Add CONTRIBUTING, coverage gate, ruff, LICENSE, dependabot & release CI

Bring ClaudeCodeCommons to the portfolio-wide shared-library standard:
self-contained trunk-on-main CONTRIBUTING, 80% coverage gate (pytest-cov),
ruff lint+format gate, MIT LICENSE, release.yml (tag->Release) and weekly
dependabot. Code reformatted by ruff (no behaviour change).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: mwebbers

.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+updates:
+  # Python dependencies declared in pyproject.toml (pytest, ruff, pytest-cov, …).
+  # This package has no runtime dependencies; only the dev/test tools are bumped.
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      python:
+        patterns: ["*"]
+  # Keep GitHub Actions (checkout, setup-python, …) current.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      actions:
+        patterns: ["*"]

.github/workflows/release.yml

@@ -0,0 +1,32 @@
+name: release
+
+# Turn an annotated vX.Y.Z tag into a GitHub Release, using that version's
+# CHANGELOG.md section as the release notes. Fires after `git push --tags`.
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - name: Extract changelog section
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          awk -v v="$version" '
+            $0 ~ "^## \\[" v "\\]" { flag = 1; next }
+            flag && /^## \[/ { exit }
+            flag { print }
+          ' CHANGELOG.md > release-notes.md
+          if [ ! -s release-notes.md ]; then
+            echo "Release ${GITHUB_REF_NAME}" > release-notes.md
+          fi
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          name: ${{ github.ref_name }}
+          body_path: release-notes.md

.github/workflows/test.yml

@@ -12,9 +12,11 @@ jobs:
       matrix:
         python-version: ["3.9", "3.11", "3.12"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - run: pip install -e ".[test]"
+      - run: ruff check .
+      - run: ruff format --check .
       - run: pytest

.gitignore

@@ -7,8 +7,12 @@ venv/
 build/
 dist/
 .DS_Store
+.coverage
+.coverage.*
+htmlcov/
 
 # Secrets and local runtime config — never commit.
 .env
 .env.*
 !.env.example
+.ruff_cache/

CHANGELOG.md

@@ -8,6 +8,18 @@ adheres to semantic versioning.
 
 ## [Unreleased]
 
+### Added
+- Self-contained trunk-on-main `CONTRIBUTING.md`, `LICENSE` (MIT) + `license`
+  field, `.github/workflows/release.yml` (tag -> GitHub Release) and
+  `.github/dependabot.yml` (weekly pip + actions PRs).
+- Code-coverage gate: `pytest-cov`, **fail_under = 80** in `[tool.coverage]`.
+- Ruff lint + format gate (`[tool.ruff]`), run in CI before the tests.
+
+### Changed
+- CI: `ruff check` + `ruff format --check` before `pytest`; `actions/checkout` -> v5.
+- Code reformatted by `ruff format` (no behaviour change); `.gitignore` ignores
+  coverage artefacts.
+
 ## [0.3.0] - 2026-06-01
 
 ### Changed

CONTRIBUTING.md

@@ -0,0 +1,58 @@
+# Contributing — branching & releases (trunk-on-main)
+
+`ClaudeCodeCommons` is a shared library for the Claude routine family. It uses **trunk-based
+development**: `main` is always releasable, and every release is an annotated `vX.Y.Z`
+tag on `main` — no `develop` / `release` / `hotfix` branches. The plain `git` commands
+below are the whole workflow.
+
+The family deliberately picks its branching model by **deploy model**: pip-installed
+libraries and scheduled routines use trunk-on-main (this guide); gated multi-environment
+apps use Git Flow. The *release gate* — version = changelog = tag — is the same either
+way; only the branching differs.
+
+## Branch model
+
+| Branch | Purpose |
+| --- | --- |
+| `main` | The line. Always releasable, always green. Every release is a tag here. Default branch. |
+| `feature/*` (optional) | A short-lived branch for one unit of work, merged back with `git merge --no-ff`. For small changes, committing straight to `main` is fine. |
+
+Tags are always `vX.Y.Z` (a `v` prefix on the version).
+
+## Daily work
+
+Follow the **SCOPE → test → code → changelog** loop in `CLAUDE.md` (if present), or at
+minimum: add/adjust the test, change the code, keep `pytest` green, and add a line under
+`[Unreleased]` in `CHANGELOG.md`. Every public symbol downstream routines import is part
+of this library's contract — change it deliberately and note breaking changes.
+
+## Quality gates (run before every commit)
+
+```bash
+ruff check .
+ruff format --check .
+pytest          # tests + line coverage >= 80% (use pytest --no-cov for subsets)
+```
+
+CI runs exactly these on every push and PR. `ruff format` owns formatting; the linter is
+a small, stable rule set (`E`, `F`, `I`).
+
+## Cutting a release (the release gate lives here)
+
+The version in `pyproject.toml`, the topmost `CHANGELOG.md` heading, and the annotated
+tag must be the same `X.Y.Z`:
+
+```bash
+# on a clean, green main:
+# 1) bump "version" in pyproject.toml
+# 2) move CHANGELOG.md [Unreleased] entries under a new "## [X.Y.Z] - YYYY-MM-DD" heading
+# 3) ruff check . && ruff format --check . && pytest
+git commit -am "Added vX.Y.Z — <summary>"
+git tag -a vX.Y.Z -m "vX.Y.Z"
+git push origin main --tags
+```
+
+Downstream routines pin this library by tag (`...@vX.Y.Z`), so a release is only "done"
+once the tag is pushed. Pushing the tag triggers `release.yml`, which creates the GitHub
+Release from the changelog. Release this package before the routines that need the new
+version, and don't break the public API without a major-version bump.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Michael Webbers (MiWebb)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -45,3 +45,9 @@ pytest
 
 A coverage test (`tests/test_scope_coverage.py`) fails if any `SCOPE.md` feature
 lacks a test or a test references a feature not in `SCOPE.md`.
+
+## Contributing
+
+Branching is **trunk-on-main**, and releases go through a strict
+version = changelog = tag gate. See [CONTRIBUTING.md](./CONTRIBUTING.md) for the full
+procedure and the `ruff` + `pytest` quality gates.

pyproject.toml

@@ -6,13 +6,14 @@ build-backend = "setuptools.build_meta"
 name = "claude-code-commons"
 version = "0.3.0"
 description = "Vendor-agnostic, standard-library-only helpers (env lookup, tolerant parsing, currency symbols, remote-path builder, run log) shared by Claude routine repos"
+license = { text = "MIT" }
 # Standard library only — a broad floor so it installs in any routine runtime,
 # including a Python 3.11 scheduled-task sandbox. Verified on 3.9 and 3.12.
 requires-python = ">=3.9"
 dependencies = []
 
 [project.optional-dependencies]
-test = ["pytest>=8"]
+test = ["pytest>=8", "pytest-cov>=5", "ruff>=0.6"]
 
 # A single top-level module, `code_commons`, living under src/. Installing this
 # package makes `from code_commons import env_required, parse_num, ...` work in
@@ -26,7 +27,25 @@ py-modules = ["code_commons"]
 [tool.pytest.ini_options]
 pythonpath = ["src"]
 testpaths = ["tests"]
-addopts = "--strict-markers"
+addopts = "--strict-markers --cov --cov-report=term-missing"
 markers = [
     "feature: link a test to a SCOPE.md feature ID, e.g. feature('F-001')",
 ]
+
+[tool.coverage.run]
+source = ["code_commons"]
+branch = true
+
+[tool.coverage.report]
+fail_under = 80
+show_missing = true
+
+[tool.ruff]
+line-length = 88
+target-version = "py39"
+
+[tool.ruff.lint]
+# Deliberately small + stable: pyflakes (F), import-order (I), and the subset of
+# pycodestyle errors ruff enables by default (E4/E7/E9). `ruff format` owns
+# formatting; keep the linter low-churn.
+select = ["E4", "E7", "E9", "F", "I"]

src/code_commons.py

@@ -21,7 +21,6 @@
 from datetime import datetime
 from typing import Any
 
-
 # ---------------------------------------------------------------------------
 # Environment: project prefix with shared fallback
 # ---------------------------------------------------------------------------
@@ -182,11 +181,23 @@ def log(msg: str) -> None:
 # Known currency code -> display symbol. Codes not in the table fall back to the
 # 3-letter code itself, which is always valid in Excel number formats.
 CURRENCY_SYMBOLS = {
-    "EUR": "€", "USD": "$", "GBP": "£", "CHF": "CHF",
-    "DKK": "kr", "SEK": "kr", "NOK": "kr", "ISK": "kr",
-    "JPY": "¥", "CNY": "¥",
-    "CAD": "$", "AUD": "$", "NZD": "$", "HKD": "$",
-    "PLN": "zł", "CZK": "Kč", "HUF": "Ft",
+    "EUR": "€",
+    "USD": "$",
+    "GBP": "£",
+    "CHF": "CHF",
+    "DKK": "kr",
+    "SEK": "kr",
+    "NOK": "kr",
+    "ISK": "kr",
+    "JPY": "¥",
+    "CNY": "¥",
+    "CAD": "$",
+    "AUD": "$",
+    "NZD": "$",
+    "HKD": "$",
+    "PLN": "zł",
+    "CZK": "Kč",
+    "HUF": "Ft",
 }