Strengthen validation and community health

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,50 @@
+name: Bug report
+description: Report a reproducible defect without publishing sensitive deployment data.
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not include disk serials, credentials, internal paths, or unredacted task-sequence logs. Use private vulnerability reporting for security concerns.
+  - type: textarea
+    id: behavior
+    attributes:
+      label: Observed behavior
+      description: What happened, and at what task-sequence step?
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What did you expect to happen?
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Provide redacted ConfigMgr, WinPE, firmware mode, storage-controller, disk count, bus type, sector size, and command parameters.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction steps
+      description: Include the smallest safe reproduction. State whether Preview or destructive execution was used.
+    validations:
+      required: true
+  - type: textarea
+    id: validation
+    attributes:
+      label: Validation performed
+      description: Describe disposable-hardware testing and the output of build\Invoke-Validation.ps1, if available.
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Safety confirmation
+      options:
+        - label: I removed sensitive deployment details and tested destructive behavior only on disposable media.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/vartaxe/ConfigMgr-OSD-DiskPartitionLayout/security/advisories/new
+    about: Report security concerns privately. Do not include sensitive deployment details in a public issue.
+  - name: Task-sequence integration guide
+    url: https://github.com/vartaxe/ConfigMgr-OSD-DiskPartitionLayout/blob/main/TASK-SEQUENCE.md
+    about: Review required step ordering, variables, and rollout checks before requesting support.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,34 @@
+name: Feature request
+description: Propose a safety, compatibility, validation, or documentation improvement.
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: Describe the deployment problem or unsupported scenario.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+      description: Explain how the change remains fail-closed and avoids guessing a target disk.
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Target environment
+      description: Provide redacted ConfigMgr, WinPE, firmware, storage, and operating-system context.
+    validations:
+      required: true
+  - type: textarea
+    id: validation
+    attributes:
+      label: Validation plan
+      description: Describe synthetic tests and disposable-hardware validation that could establish confidence.
+    validations:
+      required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,17 @@
+## Summary
+
+Describe the focused change and the risk or deployment problem it addresses.
+
+## Safety impact
+
+- Explain how the fail-closed target-selection and pre-clean guards are preserved.
+- Identify any changed support boundary, destructive behavior, or task-sequence requirement.
+- Do not include disk serials, credentials, internal paths, or unredacted logs.
+
+## Validation
+
+- [ ] `powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\build\Invoke-Validation.ps1` passes.
+- [ ] Root and packaged script copies remain byte-identical.
+- [ ] New or changed logic has synthetic tests that do not modify hardware.
+- [ ] Documentation reflects changed parameters, integration, or compatibility.
+- [ ] Destructive behavior was tested only on disposable media, or the untested hardware boundary is stated explicitly.

.github/workflows/ci.yml

@@ -16,8 +16,8 @@ jobs:
           if (-not (Get-PSRepository -Name PSGallery -ErrorAction SilentlyContinue)) {
               Register-PSRepository -Default
           }
-          Install-Module Pester -RequiredVersion '5.7.1' -Repository PSGallery -Scope CurrentUser -Force
+          Install-Module Pester -RequiredVersion '6.2.0' -Repository PSGallery -Scope CurrentUser -Force
           Install-Module PSScriptAnalyzer -RequiredVersion '1.25.0' -Repository PSGallery -Scope CurrentUser -Force
-          Import-Module Pester -RequiredVersion '5.7.1' -Force
+          Import-Module Pester -RequiredVersion '6.2.0' -Force
           Import-Module PSScriptAnalyzer -RequiredVersion '1.25.0' -Force
           .\build\Invoke-Validation.ps1

CODE_OF_CONDUCT.md

@@ -0,0 +1,15 @@
+# Code of Conduct
+
+## Our standards
+
+Be respectful, constructive, and specific. Welcome participants with different backgrounds and experience levels. Discuss technical decisions and evidence without personal attacks, harassment, discrimination, or disclosure of another person's private information.
+
+## Project safety
+
+This project performs destructive disk operations. Do not encourage unsafe testing, conceal deployment risk, or publish disk serials, credentials, internal logs, or other sensitive deployment details. Use private vulnerability reporting for security concerns.
+
+## Enforcement
+
+Project maintainers may edit or remove comments, issues, pull requests, or other contributions that violate these standards, and may temporarily or permanently restrict participation for repeated or serious violations.
+
+Report conduct concerns privately to [vartaxe@outlook.com](mailto:vartaxe@outlook.com). Maintainers will review reports in good faith and protect reporter privacy where reasonably possible.

CONTRIBUTING.md

@@ -0,0 +1,20 @@
+# Contributing
+
+Contributions that improve safety, compatibility, tests, or documentation are welcome.
+
+## Before opening an issue
+
+- Use [private vulnerability reporting](https://github.com/vartaxe/ConfigMgr-OSD-DiskPartitionLayout/security/advisories/new) for security concerns.
+- Do not publish disk serials, task-sequence logs, credentials, or internal deployment details.
+- Search existing issues and include the exact ConfigMgr, WinPE, firmware, storage-controller, and disk context needed to reproduce the behavior.
+
+## Pull requests
+
+1. Create a focused branch from `main`.
+2. Keep the root and `Scripts/Invoke-OSDDiskLayout.ps1` copies byte-identical.
+3. Preserve the fail-closed safety model. A change must not guess a target disk, weaken identity rechecks, or move a destructive operation ahead of its guards.
+4. Add synthetic tests for changed selection, planning, command, or postcondition logic. Tests must not clean or repartition hardware.
+5. Run `powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\build\Invoke-Validation.ps1`.
+6. Update user-facing documentation when support boundaries, parameters, task-sequence integration, or release behavior change.
+
+Pull requests should describe the risk addressed, the validation performed, and any remaining hardware-validation boundary. Automated tests do not establish field certification; test destructive behavior only on disposable disks in a controlled ConfigMgr/WinPE pilot.

README.md

@@ -11,7 +11,7 @@ Select one approved target disk and create a firmware-appropriate GPT or MBR lay
 
 **Current version: 1.0.0.** This README follows `main`; published releases are versioned snapshots.
 
-[Quick start](#quick-start) | [Task-sequence integration](TASK-SEQUENCE.md) | [Compatibility](docs/COMPATIBILITY-MATRIX.md) | [Security](SECURITY.md)
+[Quick start](#quick-start) | [Task-sequence integration](TASK-SEQUENCE.md) | [Compatibility](docs/COMPATIBILITY-MATRIX.md) | [Contributing](CONTRIBUTING.md) | [Security](SECURITY.md)
 
 [![Release v1.0.0](https://img.shields.io/badge/RELEASE-v1.0.0-155799)](https://github.com/vartaxe/ConfigMgr-OSD-DiskPartitionLayout/releases/tag/v1.0.0)
 [![CI - main push](https://github.com/vartaxe/ConfigMgr-OSD-DiskPartitionLayout/actions/workflows/ci.yml/badge.svg?branch=main&event=push)](https://github.com/vartaxe/ConfigMgr-OSD-DiskPartitionLayout/actions/workflows/ci.yml?query=branch%3Amain+event%3Apush)

Tests/Invoke-OSDDiskLayout.Tests.ps1

@@ -1,5 +1,5 @@
 #Requires -Version 5.1
-# Requires Pester 5. These tests import ONLY pure functions from the script AST;
+# Requires Pester 6. These tests import ONLY pure functions from the script AST;
 # they do not run the script entry point or invoke DiskPart.
 
 BeforeAll {

build/Invoke-Validation.ps1

@@ -8,7 +8,7 @@ $Package = Join-Path $Root 'Scripts\Invoke-OSDDiskLayout.ps1'
 $Test = Join-Path $Root 'Tests\Invoke-OSDDiskLayout.Tests.ps1'
 $AnalyzerSettings = Join-Path $Root 'PSScriptAnalyzerSettings.psd1'
 
-Import-Module Pester -RequiredVersion '5.7.1' -ErrorAction Stop
+Import-Module Pester -RequiredVersion '6.2.0' -ErrorAction Stop
 Import-Module PSScriptAnalyzer -RequiredVersion '1.25.0' -ErrorAction Stop
 
 foreach ($Path in @($Source, $Package, $Test)) {