veragem 0.1.0

data/template/.github/workflows/dependency-review.yml

@@ -0,0 +1,50 @@
+name: Dependency Review
+
+# The licences and advisories of what a pull request adds to Gemfile.lock and the workflows, as the
+# templates' Python and Rust ones review theirs. Advisory: it reports only when those files change,
+# so no required check can be it, and dependabot-automerge.yml merges a bump it flags (security.yml's
+# bundler-audit holds the lock daily).
+on:
+  pull_request:
+    paths:
+      - "Gemfile"
+      - "Gemfile.lock"
+      - "*.gemspec"
+      - ".github/workflows/**"
+
+permissions: {}
+
+# NOTE: it needs the repository's dependency graph (Settings → Advanced
+# Security), and on a private repository GitHub Code Security too (an
+# organization's): without them, this job fails rather than skipping --
+# enable them, or delete the workflow.
+#
+# What it reads: Gemfile.lock has no scopes, so each of its gems counts as
+# runtime -- the gemspec's dependencies and the Gemfile's tools alike --;
+# the actions for licences in effect: advisories match actions by semantic
+# version alone, not the commits these are pinned to ("Dependency graph
+# supported package ecosystems").
+jobs:
+  dependency-review:
+    name: License & Security Check
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    # no checkout: the action compares the pull request's base and head through GitHub's API
+    steps:
+      - name: Dependency Review
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: moderate
+          # The licences are ClearlyDefined's, not the gemspecs'; a gem's:
+          #   curl -s https://api.clearlydefined.io/definitions/gem/rubygems/-/NAME/VERSION
+          # (.licensed.declared). Add anything legitimate that is missing rather
+          # than deleting this list -- an empty allow-list allows everything.
+          # Ruby: Ruby's own licence, with MIT or BSD's (concurrent-ruby, reline)
+          allow-licenses: >
+            0BSD, Apache-2.0, BlueOak-1.0.0, BSD-2-Clause, BSD-3-Clause,
+            BSL-1.0, CC0-1.0, CC-BY-4.0, ISC, MIT, MIT-0, MPL-2.0,
+            Ruby, Unlicense, Zlib
+          # bundler-audit: GPL-3.0-or-later, a tool run here, never shipped. rake: MIT,
+          # to which ClearlyDefined adds a warranty disclaimer it takes for a licence
+          allow-dependencies-licenses: pkg:gem/bundler-audit, pkg:gem/rake

