fix: harden runtime paths and improve project discovery

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,106 @@
+name: Bug report
+description: Report a reproducible vminfo failure or regression
+title: "[Bug]: "
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a bug. Remove tokens, public IP addresses, hostnames, usernames, process arguments, and other sensitive data before submitting.
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Affected area
+      options:
+        - CLI commands
+        - Terminal UI
+        - Web dashboard or API
+        - Go library
+        - Installer or updater
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: vminfo version
+      description: Paste the output of `vminfo version` or provide the commit SHA.
+      placeholder: vX.Y.Z or commit SHA
+    validations:
+      required: true
+
+  - type: dropdown
+    id: operating-system
+    attributes:
+      label: Operating system
+      options:
+        - Linux
+        - macOS
+        - Windows
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: platform-details
+    attributes:
+      label: Platform details
+      description: Include distribution or OS version, architecture, and terminal name/size when relevant.
+      placeholder: Debian 12, amd64, tmux 3.3a, 120x35
+    validations:
+      required: true
+
+  - type: input
+    id: command
+    attributes:
+      label: Command
+      description: Enter the exact command and flags that triggered the problem.
+      placeholder: vminfo summary --json
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Reproduction steps
+      description: Provide the smallest reliable sequence that reproduces the issue.
+      placeholder: |
+        1. Install ...
+        2. Run ...
+        3. Observe ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs or sanitized output
+      description: Paste only the output needed to diagnose the issue.
+      render: shell
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Submission checks
+      options:
+        - label: I searched existing issues for the same problem.
+          required: true
+        - label: I removed secrets and sensitive host or process data.
+          required: true
+        - label: This is not a security vulnerability.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Documentation
+    url: https://vminfo.bestcheapvps.org
+    about: Read installation, command, web dashboard, API, and library documentation.
+  - name: Usage questions and community support
+    url: https://t.me/VMPulse
+    about: Ask installation and usage questions in the VMPulse Telegram group.
+  - name: Report a security vulnerability
+    url: https://github.com/cloudapp3/vminfo/security/advisories/new
+    about: Send sensitive vulnerability details privately. Do not open a public issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,77 @@
+name: Feature request
+description: Propose a focused improvement to vminfo
+title: "[Feature]: "
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Describe the operational problem first. Non-trivial changes should preserve cross-platform behavior, CLI JSON compatibility, and the public Go library unless a breaking change is explicitly agreed.
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Target area
+      options:
+        - CLI commands
+        - Terminal UI
+        - Web dashboard or API
+        - Go library
+        - Installer or updater
+        - Documentation
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem to solve
+      description: Explain the workflow, limitation, or user need without assuming an implementation.
+    validations:
+      required: true
+
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Desired outcome
+      description: Describe the observable behavior you want.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: List current workarounds or other tools you evaluated.
+
+  - type: checkboxes
+    id: platforms
+    attributes:
+      label: Relevant platforms
+      options:
+        - label: Linux
+        - label: macOS
+        - label: Windows
+        - label: Platform-independent
+
+  - type: textarea
+    id: compatibility
+    attributes:
+      label: Compatibility considerations
+      description: Note any expected CLI, JSON, API, package, or platform behavior changes.
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Add sanitized examples, mockups, or links that clarify the request.
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Submission checks
+      options:
+        - label: I searched existing issues for a similar request.
+          required: true
+        - label: I described the problem and desired outcome, not only an implementation.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,39 @@
+## Summary
+
+Describe the problem and the focused change that solves it.
+
+## Affected surface
+
+- [ ] CLI commands or flags
+- [ ] Terminal UI
+- [ ] Web dashboard, REST API, or WebSocket
+- [ ] Public Go library
+- [ ] Collector or platform behavior
+- [ ] Installer, updater, CI, or release packaging
+- [ ] Documentation only
+
+## Validation
+
+List the commands you ran and the platforms you tested.
+
+```text
+go test ./...
+go test -race ./...
+go vet ./...
+```
+
+## Compatibility and security
+
+- [ ] Existing CLI JSON output remains compatible, or the intended change is documented.
+- [ ] Public Go APIs remain compatible, or the intended breaking change is documented.
+- [ ] Cross-platform commands retain non-Linux support; `ps` / `kill` retain unsupported stubs where required.
+- [ ] Network, file I/O, token, and user-input paths include appropriate timeout and error handling.
+- [ ] Logs, screenshots, fixtures, and examples contain no secrets or sensitive host data.
+
+## Documentation and visuals
+
+- [ ] README, documentation, tests, and examples were updated when behavior changed.
+- [ ] TUI or web changes include a screenshot or terminal capture when useful.
+- [ ] No unrelated files or user changes were reverted.
+
+Related issue:

