Harden public repo, SEO docs, landing page, and release automation

.github/workflows/ci.yml

@@ -0,0 +1,46 @@
+name: CI
+
+on:
+  push:
+    branches: [ master, main ]
+  pull_request:
+    branches: [ master, main ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Restore and build
+    runs-on: windows-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 8.0.x
+
+      - name: Restore
+        run: dotnet restore .\ProcessBusSuite.sln
+
+      - name: Build
+        run: dotnet build .\ProcessBusSuite.sln -c Release --no-restore /p:ContinuousIntegrationBuild=true
+
+      - name: Run tests when present
+        shell: pwsh
+        run: |
+          $testProjects = Get-ChildItem -Path . -Recurse -Filter *.csproj |
+            Where-Object { $_.FullName -match '(Test|Tests)\\|\.(Test|Tests)\.csproj$' }
+
+          if (-not $testProjects) {
+            Write-Host "No test project found. Build validation completed."
+            exit 0
+          }
+
+          foreach ($project in $testProjects) {
+            dotnet test $project.FullName -c Release --no-build --logger "trx"
+          }

.github/workflows/pages.yml

@@ -0,0 +1,42 @@
+name: Deploy GitHub Pages
+
+on:
+  push:
+    branches: [ master, main ]
+    paths:
+      - 'docs/**'
+      - '.github/workflows/pages.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    name: Deploy static docs site
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure Pages
+        uses: actions/configure-pages@v5
+
+      - name: Upload Pages artifact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: docs
+
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4

.github/workflows/release-package.yml

@@ -0,0 +1,121 @@
+name: Release Windows portable package
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version label, for example 1.2.0-public-beta'
+        required: true
+        default: '1.2.0-public-beta'
+      publish_release:
+        description: 'Create or update a GitHub Release'
+        required: true
+        default: false
+        type: boolean
+      prerelease:
+        description: 'Mark GitHub Release as prerelease'
+        required: true
+        default: true
+        type: boolean
+      draft:
+        description: 'Create GitHub Release as draft'
+        required: true
+        default: false
+        type: boolean
+      release_notes_file:
+        description: 'Markdown file used as release body'
+        required: true
+        default: 'docs/RELEASE_NOTES_v1.2.0.md'
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  package:
+    name: Build portable Windows package
+    runs-on: windows-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 8.0.x
+
+      - name: Resolve release version
+        id: version
+        shell: pwsh
+        run: |
+          $version = '${{ github.event.inputs.version }}'
+          if ([string]::IsNullOrWhiteSpace($version)) {
+            $version = '${{ github.ref_name }}'
+          }
+          $version = $version.Trim()
+          if ($version.StartsWith('v')) { $version = $version.Substring(1) }
+          if ([string]::IsNullOrWhiteSpace($version)) { throw 'Unable to resolve release version.' }
+          "value=$version" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
+          Write-Host "Release version: $version"
+
+      - name: Restore
+        run: dotnet restore .\ProcessBusSuite.sln
+
+      - name: Build
+        run: dotnet build .\ProcessBusSuite.sln -c Release --no-restore /p:ContinuousIntegrationBuild=true
+
+      - name: Publish portable package
+        shell: pwsh
+        run: |
+          .\scripts\publish-windows-portable.ps1 -Version '${{ steps.version.outputs.value }}' -Configuration Release -Runtime win-x64
+
+      - name: Verify portable package
+        shell: pwsh
+        run: |
+          $zip = ".\artifacts\release\ProcessBusInsight-v${{ steps.version.outputs.value }}-win-x64-portable.zip"
+          .\scripts\verify-release-package.ps1 -PackageZip $zip
+
+      - name: Upload workflow artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ProcessBusInsight-v${{ steps.version.outputs.value }}-win-x64-portable
+          path: |
+            artifacts/release/ProcessBusInsight-v${{ steps.version.outputs.value }}-win-x64-portable.zip
+            artifacts/release/SHA256SUMS.txt
+          if-no-files-found: error
+
+      - name: Publish GitHub Release
+        if: ${{ github.event_name == 'push' || github.event.inputs.publish_release == 'true' }}
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          $version = '${{ steps.version.outputs.value }}'
+          $tag = "v$version"
+          $zip = "artifacts/release/ProcessBusInsight-v$version-win-x64-portable.zip"
+          $sha = "artifacts/release/SHA256SUMS.txt"
+          $notesFile = '${{ github.event.inputs.release_notes_file }}'
+          if ([string]::IsNullOrWhiteSpace($notesFile)) { $notesFile = 'docs/RELEASE_NOTES_v1.2.0.md' }
+          if (-not (Test-Path $notesFile)) { $notesFile = 'docs/RELEASE_NOTES_v1.2.0.md' }
+          if (-not (Test-Path $notesFile)) { throw "Release notes file not found: $notesFile" }
+
+          $releaseArgs = @('release','create',$tag,$zip,$sha,'--title',"Process Bus Insight $tag",'--notes-file',$notesFile,'--target','${{ github.sha }}')
+
+          $isDraft = '${{ github.event.inputs.draft }}'
+          $isPrerelease = '${{ github.event.inputs.prerelease }}'
+          if ('${{ github.event_name }}' -eq 'push') { $isPrerelease = 'false' }
+          if ($isDraft -eq 'true') { $releaseArgs += '--draft' }
+          if ($isPrerelease -eq 'true') { $releaseArgs += '--prerelease' }
+
+          gh release view $tag *> $null
+          if ($LASTEXITCODE -eq 0) {
+            gh release upload $tag $zip $sha --clobber
+          }
+          else {
+            gh @releaseArgs
+          }

