feat: add files for contributing

[cowan-macady]

implement ENG-9449

add files for contributing

[deepsource-io]

DeepSource Code Review

We reviewed changes in d3e1048...ec3de88 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Go		Aug 3, 2026 4:44p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[Copilot]

Pull request overview

This PR implements ENG-9449 by adding and updating contributor-facing repository hygiene files (contributing guidance, templates, ownership, and security reporting) to standardize how changes and reports are submitted to openapi-parser.

Changes:

• Add contribution and security reporting documentation (CONTRIBUTING + responsible disclosure policy).
• Add GitHub PR/issue templates and CODEOWNERS to improve triage and review flow.
• Update README and related tooling/docs comments to clarify parity-gate concepts and allow HTML table markup in markdownlint.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
responsible_disclosure.md	Adds a responsible disclosure policy and reporting channel for security-sensitive issues.
README.md	Expands docs with an annotations→OpenAPI example table and clarifies parity-gate/service terminology.
GNUmakefile	Updates parity target comments to match clarified “service” definition.
CONTRIBUTING.md	Adds contribution workflow and development ground rules (stdlib-only, testing, parity gate).
CODEOWNERS	Introduces ownership rules for repo paths and CI/security tooling configs.
cmd/oasparity/main.go	Clarifies help text describing what constitutes a “service” for parity checks.
.markdownlint.yaml	Allows HTML table elements needed by the README’s table.
.github/PULL_REQUEST_TEMPLATE.md	Adds a structured PR template emphasizing impact, testing, and parity runs.
.github/ISSUE_TEMPLATE/feature_request.md	Adds a feature request issue template tailored to annotations/spec constructs.
.github/ISSUE_TEMPLATE/config.yml	Adds GitHub issue contact link directing security reports to disclosure policy.
.github/ISSUE_TEMPLATE/bug_report.md	Adds a bug report template with reproduction, command, and expected/actual output sections.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cowan-macady]

no

[cowan-macady]

no

[cowan-macady]

not worth it

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.

Suppressed comments (3)

CONTRIBUTING.md:16

• This guidance points contributors to parse.go/schema.go, but the actual files are gen/parse.go and gen/schema.go in this repository. Using the correct paths makes the contribution guide actionable.

- **Spec-version separation.** Annotation syntax and output spec version evolve independently. Parser/model changes belong in `parse.go`/`schema.go`; version-specific output belongs in the emitter.

README.md:246

• This parenthetical is currently ungrammatical ("valid so swag") and reads like a causal claim that doesn't make sense as written. Reintroducing punctuation clarifies that extra components are acceptable because unreferenced components are valid, and separately notes the swag vs oasgen behavior around embedded base types.

oasgen components are allowed (unreferenced components are valid so swag
doesn't register embedded base types, we do).

CONTRIBUTING.md:7

• The referenced pipeline file names omit the gen/ directory; in this repo those stages live under gen/ (e.g., gen/extract.go, gen/lexer.go, etc.). Updating the paths avoids confusing contributors searching for these files.

This issue also appears on line 16 of the same file.

- Read the [README](./README.md) to understand the pipeline (`extract.go` → `lexer.go` → `parse.go` → `schema.go` → `emit.go`) and the version-agnostic model in the middle.