Production-readiness for open-source launch (GitHub + crates.io)

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,112 @@
+name: Bug report
+description: Report a problem with fleet-router (proxying, failover, build, config, or metrics).
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to file a bug report.
+
+        Before opening an issue:
+        - Search existing issues to avoid duplicates.
+        - For security vulnerabilities, do **not** open a public issue. Use private reporting per [SECURITY.md](../../SECURITY.md).
+        - For questions or usage help, please use Discussions instead.
+
+        fleet-router currently supports **Linux x86_64 only**. macOS/Windows are not supported for native builds; use the Docker image (`ghcr.io/eosrio/fleet-router`) there.
+
+  - type: input
+    id: version
+    attributes:
+      label: fleet-router version
+      description: "Output of `fleet-router --version`, or the Docker image tag / git commit you built from."
+      placeholder: "0.2.0"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: install-method
+    attributes:
+      label: How was it installed?
+      options:
+        - crates.io (cargo install fleet-router)
+        - From source (cargo install --path .)
+        - Docker image (ghcr.io/eosrio/fleet-router)
+        - Other (describe below)
+    validations:
+      required: true
+
+  - type: input
+    id: os-arch
+    attributes:
+      label: OS and architecture
+      description: "Distribution/version and CPU architecture. Remember: only Linux x86_64 is supported."
+      placeholder: "Ubuntu 24.04, x86_64"
+    validations:
+      required: true
+
+  - type: input
+    id: build-env
+    attributes:
+      label: Rust version and build toolchain (for build issues)
+      description: >-
+        Output of `rustc --version` (MSRV is 1.85), and whether clang + libclang-dev were installed
+        (required by bindgen). Leave blank if this is not a build issue.
+      placeholder: "rustc 1.85.0; clang/libclang-dev installed: yes"
+    validations:
+      required: false
+
+  - type: textarea
+    id: config
+    attributes:
+      label: config.json (redact secrets)
+      description: "Your config.json or the relevant portion. Redact endpoints/hosts you don't want public."
+      render: json
+      placeholder: |
+        {
+          "listen_address": "0.0.0.0",
+          "listen_port": 17000,
+          "upstream_reconnect_ms": 3000,
+          "upstream_monitoring_ms": 5000,
+          "upstream_status_ms": 5000,
+          "servers": [
+            { "name": "node-1", "endpoint": "10.0.0.1:8080", "enabled": true }
+          ]
+        }
+    validations:
+      required: false
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: "Exact commands and actions that trigger the problem."
+      placeholder: |
+        1. fleet-router config test ./config.json
+        2. fleet-router run --config ./config.json
+        3. Connect a SHiP client to ws://host:17000 and send a get_blocks request
+        4. ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected-actual
+    attributes:
+      label: Expected vs. actual behavior
+      description: "What you expected to happen, and what actually happened."
+      placeholder: |
+        Expected: client connection persists across upstream failover with no gap in blocks.
+        Actual: client received duplicate blocks / connection dropped / ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs (RUST_LOG=debug)
+      description: "Run with `RUST_LOG=debug` and paste the relevant output. Redact sensitive values."
+      render: shell
+      placeholder: |
+        RUST_LOG=debug fleet-router run --config ./config.json
+        2026-05-30T12:00:00Z  INFO fleet_router: ...
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Questions & usage help
+    url: https://github.com/eosrio/fleet-router/discussions
+    about: Ask questions, share deployment setups, and get usage help in GitHub Discussions.
+  - name: Security vulnerability
+    url: https://github.com/eosrio/fleet-router/security/advisories/new
+    about: Do not open a public issue for security problems. Report privately per SECURITY.md.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,43 @@
+name: Feature request
+description: Suggest a new feature or enhancement for fleet-router.
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for suggesting an improvement.
+
+        Please search existing issues and Discussions first to avoid duplicates.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem / motivation
+      description: "What problem are you trying to solve? What is the use case or pain point?"
+      placeholder: "When an upstream goes stale, I'd like ..."
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed solution
+      description: "Describe the behavior or capability you'd like. Be as concrete as you can (config fields, CLI flags, metrics, etc.)."
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: "Other approaches or workarounds you've considered, and why they fall short."
+    validations:
+      required: false
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: "Any other context, references, links, or examples that would help."
+    validations:
+      required: false