data/template/.github/workflows/image.yml

@@ -0,0 +1,140 @@
+# A release tag (`rake release`'s v<version>) publishes the command's OCI image to GHCR, as
+# ghcr.io/<owner>/<repository>: the flake's `image` built on each Linux architecture, run once
+# (`--version`), pushed per architecture, then joined under one multi-architecture tag, <version>
+# (and `latest` while it is the highest release). The per-architecture tags (<version>-amd64,
+# <version>-arm64) stay, the multi-architecture tag's parts. It runs beside release.yml, not after
+# it: the image does not wait for the gem's push to RubyGems.
+#
+# The job's token pushes: no secret stored. A first push is private (GHCR's default): make the
+# package public in its settings once.
+#
+# Docker Hub too, the same tags, once vars.DOCKERHUB_USERNAME and secrets.DOCKERHUB_TOKEN (an
+# access token that writes) are set: as vars.DOCKERHUB_REPOSITORY, else <username>/<repository>. A
+# Docker Hub failure in the build (its login, its name, a push) holds GHCR's multi-architecture tag
+# back too; a re-run, once fixed, completes both.
+#
+# Run by hand (workflow_dispatch) on a branch, it builds and runs the image on both architectures,
+# pushing nothing: a rehearsal before the first release; on a tag, it publishes that release again.
+name: Image
+
+on:
+  push:
+    tags: ["v[0-9]*"]
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  build:
+    name: Build and run (${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      matrix:
+        include:
+          - runner: ubuntu-latest
+            arch: amd64
+          - runner: ubuntu-24.04-arm
+            arch: arm64
+    permissions:
+      contents: read
+      packages: write
+    outputs:
+      description: ${{ steps.build.outputs.description }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@448cde739abec1eaf0646249e3d25bb8d9bc7702 # v31.11.2
+
+      - name: Build and run
+        id: build
+        run: |
+          set -euo pipefail
+          version="$(nix eval --raw .#image.imageTag)"
+          # a tag's version is the one version.rb declares at its commit, the image's tag
+          if [[ $GITHUB_REF_TYPE == tag && $GITHUB_REF_NAME != "v$version" ]]; then
+            echo "::error::$GITHUB_REF_NAME, but version.rb declares $version" >&2
+            exit 1
+          fi
+          # streamed into docker: no compressed copy of the closure in the store
+          stream="$(nix build --no-link --print-out-paths .#image.stream)"
+          "$stream" | docker load
+          loaded="$(nix eval --raw .#image.imageName):$version"
+          # the image as a user runs it: its entrypoint, as its user
+          expected="$(nix eval --raw .#image.imageName) $version"
+          actual="$(docker run --rm --pull never "$loaded" --version)"
+          if [[ $actual != "$expected" ]]; then
+            echo "::error::--version gave '$actual', expected '$expected'" >&2
+            exit 1
+          fi
+          # assigned first: a failing command substitution inside echo's arguments would not stop
+          # the step
+          description="$(nix eval --raw .#default.meta.description)"
+          echo "description=$description" >> "$GITHUB_OUTPUT"
+
+      - name: Push
+        if: github.ref_type == 'tag'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          # Docker Hub too, when both are set (.github/image-registries.sh): an unset variable or
+          # secret is empty, and no `if:` can read a secret. The username is a variable, as in
+          # Docker's guide: a secret would be masked wherever it appears, GHCR's paths included
+          DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USERNAME }}
+          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+          DOCKERHUB_REPOSITORY: ${{ vars.DOCKERHUB_REPOSITORY }}
+          ARCH: ${{ matrix.arch }}
+        run: |
+          set -euo pipefail
+          repositories="$(.github/image-registries.sh)"
+          version="${GITHUB_REF_NAME#v}"
+          loaded="$(nix eval --raw .#image.imageName):$version"
+          # the list on its own descriptor: no command in the loop can read it away
+          while read -r repository <&3; do
+            docker tag "$loaded" "$repository:$version-$ARCH"
+            docker push "$repository:$version-$ARCH"
+          done 3<<< "$repositories"
+
+  publish:
+    name: Multi-architecture tag
+    needs: build
+    if: github.ref_type == 'tag'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        # every tag, to tell whether this one is the highest
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Join the architectures
+        env:
+          GH_TOKEN: ${{ github.token }}
+          DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USERNAME }}
+          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+          DOCKERHUB_REPOSITORY: ${{ vars.DOCKERHUB_REPOSITORY }}
+          DESCRIPTION: ${{ needs.build.outputs.description }}
+        run: |
+          set -euo pipefail
+          repositories="$(.github/image-registries.sh)"
+          version="${GITHUB_REF_NAME#v}"
+          # `latest`: the highest final release (SemVer: no pre-release, no build metadata), so a
+          # patch to an older line leaves it where it is
+          highest="$(git tag --list 'v[0-9]*' | sed 's/^v//' \
+            | { grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' || true; } | sort -V | tail -n 1)"
+          # each repository's index from its own pushes: imagetools create's sources must be in
+          # the registry it writes to (its docs). The description is the index's annotation, as
+          # GHCR reads it for a multi-architecture image
+          while read -r repository <&3; do
+            tags=(--tag "$repository:$version")
+            if [[ $version == "$highest" ]]; then tags+=(--tag "$repository:latest"); fi
+            docker buildx imagetools create "${tags[@]}" \
+              --annotation "index:org.opencontainers.image.description=$DESCRIPTION" \
+              "$repository:$version-amd64" "$repository:$version-arm64"
+          done 3<<< "$repositories"

data/template/.github/workflows/nix.yml

@@ -0,0 +1,46 @@
+# The flake's checks (flake.nix): the Nix format, the shell scripts, the workflows, the gem built
+# as a package (and a command's run, and its OCI image on Linux) -- built on each system the flake
+# declares: x86_64 and aarch64 Linux, Apple silicon (macos-latest). The dev shell is built too, so
+# each system's tools are known to install.
+name: Nix
+
+on:
+  push:
+    branches: [main]
+  # every pull request, whatever it touches: a path-filtered workflow never reports, and a
+  # required check that never reports blocks the merge
+  pull_request:
+  workflow_dispatch:
+
+# a pull request's newest run cancels its older ones; any other run, a group of its own: every
+# commit on main checked (in a shared group, a pending run gives way to the newest: the default)
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  flake-check:
+    name: nix flake check (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install Nix
+        # flakes on, and the job's token for GitHub fetches
+        uses: cachix/install-nix-action@448cde739abec1eaf0646249e3d25bb8d9bc7702 # v31.11.2
+
+      - name: nix flake check
+        run: nix flake check --print-build-logs
+
+      - name: The dev shell
+        run: nix develop --command ruby --version

data/template/.github/workflows/release.yml

@@ -0,0 +1,117 @@
+# A release tag, v<version> (`rake bump`, then `rake release`), publishes the gem: checked and built
+# once, pushed to RubyGems through Trusted Publishing (no API key stored), then its GitHub release
+# of the same file, its notes the release's section of CHANGELOG.md (release-notes.sh). Trusted
+# Publishing needs, once, a (pending) trusted publisher on rubygems.org naming this repository,
+# this workflow (release.yml) and the `release` environment.
+#
+# Least privilege, as RubyGems' Trusted Publishing advises, after PyPI's security model: the
+# build, which runs the checks and the gemspec, writes nothing but its artifacts and mints no key;
+# only the RubyGems job can mint one, with nothing checked out and no Gemfile or Rakefile loaded;
+# only the release job can write the repository.
+name: Release
+
+on:
+  push:
+    tags: ["v[0-9]*"]
+
+permissions: {}
+
+jobs:
+  build:
+    name: Check and build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1.335.0
+        with:
+          ruby-version: "4.0"
+
+      - name: The gems, from Gemfile.lock
+        # installed afresh, not restored from bundler-cache: a cache any run on main can write is
+        # never an input to the gem published
+        env:
+          BUNDLE_FROZEN: "true"
+        run: bundle install
+
+      - name: RuboCop, Steep, the tests
+        run: bundle exec rake
+
+      - name: Build the gem, and its notes
+        run: |
+          set -euo pipefail
+          version="$(ruby -e 'puts Gem::Specification.load(Dir["*.gemspec"].first).version')"
+          if [[ $GITHUB_REF_NAME != "v$version" ]]; then
+            echo "::error::$GITHUB_REF_NAME, but the gemspec's version is $version" >&2
+            exit 1
+          fi
+          # into pkg/, as Bundler's gem tasks build it
+          bundle exec rake build
+          .github/release-notes.sh CHANGELOG.md "$version" > notes.md
+
+      - name: Keep the gem
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: gem
+          path: pkg/
+          if-no-files-found: error
+
+      - name: Keep the notes
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: notes
+          path: notes.md
+          if-no-files-found: error
+
+  rubygems:
+    name: RubyGems
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: release
+    permissions:
+      id-token: write # the short-lived token Trusted Publishing exchanges for an API key
+    steps:
+      - name: The build's gem
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: gem
+          path: pkg/
+
+      - name: Trusted Publishing's API key
+        uses: rubygems/configure-rubygems-credentials@dc5a8d8553e6ee01fc26761a49e99e733d17954a # v2.1.0
+
+      - name: Push
+        # the runner image's RubyGems: no other action in the one job that can mint a key
+        run: gem push pkg/*.gem
+
+  release:
+    name: GitHub release
+    needs: rubygems
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: The build's gem
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: gem
+          path: pkg/
+
+      - name: Its notes
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: notes
+
+      - name: Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "$GITHUB_REF_NAME" pkg/*.gem --repo "$GITHUB_REPOSITORY" --verify-tag \
+            --title "$GITHUB_REF_NAME" --notes-file notes.md

