docs: add community health files and package metadata

[ericmmartin]

Why

Our Snyk package health report scores the package 67/100. None of that deduction is security — 0 known vulnerabilities across all 11 published versions. The score is held down by the Community: LIMITED bucket, which checks for exactly the governance files this repo was missing.

This is PR 1 of 2. PR 2 covers CI hardening and npm provenance.

What changed

LICENSE (new) — The repo had no LICENSE file at all. The README's [MIT](LICENSE) link was broken, GitHub couldn't detect the license, and the published npm tarball shipped no license text. Now included in the tarball (verified with npm pack --dry-run). Credits both the original youtube-transcript project and this fork, since upstream declares MIT on npm but ships no LICENSE file of its own.

CONTRIBUTING.md (new) — Setup, the four dev commands CI runs, project layout, testing conventions (notably: mock with nock, never call YouTube for real), Conventional Commits, and PR guidance.

CODE_OF_CONDUCT.md (new) — Contributor Covenant 2.1. Snyk calls this out by name.

SECURITY.md (new) — Private disclosure via GitHub advisories with response-time expectations. The scope section is the useful part: it says explicitly that YouTube rate limiting and upstream Innertube breakage are not vulnerabilities, which should keep the private channel clear of ordinary bug reports.

Issue and PR templates (new) — Bug report and feature request issue forms, a PR template with the CI checklist, and an ISSUE_TEMPLATE/config.yml that routes security reports to private advisories. The bug form requires the video ID, package version, and Node version up front, since behavior varies so much by video and region.

package.json — Expanded keywords from ["youtube", "transcript"] to cover captions/subtitles/srt/vtt/innertube for discoverability. Added "sideEffects": false for bundler tree-shaking; verified safe, as the module graph is declaration-only with no top-level side effects.

README.md — Added Contributing and Security sections; pointed the feature-request link at /issues/new/choose so it picks up the new forms.

Notes

• No funding file. Snyk scores a funding signal, but GitHub Sponsors isn't enabled on the account and a FUNDING.yml pointing at a nonexistent page would be a dead link. Skipped deliberately.
• No Discussions link. Discussions isn't enabled on the repo, so that contact link was dropped rather than shipping a 404.
• SECURITY.md describes npm provenance, which PR 2 actually implements. Both land before the release, but worth merging PR 2 before publishing so the claim is true.

Two repo settings to enable manually

Neither can be done from a PR:

1. Private vulnerability reporting (Settings → Code security) — otherwise the advisory link in SECURITY.md and the issue template won't work for reporters.
2. Discussions, if you want it — tell me and I'll add the contact link back.

Testing

No functional or API changes; this is docs and metadata only.

npm run lint       # pass
npm run typecheck  # pass
npm run build      # pass
npm test           # 122 passed | 1 skipped

[qodo-code-review]

PR Summary by Qodo

Add community health files, templates, and npm package metadata

📝 Documentation ⚙️ Configuration changes ✨ Enhancement 🕐 10-20 Minutes

AI Description

• Add LICENSE, CONTRIBUTING, Code of Conduct, and SECURITY policy files for governance.
• Introduce GitHub issue forms and PR template to standardize incoming reports and contributions.
• Improve package metadata and README links for discoverability and security reporting.

Diagram

graph TD
  R["Repository"] --> GH["GitHub templates"] --> Intake["Issues / PRs"] --> Maint["Maintainer triage"]
  R --> Gov["Governance docs"] --> Contrib["Contributor guidance"]
  R --> Sec["SECURITY.md"] --> Adv["Private advisories"]
  R --> Pkg["package.json metadata"] --> Dist["npm & bundlers"]
  R --> Readme["README links"] --> Nav["Docs entry points"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use GitHub default community health templates only

• ➕ Less custom text to maintain over time
• ➕ Aligns with GitHub’s standard community profile checks
• ➖ Less project-specific guidance (e.g., “no live YouTube calls”, required bug info)
• ➖ Still doesn’t address npm tarball license text without adding LICENSE

