release: stabilize fojin-cli v0.3.0

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,85 @@
+name: Bug report
+description: Report a reproducible fojin-cli defect
+title: "bug: "
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for helping improve fojin-cli. Search existing issues before filing.
+
+        **Do not disclose security vulnerabilities here.** Use the private process in [SECURITY.md](https://github.com/xr843/fojin-cli/blob/master/SECURITY.md).
+  - type: input
+    id: version
+    attributes:
+      label: fojin version
+      description: Paste the output of `fojin --version`.
+      placeholder: "fojin 0.x.y"
+    validations:
+      required: true
+  - type: dropdown
+    id: installation
+    attributes:
+      label: Installation method
+      options:
+        - cargo install
+        - install.sh
+        - GitHub Release archive
+        - Built from source
+        - Other package or integration
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Operating system and architecture
+      placeholder: "Ubuntu 24.04 x86_64, macOS arm64, or Windows x64"
+    validations:
+      required: true
+  - type: textarea
+    id: command
+    attributes:
+      label: Command and input
+      description: Provide the smallest command/input that reproduces the problem. Remove private data.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: Include exact output and exit code when useful. Remove credentials and private data.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction steps
+      description: Include whether the issue also occurs with `--offline` or a fresh `--data-dir`, when relevant.
+    validations:
+      required: true
+  - type: textarea
+    id: data_status
+    attributes:
+      label: Dataset status
+      description: For data/query issues, paste `fojin data status` and `fojin data verify` output. Do not attach the dataset itself.
+      render: text
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional context
+      description: Add minimal logs or screenshots that do not contain sensitive information.
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checklist
+      options:
+        - label: I searched for an existing report of this issue.
+          required: true
+        - label: This report does not disclose a security vulnerability or sensitive data.
+          required: true

.github/pull_request_template.md

@@ -0,0 +1,24 @@
+## Summary
+
+Describe the problem and the focused change that solves it. Note user-visible behavior and compatibility impact.
+
+## Verification
+
+List the exact commands you ran and their results, for example:
+
+```text
+cargo +stable test --all --locked
+```
+
+## Checklist
+
+- [ ] The change is focused and contains no credentials, generated datasets, build artifacts, or public vulnerability details.
+- [ ] I added or updated tests for behavior changes, or explained why tests are not applicable.
+- [ ] `cargo +stable fmt --all --check` passes.
+- [ ] `cargo +stable clippy --all-targets --locked -- -D warnings` passes.
+- [ ] `cargo +stable test --all --locked` passes.
+- [ ] `cargo +1.95.0 test --all --locked` passes when the change affects Rust code or dependencies.
+- [ ] Relevant Python and shell checks from `CONTRIBUTING.md` pass.
+- [ ] Documentation and the unreleased changelog entry are updated when user-visible behavior changes.
+- [ ] Dependency changes include the intended `Cargo.lock` update and retain the MSRV.
+- [ ] Data changes comply with `DATA_LICENSE`; code changes are acceptable under MIT OR Apache-2.0.

.github/workflows/ci.yml

@@ -1,28 +1,43 @@
 name: ci
 on: [push, pull_request]
+
+permissions:
+  contents: read
+
 jobs:
   msrv:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@1.77.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        with:
+          toolchain: 1.95.0
       - run: cargo test --all --locked
       - run: cargo install --path . --locked
   rust:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
         with:
+          toolchain: stable
           components: clippy, rustfmt
       - run: cargo fmt --all --check
-      - run: cargo clippy --all-targets -- -D warnings
-      - run: cargo test --all
+      - run: cargo clippy --all-targets --locked -- -D warnings
+      - run: cargo test --all --locked
   windows-data:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        with:
+          toolchain: stable
       - run: cargo test --all --locked
   release-build:
     name: release build (${{ matrix.target }})
@@ -44,17 +59,32 @@ jobs:
             os: windows-latest
             archive_ext: zip
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - name: Install release target
-        run: rustup target add ${{ matrix.target }}
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        with:
+          toolchain: stable
+          targets: ${{ matrix.target }}
       - run: cargo build --release --locked --target ${{ matrix.target }}
   python-parity:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.12'
       - run: pip install pytest
       - run: cd data-pipeline && python -m pytest tests/ -q
+  release-contract:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: ShellCheck release scripts
+        run: shellcheck install.sh scripts/*.sh tests/*.sh
+      - run: bash tests/release-scripts.sh
+      - run: bash tests/install-script.sh