data/template/.github/workflows/rubocop-autocorrect.yml

@@ -0,0 +1,114 @@
+# A Dependabot pull request that moves Gemfile.lock gets RuboCop's safe corrections
+# (`rake rubocop:autocorrect`), when the bumped RuboCop finds any, as a commit of their own on its
+# branch, then merges as any bump once its checks pass. No token is stored: the job's GITHUB_TOKEN
+# pushes, and GitHub may hold the checks of that token's commit until a maintainer approves them
+# (the pull request's "Approve workflows to run"); no workflow can start them sooner -- dispatched,
+# theirs are not the pull request's required checks. `[dependabot skip]`: Dependabot rebases the
+# bump still, over the commit, and this workflow corrects the new one.
+name: RuboCop Autocorrect
+
+on:
+  pull_request:
+    paths:
+      - "Gemfile.lock"
+
+permissions: {}
+
+jobs:
+  correct:
+    name: Safe corrections
+    # Dependabot's own branches alone: never a fork's, never a person's pull request
+    if: >-
+      github.event.pull_request.user.login == 'dependabot[bot]' &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    # the bumped gems run here, so this job's token writes nothing: the next job, which pushes,
+    # runs no gem
+    permissions:
+      contents: read
+    outputs:
+      changed: ${{ steps.correct.outputs.changed }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1.335.0
+        with:
+          ruby-version: "4.0"
+          bundler-cache: true
+
+      - name: RuboCop's safe corrections
+        id: correct
+        run: |
+          set -euo pipefail
+          # what is left once corrected fails CI's own RuboCop, for a person to fix
+          bundle exec rake rubocop:autocorrect || true
+          git diff --binary > "$RUNNER_TEMP/corrections.patch"
+          if [[ -s $RUNNER_TEMP/corrections.patch ]]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Keep the corrections
+        if: steps.correct.outputs.changed == 'true'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: corrections
+          path: ${{ runner.temp }}/corrections.patch
+          if-no-files-found: error
+
+  push:
+    name: Commit them
+    needs: correct
+    if: needs.correct.outputs.changed == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          # the push below uses it
+          persist-credentials: true
+
+      - name: The corrections
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: corrections
+          path: ${{ runner.temp }}
+
+      - name: Commit and push
+        env:
+          BRANCH: ${{ github.event.pull_request.head.ref }}
+          CORRECTED: ${{ github.event.pull_request.head.sha }}
+          PATCH: ${{ runner.temp }}/corrections.patch
+        run: |
+          set -euo pipefail
+          # corrections of the commit they were made on: on a newer one, Dependabot's or these
+          # corrections', a re-run has nothing to do
+          if [[ $(git rev-parse HEAD) != "$CORRECTED" ]]; then
+            echo "$BRANCH is past $CORRECTED: corrected already, or a newer commit its own run corrects"
+            exit 0
+          fi
+          # RuboCop's files alone, edited in place: nothing else the bumped gems could write
+          ruby_files='^([^/]+/)*([^/]+\.(rb|gemspec)|Gemfile|Rakefile|Steepfile|(bin|exe)/[^/]+)$'
+          if [[ -n $(git apply --summary "$PATCH") ]] ||
+            git apply --numstat "$PATCH" | cut -f 3 | grep -Ev "$ruby_files"; then
+            echo "::error::the corrections change more than RuboCop's files, in place: not committed"
+            exit 1
+          fi
+          git apply "$PATCH"
+          git -c user.name="github-actions[bot]" \
+            -c user.email="41898282+github-actions[bot]@users.noreply.github.com" \
+            commit --all --quiet --message "style: apply RuboCop's safe corrections [dependabot skip]"
+          if ! git push origin "HEAD:$BRANCH"; then
+            # refused because Dependabot pushed meanwhile, whose own run corrects its commit;
+            # refused otherwise, a failure
+            remote=$(git ls-remote origin "refs/heads/$BRANCH" | cut -f 1)
+            if [[ $remote == "$CORRECTED" ]]; then exit 1; fi
+            echo "$BRANCH moved on: its own run corrects it"
+          fi

data/template/.github/workflows/ruby-ci.yml

@@ -0,0 +1,62 @@
+# The Ruby checks, `bundle exec rake` (RuboCop, Steep, the tests with their coverage gate), on each
+# Ruby the matrix lists, the gems installed from Gemfile.lock; then TypeProf's verdict, advisory.
+# nix.yml runs the flake's checks: the Nix format, the shell, the workflows, the package.
+name: Ruby CI
+
+on:
+  push:
+    branches: [main]
+  # every pull request, whatever it touches: a path-filtered workflow never reports, and a
+  # required check that never reports blocks the merge
+  pull_request:
+  workflow_dispatch:
+
+# a pull request's newest run cancels its older ones; any other run, a group of its own: every
+# commit on main checked (in a shared group, a pending run gives way to the newest: the default)
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  checks:
+    name: Checks (Ruby ${{ matrix.ruby }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # the gemspec's required_ruby_version, and each newer Ruby once released
+        ruby: ["4.0"]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Ruby
+        # bundler-cache: `bundle install`, frozen to Gemfile.lock, cached
+        uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1.335.0
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+
+      - name: RuboCop, Steep, the tests
+        # RuboCop's offences as annotations too, on a pull request's lines (its github formatter)
+        env:
+          RUBOCOP_OPTS: --format progress --format github
+        run: bundle exec rake
+
+      - name: RuboCop's safe corrections, as a patch
+        # a failed run's: what `rake rubocop:autocorrect` changes, in the run's summary, to
+        # `git apply` (a Dependabot bump's, rubocop-autocorrect.yml commits)
+        if: failure()
+        run: |
+          bundle exec rake rubocop:autocorrect || true
+          if ! git diff --quiet; then
+            { echo '```diff'; git diff; echo '```'; } >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+      - name: TypeProf (advisory)
+        run: bundle exec rake typeprof

