Bring the v3.0.0 work into main (#20 to #23)

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,56 @@
+name: Bug report
+description: Something does not work as documented
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a problem. Please never include your Equasis password, your
+        credentials file, or pages saved with `--save-html` that still contain your name.
+  - type: input
+    id: version
+    attributes:
+      label: equasis-cli version
+      description: Output of `equasis --version`
+      placeholder: equasis 3.0.0
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Operating system and Python version
+      placeholder: macOS 15, Python 3.13
+    validations:
+      required: true
+  - type: dropdown
+    id: mode
+    attributes:
+      label: Mode
+      options:
+        - Command line
+        - Interactive shell
+        - Python API
+    validations:
+      required: true
+  - type: textarea
+    id: command
+    attributes:
+      label: Command
+      description: The exact command you ran
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What you expected
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: What happened
+      description: Include the output and exit code. Re-running with `--debug` often helps.
+      render: text
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/rhinonix/equasis-cli/security/advisories/new
+    about: Report security issues privately.
+  - name: Commercial licensing
+    url: https://github.com/rhinonix/equasis-cli/blob/main/LICENSING.md
+    about: Using equasis-cli commercially.

.github/ISSUE_TEMPLATE/equasis_changed.yml

@@ -0,0 +1,42 @@
+name: Equasis page changed
+description: Exit code 6, "could not read the Equasis page", or data that is missing or in the wrong fields
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Equasis sometimes changes its website, which can break parsing. A copy of the page
+        makes this quick to fix.
+
+        1. Re-run the failing command with `--save-html pages --refresh`.
+        2. Open the saved page for the failing request in a text editor and replace your
+           name in the "Welcome" section with `Test User`.
+        3. Attach the edited page below.
+  - type: input
+    id: version
+    attributes:
+      label: equasis-cli version
+      description: Output of `equasis --version`
+    validations:
+      required: true
+  - type: textarea
+    id: command
+    attributes:
+      label: Command and output
+      render: text
+    validations:
+      required: true
+  - type: textarea
+    id: page
+    attributes:
+      label: Saved page (with your name removed)
+      description: Drag the HTML file here, or describe what looks different on equasis.org.
+    validations:
+      required: false
+  - type: checkboxes
+    id: privacy
+    attributes:
+      label: Privacy
+      options:
+        - label: I removed my name from any attached page
+          required: true

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,19 @@
+name: Feature request
+description: Suggest an improvement
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What are you trying to do?
+      description: Describe the research or workflow problem, not only the solution.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives you have considered

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,11 @@
+## Summary
+
+<!-- What does this change and why? Link related issues, for example "Fixes #123". -->
+
+## Checklist
+
+- [ ] Tests added or updated (parser changes include a fixture made with `tests/tools/make_fixture.py`)
+- [ ] `ruff check .`, `ruff format --check .`, `mypy`, and `pytest` pass
+- [ ] Documentation updated for user-visible changes
+- [ ] Entry added under "Unreleased" in `CHANGELOG.md`
+- [ ] No credentials or personal information in code, fixtures, or logs

.github/workflows/canary.yml

@@ -0,0 +1,44 @@
+name: Live canary
+
+# Runs the live test suite against equasis.org once a week to detect website
+# changes before users do. Requires the repository secrets EQUASIS_USERNAME and
+# EQUASIS_PASSWORD; without them the job is skipped.
+
+on:
+  schedule:
+    - cron: "17 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  live:
+    name: Live Equasis checks
+    runs-on: ubuntu-latest
+    env:
+      EQUASIS_USERNAME: ${{ secrets.EQUASIS_USERNAME }}
+      EQUASIS_PASSWORD: ${{ secrets.EQUASIS_PASSWORD }}
+      EQUASIS_LIVE_TESTS: "1"
+    steps:
+      - name: Check for credentials
+        id: credentials
+        run: |
+          if [ -n "$EQUASIS_USERNAME" ] && [ -n "$EQUASIS_PASSWORD" ]; then
+            echo "available=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "::notice::EQUASIS_USERNAME and EQUASIS_PASSWORD secrets are not set; skipping."
+          fi
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        if: steps.credentials.outputs.available == 'true'
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        if: steps.credentials.outputs.available == 'true'
+        with:
+          python-version: "3.14"
+          cache: pip
+      - name: Install
+        if: steps.credentials.outputs.available == 'true'
+        run: python -m pip install -e ".[dev]"
+      - name: Run live tests
+        if: steps.credentials.outputs.available == 'true'
+        run: pytest tests/test_live.py -v

.github/workflows/ci.yml

@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   lint:
-    name: Lint
+    name: Lint and type check
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -29,6 +29,8 @@ jobs:
         run: ruff check .
       - name: Ruff format
         run: ruff format --check .
+      - name: Mypy
+        run: mypy
 
   test:
     name: Test (Python ${{ matrix.python-version }}, ${{ matrix.os }})

.github/workflows/release.yml

@@ -0,0 +1,79 @@
+name: Release
+
+# Publishing uses PyPI trusted publishing (OpenID Connect), so no API tokens are stored.
+# - Run manually ("Run workflow") to publish to TestPyPI for a dry run.
+# - Publishing a GitHub release publishes to PyPI after approval of the "pypi" environment.
+# See RELEASING.md for the one-time setup.
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build distribution
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+      - name: Check that the tag matches the package version
+        if: github.event_name == 'release'
+        env:
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          version=$(python -c "import re, pathlib; print(re.search(r'__version__ = \"(.+)\"', pathlib.Path('src/equasis_cli/_version.py').read_text()).group(1))")
+          if [ "v$version" != "$TAG" ]; then
+            echo "::error::Tag $TAG does not match package version $version"
+            exit 1
+          fi
+      - name: Build and check
+        run: |
+          python -m pip install build twine
+          python -m build
+          python -m twine check --strict dist/*
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: dist
+          path: dist/
+
+  testpypi:
+    name: Publish to TestPyPI
+    if: github.event_name == 'workflow_dispatch'
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/equasis-cli
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          repository-url: https://test.pypi.org/legacy/
+
+  pypi:
+    name: Publish to PyPI
+    if: github.event_name == 'release'
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/equasis-cli
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

.pre-commit-config.yaml

@@ -1,3 +1,5 @@
+# Recorded Equasis pages are test data and must stay byte-for-byte as generated.
+exclude: ^tests/fixtures/
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v6.0.0