Refresh the template into a complete development standard

.devcontainer/devcontainer.json

@@ -1,17 +1,23 @@
 {
     "name": "template-python",
-    // https://mcr.microsoft.com/en-us/product/devcontainers/python/tags
-    "image": "mcr.microsoft.com/devcontainers/python:dev-3.13-bookworm",
+    // https://mcr.microsoft.com/en-us/artifact/mar/devcontainers/python/tags
+    "image": "mcr.microsoft.com/devcontainers/python:3-3.14-trixie",
+    "features": {
+        // Run `make ci-test-docker` and other Docker-based checks against the host daemon.
+        "ghcr.io/devcontainers/features/docker-outside-of-docker:1": {}
+    },
     "customizations": {
         "vscode": {
             "extensions": [
                 "charliermarsh.ruff",
-                "GitHub.copilot-chat",
+                "editorconfig.editorconfig",
+                "github.vscode-github-actions",
                 "ms-python.mypy-type-checker",
                 "ms-python.python"
             ]
         }
     },
-    "postCreateCommand": "pipx install uv==0.12.19 && make install-deps-dev",
+    // Keep the uv version within [tool.uv] required-version in pyproject.toml.
+    "postCreateCommand": "pipx install uv==0.13.7 && make install-deps-dev && make install-hooks",
     "remoteUser": "vscode"
 }

.dockerignore

@@ -1,19 +1,9 @@
-.git
-.github
-.venv
-.coverage
-.pytest_cache
-.ruff_cache
-.mypy_cache
-dist
-site
-notebooks
-tests
-docs
-.devcontainer
-.vscode
-*.egg-info
-__pycache__
-*.py[cod]
-.env
-.env.*
+# Allowlist: only files needed to build the image enter the build context.
+*
+!pyproject.toml
+!uv.lock
+!README.md
+!LICENSE
+!src/
+**/__pycache__
+**/*.py[cod]

.editorconfig

@@ -0,0 +1,18 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 4
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.{toml,yaml,yml}]
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false
+
+[Makefile]
+indent_style = tab

.env.template

@@ -5,3 +5,5 @@
 # Project Settings
 PROJECT_NAME=template-python
 PROJECT_LOG_LEVEL=INFO
+# text or json
+PROJECT_LOG_FORMAT=text

.gitattributes

@@ -0,0 +1,3 @@
+* text=auto eol=lf
+*.png binary
+uv.lock linguist-generated=true

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Default reviewers for every change. Replace with your team when adopting the template.
+* @ks6088ts

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,29 @@
+name: Bug report
+description: Report unexpected behavior
+labels: ["bug"]
+body:
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: Include the exact command and the first error message.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What did you expect?
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Output of `template-python --version` or the commit SHA.
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: OS, Python version, and uv version.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/ks6088ts/template-python/security/advisories/new
+    about: Please report vulnerabilities privately.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,18 @@
+name: Feature request
+description: Propose a change or improvement
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What concrete problem would this solve?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: The simplest change that solves the problem, and alternatives considered.
+    validations:
+      required: true

.github/dependabot.yaml

@@ -1,22 +1,48 @@
-# https://docs.github.com/en/code-security/dependabot/ecosystems-supported-by-dependabot/supported-ecosystems-and-repositories#supported-ecosystems-and-repositories
+# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference
+# A cooldown delays adoption of freshly published releases to reduce supply-chain risk.
 version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns: ["*"]
   - package-ecosystem: "uv"
     directory: "/"
     schedule:
       interval: "weekly"
-    # https://docs.github.com/ja/code-security/dependabot/dependabot-version-updates/optimizing-pr-creation-version-updates#setting-up-a-cooldown-period-for-dependency-updates
     cooldown:
-      default-days: 5
+      default-days: 7
+      semver-major-days: 14
+    groups:
+      python-dev:
+        dependency-type: "development"
+        update-types: ["minor", "patch"]
+      python-runtime:
+        dependency-type: "production"
+        update-types: ["minor", "patch"]
   - package-ecosystem: "pre-commit"
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
+    groups:
+      pre-commit:
+        patterns: ["*"]
   - package-ecosystem: "docker"
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
+  - package-ecosystem: "devcontainers"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/pull_request_template.md

@@ -0,0 +1,13 @@
+## Summary
+
+<!-- What changes and why. Link related issues, e.g. "Closes #123". -->
+
+## Verification
+
+<!-- Commands run and their results, e.g. `make ci-test`. -->
+
+## Checklist
+
+- [ ] Checks for the changed area pass ([checks by change type](../docs/development.md#checks-by-change-type))
+- [ ] English and Japanese documentation are updated if behavior changed
+- [ ] No secrets, credentials, or private configuration are included

.github/workflows/azure-static-web-app.yaml

@@ -10,24 +10,21 @@ permissions:
 jobs:
   deploy:
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - name: Set up uv with caching enabled
-        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+      # No cache in publishing workflows to avoid cache poisoning.
+      - name: Set up uv
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
-          enable-cache: true
-          version: "0.12.19"
-          python-version: "3.13"
-      - name: Generate documentation
-        shell: bash
-        run: |
-          make install-deps-docs
-          make docs
+          enable-cache: false
+      - name: Build documentation
+        run: make ci-test-docs
+      # Upstream has both a v1 tag (pinned here) and a v1 branch, which zizmor reports as ambiguous.
       - name: Deploy
-        uses: Azure/static-web-apps-deploy@1a947af9992250f3bc2e68ad0754c0b0c11566c9 # v1
+        uses: Azure/static-web-apps-deploy@1a947af9992250f3bc2e68ad0754c0b0c11566c9 # v1 # zizmor: ignore[ref-version-mismatch]
         with:
           azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN }}
           action: "upload"

.github/workflows/codeql.yaml

@@ -0,0 +1,45 @@
+name: codeql
+
+on:
+  push:
+    branches:
+      - "main"
+  pull_request:
+    branches:
+      - "main"
+  schedule:
+    - cron: "23 4 * * 1"
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  analyze:
+    name: analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language:
+          - actions
+          - python
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          queries: security-extended
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/docker.yaml

@@ -10,16 +10,17 @@ on:
       - "main"
 permissions:
   contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 jobs:
   docker:
     runs-on: "ubuntu-latest"
-    timeout-minutes: 5
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0 # to retrieve git tags
           persist-credentials: false
-      - name: Run CI tests for Docker
-        shell: bash
-        run: |
-          make ci-test-docker
+      - name: Lint, build, scan, and run the image
+        run: make ci-test-docker