promote dev to main (#1)

* the OSV report is read by the repository that scans two ecosystems"

* the OSV report is read here, and the repository has its own issue templates

* pin aws-sdk-s3 past GHSA-g59m-gf8j-gjf5

Author: ctolon

.github/CODEOWNERS

@@ -0,0 +1,8 @@
+# Everything, until there is somebody else. A CODEOWNERS file that lists one
+# person is not bureaucracy — it is what makes GitHub request a review at all.
+*                       @ctolon
+
+# The parts where a mistake is expensive and a second opinion is cheap.
+/SECURITY.md            @ctolon
+/deny.toml              @ctolon
+/.github/workflows/     @ctolon

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,65 @@
+name: Bug report
+description: Something behaves differently from what the documentation says
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time. The most useful reports are the ones where
+        somebody else can reproduce the problem without guessing.
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: And what you expected instead.
+      placeholder: |
+        `load()` returned `ErrorKind::Missing` for `pool.max_size`, but the key
+        is set in `config.toml`.
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: How to reproduce
+      description: >
+        The struct with its `#[dynamic_config(..)]` attribute, the config file,
+        and any environment variables involved. A small standalone `main.rs`
+        beats a description of one.
+      render: rust
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: dynamic-config version
+      placeholder: "0.1.0"
+    validations:
+      required: true
+
+  - type: input
+    id: features
+    attributes:
+      label: Enabled features
+      description: From your `Cargo.toml`.
+      placeholder: 'json, watch, tokio'
+    validations:
+      required: true
+
+  - type: input
+    id: toolchain
+    attributes:
+      label: Rust version and platform
+      description: "`rustc -Vv` output, or just the version and OS."
+      placeholder: "1.85.0, Linux x86_64"
+    validations:
+      required: true
+
+  - type: textarea
+    id: output
+    attributes:
+      label: Error message or log output
+      description: Verbatim, please — the wording carries the provenance.
+      render: text

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/dynamic-config-rs/dynamic-config-python/security/advisories/new
+    about: >
+      Please report privately rather than in a public issue. See SECURITY.md.
+  - name: Question about usage
+    url: https://github.com/dynamic-config-rs/dynamic-config-python/discussions
+    about: >
+      For "how do I…", a discussion gets a better answer than an issue — and
+      stays findable for the next person.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,64 @@
+name: Feature request
+description: Something the crate should be able to do and cannot
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before opening one, it is worth a look at
+        [Not planned](../blob/main/README.md#not-planned): several things are
+        listed there as deliberately refused, each with the reasoning and with
+        what would reopen it. If you disagree with one, say so here — a refusal
+        with a bad reason should be revisited.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem
+      description: >
+        What are you trying to do, and where does the crate stop you? Describe
+        the situation rather than the API you have in mind — the best design
+        often is not the one either of us thought of first.
+      placeholder: |
+        Our platform sets `DATABASE_URL` and I cannot rename it, so the prefixed
+        environment layer cannot reach it.
+    validations:
+      required: true
+
+  - type: textarea
+    id: workaround
+    attributes:
+      label: What you do today
+      description: The workaround, if there is one, and why it is not enough.
+
+  - type: textarea
+    id: shape
+    attributes:
+      label: What it might look like
+      description: Optional. A sketch of the API, if you have one in mind.
+      render: rust
+
+  - type: dropdown
+    id: scope
+    attributes:
+      label: Where it belongs
+      options:
+        - The core crate
+        - A companion crate (etcd, Consul, NATS, Vault, Redis, S3, Firestore)
+        - A new companion crate
+        - Not sure
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: constraints
+    attributes:
+      label: Constraints this has to respect
+      description: >
+        These are load-bearing for the crate. Tick the ones you have thought
+        about; leave the rest — it is a prompt, not a barrier.
+      options:
+        - label: Reading configuration stays lock-free and allocation-free on the hot path
+        - label: No new mandatory dependency (an optional feature is fine)
+        - label: Does not raise the core crate's MSRV of 1.71
+        - label: Secrets stay out of logs and diagnostics