2. Centralize contributor guidance in README and keep files minimal

• ➕ Single place for contributors to read
• ➕ Less file sprawl in the repo root
• ➖ Snyk/GitHub community health checks explicitly look for dedicated files (SECURITY.md, CONTRIBUTING.md, etc.)
• ➖ Harder to deep-link to specific governance policies from templates

3. Adopt a shared org-wide SECURITY/CoC via links instead of copies

• ➕ One canonical policy to maintain
• ➕ Consistent across multiple repos
• ➖ External links can break; policies may not be included in npm tarball
• ➖ GitHub community profile typically expects in-repo files for best detection

Recommendation: The PR’s approach (in-repo governance files + GitHub issue/PR templates) is the most effective way to improve package/community health signals and reduce maintainer triage load. The added project-specific constraints (Innertube variability, required bug fields, security out-of-scope clarifications) justify custom templates over GitHub defaults, and keeping LICENSE/SECURITY in-repo ensures both GitHub detection and inclusion in published artifacts.

Files changed (10) +534 / -2

Enhancement (1) +10 / -1

package.jsonExpand keywords and mark package as side-effect free +10/-1

Expand keywords and mark package as side-effect free

• Adds sideEffects:false for tree-shaking friendliness and expands keywords to improve npm discoverability across captions/subtitles/format terms.

package.json

Documentation (6) +378 / -1

PULL_REQUEST_TEMPLATE.mdAdd PR template with test and CI checklist +36/-0

Add PR template with test and CI checklist

• Provides a standardized PR description format including change type, testing notes, and a checklist matching the project’s CI commands and contribution expectations.

.github/PULL_REQUEST_TEMPLATE.md

CODE_OF_CONDUCT.mdAdd Contributor Covenant Code of Conduct +129/-0

Add Contributor Covenant Code of Conduct

• Adds a Contributor Covenant v2.1 code of conduct with scope, enforcement, and reporting contact information.

CODE_OF_CONDUCT.md

CONTRIBUTING.mdAdd contributor guide (setup, workflow, testing rules) +103/-0

Add contributor guide (setup, workflow, testing rules)

• Documents local setup, development commands, repo layout, testing conventions (including nock-only/no live YouTube calls), Conventional Commits, and PR expectations. Links to security reporting and code of conduct.

CONTRIBUTING.md

LICENSEAdd MIT license text to the repository +22/-0

Add MIT license text to the repository

• Adds an MIT LICENSE file (previously missing), fixing the README’s license link and ensuring the license text can ship with the npm tarball.

LICENSE

README.mdAdd Contributing/Security sections and fix issue link +12/-1

Add Contributing/Security sections and fix issue link

• Updates the feature request link to the issue chooser and adds sections that route contributors to CONTRIBUTING.md, CODE_OF_CONDUCT.md, and SECURITY.md.

README.md

SECURITY.mdAdd security policy and private disclosure process +76/-0

Add security policy and private disclosure process

• Defines supported versions, private vulnerability reporting channels, response expectations, and explicit in-scope/out-of-scope guidance to reduce misrouted reports. Documents intended supply-chain verification guidance.

SECURITY.md

Other (3) +146 / -0

bug_report.ymlAdd structured bug report issue form +97/-0

Add structured bug report issue form

• Introduces a GitHub issue form that collects reproduction details, video ID/URL, package version, Node version, and basic validation checks. Includes a prominent redirect to private reporting for security issues.

.github/ISSUE_TEMPLATE/bug_report.yml

config.ymlDisable blank issues and add security contact link +5/-0

Disable blank issues and add security contact link

• Configures issue creation to use templates/forms only and provides a dedicated contact link to GitHub private advisories for vulnerabilities.

.github/ISSUE_TEMPLATE/config.yml

feature_request.ymlAdd feature request issue form +44/-0

Add feature request issue form

• Adds a GitHub issue form for feature requests focused on problem statement, proposed solution, and alternatives considered, plus basic duplicate-check confirmation.

.github/ISSUE_TEMPLATE/feature_request.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}