refactor(release): improve artifact creation and documentation cleanup in release workflow

Author: pethers

.github/workflows/release.yml

@@ -154,12 +154,12 @@ jobs:
         env:
           VITE_APP_VERSION: ${{ needs.prepare.outputs.version }}
 
-      - name: Create artifacts directory
+      - name: Create release artifacts
         run: |
-          mkdir -p release-artifacts
-          # Use build directory instead of dist to match vite config
+          # Create the zip file from the dist directory
           cd dist
           zip -r ../game-${{ needs.prepare.outputs.version }}.zip .
+          cd ..
 
       - name: Upload build artifact
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
@@ -271,19 +271,18 @@ jobs:
             artifacts/security/game-${{ needs.prepare.outputs.version }}.spdx.json.intoto.jsonl
           token: ${{ secrets.GITHUB_TOKEN }}
 
-      # Selectively clean only application files
-      - name: Clean application files
+      # Prepare docs directory for GitHub Pages
+      - name: Prepare docs directory
         run: |
-          # Only remove specific application files, preserving documentation
-          rm -rf docs/index.html docs/assets
-          # Log the cleanup for debugging
-          echo "Application files cleaned at $(date)" > docs/app-update-info.txt
+          mkdir -p docs
+          # Clean only application files, preserve documentation
+          rm -rf docs/index.html docs/assets docs/*.js docs/*.css
 
       # Deploy new application version
       - name: Deploy new version
         run: |
-          mkdir -p docs
-          unzip -o artifacts/dist/game-${{ needs.prepare.outputs.version }}.zip -d docs/
+          # Extract the built application to docs
+          unzip -o artifacts/build/game-${{ needs.prepare.outputs.version }}.zip -d docs/
           # Create version marker for traceability
           echo "Version ${{ needs.prepare.outputs.version }} deployed at $(date)" > docs/version.txt
 

SECURITY.md

@@ -0,0 +1,51 @@
+# Security Policy
+
+## Supported Versions
+
+This project is under active development, and we provide security updates for the latest version only. Please ensure you're using the latest version of the project to receive security updates.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| latest  | :white_check_mark: |
+
+## Reporting a Vulnerability
+
+We take the security of the lambda-in-private-vpc project seriously. If you have found a potential security vulnerability, we kindly ask you to report it privately, so that we can assess and address the issue before it becomes publicly known.
+
+### What Constitutes a Vulnerability
+
+A vulnerability is a weakness or flaw in the project that can be exploited to compromise the security, integrity, or availability of the system or its data. Examples of vulnerabilities include, but are not limited to:
+
+- Unauthenticated access to sensitive data
+- Injection attacks (e.g., SQL injection, cross-site scripting)
+- Insecure defaults or configurations
+- Insufficient access controls
+- Remote code execution
+
+### How to Privately Report a Vulnerability using GitHub
+
+Please follow these steps to privately report a security vulnerability:
+
+1. On GitHub.com, navigate to the main page of the [game repository](https://github.com/Hack23/game).
+2. Under the repository name, click **Security**. If you cannot see the "Security" tab, select the dropdown menu, and then click **Security**.
+3. In the left sidebar, under "Reporting", click **Advisories**.
+4. Click **Report a vulnerability** to open the advisory form.
+5. Fill in the advisory details form. Provide as much information as possible to help us understand and reproduce the issue.
+6. At the bottom of the form, click **Submit report**.
+
+After you submit the report, the maintainers of the game repository will be notified. They will review the report, validate the vulnerability, and take necessary actions to address the issue. You will be added as a collaborator and credited for the security advisory.
+
+### Disclosure Timeline
+
+Upon receipt of a vulnerability report, our team will:
+
+1. Acknowledge the report within 48 hours
+2. Validate the vulnerability within 7 days
+3. Develop and release a patch or mitigation within 30 days, depending on the complexity and severity of the issue
+4. Publish a security advisory with a detailed description of the vulnerability and the fix
+
+### Recognition and Anonymity
+
+We appreciate your effort in helping us maintain a secure and reliable project. If your report results in a confirmed security fix, we will recognize your contribution in the release notes and/or a public acknowledgment, unless you request to remain anonymous.
+
+Thank you for helping us keep the game project and its users safe.