chore(ci): QA pass — action pins, integration gate, dev docs build, practice flow

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,22 @@
+<!--
+Target `dev` unless this is a hotfix. See CONTRIBUTING.md → Branches.
+Adding or changing a pathway graph? Open the PR with ?template=pathway.md instead.
+-->
+
+## What changed
+
+<!-- One paragraph. What, and why it belongs in this repository. -->
+
+## Checks I ran locally
+
+- [ ] `ruff check src tests --exclude tests/_legacy_test_pathways_source.py`
+- [ ] `./.venv/bin/python -m pytest tests/ -q`
+- [ ] `PYTHONPATH=src python3 scripts/check_pathway_integration.py` (if pathways touched)
+- [ ] `python3 tools/check_pmids.py --strict` and committed the refreshed `tools/pmid_cache.json` (if a citation was added)
+- [ ] Rebased onto `dev` and re-ran the suite afterwards
+
+## Invariants
+
+- [ ] No runtime dependency added (`dependencies = []` untouched)
+- [ ] No number without a source; no citation invented; missing data stays `OPEN`/`UNEVALUABLE`
+- [ ] Nothing from the product side (score weights, vendor variables, human rows)

.github/PULL_REQUEST_TEMPLATE/pathway.md

@@ -19,7 +19,7 @@ Fill: docs/python/templates/NEW_PATHWAY_CHECKLIST.md (paste below or attach).
 - [ ] Wired in `pathways/registry.py` → `pathway_loaders()` only
 - [ ] `PYTHONPATH=src python3 scripts/export_pathway_packs.py`
 - [ ] Pack present: `pathways/packs/<name>/{pathway.mermaid,tests.md,README.md}`
-- [ ] `packs/COVERAGE.md` updated
+- [ ] `pathways/packs/COVERAGE.md` updated
 - [ ] Tests added/updated
 - [ ] `PYTHONPATH=src python3 scripts/check_pathway_integration.py --pathway <name>` → exit 0
 - [ ] `PYTHONPATH=src python3 tests/test_pathway_packs.py` → pass

.github/dependabot.yml

@@ -0,0 +1,15 @@
+# Keeps the workflow action pins current. Every action in ci.yml, docs.yml and
+# publish.yml was two majors behind on 2026-09-07 and GitHub was emitting a
+# Node 20 deprecation annotation on every run; nobody saw it because the runs
+# were green. Pull requests land on dev, like every other change.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: dev
+    schedule:
+      interval: monthly
+    groups:
+      actions:
+        patterns: ["*"]
+    labels: ["ci"]

.github/workflows/ci.yml

@@ -17,7 +17,7 @@ jobs:
     name: Separation gate (no product identifiers)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       # Rule E. The separation gate keeps product IP out; this keeps PEOPLE out.
       # Both are unrecoverable once pushed, so both run before anything expensive.
       - name: No human rows in a public repository
@@ -61,9 +61,9 @@ jobs:
       matrix:
         python-version: ["3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install
@@ -83,6 +83,11 @@ jobs:
         run: pytest tests/ -q
       - name: Pathway packs (script form)
         run: PYTHONPATH=src python tests/test_pathway_packs.py
+      - name: Pathway integration gate
+        # CONTRIBUTING.md has said "must exit 0 before merge" since the pathway
+        # template landed, but nothing ran it here — a contributor could follow
+        # the guide, skip the step, and still see green.
+        run: PYTHONPATH=src python scripts/check_pathway_integration.py
       - name: Build wheel
         run: python -m build
       - name: Twine check
@@ -114,8 +119,8 @@ jobs:
     name: Coverage
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
       - name: Install
@@ -133,7 +138,7 @@ jobs:
             --cov=biology_as_code.packets \
             --cov-report=term-missing \
             --cov-fail-under=90
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v6
         with:
           name: coverage-xml
           path: coverage.xml

.github/workflows/docs.yml

@@ -11,7 +11,10 @@ name: Docs
 
 on:
   push:
-    branches: [main]
+    # dev is built (never deployed) on push as well as on pull request, so the
+    # integration branch carries the same evidence as main. ci.yml explains why
+    # every merge target must appear in these lists.
+    branches: [main, dev]
   # Build (not deploy) on dev pull requests too, so a broken nav entry or dead
   # link fails in review rather than after the merge to main. Deployment stays
   # gated on main below.
@@ -32,8 +35,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
       - name: Install
@@ -46,7 +49,7 @@ jobs:
         run: pytest tests/test_cookbook.py -q
       - name: Build site (strict — warnings are errors)
         run: mkdocs build --strict
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@v5
         with:
           path: site
 
@@ -59,6 +62,6 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - uses: actions/configure-pages@v5
+      - uses: actions/configure-pages@v6
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/publish.yml

@@ -43,9 +43,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 
@@ -95,7 +95,7 @@ jobs:
       - name: Twine check
         run: twine check dist/*
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v6
         with:
           name: python-package-distributions
           path: dist/
@@ -117,7 +117,7 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v7
         with:
           name: python-package-distributions
           path: dist/
@@ -146,7 +146,7 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v7
         with:
           name: python-package-distributions
           path: dist/
@@ -178,7 +178,7 @@ jobs:
       CONCEPT_RECID: "21536448"
       ZENODO_TOKEN: ${{ secrets.ZENODO_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 

CHANGELOG.md

@@ -6,6 +6,15 @@ All notable changes to the **biology-as-code** Python package are documented her
 
 ### Changed
 
+- **CI practice flow** (QA pass, 2026-09-07). Every action pin was two majors
+  behind and emitting Node 20 deprecation notices on green runs; bumped, and a
+  Dependabot config now keeps them current with PRs against `dev`. CI runs
+  `scripts/check_pathway_integration.py`, which CONTRIBUTING had required
+  without enforcing. Docs build on pushes to `dev`, not only on PRs. A default
+  pull-request template, a `ci-required` ruleset on `main` and `dev`, and a
+  CONTRIBUTING section on hotfix sync-back and releasing. `release_check.sh`
+  was pinned to `0.1.0` and ran three test files; it now reads the version from
+  `pyproject.toml` and runs the suite.
 - **Zenodo job refuses to publish outside our concept chain** (`publish.yml`): the
   release deposit now checks that the target record belongs to concept
   `10.5281/zenodo.21536448` before it uploads, so a mis-set token or a fresh deposit

CODE_OF_CONDUCT.md

@@ -0,0 +1,138 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+### One standard specific to this project
+
+Disagreement about evidence is welcome and is the point of the register. Argue
+with the source, the method, or the number. Do not argue with the person, and do
+not attribute motive. A claim that a contributor invented a figure is a serious
+accusation; raise it privately with the maintainer with the evidence attached.
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official email address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the maintainer at paulmorf@morfengineering.tech. All complaints will
+be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at
+[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at
+[https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations