Draft: license openIME under GPL-3.0-only (owner decision)

.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# Review requests go to the maintainer automatically. Code-owner approval is not
+# required yet (single maintainer); see docs/REPOSITORY.md before turning that on.
+* @Slacker-LLC

.github/dependabot.yml

@@ -0,0 +1,34 @@
+# Weekly dependency checks. Minor and patch updates are grouped into one pull
+# request per ecosystem so they do not pile up; every PR still has to pass the
+# normal CI. See docs/REPOSITORY.md.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 2
+    labels: [dependencies, ci]
+    commit-message:
+      prefix: "ci"
+    groups:
+      github-actions:
+        patterns: ["*"]
+
+  - package-ecosystem: gradle
+    directories: ["/", "/app"]
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 2
+    labels: [dependencies]
+    commit-message:
+      prefix: "build"
+    groups:
+      gradle-minor-and-patch:
+        update-types: [minor, patch]
+    ignore:
+      # AGP, Kotlin and Gradle majors move together with the pinned NDK/SDK and are upgraded by hand.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]

.github/pull_request_template.md

@@ -21,6 +21,12 @@
 
 测试设备、Android 版本和命令：
 
+## 变更记录与版本
+
+- [ ] 用户可见的改动（功能、行为、修复、权限、数据格式）已写入 `CHANGELOG.md` 的 `[Unreleased]`；纯内部改动不需要
+- [ ] 没有修改 `VERSION`（只有发布 PR 才升级版本，见 `docs/RELEASE.md`）
+- [ ] PR 标题能独立说清结果：合并时它就是提交标题，描述就是提交正文
+
 ## 隐私与交付检查
 
 - [ ] 没有提交密码、剪贴板、录音、设备日志或个人路径

.github/workflows/android.yml

@@ -26,6 +26,14 @@ jobs:
         with:
           lfs: true
 
+      # Fails in seconds, before the toolchain is set up: VERSION is valid and
+      # CHANGELOG.md has the matching dated section (docs/RELEASE.md).
+      - name: Check version and changelog
+        shell: bash
+        run: |
+          python3 -m unittest discover -s scripts -p 'test_*.py'
+          python3 scripts/release_check.py check
+
       - name: Set up JDK 17
         uses: actions/setup-java@v6
         with:
@@ -80,6 +88,12 @@ jobs:
           fi
           exit $status
 
+      - name: Verify APK version identity
+        shell: bash
+        run: |
+          python3 scripts/release_check.py apk app/build/outputs/apk/debug/app-debug.apk \
+            --aapt2 "$ANDROID_HOME/build-tools/35.0.0/aapt2"
+
       - name: Upload test APKs
         uses: actions/upload-artifact@v7
         with:
@@ -134,9 +148,16 @@ jobs:
           test -n "$test_apk"
           adb install -r "$app_apk"
           adb install -r "$test_apk"
+          report="ci-reports/instrumentation-api-${api_level}.txt"
           adb shell am instrument -w -r \
             llc.slacker.openime.test/androidx.test.runner.AndroidJUnitRunner \
-            | tee "ci-reports/instrumentation-api-${api_level}.txt"
+            | tee "$report"
+          # 'am instrument' exits 0 even when tests fail; a clean run ends with "OK (N tests)".
+          if ! grep -aq '^OK (' "$report"; then
+            echo "::error::Instrumentation tests failed on API ${api_level}"
+            grep -a -B1 -A12 'INSTRUMENTATION_STATUS_CODE: -[12]' "$report" | head -120 || true
+            exit 1
+          fi
           EOF
           chmod +x ci-run-instrumentation.sh