Modernize examples and OSS maintenance

.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = true
+
+[*.py]
+indent_size = 4
+
+[*.sh]
+indent_size = 2

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @MPIsaac-Per

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,44 @@
+name: Example bug
+description: Report reproducible incorrect behavior in an infrastructure example.
+title: "bug: "
+labels: [bug, triage]
+body:
+  - type: markdown
+    attributes:
+      value: Remove credentials, generated virtual keys, provider payloads, and customer data before posting.
+  - type: input
+    id: example
+    attributes:
+      label: Example and file
+      placeholder: production-agent-observability/02-snippet.py
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Sanitized reproduction
+      description: Include the smallest configuration, command, and input needed to reproduce the problem.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected and actual behavior
+    validations:
+      required: true
+  - type: input
+    id: versions
+    attributes:
+      label: Dependency and platform versions
+      placeholder: Langfuse 4.14, Python 3.13, macOS 15
+    validations:
+      required: true
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Pre-submission checks
+      options:
+        - label: I removed secrets and private data.
+          required: true
+        - label: I checked the current upstream documentation and existing issues.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/MPIsaac-Per/agentinfra-examples/security/advisories/new
+    about: Report vulnerabilities privately. Do not open a public issue.
+  - name: Usage questions
+    url: https://github.com/MPIsaac-Per/agentinfra-examples/discussions
+    about: Ask integration questions without including credentials or private data.

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,26 @@
+name: Example proposal
+description: Propose a bounded infrastructure example or an update to an existing one.
+title: "proposal: "
+labels: [enhancement, triage]
+body:
+  - type: textarea
+    id: operator_problem
+    attributes:
+      label: Operator problem
+      description: Describe the production or evaluation problem the example should address.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed example
+      description: Include dependencies, external services, local validation, and failure behavior.
+    validations:
+      required: true
+  - type: textarea
+    id: upstream
+    attributes:
+      label: Upstream contracts
+      description: Link the current official documentation for every external API used.
+    validations:
+      required: true

.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns: ["*"]
+    labels: [dependencies]
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      development-dependencies:
+        dependency-type: development
+    labels: [dependencies, python]
+    open-pull-requests-limit: 5

.github/pull_request_template.md

@@ -0,0 +1,16 @@
+## Change
+
+Describe the example, contract, or documentation changed.
+
+## Verification
+
+- [ ] `uv run ruff check .`
+- [ ] `uv run ruff format --check .`
+- [ ] `uv run pytest --cov=. --cov-report=term-missing`
+- [ ] `shellcheck litellm-proxy-setup/*.sh`
+- [ ] No credentials, generated keys, provider responses, or customer data are included
+- [ ] Version pins and upstream links reflect the APIs used
+
+## Operator impact
+
+List migration, security, cost-control, or compatibility changes. Write `None` when there are none.

.github/workflows/ci.yml

@@ -0,0 +1,96 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    name: Quality
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Install uv
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          enable-cache: true
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.14"
+      - name: Install locked dependencies
+        run: uv sync --locked --all-extras --dev
+      - name: Lint Python
+        run: uv run ruff check .
+      - name: Check Python formatting
+        run: uv run ruff format --check .
+      - name: Type-check standalone examples
+        run: |
+          for example in \
+            agent-eval-pipelines/01-snippet.py \
+            agent-eval-pipelines/02-snippet.py \
+            agent-eval-pipelines/03-snippet.py \
+            production-agent-observability/01-snippet.py \
+            production-agent-observability/02-snippet.py \
+            litellm-proxy-setup/12-snippet.py
+          do
+            uv run mypy "$example"
+          done
+      - name: Lint shell scripts
+        run: shellcheck litellm-proxy-setup/*.sh
+      - name: Validate Docker Compose
+        working-directory: litellm-proxy-setup
+        run: |
+          cp 03-snippet.sh .env
+          cp 05-snippet.yaml config.yaml
+          cp 07-snippet.yaml compose.yaml
+          docker compose config --quiet
+      - name: Audit Python dependencies
+        run: uv run pip-audit
+
+  test:
+    name: Test (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.14"]
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Install uv
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          enable-cache: true
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install locked dependencies
+        run: uv sync --locked --all-extras --dev
+      - name: Test
+        run: uv run pytest --cov=. --cov-report=term-missing --cov-report=xml
+      - name: Upload coverage report
+        if: matrix.python-version == '3.14'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: coverage-report
+          path: coverage.xml
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/codeql.yml

@@ -0,0 +1,38 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "17 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze Python
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      security-events: write # Upload CodeQL findings to code scanning.
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        with:
+          languages: python
+          queries: security-extended
+      - name: Analyze
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0

.github/workflows/dependency-review.yml

@@ -0,0 +1,25 @@
+name: Dependency review
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dependency-review-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  review:
+    name: Review dependencies
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

.github/workflows/scorecard.yml

@@ -0,0 +1,48 @@
+name: OpenSSF Scorecard
+
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "31 6 * * 2"
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: scorecard-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analysis:
+    name: Analyze supply-chain posture
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write # Publish signed Scorecard results to the OpenSSF API.
+      security-events: write # Upload Scorecard findings to code scanning.
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Run Scorecard
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+      - name: Upload Scorecard artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: scorecard-results
+          path: results.sarif
+          if-no-files-found: error
+          retention-days: 5
+      - name: Upload Scorecard results to code scanning
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        with:
+          sarif_file: results.sarif

.gitignore

@@ -0,0 +1,21 @@
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.ruff_cache/
+.venv/
+.coverage
+coverage.xml
+htmlcov/
+
+.env
+.env.*
+!.env.example
+*virtual-key*.json
+*.dump
+config.local.yaml
+compose.override.yaml
+
+.DS_Store
+.idea/
+.vscode/
+*.swp

CHANGELOG.md

@@ -0,0 +1,19 @@
+# Changelog
+
+This project follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and intends to use [Semantic Versioning](https://semver.org/spec/v2.0.0.html) for releases.
+
+## [Unreleased]
+
+### Added
+
+- Automated Python, YAML, shell, Compose, dependency, CodeQL, dependency review, and OpenSSF Scorecard checks.
+- Tests for SDK contracts, evaluation utilities, observability instrumentation, configuration security, and import safety.
+- Standard contribution, support, security, conduct, citation, and release documentation.
+
+### Changed
+
+- Langfuse examples use the v4 observation, propagation, and query APIs.
+- OpenTelemetry examples use current GenAI semantic attributes and low-cardinality span names.
+- LiteLLM and PostgreSQL images are pinned by release and digest.
+- Proxy scripts apply timeouts, fail on HTTP errors, avoid hard-coded keys, and store generated virtual keys with mode `0600`.
+- Provider model IDs and budget limits are operator-supplied values.