.gitignore

@@ -1,5 +1,5 @@
 ################################################################################
-# Source-only repository hygiene
+# Source repository hygiene
 ################################################################################
 
 # IDE / editor state
@@ -19,17 +19,23 @@ bin/
 obj/
 **/bin/
 **/obj/
+out/
 artifacts/
 installer/
 publish/
+release/
 
-# .NET local state
+# .NET local state and packages
 .dotnet/
 .dotnet-cli/
 .dotnet-home/
 .dotnet-home-build/
 *.nupkg
 *.snupkg
+TestResults/
+coverage/
+coverage.*
+*.trx
 
 # Native / Visual C++ generated files
 *.ipch
@@ -53,16 +59,36 @@ UpgradeLog*.htm
 *.cache
 *.log
 
+# Local configuration / secrets
+.env
+.env.*
+*.pfx
+*.snk
+secrets.json
+appsettings.Development.json
+
 # Local capture/runtime state
 *.last_interface.txt
 *.pcap
 *.pcapng
 *.etl
+captures/
+logs/
+temp/
+tmp/
 
-# Local generated media / reports
+# Local generated reports/media
 *.pdf
 *.gif
 docs/screenshot/*.png
 
-# Codex/browser local state
+# Node/web outputs if a future site toolchain is added
+node_modules/
+dist/
+build/
+.parcel-cache/
+.vite/
+
+# Local automation/browser state
 .codex/
+.playwright/

AGENTS.md

@@ -249,3 +249,19 @@ Required behavior:
 - Missing expected streams and unexpected live streams are both important commissioning evidence.
 - Binding matrix selection should drive the semantic inspector so the engineer can move from finding to evidence quickly.
 - Never silently auto-correct semantic mapping. Show evidence and confidence.
+
+## Public Repository Packaging Rule
+
+Public-facing repo work must keep README, landing page, release notes, and package quick-start material written for users who want to understand, download, run, build, and contribute.
+
+Do not write public docs as internal audit notes. Avoid wording such as "owner should", "next step for maintainer", or "audit found" in README, landing page, package notes, or release body.
+
+For Windows desktop releases, keep the portable package flow working:
+
+```text
+scripts/publish-windows-portable.ps1
+scripts/verify-release-package.ps1
+.github/workflows/release-package.yml
+```
+
+The package should contain the published app, quick-start note, license, notice files, third-party notices, and a convenience launcher only when it helps desktop users run the app.

CONTRIBUTING.md

@@ -0,0 +1,42 @@
+# Contributing to Process Bus Insight
+
+Thank you for helping improve Process Bus Insight.
+
+This project is intended to stay receive-only, raw-passive, evidence-focused, and honest about timing confidence.
+
+## Good contribution areas
+
+- SV, GOOSE, and PTP decoder coverage.
+- SCL examples and parser improvements.
+- Validation scenarios for FAT/SAT workflows.
+- UI clarity and evidence wording.
+- Documentation, troubleshooting notes, and field checklists.
+- Automated tests for protocol parsers and edge cases.
+
+## Product boundaries
+
+Please keep these boundaries intact:
+
+- Do not add IEC 61850 control workflows to the product app.
+- Do not make timing claims beyond the timestamp source quality.
+- Do not vendor restricted third-party binaries without license review.
+- Do not add sample captures that expose private customer/project data.
+
+## Pull request checklist
+
+Before opening a pull request:
+
+1. Build the solution in Release mode.
+2. Confirm the app still starts on Windows.
+3. Keep README and docs user-facing.
+4. Add or update validation notes when behavior changes.
+5. Avoid committing `bin`, `obj`, `artifacts`, captures, logs, or local settings.
+
+## Development setup
+
+```powershell
+git clone https://github.com/masarray/DigSubAnalyzer.git
+cd DigSubAnalyzer
+dotnet restore .\ProcessBusSuite.sln
+dotnet build .\ProcessBusSuite.sln -c Release
+```

Directory.Build.props

@@ -6,5 +6,11 @@
     <PackageLicenseExpression>Apache-2.0</PackageLicenseExpression>
     <RepositoryType>git</RepositoryType>
     <NeutralLanguage>en</NeutralLanguage>
+    <VersionPrefix>1.2.0</VersionPrefix>
+    <VersionSuffix>public-beta</VersionSuffix>
+    <PackageVersion>1.2.0-public-beta</PackageVersion>
+    <AssemblyVersion>1.2.0.0</AssemblyVersion>
+    <FileVersion>1.2.0.0</FileVersion>
+    <InformationalVersion>1.2.0-public-beta</InformationalVersion>
   </PropertyGroup>
 </Project>

NOTICE

@@ -0,0 +1,6 @@
+Process Bus Insight / DigSubAnalyzer
+Copyright 2026 Process Bus Insight Contributors
+
+This product includes source code licensed under the Apache License, Version 2.0.
+
+Npcap is a runtime prerequisite for raw packet capture on Windows. Npcap is not vendored in this repository and must be installed separately by the user.