Docs/website and readme

.claude/settings.json

@@ -0,0 +1,16 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(go *)",
+      "Bash(gofmt *)",
+      "Bash(golangci-lint run:*)",
+      "Bash(GOFLAGS=-mod=mod go mod tidy)",
+      "Bash(make all *)",
+      "Bash(make ci *)",
+      "Bash(make test *)",
+      "Bash(make test-all *)",
+      "Bash(make lint *)",
+      "Bash(make tidy *)"
+    ]
+  }
+}

.coderabbit.yaml

@@ -39,6 +39,17 @@ reviews:
     - "!bin/**"
     - "!dist/**"
     - "!**/testdata/**"
+    - "!**/node_modules/**"
+    - "!**/package-lock.json"
+    # Frozen snapshots of website/docs taken at release time. A docs change
+    # lands in website/docs only — snapshots are produced by cut-version and
+    # are never hand-edited, so any suggestion here is unactionable by
+    # definition: a published snapshot documents the behaviour of a shipped
+    # version, and changing it rewrites history for users still on it.
+    - "!website/versioned_docs/**"
+    - "!website/versioned_sidebars/**"
+    # Generated raster assets and the logo SVGs; nothing to review as text.
+    - "!website/static/**"
 
   path_instructions:
     - path: "**/*.go"
@@ -159,18 +170,54 @@ reviews:
         failure mode (e.g. a bug-reintroduction check) where practical. errcheck
         is intentionally relaxed in tests.
 
+    - path: "cmd/sqlguard/**"
+      instructions: >-
+        The CLI. cmd/sqlguard/db.go blank-imports pgx/v5/stdlib and
+        go-sql-driver/mysql so `sqlguard explain` can connect; only this
+        package imports them, so library consumers of analyzer/middleware never
+        link them — do not flag those imports as a core-dependency violation,
+        and do not suggest moving them into explain/ (that WOULD put drivers in
+        the library import graph).
+
+    - path: "website/docs/**"
+      instructions: >-
+        Docusaurus source for the unreleased docs. Verify every Go snippet
+        compiles against the current API and that option, function and rule
+        names match the exported identifiers / registered rule names exactly —
+        a wrong name here is a support burden, not a typo. This site is
+        versioned by snapshot, not per release: additive changes are marked
+        inline instead of being snapshotted, so check that anything documenting
+        a new API carries its version marker — `_0.3+_` appended to an API
+        table's description cell, `_Added in 0.3._` opening a prose paragraph,
+        or a trailing `// 0.3+` comment inside a code block. Behaviour that
+        changed takes `_Changed in 0.3._` plus a line on what it was before.
+        See website/VERSIONING.md rules 1 and 2. Do not suggest edits to
+        website/versioned_docs; those are frozen release snapshots.
+
+    - path: "website/**/*.{ts,tsx,css,json,mjs}"
+      instructions: >-
+        Docusaurus site code, linted and formatted by Biome (website/biome.json)
+        and type-checked by TypeScript 7 (website/tsconfig.json deliberately
+        inlines @docusaurus/tsconfig because TS 7 removed baseUrl). Keep
+        docusaurus.config.ts and scripts/cut-version.mjs reading
+        MAX_LIVE_VERSIONS from versions.config.json rather than duplicating it.
+        Node-side files (config, sidebars, scripts) must not use browser APIs.
+
   # CodeRabbit can also run linters/scanners and fold results into the review.
   tools:
     golangci-lint:
       enabled: true # uses the repo's .golangci.yml (v2 schema)
+      config_file: .golangci.yml
     gitleaks:
       enabled: true # secret scanning — important for a security-adjacent tool
     yamllint:
       enabled: true # also lints test/integration/docker-compose.yml
     actionlint:
-      enabled: true # lints .github/workflows/ci.yml
+      enabled: true # lints .github/workflows/{ci,codeql,docs}.yml
     markdownlint:
-      enabled: true
+      enabled: true # config: .markdownlint-cli2.jsonc (same as `make lint-docs`)
+    biome:
+      enabled: true # website/ — config: website/biome.json
 
