Release 1.8.0

.github/DISCUSSION_TEMPLATE/ideas.yml

@@ -0,0 +1,28 @@
+title: "[Idea] "
+labels: ["idea"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Ideas for new packing rules, outputs or integrations. An idea the maintainers take on
+        is moved to an issue and linked back here, so you can follow it.
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem behind the idea
+      description: What real shipment or load does today's library not handle?
+    validations:
+      required: true
+  - type: textarea
+    id: idea
+    attributes:
+      label: The idea
+    validations:
+      required: true
+  - type: input
+    id: package
+    attributes:
+      label: Package(s) you use
+      placeholder: "packvium"
+    validations:
+      required: false

.github/DISCUSSION_TEMPLATE/q-a.yml

@@ -0,0 +1,30 @@
+title: "[Q&A] "
+labels: ["question"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Ask anything about using the library. If you have found a wrong result or an error,
+        a bug report is the better place.
+  - type: input
+    id: package-version
+    attributes:
+      label: Package and version
+      placeholder: "packvium 1.8.0 (Python)"
+    validations:
+      required: true
+  - type: textarea
+    id: question
+    attributes:
+      label: Your question
+      description: What you are trying to pack, and what you tried.
+    validations:
+      required: true
+  - type: textarea
+    id: request
+    attributes:
+      label: Request (optional)
+      description: The JSON request or code, if it helps.
+      render: json
+    validations:
+      required: false

.github/DISCUSSION_TEMPLATE/show-and-tell.yml

@@ -0,0 +1,33 @@
+title: "[Show and tell] "
+labels: ["show-and-tell"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Using the library in a shop, a warehouse tool or a load planner? Tell us how. Leave out
+        anything confidential about your business.
+  - type: textarea
+    id: what
+    attributes:
+      label: What you built
+    validations:
+      required: true
+  - type: input
+    id: package-version
+    attributes:
+      label: Package and version
+      placeholder: "packvium 1.8.0 (Python)"
+    validations:
+      required: false
+  - type: textarea
+    id: lessons
+    attributes:
+      label: What worked, and what got in the way
+    validations:
+      required: false
+  - type: input
+    id: link
+    attributes:
+      label: Link (optional)
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,105 @@
+name: Bug report
+description: A result that is wrong, an error you did not expect, or a crash.
+title: "[Bug]: "
+labels: ["bug", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting. A report we can run is a report we can fix, so the most useful
+        thing below is the smallest request that shows the problem.
+
+        **Security problems do not belong here.** Use **Report a vulnerability** under the
+        Security tab instead; it opens a private advisory.
+  - type: dropdown
+    id: package
+    attributes:
+      label: Package
+      description: Which package did you call?
+      options:
+        - "packvium (PyPI) — Packvium for Python"
+        - "packvium-native (PyPI) — Packvium native backend selector for Python"
+        - "packvium/packvium (Packagist) — Packvium for PHP"
+        - "packvium/native-bridge (Packagist) — Packvium native bridge for PHP"
+        - "@packvium/engine (npm) — Packvium for Node.js"
+        - "@packvium/browser (npm) — Packvium for browsers"
+        - "packvium (crates.io) — Packvium for Rust"
+        - "packvium-native-rust (PyPI) — Packvium native engines: Python wheels, Node addons and the C library"
+        - Not sure
+      default: 0
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Package version
+      description: The exact version installed, for example 1.8.0.
+      placeholder: "1.8.0"
+    validations:
+      required: true
+  - type: input
+    id: runtime
+    attributes:
+      label: Runtime and operating system
+      description: Language runtime version and OS, for example "Python 3.12, Ubuntu 24.04" or "PHP 8.3, macOS 15".
+    validations:
+      required: true
+  - type: dropdown
+    id: profile
+    attributes:
+      label: Search profile
+      options:
+        - fast
+        - balanced
+        - quality
+        - exact_small
+        - Not set / default
+        - Not sure
+    validations:
+      required: false
+  - type: textarea
+    id: request
+    attributes:
+      label: Request that reproduces it
+      description: |
+        The JSON request, or the code that builds it, cut down as far as it still shows the
+        problem. Remove anything confidential; renamed item ids are fine.
+      render: json
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: What happened
+      description: The result (or its relevant part), or the full error message and stack trace.
+      render: text
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What you expected
+      description: What the result should have been, and why. If another of the packages gives a different answer for the same request, say which.
+    validations:
+      required: true
+  - type: dropdown
+    id: stopped-by
+    attributes:
+      label: How was the search limited?
+      description: A search stopped by a time limit can differ between runs by design; one stopped by an effort budget cannot.
+      options:
+        - effort_budget
+        - time_limit_ms
+        - Both
+        - Neither / not sure
+    validations:
+      required: false
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Before submitting
+      options:
+        - label: I searched the existing issues and did not find this one.
+          required: true
+        - label: I read [docs/GUARANTEES.md](https://github.com/toxakara/packvium-python/blob/HEAD/docs/GUARANTEES.md) and this is not something it says the library does not guarantee.
+          required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Question or help with a request
+    url: https://github.com/toxakara/packvium-python/discussions/categories/q-a
+    about: Ask in Discussions → Q&A. Answers there help the next person too.
+  - name: Report a security vulnerability
+    url: https://github.com/toxakara/packvium-python/security/advisories/new
+    about: Report privately. Do not open a public issue for a security problem.
+  - name: Documentation
+    url: https://packvium.com/docs
+    about: Guides, the request contract and the constraint reference.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,62 @@
+name: Feature request
+description: A packing rule, constraint, output or integration the library does not support yet.
+title: "[Feature]: "
+labels: ["enhancement", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Open-ended ideas are welcome in **Discussions → Ideas** first. Use this form when you can
+        describe a concrete problem the library does not solve today.
+  - type: dropdown
+    id: package
+    attributes:
+      label: Package you use
+      options:
+        - "packvium (PyPI) — Packvium for Python"
+        - "packvium-native (PyPI) — Packvium native backend selector for Python"
+        - "packvium/packvium (Packagist) — Packvium for PHP"
+        - "packvium/native-bridge (Packagist) — Packvium native bridge for PHP"
+        - "@packvium/engine (npm) — Packvium for Node.js"
+        - "@packvium/browser (npm) — Packvium for browsers"
+        - "packvium (crates.io) — Packvium for Rust"
+        - "packvium-native-rust (PyPI) — Packvium native engines: Python wheels, Node addons and the C library"
+        - More than one
+      default: 0
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Package version
+      placeholder: "1.8.0"
+    validations:
+      required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem
+      description: What are you packing, into what, and what rule or output is missing? A real (anonymised) example helps more than a general description.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What you would like
+      description: The behaviour or field you have in mind, if you have one.
+    validations:
+      required: false
+  - type: textarea
+    id: workaround
+    attributes:
+      label: What you do today
+      description: Any workaround you use, and what it costs you.
+    validations:
+      required: false
+  - type: markdown
+    attributes:
+      value: |
+        Every package implements one shared contract, so a new rule or result field lands in all
+        of them together, and a change to the request or result format waits for a release that
+        is allowed to change it. A request that is accepted may therefore take more than one
+        release to ship.

