chore: main -> test

.github/CODEOWNERS

@@ -0,0 +1,10 @@
+# Default reviewers for all changes in this repo.
+# @nudgebee/oss is the maintainers team (must have write access). A PR
+# author cannot satisfy their own code-owner review, so a teammate reviews.
+
+*                               @nudgebee/oss
+
+# Chart-specific
+/charts/                        @nudgebee/oss
+/.github/workflows/             @nudgebee/oss
+/installation.sh                @nudgebee/oss

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,79 @@
+name: Bug report
+description: Report a problem with the nudgebee-agent Helm chart
+labels: ["bug", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report a bug. Please fill in the details below so we can reproduce it.
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: Describe the bug clearly. Include error messages and unexpected behavior.
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: What did you expect to happen?
+    validations:
+      required: true
+
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: Minimum steps required to reproduce, including `helm install` command and any non-default values.
+      placeholder: |
+        1. helm install ...
+        2. kubectl get ...
+        3. ...
+    validations:
+      required: true
+
+  - type: input
+    id: chart-version
+    attributes:
+      label: Chart version
+      description: Output of `helm list -n <namespace>` or the version you installed.
+      placeholder: "e.g. 0.1.1"
+    validations:
+      required: true
+
+  - type: input
+    id: k8s-version
+    attributes:
+      label: Kubernetes version
+      description: Output of `kubectl version --short`.
+      placeholder: "e.g. v1.29.3"
+    validations:
+      required: true
+
+  - type: input
+    id: platform
+    attributes:
+      label: Cluster platform
+      description: EKS, GKE, AKS, kind, OpenShift, etc.
+    validations:
+      required: false
+
+  - type: textarea
+    id: values
+    attributes:
+      label: Relevant values.yaml overrides
+      description: Paste any non-default values you set (redact secrets and auth keys).
+      render: yaml
+    validations:
+      required: false
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: Output from `kubectl logs` for the relevant pods. Redact sensitive data.
+      render: shell
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/nudgebee/k8s-agent/security/advisories/new
+    about: Report security issues privately. Do not open a public issue.
+  - name: NudgeBee documentation
+    url: https://app.nudgebee.com/help/docs/installation/agent/installation/
+    about: Installation, configuration, and troubleshooting guides.
+  - name: Community / questions
+    url: https://github.com/nudgebee/k8s-agent/discussions
+    about: Ask questions or discuss usage. Please search first.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,35 @@
+name: Feature request
+description: Suggest a new chart capability or configuration option
+labels: ["enhancement", "triage"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem are you trying to solve?
+      description: Describe the use case. What can't you do today with the chart?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: How would you like the chart to support this? New values, new templates, behavior change?
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Other approaches you considered, including workarounds you're using today.
+    validations:
+      required: false
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Links, screenshots, related issues, etc.
+    validations:
+      required: false

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,31 @@
+<!-- Thanks for opening a PR! Please fill in the sections below. -->
+
+## Summary
+
+<!-- What does this PR change and why? -->
+
+## Type of change
+
+- [ ] Bug fix (non-breaking)
+- [ ] New feature (non-breaking)
+- [ ] Breaking change (chart upgrade requires user action)
+- [ ] Documentation only
+- [ ] CI / tooling
+
+## Chart version
+
+- [ ] I bumped `version` in `charts/nudgebee-agent/Chart.yaml` (required for user-visible changes)
+- [ ] No version bump needed (docs/CI only)
+
+## Test plan
+
+<!-- How did you verify this works? -->
+
+- [ ] `helm lint charts/nudgebee-agent` passes
+- [ ] `ct lint --config .github/configs/ct.yaml` passes
+- [ ] `helm template` output reviewed
+- [ ] Installed on a real/kind cluster and verified the change
+
+## Related issues
+
+<!-- Closes #123, refs #456 -->

.github/dependabot.yml

@@ -0,0 +1,35 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - ci
+
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - dependencies
+      - docker
+
+  # Runner component (Go binary + its Dockerfile)
+  - package-ecosystem: docker
+    directory: /runner
+    schedule:
+      interval: weekly
+    labels:
+      - dependencies
+      - docker
+
+  - package-ecosystem: gomod
+    directory: /runner
+    schedule:
+      interval: weekly
+    labels:
+      - dependencies
+      - go

.github/workflows/codeql.yml

@@ -0,0 +1,62 @@
+name: CodeQL
+
+# Linguist mis-classifies this repo (Helm templates dominate, runner/ Go code
+# is hidden), so default-setup CodeQL doesn't see Go. Configure it explicitly.
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '24 7 * * 1' # weekly, Monday
+
+permissions: read-all
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: go
+            build-mode: manual
+          - language: actions
+            build-mode: none
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - name: Setup Go
+        if: matrix.language == 'go'
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        with:
+          go-version-file: runner/go.mod
+          cache: true
+          cache-dependency-path: runner/go.sum
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      - name: Build Go (manual)
+        if: matrix.language == 'go'
+        working-directory: runner
+        run: go build ./...
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/helm-dev-lint.yml

@@ -1,5 +1,5 @@
 # CI Workflow for Agent Helm chart
-name: CI
+name: Helm Lint (dev)
 
 on:
   push:
@@ -8,12 +8,15 @@ on:
     branches: [ "main"]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   helm-lint-and-validate:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
@@ -24,16 +27,16 @@ jobs:
           helm repo add open-telemetry https://open-telemetry.github.io/opentelemetry-helm-charts
           helm repo add bitnami https://charts.bitnami.com/bitnami
 
-      - uses: azure/setup-helm@v4
+      - uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
         with:
           version: v3.14.0
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.12'
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2.7.0
+        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0
 
       - name: Run chart-testing (lint)
         run: ct lint --debug --config ./.github/configs/ct.yaml --lint-conf ./.github/configs/lintconf.yaml --check-version-increment=false

.github/workflows/helm-prod-test.yml

@@ -1,5 +1,5 @@
 # CI Workflow for Agent Helm chart
-name: CI
+name: Helm Test (prod)
 
 on:
   push:
@@ -8,12 +8,15 @@ on:
     branches: [ "prod"]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   helm-lint-and-validate:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
@@ -24,16 +27,16 @@ jobs:
           helm repo add open-telemetry https://open-telemetry.github.io/opentelemetry-helm-charts
           helm repo add bitnami https://charts.bitnami.com/bitnami
 
-      - uses: azure/setup-helm@v4
+      - uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
         with:
           version: v3.14.0
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.12'
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2.7.0
+        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0
 
       - name: List changed charts
         id: list-changed