ci: Add community health files and kind e2e (#21)

Add GitHub community health files, keep Apache-2.0 license detection clean, and package security metadata in release archives.

Add a kind-based end-to-end CI job that deploys the sample workload and verifies CLI plus viewer diagnostics against the in-cluster daemon.

Co-authored-by: Codex <noreply@openai.com>

Author: Colvin-Y

.github/pull_request_template.md

@@ -0,0 +1,18 @@
+## Summary
+
+<!-- What changed and why? -->
+
+## Validation
+
+<!-- Paste the exact commands you ran, for example `make ci` or `bash scripts/ci/verify_kind_e2e.sh`. -->
+
+## Safety Checklist
+
+- [ ] This keeps observed Kubernetes resources read-only.
+- [ ] Graph or diagnostic contract changes are covered by tests.
+- [ ] User-facing command or install changes are documented.
+- [ ] Security-sensitive behavior is documented in `SECURITY.md` or the README.
+
+## Notes For Reviewers
+
+<!-- Anything risky, intentionally deferred, or worth reviewing first? -->

.github/workflows/ci.yml

@@ -72,3 +72,31 @@ jobs:
           python-version: "3.x"
 
       - run: make ci-visualize
+
+  kind-e2e:
+    name: Kind end-to-end
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
+
+      - uses: azure/setup-helm@v4
+
+      - uses: helm/kind-action@v1
+        with:
+          cluster_name: ko-e2e
+          config: samples/kind-helm-storage-demo/kind-config.yaml
+          wait: 120s
+
+      - name: Build local image
+        run: docker build -t kubernetes-ontology:e2e .
+
+      - name: Load image into kind
+        run: kind load docker-image kubernetes-ontology:e2e --name ko-e2e
+
+      - name: Verify in-cluster diagnostics
+        run: bash scripts/ci/verify_kind_e2e.sh

.github/workflows/release.yml

@@ -55,7 +55,7 @@ jobs:
                 -ldflags="-s -w" \
                 -o "${work}/${cmd}${ext}" "./cmd/${cmd}"
             done
-            cp README.md README.zh-CN.md QUICKSTART.md CHANGELOG.md AI_CONTRACT.md LICENSE "${work}/"
+            cp README.md README.zh-CN.md QUICKSTART.md CHANGELOG.md AI_CONTRACT.md LICENSE NOTICE SECURITY.md "${work}/"
             mkdir -p "${work}/docs"
             cp -R docs/assets "${work}/docs/"
             mkdir -p "${work}/local"

CODE_OF_CONDUCT.md

@@ -0,0 +1,29 @@
+# Code of Conduct
+
+This project is a place to build useful infrastructure together.
+
+## Expected Behavior
+
+- Be respectful and direct.
+- Assume good intent, but respond to impact.
+- Keep criticism specific to code, docs, design, or behavior.
+- Help new contributors find the smallest useful next step.
+- Respect private security reports and sensitive cluster data.
+
+## Unacceptable Behavior
+
+- Harassment, threats, or personal attacks.
+- Discriminatory language or behavior.
+- Publishing private credentials, kubeconfigs, cluster data, or personal
+  information.
+- Derailing technical discussions with repeated off-topic comments.
+- Pressuring maintainers or contributors to bypass the project's read-only
+  safety model.
+
+## Enforcement
+
+Maintainers may edit, hide, or remove comments; close issues; reject
+contributions; or block participants who violate this code.
+
+If you see a problem, contact the maintainer privately when possible. For
+security-sensitive issues, follow `SECURITY.md`.

CONTRIBUTING.md

@@ -0,0 +1,67 @@
+# Contributing
+
+Thanks for helping improve `kubernetes-ontology`.
+
+The project is still early, so the best contributions are small, concrete, and
+easy to verify. Good examples:
+
+- New diagnostic graph fixtures for real Kubernetes failure modes.
+- Tests for graph edges, diagnostic budgets, degraded sources, or Helm evidence.
+- Documentation fixes that reduce setup steps or clarify the read-only safety model.
+- Bug reports with a minimal manifest, command, and observed output.
+
+## Development Setup
+
+Install Go, Helm, Python 3, and Docker if you want to run the full validation
+path. For normal Go changes:
+
+```bash
+make test
+```
+
+For the repository CI checks:
+
+```bash
+make ci
+```
+
+For kind-based end-to-end validation:
+
+```bash
+kind create cluster --name ko-e2e --config samples/kind-helm-storage-demo/kind-config.yaml
+docker build -t kubernetes-ontology:e2e .
+kind load docker-image kubernetes-ontology:e2e --name ko-e2e
+bash scripts/ci/verify_kind_e2e.sh
+kind delete cluster --name ko-e2e
+```
+
+The kind test installs the sample Helm workload, deploys the current
+`kubernetes-ontology` chart, and verifies real CLI and viewer queries against the
+in-cluster daemon.
+
+## Pull Request Checklist
+
+- Keep the observed-cluster runtime read-only.
+- Add or update tests for changed graph semantics.
+- Update `AI_CONTRACT.md` or `schemas/diagnostic-subgraph.schema.json` when the
+  diagnostic response contract changes.
+- Update README or Quickstart docs when user-facing commands change.
+- Run `make ci` before opening the PR when practical.
+
+## Design Notes
+
+Use the existing package boundaries:
+
+- `internal/collect/k8s` reads Kubernetes objects.
+- `internal/graph` builds and indexes graph facts.
+- `internal/reconcile` applies scoped graph updates.
+- `internal/query` and `internal/service/diagnostic` shape diagnostic responses.
+- `internal/server` exposes the read-only HTTP API.
+
+Prefer explicit graph semantics over clever inference. If an edge is inferred,
+include provenance that tells downstream agents how much to trust it.
+
+## Reporting Security Issues
+
+Do not file public issues for security vulnerabilities. Follow
+`SECURITY.md` instead.

