chore: Update Issue+PR Templates / add SECURITY.md (#1732)

atilafassina · web-flow · commit 99e3218a6ca9 · 2025-01-27T13:56:27.000+01:00
* update the contributing templates and links

* add `SECURITY.md`

* hardcode issue template order / update PR template
diff --git a/.github/ISSUE_TEMPLATE.md b/.github/ISSUE_TEMPLATE.md
@@ -0,0 +1,9 @@
+<!-- Note: Please must use one of our issue templates to file an issue! 🛑 -->
+<!-- 👉 https://github.com/JoshuaKGoldberg/create-typescript-app/issues/new/choose 👈 -->
+<!-- **Issues that should have been filed with a template will be closed without action, and we will ask you to use a template.** -->
+
+<!-- This blank issue template is only for issues that don't fit any of the templates. -->
+
+## Overview
+
+...
diff --git a/.github/ISSUE_TEMPLATE/01-bug.yml b/.github/ISSUE_TEMPLATE/01-bug.yml
@@ -1,7 +1,7 @@
 name: Bug report 🐛
-description: Create a bug report for Solid Start.
-labels: ['bug', 'needs triage']
-title: '[Bug?]: '
+description: Create a bug report for SolidStart.
+labels: ["bug", "needs triage"]
+title: "[Bug?]: "
 body:
   - type: markdown
     attributes:
@@ -59,9 +59,10 @@ body:
           OS: Linux 5.10 Debian GNU/Linux 9 (stretch)
           CPU: (8) arm64
         Binaries:
-          Node: 14.17.0 - /usr/local/bin/node
-          Yarn: 1.22.5 - /usr/local/bin/yarn
-          npm: 6.14.13 - /usr/local/bin/npm
+          Node: 20.0.0 - /usr/local/bin/node
+          Yarn: 3.0.0 - /usr/local/bin/yarn
+          npm: 9.8.0 - /usr/local/bin/npm
+          pnpm: 9.0.0 - /usr/local/bin/pnpm
         npmPackages:
-          solid-start: 1.0.0 => 1.0.0
+          @solidjs/start: 1.0.0 => 1.0.0
       render: shell
diff --git a/.github/ISSUE_TEMPLATE/02-feature.yml b/.github/ISSUE_TEMPLATE/02-feature.yml
@@ -1,36 +1,41 @@
 name: Feature request 💄
-description: Suggest a new idea for Solid Start.
-labels: ['enhancement', 'needs triage']
-title: '[Feature?]: '
+description: Suggest a new idea for SolidStart.
+labels: ["enhancement", "needs triage"]
+title: "[Feature?]: "
 body:
-  - type: markdown
-    attributes:
-      value: |
-        Please provide a searchable summary of the issue in the title above ⬆️.
-
-        Thanks for contributing by creating an issue! ❤️
   - type: checkboxes
     attributes:
       label: Duplicates
       description: Please [search the history](https://github.com/solidjs/solid-start/issues) to see if an issue already exists for the same problem.
       options:
         - label: I have searched the existing issues
           required: true
+
   - type: checkboxes
     attributes:
       label: Latest version
       description: We roll bug fixes, performance enhancements, and other improvements into new releases.
       options:
         - label: I have tested the latest version
           required: true
+
+  - type: markdown
+    attributes:
+      value: |
+        Please provide a searchable summary of the issue in the title above ⬆️.
+
+        Thanks for contributing by creating an issue! ❤️
+
   - type: textarea
     attributes:
       label: Summary 💡
       description: Describe how it should work.
+
   - type: textarea
     attributes:
       label: Examples 🌈
       description: Provide a link to the Solid Start specification, other implementations, or screenshots of the expected behavior.
+
   - type: textarea
     attributes:
       label: Motivation 🔦
diff --git a/.github/ISSUE_TEMPLATE/03-question.yml b/.github/ISSUE_TEMPLATE/03-question.yml
@@ -1,7 +1,7 @@
-name: 'Questions / Help 💬'
+name: "Questions / Help 💬"
 description: If you have questions, please check the Discussions tab
-title: '[Please read the message below]'
-labels: [':speech_balloon: Question']
+title: "[Please read the message below]"
+labels: [":speech_balloon: Question"]
 body:
   - type: markdown
     attributes:
@@ -14,6 +14,7 @@ body:
 
         - [The Discussion Q&A page](https://github.com/solidjs/solid-start/discussions/categories/q-a)
         - [All Discussions](https://github.com/solidjs/solid-start/discussions)
+        - [SolidJS Discord](https://discord.gg/solidjs)
   - type: checkboxes
     id: no-post
     attributes:
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
@@ -1 +1,4 @@
-blank_issues_enabled: false
+contact_links:
+  - name: "SolidJS Discord"
+    url: https://discord.gg/solidjs
+    about: For questions and suggestions, please joins us on discord!
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
@@ -2,28 +2,15 @@
 
 Please check if your PR fulfills the following requirements:
 
+- [ ] Addresses an existing open issue: fixes #000
 - [ ] Tests for the changes have been added (for bug fixes / features)
 
-## PR Type
-
-What kind of change does this PR introduce?
-
-<!-- Please check the one that applies to this PR using "x". -->
-
-- [ ] Bugfix
-- [ ] Feature
-- [ ] Code style update (formatting, local variables)
-- [ ] Refactoring (no functional changes, no api changes)
-- [ ] Build related changes
-- [ ] CI related changes
-- [ ] Documentation content changes
-- [ ] infrastructure changes
-- [ ] Other... Please describe:
-
 ## What is the current behavior?
+
 <!-- Please describe the current behavior that you are modifying, or link to a relevant issue. -->
 
 ## What is the new behavior?
 
 ## Other information
+
 <!-- Add screenshots, GIFS, or any other relevant information that might help give more context. -->
diff --git a/.github/SECURITY.md b/.github/SECURITY.md
@@ -0,0 +1,25 @@
+Thanks for helping make Solid safe for everyone.
+
+# Security
+
+SolidJS takes the security of our software seriously, including all of the open-source code repositories managed through [this GitHub organization](https://github.com/solidjs).
+
+## Reporting a Vulnerability
+
+<ins>**If you think you've found a security issue, please DO NOT report, discuss, or describe it on Discord or GitHub.**<ins>
+
+**All security-related issues, concerns, and problems must be reported via email to: security@solidjs.com**
+
+Please include everything necessary to reproduce the problem when sending over information, including an example repository on StackBlitz or GitHub. Please don't add explicit details about the security issue you are reporting in any of the repository's contents.
+
+**_This is detrimental to the safety of all SolidStart users. No exceptions._**
+
+## Embargo Policy
+
+SolidJS's Security Team members must share information only within the Solid Core and Security teams on a need-to-know basis to fix the related issue in Solid. The information members and others receive thorough participation in this group must not be made public, shared, or even hinted otherwise, except with prior explicit approval (which shall be handled on a case-by-case basis). This holds true until the agreed-upon public disclosure date/time is satisfied.
+
+As a clarifying example, this policy forbids Solid Security members from sharing list information with their employers; unless prior arrangements have been made directly with an employer.
+
+In the unfortunate event that you share the information beyond what is allowed by this policy, you must urgently inform the Solid Security Team of exactly what information leaked and to whom, as well as the steps that will be taken to prevent future leaks.
+
+**Repeated offenses may lead to the removal from the Security or Solid team.**
diff --git a/package.json b/package.json
@@ -7,7 +7,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/ryansolid/solid-start"
+    "url": "https://github.com/solidjs/solid-start"
   },
   "private": true,
   "scripts": {
