Harden Python template for agentic workflows

.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 4
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.{md,yml,yaml}]
+indent_size = 2
+
+[Makefile]
+indent_style = tab

.github/ISSUE_TEMPLATE/bug_report.md

@@ -7,32 +7,29 @@ assignees: ''
 
 ---
 
-**Describe the bug**
-A clear and concise description of what the bug is.
-
-**To Reproduce**
-Steps to reproduce the behavior:
-1. Go to '...'
-2. Click on '....'
-3. Scroll down to '....'
-4. See error
-
-**Expected behavior**
-A clear and concise description of what you expected to happen.
-
-**Screenshots**
-If applicable, add screenshots to help explain your problem.
-
-**Desktop (please complete the following information):**
- - OS: [e.g. iOS]
- - Browser [e.g. chrome, safari]
- - Version [e.g. 22]
-
-**Smartphone (please complete the following information):**
- - Device: [e.g. iPhone6]
- - OS: [e.g. iOS8.1]
- - Browser [e.g. stock browser, safari]
- - Version [e.g. 22]
-
-**Additional context**
-Add any other context about the problem here.
+## Summary
+
+Describe the incorrect behavior and its user impact.
+
+## Reproduction
+
+1.
+2.
+3.
+
+## Expected Behavior
+
+## Actual Behavior
+
+## Environment
+
+- Package version or commit:
+- Python version:
+- Operating system:
+
+## Acceptance Criteria
+
+- [ ] The expected behavior is restored.
+- [ ] A regression test covers the reported behavior.
+
+## Additional Context

.github/ISSUE_TEMPLATE/feature_request.md

@@ -7,14 +7,18 @@ assignees: ''
 
 ---
 
-**Is your feature request related to a problem? Please describe.**
-A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+## Problem
 
-**Describe the solution you'd like**
-A clear and concise description of what you want to happen.
+Describe the user need or limitation this request addresses.
 
-**Describe alternatives you've considered**
-A clear and concise description of any alternative solutions or features you've considered.
+## Proposed Change
 
-**Additional context**
-Add any other context or screenshots about the feature request here.
+## Alternatives Considered
+
+## Acceptance Criteria
+
+- [ ]
+
+## Documentation and Release Notes
+
+Describe expected documentation or changelog impact.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,17 @@
+## Summary
+
+Describe the user-facing problem and the change that addresses it.
+
+## Acceptance Criteria
+
+- [ ] The behavior matches the issue or request.
+- [ ] Relevant edge cases are covered.
+
+## Validation
+
+List the commands run and their results.
+
+## Documentation and Release Notes
+
+- [ ] Documentation is updated, or no update is needed.
+- [ ] `CHANGELOG.md` is updated for a user-facing, compatibility, or security change.

.github/workflows/continuous-deployment.yaml

@@ -2,84 +2,36 @@ name: Continuous deployment
 
 on:
   push:
+  pull_request:
   workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  lint-python:
-    name: Lint Python code
+  check:
+    name: Check project
     runs-on: ubuntu-latest
     steps:
-      - id: checkout
-        name: Checkout
-        uses: actions/checkout@v7
-
-      - id: check-ruff
-        name: Check with Ruff
-        uses: astral-sh/ruff-action@v3
-        with:
-          args: "check --exit-zero --verbose"
-
-      - id: format-ruff
-        name: Format with Ruff
-        uses: astral-sh/ruff-action@v3
-        with:
-          args: "format --check --verbose"
-
-  type-check:
-    name: Verify static typing
-    runs-on: ubuntu-latest
-    steps:
-      - id: checkout
-        name: Checkout
+      - name: Checkout
         uses: actions/checkout@v7
 
       - name: Setup uv
         uses: astral-sh/setup-uv@v7
         with:
-          version: "latest"
+          version: "0.10.7"
           enable-cache: true
-          cache-dependency-glob: "**/pyproject.toml"
-
-      - id: install-python-dependencies
-        name: Install Python dependencies
-        run: uv sync --extra dev --frozen
-
-      - id: type-check
-        name: Run type check
-        timeout-minutes: 10
-        run: uv run ty check
+          cache-dependency-glob: "uv.lock"
 
-  vulture:
-    name: Detect dead code
-    runs-on: ubuntu-latest
-    steps:
-      - id: checkout
-        name: Checkout
-        uses: actions/checkout@v7
+      - name: Install Python dependencies
+        run: make install-dev
 
-      - name: Setup uv
-        uses: astral-sh/setup-uv@v7
-        with:
-          version: "latest"
-          enable-cache: true
-          cache-dependency-glob: "**/pyproject.toml"
+      - name: Run static checks
+        run: make check
 
-      - id: install-python-dependencies
-        name: Install Python dependencies
-        run: uv sync --extra dev --frozen
-
-      # - id: vulture
-      #   name: Run vulture
-      #   timeout-minutes: 10
-      #   run: >-
-      #     uv run vulture
-      #     --min-confidence 90
-      #     --exclude "tests/*,docs/*"
-      #     your_package_name
+      - name: Prune uv cache
+        run: uv cache prune --ci
 
   test-python:
     name: Test Python code
@@ -95,26 +47,33 @@ jobs:
         name: Install uv
         uses: astral-sh/setup-uv@v7
         with:
-          version: "latest"
+          version: "0.10.7"
           enable-cache: true
-          cache-dependency-glob: "**/pyproject.toml"
+          cache-dependency-glob: "uv.lock"
 
       - id: install-python
         name: Install Python
         run: uv python install ${{ matrix.python }}
 
       - id: install-python-dependencies
         name: Install Python dependencies
-        run: uv sync --extra test --python ${{ matrix.python }}
+        run: make install-test UV_PYTHON=${{ matrix.python }}
 
       - id: tests
         name: Run tests
-        run: uv run --python ${{ matrix.python }} pytest --cov -sv
+        run: make test UV_PYTHON=${{ matrix.python }}
+
+      - name: Verify package distribution
+        if: matrix.python == '3.13' && vars.PACKAGE_IMPORT_NAME != ''
+        run: make package-verify PACKAGE=${{ vars.PACKAGE_IMPORT_NAME }}
+
+      - name: Prune uv cache
+        run: uv cache prune --ci
 
   build:
     name: Build release candidate
     runs-on: ubuntu-latest
-    needs: [test-python]
+    needs: [check, test-python]
     steps:
       - name: Checkout
         uses: actions/checkout@v7
@@ -123,13 +82,16 @@ jobs:
         name: Install uv
         uses: astral-sh/setup-uv@v7
         with:
-          version: "latest"
+          version: "0.10.7"
           enable-cache: true
-          cache-dependency-glob: "**/pyproject.toml"
+          cache-dependency-glob: "uv.lock"
 
       - id: build
         name: Build releases
-        run: uv build --sdist --wheel
+        run: make build
+
+      - name: Prune uv cache
+        run: uv cache prune --ci
 
       - id: save
         name: Save artifact