.github/dependabot.yml

@@ -0,0 +1,30 @@
+version: 2
+
+updates:
+  # Cargo updates are grouped: what a wheel links is reviewed as one tree.
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    groups:
+      patch-and-minor:
+        update-types: [minor, patch]
+    ignore:
+      # PyO3 majors change the binding's whole vocabulary.
+      - dependency-name: pyo3
+        update-types: [version-update:semver-major]
+  # The wheels' Python dependencies are extras rather than requirements, so
+  # there is no lockfile to bump — `scripts/resolve-python-audit.py` is what
+  # resolves them, and the OSV job is what watches them.
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    # One grouped bump instead of a queue: an action pin is reviewed the same
+    # way whether one moved or five did.
+    groups:
+      actions:
+        patterns: ["*"]

.github/pull_request_template.md

@@ -0,0 +1,31 @@
+## What this changes
+
+<!-- One or two sentences. What is different afterwards, from a user's side? -->
+
+## Why
+
+<!-- The problem, not the patch. If it fixes an issue, link it: Fixes #123 -->
+
+## The decision, if there was one
+
+<!-- Delete if there wasn't. If you chose between two reasonable designs, say
+     which and why — that reasoning is the part a future reader cannot recover
+     from the diff. The same goes for anything deliberately *not* done. -->
+
+## Checklist
+
+- [ ] `just check` passes locally (fmt, clippy, tests, docs)
+- [ ] New behaviour has a test that would fail without the change
+- [ ] Public items have doc comments; a new argument or feature is in `README.md`
+- [ ] `CHANGELOG.md` has an entry under `Unreleased`
+- [ ] MSRV unchanged, or the change is called out here and in the README table
+
+<!-- For a change to a companion crate, its own README and CHANGELOG too. -->
+
+## Compatibility
+
+- [ ] No public API removed or narrowed
+- [ ] No behaviour change a working program would notice
+
+<!-- If either is unchecked, say what breaks and how a user migrates. MSRV
+     changes count as breaking. -->

Cargo.lock

@@ -36,6 +36,13 @@ ignore = [
     # vulnerable code path occurs in the SDK's identity-cache usage. Re-add
     # entries here if RustSec ships criteria that match.
 ]
+# `aws-sdk-s3` is pinned to 1.112.0 or newer (GHSA-g59m-gf8j-gjf5), which
+# regenerating the lockfile undoes: the MSRV-fallback resolver picks 1.96,
+# the newest release compatible with the *lowest* floor in the workspace.
+# The same trap `time` is in, one crate over. After any `cargo
+# generate-lockfile`, re-apply:
+#
+#   cargo update -p aws-sdk-s3 --precise 1.112.0
 # `time` is pinned in Cargo.lock to 0.3.47 or newer (RUSTSEC-2026-0009), which
 # declares rust-version 1.88. That is fine — it is reached only through the
 # companion crates and dev-dependencies, never through the core crate, whose

deny.toml

@@ -5,6 +5,7 @@ around the checks. Each one is safe to re-run and says what it did.
 
 | Script | What it does |
 |---|---|
+| `audit-report.py` | An OSV scan's findings, split into *a fix exists* (fails the job) and *no fix published* (a warning). Exemptions are `osv-scanner.toml`'s and never reach this. |
 | `ci-local.sh` | The whole CI gate locally, in the order that fails fastest. |
 | `claude-review-pr.sh` | Reviews a pull request with Claude locally — title, body, diff, and read-only access to the checkout. `--post` comments the review on the PR; without it, nothing leaves the terminal. |
 | `dismiss-alert.sh` | Dismisses a Dependabot alert with the reason recorded *on the alert* — GitHub's UI leaves that nowhere a reviewer finds later. `--list` shows what is open. |