 chat:
   auto_reply: true

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,107 @@
+name: Bug Report
+description: Report incorrect behavior, a false positive/negative, or a crash
+title: "[Bug]: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a bug! Please fill out the sections below.
+
+        **Do not file security vulnerabilities here** — see
+        [SECURITY.md](https://github.com/KARTIKrocks/sqlguard/blob/main/SECURITY.md)
+        for how to report privately.
+
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened
+      description: A clear description of the bug.
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: >-
+        What you expected instead. For a false positive/negative, name the
+        **rule** (e.g. `select-star`) that fired or failed to fire.
+    validations:
+      required: true
+
+  - type: textarea
+    id: query
+    attributes:
+      label: SQL
+      description: The query (redacted is fine).
+      render: sql
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Minimal Go reproduction
+      description: How the query was issued — the smallest snippet that shows the problem.
+      render: go
+
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Entry surface
+      options:
+        - Runtime middleware (sqlguard.Register / OpenDB)
+        - CLI `scan`
+        - CLI `explain`
+        - gormguard
+        - sqlxguard
+        - pgxguard
+        - bunguard
+        - xormguard
+        - entguard
+        - Analyzer API (direct)
+    validations:
+      required: true
+
+  - type: dropdown
+    id: parser
+    attributes:
+      label: Parser in use
+      options:
+        - Default fallback parser
+        - parsers/pgparser
+        - parsers/mysqlparser
+    validations:
+      required: true
+
+  - type: input
+    id: sqlguard-version
+    attributes:
+      label: sqlguard version
+      description: Tag or commit. All nine modules are tagged in lockstep.
+      placeholder: "v0.2.0"
+    validations:
+      required: true
+
+  - type: input
+    id: go-version
+    attributes:
+      label: Go version
+      description: Output of `go version`.
+      placeholder: "go1.27.0 linux/amd64"
+    validations:
+      required: true
+
+  - type: input
+    id: database
+    attributes:
+      label: Database and dialect
+      description: If relevant — e.g. PostgreSQL 18, MySQL 9.7, MariaDB 12.3.
+      placeholder: "PostgreSQL 18"
+
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional context
+      description: Logs (redaction-safe), your `.sqlguard.yml`, or anything else useful.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,56 @@
+name: Feature Request
+description: Suggest a new rule, integration, or capability
+title: "[Feature]: "
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for suggesting a feature! Please describe it below.
+
+  - type: dropdown
+    id: kind
+    attributes:
+      label: Kind of request
+      options:
+        - New detection rule
+        - New integration (ORM / driver)
+        - New parser dialect
+        - Change to an existing rule or option
+        - Something else
+    validations:
+      required: true
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What are you trying to catch or do that sqlguard can't today?
+      placeholder: "I'm always frustrated when ..."
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed solution
+      description: >-
+        How would you like this to work? For a **new rule**, include the
+        SQL anti-pattern, example queries that should and should **not**
+        trigger it, a suggested severity (info / warning / critical), and any
+        tunable with its default. For a **new integration**, name the
+        ORM/driver and its hook/seam.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Other approaches, workarounds, or existing rules/config that almost fit.
+
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional context
+      description: Links, prior art, willingness to send a PR.

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,3 +1,5 @@
+<!-- A PR body is a form, not a document; its sections start at h2 by design. -->
+<!-- markdownlint-disable-next-line MD041 -->
 ## Summary
 
 What does this PR change, and why?
@@ -15,9 +17,10 @@ Closes #<!-- issue number, if any -->
 
 ## Checklist
 
-- [ ] `make ci` passes (fmt-check, vet, lint, test-race) across all modules
+- [ ] `make ci` passes (fmt-check, vet, lint, vuln, test-race, lint-docs) across all modules
 - [ ] Added/updated tests (and, where practical, a failure-mode check)
-- [ ] Updated docs as needed (`README.md`, `AGENTS.md`, `.sqlguard.example.yml`)
+- [ ] Updated docs under `website/docs/` with a version marker for anything new (`_0.3+_`, `_Added in 0.3._`, `// 0.3+`) — never `website/versioned_docs/`
+- [ ] Updated `AGENTS.md` / `.sqlguard.example.yml` if a convention or config key changed
 - [ ] Added an entry under `## [Unreleased]` in `CHANGELOG.md`
 - [ ] No new third-party deps in `analyzer` / `middleware` / `reporter`
 - [ ] Findings stay redaction-safe (no raw literals leak into a `Result`)

.github/dependabot.yml

@@ -82,6 +82,24 @@ updates:
         patterns:
           - "*"
 
+  # The documentation site. Grouped on purpose: Docusaurus pulls in a large
+  # transitive tree, and ungrouped weekly updates would bury the Go module PRs
+  # that actually affect what users import. Two PRs a week at most — the Docs
+  # workflow builds the site on each one, so a bad bump fails before merge.
+  - package-ecosystem: npm
+    directory: /website
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 3
+    groups:
+      docusaurus:
+        patterns:
+          - "@docusaurus/*"
+          - "@mdx-js/*"
+      website:
+        patterns:
+          - "*"
+
   - package-ecosystem: github-actions
     directory: /
     schedule: