feat: governance improvements

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,66 @@
+name: Bug Report
+description: Report a bug to help us improve
+labels: ["kind/bug"]
+body:
+- type: checkboxes
+  id: duplicate-check
+  attributes:
+    label: Pre-submission checklist
+    options:
+    - label: I have searched existing issues and confirmed this is not a duplicate.
+      required: true
+- type: textarea
+  id: description
+  attributes:
+    label: Description
+    description: A clear and concise description of the bug.
+  validations:
+    required: true
+- type: textarea
+  id: steps-to-reproduce
+  attributes:
+    label: Steps to Reproduce
+    description: Steps to reproduce the behavior.
+    placeholder: |
+      1. ...
+      2. ...
+      3. ...
+  validations:
+    required: true
+- type: textarea
+  id: expected-behavior
+  attributes:
+    label: Expected Behavior
+    description: What did you expect to happen?
+  validations:
+    required: true
+- type: textarea
+  id: actual-behavior
+  attributes:
+    label: Actual Behavior
+    description: What actually happened?
+  validations:
+    required: true
+- type: input
+  id: version
+  attributes:
+    label: Kargo Version
+    description: Output of `kargo version`.
+    placeholder: e.g. v1.3.0
+  validations:
+    required: true
+- type: textarea
+  id: logs
+  attributes:
+    label: Relevant Logs
+    description: If applicable, paste relevant log output. This will be automatically formatted as code.
+    render: shell
+  validations:
+    required: false
+- type: textarea
+  id: screenshots
+  attributes:
+    label: Screenshots
+    description: If applicable, add screenshots to help explain the bug.
+  validations:
+    required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -1,4 +1,4 @@
-blank_issues_enabled: true
+blank_issues_enabled: false
 
 contact_links:
   - name: Have you read the docs?

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,54 @@
+name: Feature Request
+description: Propose an enhancement for consideration by the maintainers
+labels: ["kind/proposal", "kind/enhancement"]
+body:
+- type: markdown
+  attributes:
+    value: |
+      **Please read before submitting.**
+
+      Feature requests are reviewed by maintainers on a best-effort basis.
+      Submitting a request does not guarantee it will be implemented.
+
+      **Do NOT begin work on a feature until all blocking labels have been removed
+      from the issue by a maintainer.** Pull requests linked to issues that still
+      carry blocking labels (`kind/proposal`, `needs discussion`, `needs research`,
+      `maintainer only`, `area/security`, `size/large`, `size/x-large`,
+      `size/xx-large`) will be automatically closed.
+
+      See the [Contributor Guide](https://docs.kargo.io/contributor-guide) for
+      full details on the contribution process.
+
+      If you are requesting a Helm chart option that may be very niche and not
+      useful to the community at large, please consider using Kustomize to apply
+      "last mile" tweaks to the output of `helm template` instead.
+- type: checkboxes
+  id: preconditions
+  attributes:
+    label: Pre-submission checklist
+    options:
+    - label: I have searched existing issues and confirmed this is not a duplicate.
+      required: true
+    - label: I understand that submitting a feature request does not guarantee it will be implemented.
+      required: true
+- type: textarea
+  id: proposal
+  attributes:
+    label: Proposed Feature
+    description: What new feature would you like to see?
+  validations:
+    required: true
+- type: textarea
+  id: motivation
+  attributes:
+    label: Motivation and Use Case
+    description: Why do you need this? Please give concrete examples of when someone would use this.
+  validations:
+    required: true
+- type: textarea
+  id: alternatives
+  attributes:
+    label: Alternatives Considered
+    description: Have you considered any alternative solutions or workarounds?
+  validations:
+    required: false

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,34 @@
+**All pull requests must reference an existing issue with no blocking labels.**
+PRs that do not meet this requirement will be automatically closed. See the
+[Contributor Guide](https://docs.kargo.io/contributor-guide) for details.
+
+## Issue Reference
+
+Closes #<!-- insert issue number -->
+
+## Description
+
+<!-- Describe what this PR does and why. -->
+
+## Checklist
+
+- [ ] The PR is linked to an existing issue.
+- [ ] The linked issue has no blocking labels (`kind/proposal`,
+  `needs discussion`, `needs research`, `maintainer only`, `area/security`,
+  `size/large`, `size/x-large`, `size/xx-large`).
+- [ ] I have added or updated tests as appropriate.
+- [ ] I have added or updated documentation as appropriate.
+
+### AI Use Disclosure
+
+Select one:
+
+- [ ] This PR was written by a human _without_ AI assistance.
+- [ ] This PR was written by a human _with_ AI assistance. A human has reviewed every line prior to opening the PR.
+- [ ] This PR was written by an AI _with human supervision._ A human has reviewed every line prior to opening the PR.
+- [ ] This PR was written entirely by AI. No human has reviewed this prior to opening the PR.
+
+### Sign-Off
+
+- [ ] All commits are signed off (`git commit -s`) **(required)**
+- [ ] All commits are cryptographically signed (`git commit -S`) **(preferred)**

