SECONDS=10
+# EVYDENCE_TRANSPARENCY_FETCH_ALLOW_INSECURE_LOCALHOST=false
 # For MinIO/S3, set EVYDENCE_OBJECT_STORE=minio and provide:
 # EVYDENCE_S3_ENDPOINT=localhost:9000
 # EVYDENCE_S3_BUCKET=evydence

.dockerignore

@@ -0,0 +1,49 @@
+.git
+.github
+.refs
+.trash
+
+# Local secrets and environment overrides. Keep examples in git, but do not
+# send operator-specific values into Docker build contexts.
+.env
+.env.*
+.api.env
+.api.env.*
+.test.env
+.test.env.*
+*.pem
+*.key
+*.p12
+*.pfx
+
+# Release, backup, and generated evidence artifacts.
+release-evidence
+release-evidence/
+backups
+backups/
+coverage.out
+*.prof
+*.pprof
+*.test
+
+# Build output and temporary files.
+bin
+bin/
+dist
+dist/
+tmp
+tmp/
+__pycache__
+**/__pycache__
+
+# SDK build artifacts.
+sdk/typescript/.build
+sdk/typescript/node_modules
+sdk/python/**/__pycache__
+
+# Terraform local state/cache.
+.terraform
+**/.terraform
+.terraform.lock.hcl
+*.tfstate
+*.tfstate.*

.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,35 @@
+# Issue Intake
+
+Use the structured issue forms when GitHub shows them. This fallback template is
+for clients that do not render issue forms.
+
+Before posting, remove API keys, collector secrets, bearer tokens, session
+tokens, portal tokens, private keys, provider credentials, database URLs,
+raw evidence payloads, customer data, exploit payloads against third-party
+systems, and unredacted customer package contents.
+
+Security vulnerabilities should not be reported in public issues. Use GitHub
+private vulnerability reporting when available, or follow `SECURITY.md` to
+request a private intake channel without including vulnerability details in the
+first contact.
+
+## Summary
+
+Describe the bug, documentation gap, feature request, or production-support
+question.
+
+## Environment
+
+- Evydence commit, tag, or image digest:
+- Deployment profile:
+- PostgreSQL/object-store mode:
+- Relevant command or endpoint:
+
+## Evidence
+
+List sanitized logs, commands, request IDs, report IDs, or reproduction steps.
+Do not attach raw tenant evidence or secrets.
+
+## Expected Outcome
+
+Describe the result you expected and the result you observed.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,69 @@
+name: Bug report
+description: Report a reproducible Evydence defect without sharing secrets or raw evidence.
+title: "bug: "
+labels: ["bug", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not include API keys, bearer tokens, session tokens, private keys,
+        provider credentials, database URLs, raw evidence payloads, customer
+        data, or unredacted customer package contents. Use the private security
+        intake in SECURITY.md for suspected vulnerabilities.
+  - type: input
+    id: version
+    attributes:
+      label: Version or commit
+      description: Commit SHA, tag, image digest, or chart version.
+      placeholder: 842fb053f303b2a78eb3118be6a4536715571215
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - API
+        - CLI
+        - Worker/outbox
+        - PostgreSQL/migrations
+        - Object storage
+        - Signing/verification
+        - Reports/packages
+        - Deployment/Helm/Docker
+        - Documentation
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: observed
+    attributes:
+      label: Observed behavior
+      description: Sanitize logs and redact sensitive values.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction steps
+      description: Include exact commands, API paths, or configuration names when safe.
+    validations:
+      required: true
+  - type: textarea
+    id: validation
+    attributes:
+      label: Checks already run
+      placeholder: make test, make docs-check, make production-check
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Safety confirmation
+      options:
+        - label: I have not included secrets, raw evidence payloads, private keys, bearer tokens, provider credentials, database URLs, or customer data.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/aatuh/evydence/security
+    about: Use the private security intake described in SECURITY.md. Do not post suspected vulnerabilities publicly.
+  - name: Support policy
+    url: https://github.com/aatuh/evydence/blob/master/SUPPORT.md
+    about: Read support boundaries and sanitized-report expectations before opening an issue.