LICENSE

@@ -1,17 +1,3 @@
-Copyright 2026 Colvin-Y
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    https://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-
                               Apache License
                         Version 2.0, January 2004
                      https://www.apache.org/licenses/

Makefile

@@ -46,7 +46,7 @@ DAEMON_CONFIG_OVERRIDES = $(CLI_CONFIG_OVERRIDES) $(call make_arg,SERVER_ADDR,ad
 CLI_CONFIG_ARGS = $(if $(CONFIG),--config "$(CONFIG)" $(CLI_CONFIG_OVERRIDES),--kubeconfig "$(KUBECONFIG)" --cluster "$(CLUSTER)" --context-namespaces "$(CONTEXT_NAMESPACES)" --workload-resources "$(WORKLOAD_RESOURCES)" --controller-rules "$(CONTROLLER_RULES)" --bootstrap-timeout "$(BOOTSTRAP_TIMEOUT)")
 DAEMON_CONFIG_ARGS = $(if $(CONFIG),--config "$(CONFIG)" $(DAEMON_CONFIG_OVERRIDES),--kubeconfig "$(KUBECONFIG)" --cluster "$(CLUSTER)" --context-namespaces "$(CONTEXT_NAMESPACES)" --workload-resources "$(WORKLOAD_RESOURCES)" --controller-rules "$(CONTROLLER_RULES)" --addr "$(SERVER_ADDR)" --bootstrap-timeout "$(BOOTSTRAP_TIMEOUT)" --poll-interval "$(POLL_INTERVAL)")
 
-.PHONY: build build-daemon build-viewer docker-build owl test verify ci ci-go ci-helm ci-binaries ci-client ci-visualize run serve status status-server list-entities-server get-entity-server list-relations-server neighbors-server expand-node-server collapse-node-graph observe-status diagnose-pod diagnose-workload diagnose-helm-release diagnose-pod-server diagnose-workload-server diagnose-helm-release-server visualize visualize-go visualize-check live-check verify-live require-kubeconfig require-entry
+.PHONY: build build-daemon build-viewer docker-build owl test verify ci ci-go ci-helm ci-binaries ci-client ci-visualize ci-kind-e2e run serve status status-server list-entities-server get-entity-server list-relations-server neighbors-server expand-node-server collapse-node-graph observe-status diagnose-pod diagnose-workload diagnose-helm-release diagnose-pod-server diagnose-workload-server diagnose-helm-release-server visualize visualize-go visualize-check live-check verify-live require-kubeconfig require-entry
 
 build:
 	mkdir -p bin
@@ -87,6 +87,9 @@ ci-client: build
 ci-visualize: build-viewer visualize-check
 	bash scripts/ci/verify_viewer.sh
 
+ci-kind-e2e:
+	bash scripts/ci/verify_kind_e2e.sh
+
 run: build
 	$(BINARY) $(ARGS)
 

NOTICE

@@ -0,0 +1,4 @@
+kubernetes-ontology
+Copyright 2026 Colvin-Y
+
+This product includes software developed by Colvin-Y.

README.md

@@ -641,6 +641,8 @@ archives, so marketplace pages should link to the live repository path:
 - [docs/design/README.md](docs/design/README.md): design document index
 - [docs/ontology/README.md](docs/ontology/README.md): ontology notes
 - [docs/release.md](docs/release.md): release checklist
+- [CONTRIBUTING.md](CONTRIBUTING.md): contribution workflow and validation
+- [SECURITY.md](SECURITY.md): supported versions, reporting, and safety boundaries
 - [CHANGELOG.md](CHANGELOG.md): release notes
 
 ## License

SECURITY.md

@@ -0,0 +1,56 @@
+# Security Policy
+
+`kubernetes-ontology` is designed as a read-only Kubernetes topology and
+diagnostic service. It should not mutate observed cluster workloads or write
+status, annotations, CRDs, or remediation actions.
+
+## Supported Versions
+
+Security fixes target the latest released version and the default branch.
+
+| Version | Supported |
+| ------- | --------- |
+| latest release | Yes |
+| default branch | Yes |
+| older releases | Best effort |
+
+## Reporting A Vulnerability
+
+Please report suspected vulnerabilities privately to the maintainer before
+opening a public issue.
+
+Preferred contact:
+
+- GitHub: open a private vulnerability report from the repository Security tab
+  if available.
+- Fallback: contact the repository owner, `Colvin-Y`, through GitHub.
+
+Include:
+
+- Affected version or commit.
+- Install mode: Helm, release binary, or source.
+- Minimal reproduction steps.
+- Whether the issue requires cluster credentials, public HTTP exposure, or
+  access to Secret-derived graph data.
+
+## Security Boundaries
+
+Expected behavior:
+
+- Kubernetes collection uses `get`, `list`, and `watch`.
+- The daemon and viewer should be exposed only on localhost or controlled
+  internal networks unless an operator adds external protection.
+- The HTTP API has no built-in authentication or TLS yet.
+- Secret reads are used only to model Secret nodes and `uses_secret` edges.
+  Disable them with `rbac.readSecrets=false` when that evidence is not needed.
+
+Out of scope for the current MVP:
+
+- Public multi-tenant hosting.
+- Built-in HTTP authentication and TLS termination.
+- Remediation or cluster mutation.
+- Full Kubernetes authorization reasoning.
+
+If a report shows that the runtime writes to observed resources, leaks Secret
+values, or makes unsafe claims from partial graph evidence, treat it as high
+priority.