.github/workflows/ci.yml

@@ -39,6 +39,9 @@ jobs:
       - name: Run tests
         run: go test ./...
 
+      - name: Run race detector
+        run: go test -race ./...
+
       - name: Run vet
         run: go vet ./...
 

.github/workflows/release.yml

@@ -6,11 +6,56 @@ on:
       - 'v*'
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Check formatting
+        run: |
+          unformatted=$(gofmt -l $(git ls-files '*.go'))
+          if [ -n "$unformatted" ]; then
+            echo "The following files are not gofmt formatted:"
+            echo "$unformatted"
+            exit 1
+          fi
+
+      - name: Check module tidiness
+        run: |
+          go mod tidy
+          git diff --exit-code -- go.mod go.sum
+
+      - name: Run tests
+        run: go test ./...
+
+      - name: Run race detector
+        run: go test -race ./...
+
+      - name: Run vet
+        run: go vet ./...
+
+      - name: Smoke checks
+        run: |
+          go run ./cmd/vminfo version
+          go run ./cmd/vminfo summary --json
+          go run ./cmd/vminfo watch --count 1
+          go run ./cmd/vminfo ps
+
   release:
+    needs: verify
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.goreleaser.yml

@@ -63,13 +63,35 @@ release:
   draft: false
   prerelease: auto
   mode: replace
+  header: |
+    {{ .ProjectName }} {{ .Tag }} is a cross-platform terminal system monitor with JSON output, a web dashboard, network diagnostics, and embeddable Go APIs.
+
+    ## Changes
+  footer: |
+    ## Install or upgrade
+
+    Linux and macOS:
+
+    ```bash
+    curl -fsSL https://raw.githubusercontent.com/cloudapp3/vminfo/main/install.sh | sudo bash -s -- --dir /usr/local/bin
+    ```
+
+    Existing Linux and macOS release builds can upgrade with:
+
+    ```bash
+    vminfo update --version {{ .Tag }}
+    ```
+
+    Download archives and Linux packages from the assets below. Verify downloads against `checksums.txt` before installation.
+
+    [Documentation](https://vminfo.bestcheapvps.org) · [Quick start](https://vminfo.bestcheapvps.org/guide/quick-start) · [Command reference](https://vminfo.bestcheapvps.org/commands/) · [Compare releases](https://github.com/cloudapp3/vminfo/releases)
 
 nfpms:
   - id: packages
     package_name: vminfo
     maintainer: cloudapp3
-    description: Host runtime information toolkit
-    homepage: https://github.com/cloudapp3/vminfo
+    description: Terminal system monitor with JSON output and a web dashboard
+    homepage: https://vminfo.bestcheapvps.org
     license: MIT
     formats:
       - deb

CONTRIBUTING.md

@@ -41,8 +41,9 @@ Thanks for helping improve vminfo. Bug reports, feature ideas, documentation imp
 git clone https://github.com/cloudapp3/vminfo.git
 cd vminfo
 go test ./...
+go test -race ./...
 go vet ./...
-go run ./cmd/vminfo version --json
+go run ./cmd/vminfo version
 go run ./cmd/vminfo summary --json
 go run ./cmd/vminfo watch --count 1
 go run ./cmd/vminfo ps # Linux-only
@@ -58,6 +59,7 @@ Notes:
 - [ ] The change is focused and clearly described
 - [ ] Modified Go files have been formatted with `gofmt -w`
 - [ ] `go test ./...` passes
+- [ ] `go test -race ./...` passes
 - [ ] `go vet ./...` passes
 - [ ] README / docs / tests were updated when behavior changed
 - [ ] No unrelated files were reverted