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,15 @@
+# Summary
+
+<!-- What does this PR change and why? Keep it concise. -->
+
+## Related issues
+
+<!-- e.g. Closes #123, Refs #456 -->
+
+## Checklist
+
+- [ ] Ran `cargo fmt --all`
+- [ ] Ran `cargo clippy --workspace --all-targets --all-features -- -D warnings`
+- [ ] Ran `cargo test --workspace`
+- [ ] Updated [CHANGELOG.md](../CHANGELOG.md)
+- [ ] Updated docs if needed

.github/workflows/ci.yml

@@ -2,34 +2,76 @@ name: CI
 
 on:
   push:
-    branches: [ "main" ]
+    branches: ["main"]
   pull_request:
-    branches: [ "main" ]
+    branches: ["main"]
+
+# Least-privilege default token.
+permissions:
+  contents: read
 
 env:
   CARGO_TERM_COLOR: always
 
 jobs:
-  build_and_test:
+  test:
     name: Build, Test, and Lint
     runs-on: ubuntu-latest
-
     steps:
-    - uses: actions/checkout@v4
-
-    - name: Use stable Rust
-      uses: dtolnay/rust-toolchain@stable
-      with:
-        components: clippy, rustfmt
-
-    - name: Check formatting
-      run: cargo fmt --all -- --check
-
-    - name: Run Clippy
-      run: cargo clippy --workspace --all-targets --all-features -- -D warnings
-
-    - name: Build
-      run: cargo build --verbose
-
-    - name: Run tests
-      run: cargo test --workspace --verbose
+      - uses: actions/checkout@v4
+
+      # rs_abieos builds vendored C++ via bindgen, which needs a C++ toolchain
+      # and libclang at build time.
+      - name: Install build dependencies
+        run: sudo apt-get update && sudo apt-get install -y clang libclang-dev
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+
+      - name: Cache cargo registry and target
+        uses: Swatinem/rust-cache@v2
+
+      - name: Check formatting
+        run: cargo fmt --all -- --check
+
+      - name: Clippy
+        run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
+
+      - name: Build
+        run: cargo build --workspace --locked --verbose
+
+      - name: Test
+        run: cargo test --workspace --locked --verbose
+
+  msrv:
+    name: Minimum Supported Rust Version (1.85)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install build dependencies
+        run: sudo apt-get update && sudo apt-get install -y clang libclang-dev
+      - name: Install Rust 1.85
+        uses: dtolnay/rust-toolchain@1.85
+      - uses: Swatinem/rust-cache@v2
+      - name: Check (MSRV)
+        run: cargo check --workspace --locked
+
+  audit:
+    name: Supply-chain audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: cargo-deny (advisories, bans, licenses, sources)
+        uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check advisories bans licenses sources
+
+  docker:
+    name: Docker image builds
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build image
+        run: docker build -t fleet-router:ci .

.github/workflows/release.yml

@@ -0,0 +1,72 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: write # create the GitHub release and upload assets
+  packages: write # push the image to GHCR
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  crates-io:
+    name: Publish to crates.io
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install build dependencies
+        run: sudo apt-get update && sudo apt-get install -y clang libclang-dev
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - name: Publish
+        run: cargo publish -p fleet-router --locked --token ${{ secrets.CARGO_REGISTRY_TOKEN }}
+
+  binary:
+    name: Build Linux release binary
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install build dependencies
+        run: sudo apt-get update && sudo apt-get install -y clang libclang-dev
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - name: Build
+        run: cargo build --release --locked
+      - name: Package (x86_64-unknown-linux-gnu)
+        run: tar -C target/release -czf fleet-router-${{ github.ref_name }}-x86_64-unknown-linux-gnu.tar.gz fleet-router
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: fleet-router-*.tar.gz
+          generate_release_notes: true
+
+  docker:
+    name: Build and push image to GHCR
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Image metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/eosrio/fleet-router
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -3,9 +3,9 @@
 debug/
 target/
 
-# Remove Cargo.lock from gitignore if creating an executable, leave it for libraries
-# More information here https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html
-Cargo.lock
+# Cargo.lock IS committed: fleet-router ships a binary, so we pin the exact,
+# reproducible dependency graph. (Cargo's guidance: commit it for binaries.)
+# https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html
 
 # These are backup files generated by rustfmt
 **/*.rs.bk