[ks6088ts]

Summary

Refreshes the template into a complete development standard: static analysis, vulnerability/secret scanning, hardened containers, and CI/CD with signed releases — on current but mature tooling. The application remains a minimal Typer CLI skeleton.

Issues found in review and fixed

#	Problem	Fix
1	Docs described features that did not exist (tag/version check, GHCR provenance, container-release.yaml badge, #adopting-the-template anchor); uv version stated three different ways	Implemented the features, fixed links, single uv source ([tool.uv] required-version)
2	Release bug: v1.0.0-rc1 stripped the suffix and overwrote 1.0.0 and latest; logic duplicated across two workflows	One release.yaml using type=pep440 tags (pre-releases never move latest)
3	Docker installed with uv export --no-hashes + pip (no hash verification); base/tool images not digest-pinned	uv sync --locked multi-stage build, digest-pinned images, allowlist .dockerignore, Debian security upgrades, no pip at runtime
4	No dependency audit, secret scanning, SAST, or posture checks	pip-audit, gitleaks, Trivy fs, CodeQL (python, actions), OpenSSF Scorecard; weekly security.yaml
5	Two version sources for tools (pre-commit ruff 0.17.2 vs lock 0.17.4); actionlint downloaded separately	Hooks run uv run --locked; actionlint via actionlint-py in uv.lock
6	zizmor ran at high only, hiding medium findings (Dependabot cooldown)	--min-severity low; Dependabot groups, 7-day cooldown, devcontainers ecosystem
7	__main__.py ran on import and was untested; tests read the developer's .env/PROJECT_*	Guarded entry point tested via runpy; autouse isolation fixture; coverage 96% → 100%
8	template_python/logging.py shadowed the stdlib name; deprecated license classifier (PEP 639 warning)	Renamed to log.py; classifier removed

Additions

• CLI: --version/-V (works even with invalid settings), config (effective settings as JSON, SecretStr masked), PROJECT_LOG_FORMAT=text|json; pretty exceptions no longer show locals.
• Python: default 3.14 (.python-version), supported/tested 3.12–3.15, plus a lowest-direct dependency job (make test-lowest).
• Quality: extended Ruff rules incl. bandit S; pytest strict mode with warnings as errors; stricter mypy.
• Release: tag must equal v + pyproject.toml version; pre-push Trivy scan; multi-arch image with SBOM, mode=max provenance, and GitHub artifact attestation. Docker Hub publishing removed (GHCR only).
• Governance: SECURITY.md, CONTRIBUTING.md, CODEOWNERS, PR template, issue forms, .editorconfig, .gitattributes.
• Docs: EN/JA rewritten; explicit heading IDs fix Japanese anchors; mkdocs build --strict; new sections for technology choices, security & supply chain, and template adoption. Notes Material for MkDocs EOL (2027-05-05) and Zensical as the migration path.

Breaking changes

• template_python.logging → template_python.log.
• Docker Hub images are no longer published.
• The next release requires bumping pyproject.toml (currently 0.0.13; latest tag is v0.0.14) because the tag/version check now enforces equality.

Verification

All run locally on macOS (uv 0.13.1, Docker 29.2.1):

• make ci-test — format, mypy strict, Ruff, actionlint, zizmor (offline and online, 0 findings), 26 tests at 100% coverage, wheel/sdist + installed CLI/module/--version smoke tests
• Tests on Python 3.12, 3.14, 3.15; make test-lowest (pydantic 2.12, pydantic-settings 2.15, typer 0.27)
• make hooks-check — all 16 hooks pass
• make ci-test-security — pip-audit: no known vulnerabilities; gitleaks: 215 commits, no leaks; Trivy fs: clean
• make ci-test-docker — hadolint, build, Trivy image scan (HIGH/CRITICAL clean), run; docker compose up with read-only FS and dropped capabilities; JSON logs confirmed
• make ci-test-docs — strict build, no anchor warnings

Not verifiable locally: CodeQL, Scorecard, and the release workflow (validated statically with actionlint/zizmor). After merge, enable code scanning, private vulnerability reporting, and branch protection as described in the adoption checklist.

[ks6088ts]

Note: CodeQL default setup was enabled on this repository, which rejects results from the committed codeql.yaml ("advanced configurations cannot be processed when the default setup is enabled"). I switched the repository to advanced setup (code-scanning/default-setup → not-configured); the workflow covers the same languages (actions, python) with the stronger security-extended suite. Revert with: gh api -X PATCH repos/ks6088ts/template-python/code-scanning/default-setup -f state=configured (and delete codeql.yaml). All PR checks are now green.