ci: make the template the source of the org standard

setup_repo.py now configures a new repository to the full standard, not just
branch protection: environments and Pages where the workflows use them,
read-only workflow tokens, squash/merge-commit only with branches deleted on
merge, secret scanning + push protection + Dependabot security updates +
private vulnerability reporting, topics from pyproject keywords, and a
`master` ruleset (pull requests only, no force-push or deletion, "All checks
passed" required) in place of classic protection. It is idempotent and is
what the existing repositories were aligned with.

The template gets a CI of its own: render with copier and run the generated
project's gate, aggregated into "All checks passed" so the same ruleset can
apply here. Its own CONTRIBUTING, CODE_OF_CONDUCT and SECURITY are added, and
the generated SECURITY.md becomes the org-wide one (draft advisory link, no
version table that goes stale).

Author: AlexeyShalaev

.github/workflows/ci.yml

@@ -0,0 +1,48 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  # The only thing that can be wrong with a template is what it generates, so the
+  # check is the generated project's own gate: render with the defaults, then run
+  # exactly what a new library's CI would run.
+  render:
+    name: Render the template and run the generated gate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+
+      - name: Render with copier
+        run: |
+          uvx --with jinja2-time copier copy --defaults --trust --vcs-ref HEAD \
+            --data project_name=demo-lib \
+            --data project_slug=demo-lib \
+            --data package_name=demo_lib \
+            --data project_description="Demo library rendered from the template" \
+            --data author_name="Bedrock Python" \
+            --data author_email="maintainers@example.com" \
+            . "${RUNNER_TEMP}/demo-lib"
+
+      - name: The generated project passes its own gate
+        working-directory: ${{ runner.temp }}/demo-lib
+        run: |
+          uv sync --group dev --all-extras
+          make check
+          make test-unit
+          uv build
+
+  all-checks-passed:
+    name: All checks passed
+    if: always()
+    needs: [render]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Every job above succeeded
+        run: echo '${{ toJSON(needs) }}' | jq -e 'all(.[]; .result == "success")'

CODE_OF_CONDUCT.md

@@ -0,0 +1,54 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes
+- Focusing on what is best not just for us as individuals, but for the overall community
+
+Examples of unacceptable behavior:
+
+- The use of sexualized language or imagery, and sexual attention or advances of any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information without explicit permission
+- Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Enforcement Responsibilities
+
+Project maintainers are responsible for clarifying and enforcing standards of acceptable
+behavior and will take appropriate and fair corrective action in response to any behavior
+deemed inappropriate, threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to
+the project maintainer at **shalaevad.alexey@gmail.com**.
+
+All complaints will be reviewed and investigated promptly and fairly.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org/),
+version 2.1.

CONTRIBUTING.md

@@ -0,0 +1,44 @@
+# Contributing to python-library-template
+
+This repository is the Copier template every bedrock-python library starts from, so a
+change here lands in the next library generated — and, through `copier update`, in the
+existing ones. Treat it like library code.
+
+## What a change looks like
+
+- Files under `template/` are what gets generated; `.jinja` files are rendered by Copier,
+  everything else is copied as is. Copier's own variables come from `copier.yml`.
+- `scripts/setup_repo.py` configures a freshly created GitHub repository to the org
+  standard (ruleset on `master`, security settings, merge settings, topics). It is run
+  once per new library and is also what keeps the existing repositories aligned.
+- `NEW_LIBRARY_CHECKLIST.md.jinja` and `.claude/LIBRARY_CREATION.md` are the operator
+  and agent instructions. Keep them in step with what the template actually does.
+
+## Checking a change
+
+Render the template and run the generated project's own gate — that is exactly what CI
+does:
+
+```bash
+uvx --with jinja2-time copier copy --defaults --trust --vcs-ref HEAD \
+  --data project_name=demo-lib --data project_slug=demo-lib --data package_name=demo_lib \
+  --data project_description="Demo" --data author_name="You" --data author_email="you@example.com" \
+  . /tmp/demo-lib
+cd /tmp/demo-lib && uv sync --group dev --all-extras && make check && make test-unit && uv build
+```
+
+A change to `setup_repo.py` is checked by running it against a throwaway repository, or
+against one of the org's repositories with `--help` first: the script is idempotent, so a
+re-run on an already configured repository is a no-op.
+
+## Commit messages
+
+[Conventional Commits](https://www.conventionalcommits.org/): `feat:` for something new in
+the generated project, `fix:` for a bug in it, `ci:` for workflow and setup-script
+changes, `docs:` for the instructions. There is no release; the template is consumed by
+git ref.
+
+## Pull requests
+
+Branch from `master`, open a PR against it. `master` takes pull requests only and needs
+the "All checks passed" status.

NEW_LIBRARY_CHECKLIST.md.jinja

@@ -31,11 +31,15 @@ then run from the template repo:
 python /path/to/python-library-template/scripts/setup_repo.py {{ github_org }}/{{ project_slug }}
 ```
 
-This configures:
-- GitHub environments (`pypi`, `github-pages`)
-- GitHub Pages (source: GitHub Actions)
-- Actions permissions (allow creating PRs for Release Please)
-- Branch protection on `master` requiring `All checks passed`
+This configures (idempotent, re-run any time):
+- GitHub environments (`pypi`, `github-pages`) and Pages (source: GitHub Actions)
+- Actions: read-only workflow token by default, Release Please may open PRs
+- Merge settings: squash or merge commit, branches deleted on merge, no wiki/projects,
+  docs site as the homepage, topics from `pyproject` keywords
+- Security: secret scanning, push protection, Dependabot alerts + security updates,
+  private vulnerability reporting
+- A `master` ruleset: pull requests only, no force-push or deletion, `All checks passed`
+  required (left out with a warning if CI has not reported yet — re-run after it has)
 
 ## Step 4 — PyPI Trusted Publisher (manual)
 

README.md

@@ -42,11 +42,16 @@ make check
 
 Then:
 1. Create a GitHub repo: `gh repo create bedrock-python/my-library --public`
-2. **Configure repo** (run once, then delete):
+2. **Configure repo** (after the first CI pass, then delete the script):
    ```bash
    python scripts/setup_repo.py bedrock-python/my-library
    git rm scripts/setup_repo.py .claude/LIBRARY_CREATION.md
    ```
+   Idempotent. Sets the org standard: `pypi`/`github-pages` environments and Pages,
+   read-only workflow tokens, squash/merge-commit only with branches deleted on merge,
+   secret scanning + push protection + Dependabot security updates + private
+   vulnerability reporting, topics from `pyproject` keywords, and a `master` ruleset
+   (pull requests only, no force-push or deletion, "All checks passed" required).
 3. **Push** (⚠️ **no** `Co-Authored-By:` in commits!):
    ```bash
    git init && git add . && git commit -m "feat: initial release" && git push -u origin master

SECURITY.md

@@ -0,0 +1,19 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+**Please do not report security vulnerabilities via public GitHub Issues.**
+
+Report it privately through GitHub, by
+[opening a draft security advisory](https://github.com/bedrock-python/python-library-template/security/advisories/new),
+or send an email to **shalaevad.alexey@gmail.com**. Either way, include:
+
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact and affected versions
+
+We aim to acknowledge reports within **48 hours** and provide a fix within **7 days**
+for critical issues.
+
+Once the fix is released, we will credit you in the release notes unless you prefer
+to remain anonymous.