Release boundver 0.10.0

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,80 @@
+name: Bug report
+description: Report a reproducible problem with boundver.
+title: "bug: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for helping improve boundver. Remove secrets and proprietary source before submitting.
+  - type: input
+    id: version
+    attributes:
+      label: boundver version
+      description: Paste the output of `boundver --version`.
+      placeholder: boundver 0.10.0
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: Include Python, operating system, and Git versions.
+      placeholder: Python 3.12, Ubuntu 24.04, Git 2.43
+    validations:
+      required: true
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      description: Describe the observed behavior and its impact.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Provide the smallest repository layout, sanitized config, and commands that reproduce the problem.
+      placeholder: |
+        1. Create ...
+        2. Run `boundver ...`
+        3. Observe ...
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: output
+    attributes:
+      label: Relevant output
+      description: Paste logs, tracebacks, or JSON output. Remove credentials and sensitive paths.
+      render: shell
+  - type: dropdown
+    id: interface
+    attributes:
+      label: Where did this occur?
+      options:
+        - CLI
+        - GitHub Action
+        - Python API
+        - Packaging or installation
+        - Documentation
+        - Other
+    validations:
+      required: true
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Submission checks
+      options:
+        - label: I searched existing issues for this problem.
+          required: true
+        - label: I removed secrets and proprietary content from this report.
+          required: true
+        - label: This is not a vulnerability; security reports belong in private vulnerability reporting.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Documentation
+    url: https://github.com/yzm1/boundver#readme
+    about: Read the overview, quick start, and links to detailed guides.
+  - name: Private security report
+    url: https://github.com/yzm1/boundver/security/advisories/new
+    about: Report suspected vulnerabilities privately; do not open a public issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,43 @@
+name: Feature request
+description: Suggest an improvement to boundver.
+title: "feature: "
+labels:
+  - enhancement
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Describe the user problem first. Concrete workflows help evaluate the smallest useful solution.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem or workflow
+      description: Who encounters this problem, and what are they trying to accomplish?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed outcome
+      description: Describe the behavior you would like, including a CLI or config example when relevant.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: What workarounds or other designs have you tried?
+  - type: textarea
+    id: compatibility
+    attributes:
+      label: Compatibility considerations
+      description: Note any effect on lockfiles, config, exit codes, providers, or CI integrations.
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Submission checks
+      options:
+        - label: I searched existing issues and documentation for this request.
+          required: true
+        - label: I can help test or document this change if it is accepted.
+          required: false

.github/pull_request_template.md

@@ -0,0 +1,17 @@
+## What changed
+
+Describe the problem and the resulting behavior. Link related issues with
+`Fixes #...` when appropriate.
+
+## How it was verified
+
+List the tests or manual checks you ran.
+
+## Checklist
+
+- [ ] The change is focused and does not include unrelated generated files.
+- [ ] Tests cover new behavior or the reason tests are unnecessary is explained.
+- [ ] User-facing CLI, config, schema, exit-code, or lockfile changes are documented.
+- [ ] Compatibility and migration impact has been considered.
+- [ ] `CHANGELOG.md` is updated for a user-visible change.
+- [ ] No secrets, private data, or proprietary fixtures are included.

.github/workflows/ci.yml

@@ -17,7 +17,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest]
-        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
+        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -82,17 +82,36 @@ jobs:
       - name: Build package
         run: |
           python -m pip install --upgrade pip
-          pip install build
-          python -m build
-
-      - name: Install and smoke-test
-        run: |
-          pip install dist/*.whl
-          boundver --help
-          boundver init --out /tmp/test.config.json --force
+          bash scripts/packaging_smoke.sh
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
         with:
           name: dist
           path: dist/
+
+  action:
+    name: Public Action contract
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Verify with the public interface
+        uses: ./
+        with:
+          facets: boundary,compat
+
+      - name: Exercise hostile input as data
+        id: hostile
+        continue-on-error: true
+        uses: ./
+        with:
+          components: 'boundver; touch /tmp/boundver-action-injected'
+
+      - name: Confirm input was not executed
+        shell: bash
+        run: test ! -e /tmp/boundver-action-injected