release: promote development → main for v0.4.0

.github/CODEOWNERS

@@ -0,0 +1,8 @@
+# Default owner for everything in the repo.
+* @alphacrack
+
+# Security-sensitive paths: sandbox, transpiler string handling, CI/publish.
+/maithili_dsl/cli.py            @alphacrack
+/maithili_dsl/transpiler/       @alphacrack
+/.github/workflows/             @alphacrack
+/SECURITY.md                    @alphacrack

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,69 @@
+name: 🐛 Bug report
+description: Something in the transpiler, linter, sandbox, or CLI doesn't work as documented.
+title: "[BUG] "
+labels: ["bug", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report a bug! धन्यवाद 🙏
+
+        ⚠️ **Security issues** (sandbox escapes, exec bypasses) must NOT be reported here.
+        Use [private vulnerability reporting](https://github.com/alphacrack/python-maithili-dsl/security/advisories/new)
+        or the process in [SECURITY.md](https://github.com/alphacrack/python-maithili-dsl/blob/main/SECURITY.md).
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      description: A clear description of the bug.
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Minimal .dmai reproduction
+      description: The smallest Maithili snippet that triggers the bug.
+      placeholder: |
+        छपाउ("यह में है")
+      render: text
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What you expected to happen (e.g. the transpiled Python, or output).
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: What actually happened. Paste the full output / traceback.
+      render: shell
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: python_maithili version
+      description: Output of `python_maithili --version`
+      placeholder: "0.3.0"
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Python version and OS
+      placeholder: "Python 3.12, macOS 15"
+    validations:
+      required: true
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I searched existing issues and this is not a duplicate.
+          required: true
+        - label: This is not a security vulnerability (those go through SECURITY.md).
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: 🔐 Report a security vulnerability
+    url: https://github.com/alphacrack/python-maithili-dsl/security/advisories/new
+    about: Sandbox escapes and exec bypasses must be reported privately — never as a public issue. See SECURITY.md.
+  - name: 💬 Questions & general discussion
+    url: https://github.com/alphacrack/python-maithili-dsl/blob/main/README.md
+    about: Check the README and docs first; for usage questions, open a blank issue with the "question" label.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,36 @@
+name: ✨ Feature request
+description: Propose a new capability for the DSL, CLI, or tooling.
+title: "[FEATURE] "
+labels: ["enhancement", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        For a **new Maithili keyword or module mapping**, please use the
+        dedicated "🔤 Keyword / mapping proposal" template instead.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What problem does this solve? Who benefits?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: What you'd like to see, ideally with an example `.dmai` snippet.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Other approaches you thought about, and why they're worse.
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I searched existing issues and BACKLOG.md and this is not already tracked.
+          required: true

.github/ISSUE_TEMPLATE/keyword_proposal.yml

@@ -0,0 +1,57 @@
+name: 🔤 Keyword / mapping proposal
+description: Propose a new Maithili keyword, builtin, or module-name mapping.
+title: "[KEYWORD] "
+labels: ["enhancement", "keyword-mapping", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Keyword choices shape the language for every Maithili speaker, so
+        native-speaker input on word choice is especially valuable here.
+  - type: input
+    id: maithili
+    attributes:
+      label: Proposed Maithili word (Devanagari)
+      placeholder: "जबतक"
+    validations:
+      required: true
+  - type: input
+    id: python
+    attributes:
+      label: Python equivalent
+      placeholder: "while"
+    validations:
+      required: true
+  - type: textarea
+    id: rationale
+    attributes:
+      label: Why this word?
+      description: |
+        Is this the natural Maithili term? Are there regional variants or
+        alternative spellings a reader might expect? Could it collide with
+        an existing keyword or with common identifier names?
+    validations:
+      required: true
+  - type: textarea
+    id: example
+    attributes:
+      label: Example usage
+      description: A short `.dmai` snippet showing the keyword in use, with the expected transpiled Python.
+      render: text
+      placeholder: |
+        गिनती = ०
+        जबतक गिनती < ५:
+            छपाउ(गिनती)
+            गिनती = गिनती + १
+    validations:
+      required: true
+  - type: dropdown
+    id: speaker
+    attributes:
+      label: Are you a Maithili speaker?
+      options:
+        - "Yes — native"
+        - "Yes — non-native / learner"
+        - "No — proposing on technical grounds only"
+    validations:
+      required: true

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  # Keep GitHub Actions pinned versions current (checkout, setup-python, etc.)
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    target-branch: "development"
+    labels: ["infra", "needs-triage"]
+
+  # Dev dependencies (pytest, coverage tooling). The package itself has
+  # zero runtime deps, so this mostly tracks requirements-dev.txt.
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    target-branch: "development"
+    labels: ["infra", "needs-triage"]

.github/workflows/ci.yml

@@ -20,14 +20,14 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest]
-        python-version: ["3.9", "3.10", "3.11", "3.12"]
+        python-version: ["3.10", "3.11", "3.12"]
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip
@@ -70,8 +70,24 @@ jobs:
 
       - name: Upload coverage artifact
         if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.12'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: coverage-xml
           path: coverage.xml
           if-no-files-found: warn
+
+  # Aggregate gate: branch protection requires this single check instead of
+  # every matrix leg, so the matrix can change without touching repo settings.
+  ci-ok:
+    name: ci-ok
+    if: always()
+    needs: [test]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fail if any test job failed
+        run: |
+          if [ "${{ needs.test.result }}" != "success" ]; then
+            echo "test matrix result: ${{ needs.test.result }}"
+            exit 1
+          fi
+          echo "all test jobs green"