data/template/.github/workflows/security.yml

@@ -0,0 +1,43 @@
+# bundler-audit: Gemfile.lock against the Ruby Advisory Database -- daily, on demand, and when the
+# lock changes (`rake audit`). A finding fails the run, notified to the workflow's creator (or
+# whoever last changed its cron: docs.github.com, "Notifications for workflow runs"). GitHub
+# disables a public repository's schedule after 60 days without activity ("Events that trigger
+# workflows"): Dependabot alerts, the repository's setting, watch the lock without one.
+name: Security
+
+on:
+  schedule:
+    - cron: "0 0 * * *" # daily, midnight UTC
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - "Gemfile.lock"
+      - ".github/workflows/security.yml"
+  pull_request:
+    paths:
+      - "Gemfile.lock"
+      - ".github/workflows/security.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  bundler-audit:
+    name: bundler-audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1.335.0
+        with:
+          ruby-version: "4.0"
+          bundler-cache: true
+
+      - name: bundler-audit
+        # the advisory database updated first, then the lock checked
+        run: bundle exec rake audit

data/template/.github/workflows/style-check-cocogitto.yml

@@ -0,0 +1,56 @@
+name: Conventional Commits Check
+
+# On a push, the whole history rather than `--from-latest-tag`: with no tag
+# yet, cog stops "unable to get any tag" -- every new project's first push.
+# A pull request's title too: a squash merge of two or more commits makes the
+# title the commit, and so a changelog entry -- checked again when edited.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+
+# a pull request's newest run cancels its older ones; any other run, a group of its own: every
+# commit on main checked (in a shared group, a pending run gives way to the newest: the default)
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  check_commits:
+    runs-on: ubuntu-latest
+    name: Check Conventional Commits
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+
+      - name: Check PR Commits
+        if: github.event_name == 'pull_request'
+        uses: cocogitto/cocogitto-action@52d0023b4396897f1815648e553db2ab8d782f3a # v4.2.0
+        with:
+          command: check
+          args: --ignore-merge-commits ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}
+
+      # after the action: `cog verify` panics without git's user.name and user.email, which
+      # the action sets globally (its git-user inputs) on every run
+      - name: Check PR Title
+        if: github.event_name == 'pull_request'
+        env:
+          TITLE: ${{ github.event.pull_request.title }} # through the environment, never the script
+        # after `--`: a title is the message, never an option (`--file=...`)
+        run: cog verify -- "$TITLE"
+
+      - name: Check Push Commits
+        if: github.event_name == 'push'
+        uses: cocogitto/cocogitto-action@52d0023b4396897f1815648e553db2ab8d782f3a # v4.2.0
+        with:
+          command: check
+          args: --ignore-merge-commits

data/template/.github/workflows/style-check-dprint.yml

@@ -0,0 +1,44 @@
+# The action installs dprint's latest release, attested; the formatting is
+# the plugins', pinned in dprint.json.
+name: Dprint Formatting Checks
+
+on:
+  push:
+    branches: [main]
+    paths:
+      # dprint.json's plugins' extensions, markdown and toml, no more: one
+      # no plugin handles (yaml, json, Dockerfile) only schedules runs that
+      # check nothing. Add a plugin there and its extensions here together,
+      # each its own entry: path filters have no brace expansion {a,b}.
+      - "**/*.md"
+      - "**/*.markdown"
+      - "**/*.toml"
+      - ".github/workflows/style-check-dprint.yml"
+      - "dprint.json"
+  # every pull request, whatever it touches: a path-filtered workflow never
+  # reports, and a required check that never reports blocks the merge
+  pull_request:
+
+# a pull request's newest run cancels its older ones; any other run, a group of its own: every
+# commit on main checked (in a shared group, a pending run gives way to the newest: the default)
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  dprint:
+    name: dprint check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Dprint format check
+        uses: dprint/check@7dc032d8874778fc024f6f9b4a7e6d896782c330 # v2.5
+        with:
+          config-path: dprint.json