chore: sync from plugin-template

.editorconfig

@@ -0,0 +1,21 @@
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: 2026 The semrel Authors
+
+root = true
+
+[*]
+charset = utf-8
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.{html,tmpl,py,go}]
+indent_style = tab
+indent_size = 4
+
+[*.{yml,yaml,toml,json,css,less,js,vue,rb,nix}]
+indent_style = space
+indent_size = 2
+
+[*.sh]
+indent_style = space
+indent_size = 4

.golangci.yml

@@ -1,8 +1,9 @@
+---
 # SPDX-License-Identifier: Apache-2.0
-# SPDX-FileCopyrightText: 2026 The plugin-template Authors
+# SPDX-FileCopyrightText: 2026 The semrel Authors
+# yaml-language-server: $schema=https://golangci-lint.run/jsonschema/golangci.jsonschema.json
 version: "2"
 
-
 run:
   timeout: 5m
 
@@ -13,3 +14,5 @@ linters:
     - ineffassign
     - staticcheck
     - unused
+
+...

.pre-commit-config.yaml

@@ -0,0 +1,18 @@
+---
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: 2026 The semrel Authors
+# yaml-language-server: $schema=https://www.schemastore.org/pre-commit-config.json
+default_stages:
+  - pre-commit
+
+repos:
+  - repo: https://github.com/alessandrojcm/commitlint-pre-commit-hook
+    rev: v9.26.0
+    hooks:
+      - id: commitlint
+        stages:
+          - commit-msg
+        additional_dependencies:
+          - "@commitlint/config-conventional"
+
+...

CODE_OF_CONDUCT.md

@@ -1,6 +1,6 @@
 # Code of Conduct
 
-updater-python is committed to providing a welcoming and harassment-free community.
+`updater-python` is committed to providing a welcoming and harassment-free community.
 
 ## Our Pledge
 

Dockerfile

@@ -1,31 +1,45 @@
 # SPDX-License-Identifier: Apache-2.0
-# SPDX-FileCopyrightText: 2026 The updater-python Authors
+# SPDX-FileCopyrightText: 2026 The semrel Authors
 
 # ── build stage ────────────────────────────────────────────────────────────────
-FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS build
+FROM --platform=$BUILDPLATFORM debian:13-slim@sha256:62bd423aeee912639ca8ee681c2b762cb3e25137e0a92b20be455898a9f034ad AS build
+
+RUN apt-get update && \
+    apt-get -y --no-install-recommends install ca-certificates curl git build-essential && \
+    rm -rf /var/lib/apt/lists/*
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+ENV PATH="/root/.local/bin:/mise/shims:$PATH" \
+    MISE_DATA_DIR="/mise" \
+    MISE_CONFIG_DIR="/mise" \
+    MISE_CACHE_DIR="/mise/cache" \
+    MISE_INSTALL_PATH="/usr/local/bin/mise"
+
+RUN curl --proto '=https' --proto-redir '=https' \
+    --fail --show-error --silent --location https://mise.run | sh
+
+COPY mise.toml ./
+RUN --mount=type=cache,target=/mise/cache \
+   mise trust && mise install
+
+WORKDIR /src
+
+COPY go.mod go.sum* ./
+RUN --mount=type=cache,target=/root/go/pkg \
+    go mod download -x
+
+COPY . .
 
 ARG TARGETOS
 ARG TARGETARCH
 ARG VERSION=dev
 
-WORKDIR /src
-RUN apk add --no-cache ca-certificates git
-COPY go.mod go.sum ./
-RUN go mod download
-COPY . .
-RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
-    go build -trimpath -ldflags="-s -w" -o /out/plugin ./cmd/plugin
+RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
+    task build
 
 # ── distroless release image ───────────────────────────────────────────────────
-FROM gcr.io/distroless/static-debian12:nonroot
-
-# NOTE: intentionally no repo-specific `org.opencontainers.image.*` LABEL block
-# here. sync-template.yml only substitutes the "updater-python Authors" line
-# in this file when propagating it to plugin repos (see `sed` step) — it does
-# NOT rewrite LABEL title/description/source values. Adding those here would
-# get copied verbatim (and wrongly) into every plugin's Dockerfile. Add labels
-# in each plugin's own Dockerfile after copying this template, not here.
+FROM gcr.io/distroless/static-debian13:nonroot@sha256:d62067879de890a1def9da0e7766b7d20810a5e5555cef8506b752437d7a3e88
 
-COPY --from=build /out/plugin /usr/local/bin/plugin
+COPY --from=build /src/bin/plugin /usr/local/bin/plugin
 USER nonroot
 ENTRYPOINT ["/usr/local/bin/plugin"]

GOVERNANCE.md

@@ -2,17 +2,20 @@
 
 ## Overview
 
-{{PROJECT_NAME}} is an open source project governed by its maintainers and community contributors. This document describes how decisions are made and how to participate.
+`updater-python` is an open source project governed by its maintainers and community contributors. This document describes how decisions are made and how to participate.
 
