Establish Gloss-maintained BabelDOC downstream

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @SunChJ

.github/ISSUE_TEMPLATE/bug_report.yaml

@@ -13,7 +13,7 @@ body:
           required: true
         - label: I confirmed this is not caused by a network issue
           required: true
-        - label: I have fully read and understood the [README](https://github.com/funstory-ai/BabelDOC/blob/main/README.md)
+        - label: I have fully read and understood the [README](https://github.com/SunChJ/BabelDOC/blob/main/README.md) and [downstream scope](https://github.com/SunChJ/BabelDOC/blob/main/DOWNSTREAM.md)
           required: true
         - label: I am certain that this issue is with BabelDOC itself and can be reproduced through the BabelDOC cli
           required: true
@@ -49,7 +49,7 @@ body:
       value: |
         - OS:
         - Python:
-        - BabelDOC:
+        - Gloss BabelDOC runtime:
       render: markdown
     validations:
       required: true

.github/ISSUE_TEMPLATE/feature_request.yaml

@@ -14,7 +14,7 @@ body:
       options:
         - label: I have searched existing issues
           required: true
-        - label: I have fully read and understood the [README](https://github.com/funstory-ai/BabelDOC/blob/main/README.md)
+        - label: I have fully read and understood the [README](https://github.com/SunChJ/BabelDOC/blob/main/README.md) and [downstream scope](https://github.com/SunChJ/BabelDOC/blob/main/DOWNSTREAM.md)
           required: true
         - label: This feature is not related to BabelDOC CLI. The CLI is only used for debugging purposes, we do not accept any feature requests related to the CLI.
           required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -36,7 +36,7 @@
 
 ### Contributor Checklist
 
-- [ ] I have fully read and understood the **[CONTRIBUTING.md](https://funstory-ai.github.io/BabelDOC/CONTRIBUTING/)** guide.
+- [ ] I have fully read and understood the **[downstream maintenance guide](https://github.com/SunChJ/BabelDOC/blob/main/DOWNSTREAM.md)**.
 - [ ] I have performed a self-review of my own code.
 - [ ] My changes follow the project's code style and guidelines
 - [ ] I have linked the related issue(s) in the description above (if applicable)
@@ -62,4 +62,4 @@
 
 ### Additional Notes
 
-<!-- Is there anything else the reviewer should know? For example, any dependencies, or potential impacts. --> 
+<!-- Is there anything else the reviewer should know? For example, any dependencies, or potential impacts. -->

.github/PULL_REQUEST_TEMPLATE/pr_form.yml

@@ -52,7 +52,7 @@ body:
     attributes:
       label: Contributor Checklist
       options:
-        - label: I’ve fully read and understood the **[CONTRIBUTING.md](https://funstory-ai.github.io/BabelDOC/CONTRIBUTING/)** guide
+        - label: I’ve fully read and understood the **[downstream maintenance guide](https://github.com/SunChJ/BabelDOC/blob/main/DOWNSTREAM.md)**
           required: true
         - label: My changes follow the project’s code style and guidelines
           required: true

.github/workflows/checks.yml

@@ -2,23 +2,25 @@ name: Checks
 
 on:
   push:
+    branches: ["main"]
   pull_request:
     branches: ["main"]
+  workflow_dispatch:
 
 permissions:
   contents: read
 
 jobs:
-  checks:
-    name: Package and lightweight PDF smoke
+  quality:
+    name: Quality and PDF smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           persist-credentials: false
 
       - name: Cache BabelDOC assets
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: ~/.cache/babeldoc
           key: babeldoc-assets-${{ hashFiles('babeldoc/assets/embedding_assets_metadata.py') }}
@@ -32,18 +34,19 @@ jobs:
           activate-environment: true
 
       - name: Install dependencies
-        run: uv sync
+        run: uv sync --frozen
 
       - name: Lint
         run: uv run ruff check .
 
-      - name: Build package
-        run: uv build
+      - name: Unit tests
+        run: uv run pytest -q
 
-      - name: Import and CLI smoke
-        run: |
-          uv run python -m compileall babeldoc
-          uv run babeldoc --help
+      - name: Build distributions
+        run: uv build --wheel --sdist
+
+      - name: Import smoke
+        run: uv run python -m compileall babeldoc
 
       - name: Lightweight no-secret PDF E2E
         run: |
@@ -53,3 +56,46 @@ jobs:
             --files examples/ci/test.pdf \
             --only-parse-generate-pdf \
             --skip-scanned-detection
+
+  wheel-smoke:
+    name: Wheel smoke (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-14]
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+
+      - name: Setup uv with Python 3.12
+        uses: astral-sh/setup-uv@85856786d1ce8acfbcc2f13a5f3fbd6b938f9f41 # v7.1.2
+        with:
+          python-version: "3.12"
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+
+      - name: Build wheel
+        run: uv build --wheel
+
+      - name: Install wheel into a clean environment
+        shell: bash
+        run: |
+          uv venv --python 3.12 .wheel-venv
+          uv pip install --python .wheel-venv/bin/python dist/*.whl
+
+      - name: Validate runtime handshake
+        shell: bash
+        run: |
+          .wheel-venv/bin/gloss-babeldoc runtime-info --json \
+            | .wheel-venv/bin/python -c '
+          import json
+          import sys
+          from importlib.metadata import version
+
+          payload = json.load(sys.stdin)
+          assert payload["runtime"]["version"] == version("BabelDOC")
+          assert payload["runtime_api_version"] == 1
+          assert payload["upstream"]["version"] == "0.6.4"
+          '

.github/workflows/codeql.yml

@@ -13,6 +13,7 @@ name: "CodeQL Advanced"
 
 on:
   push:
+    branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
   schedule:
@@ -55,11 +56,11 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -87,6 +88,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
       with:
         category: "/language:${{matrix.language}}"