.github/workflows/pr-policy-check.yaml

@@ -0,0 +1,108 @@
+name: PR Policy Check
+
+on:
+  pull_request_target:
+    types:
+    - opened
+
+permissions:
+  pull-requests: write
+  issues: read
+
+jobs:
+  check:
+    name: Validate linked issue
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.pull_request.author_association != 'MEMBER' &&
+      github.event.pull_request.author_association != 'OWNER' &&
+      !endsWith(github.event.pull_request.user.login, '[bot]')
+    steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
+      with:
+        egress-policy: audit
+
+    - name: Check for linked issue and blocking labels
+      env:
+        GH_TOKEN: ${{ secrets.AKUITYBOT_PAT }}
+        GH_REPO: ${{ github.repository }}
+        PR_NUMBER: ${{ github.event.pull_request.number }}
+      run: |
+        # Read PR body safely from the event payload instead of an env var.
+        PR_BODY=$(jq -r '.pull_request.body // ""' "$GITHUB_EVENT_PATH")
+
+        # Parse issue reference from PR body.
+        # Supports: Closes #N, Fixes #N, Resolves #N (and singular forms),
+        # plus full URL variants like https://github.com/owner/repo/issues/N
+        ISSUE_NUMBER=$(echo "$PR_BODY" | grep -oiP '(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s+(?:https://github\.com/[^/]+/[^/]+/issues/)?#?(\d+)' | head -1 | grep -oP '\d+$' || true)
+
+        if [ -z "$ISSUE_NUMBER" ]; then
+          gh pr edit "$PR_NUMBER" --add-label "policy/no-linked-issue"
+          gh pr comment "$PR_NUMBER" --body "$(cat <<'COMMENT'
+        ## Automated Policy Notice
+
+        This pull request has been closed because it does not reference an unblocked issue.
+
+        All contributions to Kargo require a linked, unblocked issue. This ensures that proposed changes have been reviewed by maintainers before effort is invested.
+
+        **To contribute:**
+
+        1. Open a [Bug Report](https://github.com/${{ github.repository }}/issues/new?template=bug_report.yml) or [Feature Request](https://github.com/${{ github.repository }}/issues/new?template=feature_request.yml)
+        2. Wait for a maintainer to review the issue and remove any blocking labels
+        3. Reference the issue in your PR using `Closes #<number>`
+
+        See the [Contributor Guide](https://docs.kargo.io/contributor-guide) for full details.
+        COMMENT
+          )"
+          gh pr close "$PR_NUMBER"
+          exit 1
+        fi
+
+        echo "Found linked issue: #$ISSUE_NUMBER"
+
+        # Fetch the issue's labels.
+        LABELS=$(gh issue view "$ISSUE_NUMBER" --json labels --jq '.labels[].name')
+
+        # Check for blocking labels.
+        BLOCKING_LABELS=(
+          "kind/proposal"
+          "needs discussion"
+          "needs research"
+          "maintainer only"
+          "area/security"
+          "size/large"
+          "size/x-large"
+          "size/xx-large"
+        )
+
+        FOUND_BLOCKERS=""
+        for blocker in "${BLOCKING_LABELS[@]}"; do
+          if echo "$LABELS" | grep -qxF "$blocker"; then
+            if [ -n "$FOUND_BLOCKERS" ]; then
+              FOUND_BLOCKERS="$FOUND_BLOCKERS, \`$blocker\`"
+            else
+              FOUND_BLOCKERS="\`$blocker\`"
+            fi
+          fi
+        done
+
+        if [ -n "$FOUND_BLOCKERS" ]; then
+          gh pr edit "$PR_NUMBER" --add-label "policy/blocked-issue"
+          gh pr comment "$PR_NUMBER" --body "$(cat <<COMMENT
+        ## Automated Policy Notice
+
+        This pull request has been closed because the linked issue (#$ISSUE_NUMBER) has not been unblocked for external contribution.
+
+        The issue currently has the following blocking label(s): $FOUND_BLOCKERS
+
+        Please wait for a maintainer to review and unblock the issue before opening a pull request. An issue is ready for external contribution when all blocking labels have been removed.
+
+        See the [Contributor Guide](https://docs.kargo.io/contributor-guide) for full details.
+        COMMENT
+          )"
+          gh pr close "$PR_NUMBER"
+          exit 1
+        fi
+
+        echo "No blocking labels found on issue #$ISSUE_NUMBER. PR is allowed."