.github/ISSUE_TEMPLATE/docs.yml

@@ -0,0 +1,30 @@
+name: Documentation issue
+description: Report unclear, stale, missing, or misleading documentation.
+title: "docs: "
+labels: ["documentation", "triage"]
+body:
+  - type: input
+    id: path
+    attributes:
+      label: Document path
+      placeholder: docs/tutorials/getting-started.md
+    validations:
+      required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: What is wrong or missing?
+      description: Include the exact command, section, or expectation that did not match reality.
+    validations:
+      required: true
+  - type: textarea
+    id: fix
+    attributes:
+      label: Suggested correction
+  - type: checkboxes
+    id: claims
+    attributes:
+      label: Claim safety
+      options:
+        - label: This issue does not ask Evydence to claim legal compliance, certification, complete SBOM coverage, authoritative scanner results, or secure releases.
+          required: true

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,47 @@
+name: Feature request
+description: Propose a focused Evydence capability or integration.
+title: "feat: "
+labels: ["enhancement", "triage"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What release-evidence, compliance-readiness, or operator workflow is blocked?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+      description: Describe the smallest useful capability.
+    validations:
+      required: true
+  - type: dropdown
+    id: boundary
+    attributes:
+      label: Trust boundary affected
+      options:
+        - API
+        - Tenant isolation/authz
+        - File upload/object storage
+        - Signing/verification
+        - Provider/collector integration
+        - Reports/packages/exports
+        - Deployment/operations
+        - Documentation only
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: validation
+    attributes:
+      label: Acceptance test idea
+      description: What command, API flow, or report would prove the feature works?
+  - type: checkboxes
+    id: scope
+    attributes:
+      label: Scope confirmation
+      options:
+        - label: This request supports compliance readiness or technical evidence organization without asking for legal compliance, certification, or secure-release guarantees.
+          required: true

.github/ISSUE_TEMPLATE/production_support.yml

@@ -0,0 +1,41 @@
+name: Production support question
+description: Ask a non-sensitive self-hosting or operations question.
+title: "ops: "
+labels: ["operations", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Public issues are not a private support channel. Do not include secrets,
+        raw evidence payloads, customer data, private keys, bearer tokens,
+        database URLs, or provider credentials.
+  - type: dropdown
+    id: profile
+    attributes:
+      label: Deployment profile
+      options:
+        - Local evaluation
+        - Controlled internal self-hosted candidate
+        - Air-gapped self-hosted candidate
+        - Regulated self-hosted review
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: question
+    attributes:
+      label: Question
+    validations:
+      required: true
+  - type: textarea
+    id: sanitized_config
+    attributes:
+      label: Sanitized configuration summary
+      description: Use variable names and redacted values only.
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Safety confirmation
+      options:
+        - label: I have redacted all secrets, raw payloads, customer data, bearer tokens, private keys, provider credentials, and database URLs.
+          required: true

.github/dependabot.yml

@@ -0,0 +1,26 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - go
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - github-actions
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - docker

.github/pull_request_template.md

@@ -0,0 +1,33 @@
+# Pull Request
+
+## Summary
+
+- 
+
+## Change Type
+
+- [ ] Documentation
+- [ ] Tooling
+- [ ] API contract
+- [ ] Persistence/data
+- [ ] Security/authz/session/secret handling
+- [ ] Deployment/operations
+- [ ] Refactor
+
+## Security And Evidence Invariants
+
+Confirm the change preserves tenant isolation, append-only evidence behavior,
+safe errors/logs, conservative product language, and no compliance,
+certification, complete-SBOM, scanner-authority, or secure-release claims.
+
+## Validation
+
+List the exact commands run and their results. Include skipped checks with the
+reason.
+
+## Sensitive Data Check
+
+Confirm the PR does not include API keys, collector secrets, bearer tokens,
+session tokens, portal tokens, private keys, provider credentials, database
+URLs, raw evidence payloads, customer data, or unredacted customer package
+contents.