Sync with opengeos/RustGIS main

.dockerignore

@@ -0,0 +1,16 @@
+# Kept out of the Dockerfile's build context: build output, local state and secrets. The Dockerfile
+# itself is read separately, so leaving it out means editing it doesn't rebuild the app.
+/target
+/dist
+/site
+/plan
+/private
+# Every dot-file and dot-folder at the root (.git, .github, editors' and tools' local state) but
+# .cargo, which holds the `cargo xtask` alias the build uses; and .env files at any depth.
+/.*
+!/.cargo
+**/.env
+**/.env.*
+**/__pycache__
+**/.DS_Store
+Dockerfile

.github/dependabot.yml

@@ -49,6 +49,22 @@ updates:
           - minor
           - patch
 
+  # The base images of the Docker images (the web app's Dockerfile at the root, the command line's
+  # in packaging/docker), pinned by tag and digest.
+  - package-ecosystem: docker
+    directories:
+      - "/"
+      - "/packaging/docker"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 2
+    groups:
+      docker-minor-patch:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
+
   # GitHub Actions used by the workflows in .github/workflows/.
   - package-ecosystem: github-actions
     directory: "/"

.github/pull_request_template.md

@@ -6,6 +6,11 @@
 
 <!-- How did you verify it? e.g. `cargo xtask ci`, new tests, a `ui_shot` screenshot, manual steps. -->
 
+## UI evidence
+
+<!-- For substantial visible UI changes, include screenshots (before/after where useful).
+     Omit this section if there is no visible UI change. -->
+
 ## Related issue
 
 <!-- e.g. Closes #123, or Part of #456. -->

.github/workflows/ci.yml

@@ -51,6 +51,36 @@ jobs:
       - name: Build for the browser
         run: cargo build --locked --target wasm32-unknown-unknown -p rustgis-web
 
+  # Every dependency's licence must be one the project accepts (deny.toml). The third-party
+  # notices the packages ship (`cargo xtask notices`) only warn here when out of date, since
+  # Dependabot can't regenerate them; the release build requires them current.
+  licenses:
+    name: Licences
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with:
+          # Only main saves the cache (see test-rust.yml).
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-deny,cargo-about@0.9.2
+      - name: Dependency licences
+        run: cargo deny --locked check licenses
+      - name: Third-party notices
+        # Exit code 2 is stale notices (a warning); anything else (cargo-about failing, a licence
+        # it can't work out) fails the job.
+        run: |
+          status=0
+          cargo xtask notices --check || status=$?
+          if [ "$status" -eq 2 ]; then
+            echo "::warning::THIRD-PARTY-LICENSES.txt is out of date: run cargo xtask notices and commit it before the next release."
+          elif [ "$status" -ne 0 ]; then
+            exit "$status"
+          fi
+
   plan:
     name: Platforms
     runs-on: ubuntu-latest

.github/workflows/claude-code-review.yml

@@ -360,7 +360,7 @@ jobs:
         # does not strand us on an old version. When it bumps, re-read the
         # action's release notes for changes to the scrub, MCP wiring, or the
         # `execution_file` contract that the summary step below parses.
-        uses: anthropics/claude-code-action@a26b07d8c778b0c43f64618e5fd29fd0f8af72e8 # v1 (Claude Code 2.1.220)
+        uses: anthropics/claude-code-action@16f9f71ab9c490faf367f94dd294897edc25be33 # v1 (Claude Code 2.1.220)
         with:
           # Use the workflow's GITHUB_TOKEN for GitHub API calls instead of the
           # default OIDC -> Claude GitHub App token exchange. That exchange
@@ -417,6 +417,7 @@ jobs:
           # comes from the checkout plus `pr-context/`; output goes through the
           # inline-comment MCP server and the final message. See the header.
           claude_args: |
+            --model claude-haiku-5-5
             --allowedTools "Read,Grep,Glob,mcp__github_inline_comment__create_inline_comment"
           # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
           # or https://code.claude.com/docs/en/cli-reference for available options