.github/workflows/ci.yml

@@ -15,7 +15,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        # ubuntu-24.04, not ubuntu-latest: ubuntu-latest became 26.04, which setup-python has no 3.9 for.
+        os: [ubuntu-24.04, macos-latest, windows-latest]
         python: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

.github/workflows/rc.yml

@@ -0,0 +1,81 @@
+name: rc
+
+# A pre-release tag (`v1.9.0-rc.1`) builds and tests exactly as `release.yml` does, then goes
+# to TestPyPI -- a separate index whose database "may be periodically pruned" -- and never to
+# PyPI, where a version is permanent. There is no GitHub Release: an RC is not a release.
+#
+# Before the first RC, once (the owner):
+#   1. Create an account on https://test.pypi.org (separate from the PyPI one) and enable 2FA.
+#   2. Add a pending Trusted Publisher for project `packvium`: owner `toxakara`, repository
+#      `packvium-python`, workflow `rc.yml`, environment `testpypi`.
+#   3. In this repository, create a GitHub environment named `testpypi` with the same
+#      reviewers as `pypi`.
+#   4. Set the repository variable RC_PUBLISHING to `enabled`.
+# A consumer then installs it with
+#   pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple/ packvium==<version>
+
+on:
+  push:
+    tags: ["v*-*"]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.12"
+      - run: python -m pip install --upgrade pip build twine
+      - run: python -m build
+      - run: python -m twine check --strict dist/*
+
+      # The tag and the packaged version must agree. Without this, `git tag v0.2.0` on a
+      # tree that still says 0.1.0 publishes 0.1.0 under a name that claims otherwise,
+      # and the mistake is only visible after it is public and immutable.
+      - name: The tag must match the version in the distribution
+        run: |
+          tagged="${GITHUB_REF_NAME#v}"
+          built=$(python -c "import tomllib,pathlib; print(tomllib.loads(pathlib.Path('pyproject.toml').read_text())['project']['version'])")
+          if [ "$tagged" != "$built" ]; then
+            echo "tag $GITHUB_REF_NAME does not match pyproject version $built" >&2
+            exit 1
+          fi
+
+      - name: Install the built wheel into a clean environment and re-run the tests
+        run: |
+          python -m venv /tmp/clean
+          /tmp/clean/bin/python -m pip install --quiet pytest
+          /tmp/clean/bin/python -m pip install --quiet --no-index --find-links dist packvium
+          /tmp/clean/bin/python -m pytest tests -q
+
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: distributions
+          path: dist/
+
+  # Inert until the owner sets the repository variable RC_PUBLISHING to `enabled` (Settings ->
+  # Secrets and variables -> Actions -> Variables). Without it the job is skipped and the run
+  # stays green, so an RC tag pushed before the accounts exist publishes nothing.
+  publish-testpypi:
+    needs: build
+    if: vars.RC_PUBLISHING == 'enabled'
+    runs-on: ubuntu-latest
+    environment: testpypi
+    permissions:
+      id-token: write      # OIDC, for Trusted Publishing and for the attestation
+      attestations: write  # build provenance, so a consumer can verify where a file came from
+    steps:
+      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          name: distributions
+          path: dist/
+      - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        with:
+          subject-path: dist/*
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          repository-url: https://test.pypi.org/legacy/

.github/workflows/release.yml

@@ -13,9 +13,11 @@ name: release
 # wants. The environment is what turns "anyone who can push a tag" into "a release a
 # named person approved".
 
+# A pre-release tag (`v1.9.0-rc.1`) never reaches the production registries: the negated
+# pattern must follow the positive one, and `rc.yml` takes those tags instead.
 on:
   push:
-    tags: ["v*"]
+    tags: ["v*", "!v*-*"]
 
 permissions:
   contents: read