 ## Project Roles
 
 ### Contributor
+
 Anyone who opens an issue, submits a PR, improves documentation, or participates in discussions. No formal process is required beyond following [CONTRIBUTING.md](CONTRIBUTING.md) and the [Code of Conduct](CODE_OF_CONDUCT.md).
 
 ### Reviewer
+
 An experienced contributor trusted to review changes in a specific area. Reviewers can approve changes but should not merge without maintainer approval unless the repo explicitly grants that permission.
 
 ### Maintainer
+
 Maintainers have merge rights and are responsible for the overall health of the repository. The current list of maintainers is in [MAINTAINERS.md](MAINTAINERS.md).
 
 **To become a Maintainer:**

MAINTAINERS.md

@@ -4,8 +4,8 @@
 
 | Name | GitHub | Affiliation | Areas |
 | --- | --- | --- | --- |
-| {{MAINTAINER_NAME_1}} | [@{{MAINTAINER_GITHUB_1}}](https://github.com/{{MAINTAINER_GITHUB_1}}) | {{AFFILIATION_1}} | {{AREAS_1}} |
-| {{MAINTAINER_NAME_2}} | [@{{MAINTAINER_GITHUB_2}}](https://github.com/{{MAINTAINER_GITHUB_2}}) | {{AFFILIATION_2}} | {{AREAS_2}} |
+| Markus Waldheim | [@mwaldheim](https://github.com/mwaldheim) | Independent | Core, Plugin Architecture, CI |
+| Thomas Boerger | [@tboerger](https://github.com/tboerger) | Independent | Core, Plugin Architecture, Gitea Integration |
 
 ## Responsibilities
 

SECURITY.md

@@ -4,17 +4,17 @@
 
 | Version | Supported |
 | --- | --- |
-| `main` / `{{DEFAULT_BRANCH}}` | ? |
+| `main` (pre-release) | ✅ |
 
-Update this table once stable releases exist.
+Once stable releases are published this table will list supported version ranges.
 
 ## Reporting a Vulnerability
 
-**Do not open a public issue for security vulnerabilities.**
+**Please do not open a public GitHub Issue for security vulnerabilities.**
 
-Please report vulnerabilities through **[GitHub Security Advisories]({{SECURITY_ADVISORY_URL}})**.
+Report security issues privately via **[GitHub Security Advisories](https://github.com/SemRels/updater-python/security/advisories/new)**.
 
-Alternative contact: {{SECURITY_CONTACT}}
+You can also reach the maintainers at the addresses listed in [MAINTAINERS.md](MAINTAINERS.md).
 
 ## What To Include
 
@@ -23,7 +23,7 @@ Alternative contact: {{SECURITY_CONTACT}}
 - Affected versions, tags, or commits
 - Proposed mitigations or workarounds, if known
 
