Release 0.3.0: release engineering, GUI and bootstrap hardening, aas --version

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

.github/ISSUE_TEMPLATE/bug_report.md

@@ -26,7 +26,9 @@ What happens. Include error text, stack trace, or logs.
 
 ## Environment
 
-Repo, commit or tag, OS, runtime version, relevant inputs.
+Repo, commit or tag, OS, runtime version, relevant inputs. Include the
+output of `node bin/aas.mjs --version`, and for a saved case the
+`stack_version` in its `manifest.json`.
 
 ## Severity
 

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,11 +1,3 @@
----
-name: Pull Request
-about: Open a change for review
-title: ""
-labels: ""
-assignees: ""
----
-
 ## Description
 
 What does this PR do and why?
@@ -20,9 +12,9 @@ How did you verify this? Commands run, scenarios exercised, evidence captured.
 
 ## Checklist
 
-- [ ] Branch name follows the repo convention
-- [ ] No edits to main
-- [ ] No edits to LICENSE, CODEOWNERS, CHANGELOG, SECURITY, CONTRIBUTING
-- [ ] No edits to existing CI workflows
-- [ ] Linked issue or rationale included
-- [ ] Validation commands and outputs attached or referenced
+- [ ] Branch is named `imp/<topic>-<date>` (see `CONTRIBUTING.md`)
+- [ ] `npm run check` passes (unit suite, syntax gate, version consistency)
+- [ ] `npm run integration` passes, if orchestration, bootstrap, or lock files changed
+- [ ] `CHANGELOG.md` has a bullet under `## [Unreleased]` in the right category
+- [ ] A `stack-lock.json` change cites the sibling PR and merge SHA and updates `docs/release-readiness.md`
+- [ ] No private data, real credentials, or production endpoints

.github/dependabot.yml

@@ -0,0 +1,20 @@
+# Dependabot only opens pull requests. Each one goes through the full CI
+# matrix and is reviewed and merged by hand; nothing here merges or releases.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      all:
+        patterns: ["*"]
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      all:
+        patterns: ["*"]

.github/workflows/ci.yml

@@ -23,9 +23,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Nothing here pushes. Keep the token out of .git/config while
+          # installed packages and pinned component code run in the workspace.
+          persist-credentials: false
       - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node }}
           cache: npm
@@ -34,11 +38,9 @@ jobs:
       - name: Run tests
         run: npm test
       - name: Check syntax
-        # Every shipped module except the test files, which `npm test` and
-        # `npm run test:browser` already parse by running them. A parse error
-        # in the integration proof or an example otherwise surfaces only in the
-        # integration and browser jobs, and only on one platform.
-        run: node --check bin/aas.mjs && node --check bin/aas-gui.mjs && node --check bin/aas-gui-worker.mjs && node --check bin/case-review.mjs && node --check scripts/bootstrap.mjs && node --check scripts/integration-check.mjs && node --check examples/connector-conformance.mjs && node --check examples/review-handoff.mjs && node --check playwright.config.mjs
+        run: npm run check:syntax
+      - name: Check version consistency
+        run: npm run check:version
       - name: Smoke test GUI
         run: npm run gui:smoke
   integration:
@@ -48,19 +50,30 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest]
         node: ["22.12.0", 24]
+        python: ["3.13"]
+        # The documented floor (MIN_PYTHON, README) on one leg. Overriding an
+        # original matrix value makes this a fifth job, not a change to one.
+        include:
+          - os: ubuntu-latest
+            node: "22.12.0"
+            python: "3.11"
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Nothing here pushes. Keep the token out of .git/config while
+          # installed packages and pinned component code run in the workspace.
+          persist-credentials: false
       - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node }}
           cache: npm
       - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: "3.13"
+          python-version: ${{ matrix.python }}
       - name: Run full-stack integration proof
         run: npm run integration --ignore-scripts
       - name: Run integrator example (pass path)
@@ -82,19 +95,23 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Nothing here pushes. Keep the token out of .git/config while
+          # installed packages and pinned component code run in the workspace.
+          persist-credentials: false
       - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22.12.0"
           cache: npm
       - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
       - name: Install locked package set
         run: npm ci --ignore-scripts
-      - name: Install the Chromium browser (bounded, cached)
+      - name: Install the Chromium browser
         run: npx playwright install --with-deps chromium
       - name: Bootstrap pinned components
         run: npm run bootstrap

.github/workflows/release.yml

@@ -0,0 +1,60 @@
+name: Release
+
+# Runs only when a vX.Y.Z tag is pushed. It re-verifies the tagged commit,
+# checks the tag against package.json, package-lock.json, and CHANGELOG.md,
+# and publishes that version's CHANGELOG section as a GitHub Release. Nothing
+# is published to a package registry.
+on:
+  push:
+    tags: ["v*.*.*"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    permissions:
+      # Only this job can write, and only to create the GitHub Release.
+      contents: write
+    steps:
+      - name: Check out
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22.12.0"
+          # A job with write permission restores no cache.
+          package-manager-cache: false
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+      - name: Install locked package set
+        run: npm ci --ignore-scripts
+      - name: Run unit, syntax, and version checks
+        run: npm run check
+      - name: Run full-stack integration proof
+        run: npm run integration --ignore-scripts
+      - name: Check the tag and extract its release notes
+        env:
+          TAG: ${{ github.ref_name }}
+        run: node scripts/check-version.mjs --tag "$TAG" --notes "$RUNNER_TEMP/release-notes.md"
+      - name: Publish the GitHub Release
+        env:
+          TAG: ${{ github.ref_name }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            echo "Release $TAG already exists; leaving it unchanged."
+          else
+            gh release create "$TAG" --repo "$GITHUB_REPOSITORY" --verify-tag \
+              --title "Agent Action Stack $TAG" --notes-file "$RUNNER_TEMP/release-notes.md"
+          fi