-## Response Targets
+## Response SLA
 
 | Action | Target |
 | --- | --- |

Taskfile.yaml

@@ -0,0 +1,143 @@
+---
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: 2026 The semrel Authors
+# yaml-language-server: $schema=https://taskfile.dev/schema.json
+version: "3.40"
+
+tasks:
+  clean:
+    desc: Remove all temporary build artifacts
+    cmds:
+      - go clean -i ./...
+      - rm -rf dist/ bin/ coverage.out
+
+  fmt:
+    desc: Run standard formatter
+    vars:
+      SOURCES:
+        sh: find . -name "*.go" -type f | xargs echo
+    cmds:
+      - gofmt -s -w {{ .SOURCES }}
+
+  vet:
+    desc: Run vet linting
+    cmds:
+      - go vet ./...
+
+  lint:
+    desc: Run golangci linter
+    cmds:
+      - golangci-lint run
+
+  test:
+    desc: Run unit tests
+    vars:
+      PACKAGES:
+        sh: go list ./... | xargs echo
+    cmds:
+      - go test -v -coverprofile=coverage.out ./...
+
+  e2e:
+    desc: Run end-to-end tests
+    cmds:
+      - go test -tags e2e -v ./cmd/plugin/...
+
+  build:
+    desc: Build the plugin for the current platform
+    cmds:
+      - go build -v -trimpath -ldflags="-s -w" -o bin/plugin{{if eq .GOOS "windows"}}.exe{{end}} ./cmd/plugin
+    env:
+      CGO_ENABLED: "0"
+      GOOS: "{{ .GOOS }}"
+      GOARCH: "{{ .GOARCH }}"
+    vars:
+      GOOS:
+        sh: go env GOOS
+      GOARCH:
+        sh: go env GOARCH
+
+  build:dist:
+    desc: Build the plugin for the current platform
+    cmds:
+      - go build -v -trimpath -ldflags="-s -w" -o dist/plugin{{if eq .GOOS "windows"}}.exe{{end}} ./cmd/plugin
+      - sha256sum "dist/plugin{{if eq .GOOS "windows"}}.exe{{end}}" > "dist/plugin{{if eq .GOOS "windows"}}.exe{{end}}.sha256"
+    env:
+      CGO_ENABLED: "0"
+      GOOS: "{{ .GOOS }}"
+      GOARCH: "{{ .GOARCH }}"
+    vars:
+      GOOS:
+        sh: go env GOOS
+      GOARCH:
+        sh: go env GOARCH
+
+  build:all:
+    desc: Build the plugin for all release platforms
+    cmds:
+      - for:
+          - linux/amd64
+          - linux/arm64
+          - darwin/amd64
+          - darwin/arm64
+          - windows/amd64
+          - windows/arm64
+        cmd: >-
+          GOOS={{ index (splitList "/" .ITEM) 0 }}
+          GOARCH={{ index (splitList "/" .ITEM) 1 }}
+          go build -o dist/plugin-{{ index (splitList "/" .ITEM) 0 }}-{{ index (splitList "/" .ITEM) 1 }}{{if eq (index (splitList "/" .ITEM) 0) "windows"}}.exe{{end}}
+          ./cmd/plugin
+      - for:
+          - linux/amd64
+          - linux/arm64
+          - darwin/amd64
+          - darwin/arm64
+          - windows/amd64
+          - windows/arm64
+        cmd: >-
+          cd dist &&
+          sha256sum plugin-{{ index (splitList "/" .ITEM) 0 }}-{{ index (splitList "/" .ITEM) 1 }}{{if eq (index (splitList "/" .ITEM) 0) "windows"}}.exe{{end}}
+          > plugin-{{ index (splitList "/" .ITEM) 0 }}-{{ index (splitList "/" .ITEM) 1 }}{{if eq (index (splitList "/" .ITEM) 0) "windows"}}.exe{{end}}.sha256
+    env:
+      CGO_ENABLED: "0"
+
+  checksums:
+    desc: Generate checksums for all release artifacts
+    cmds:
+      - |
+        cd dist && find . -maxdepth 1 -type f ! -name '*.sha256' ! -name checksums.txt | sed 's|^\./||' | sort | while read -r file; do
+          sha256sum "${file}"
+        done > checksums.txt
+
+  sync:registry:
+    desc: Trigger a plugin sync in the semrel registry for a release tag
+    silent: true
+    vars:
+      PLUGIN_OWNER: SemRels
+      PLUGIN_REPO: SemRels/updater-python
+      PLUGIN_TAG:
+        sh: if [ -n "{{ .PLUGIN_TAG }}" ]; then echo "{{ .PLUGIN_TAG }}"; else git describe --tags --abbrev=0; fi
+    env:
+      PLUGIN_TAG: "{{ .PLUGIN_TAG }}"
+    cmds:
+      - |
+        if [ -n "${REGISTRY_SYNC_TOKEN:-}" ]; then
+          payload=$(printf '{"event_type":"sync-plugins","client_payload":{"source_owner":"{{ .PLUGIN_OWNER }}","source_repo":"{{ .PLUGIN_REPO }}","tag":"%s"}}' "${PLUGIN_TAG}")
+          curl --fail --silent --show-error \
+            -X POST \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${REGISTRY_SYNC_TOKEN}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/SemRels/semrel-registry/dispatches \
+            -d "${payload}"
+        elif [ -n "${REGISTRY_SYNC_WEBHOOK:-}" ]; then
+          payload=$(printf '{"repository":"{{ .PLUGIN_REPO }}","owner":"{{ .PLUGIN_OWNER }}","tag":"%s"}' "${PLUGIN_TAG}")
+          curl --fail --silent --show-error \
+            -X POST \
+            -H "Content-Type: application/json" \
+            "${REGISTRY_SYNC_WEBHOOK}" \
+            -d "${payload}"
+        else
+          echo "No registry sync secret configured; skipping dispatch."
+        fi
+
+...

commitlint.config.js

@@ -0,0 +1,34 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2026 The semrel Authors
+// yaml-language-server: $schema=https://json.schemastore.org/commitlintrc.json
+module.exports = {
+  extends: ["@commitlint/config-conventional"],
+  rules: {
+    "signed-off-by": [
+      2,
+      "always",
+      "Signed-off-by:",
+    ],
+    "type-enum": [
+      2,
+      "always",
+      [
+        "feat",
+        "fix",
+        "docs",
+        "style",
+        "refactor",
+        "perf",
+        "test",
+        "build",
+        "ci",
+        "chore",
+        "revert",
+        "major",
+        "minor",
+        "patch",
+        "deps",
+      ],
+    ],
+  },
+};