fix: nightly hardening - config semantic validation

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,53 @@
+name: Bug report
+description: Something is broken, crashing, or returning the wrong result
+labels: ["bug"]
+body:
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: What did you do, what did you expect, what did you get instead?
+      placeholder: |
+        1. I ran `frugal serve`
+        2. I sent a chat completion with `X-Frugal-Use-Case: research-synthesis`
+        3. I expected routing to Claude Sonnet 4, got GPT-4o-mini
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: frugal version
+      description: Output of `frugal --version`
+      placeholder: "v0.0.1"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: os
+    attributes:
+      label: OS
+      options:
+        - macOS (Apple silicon)
+        - macOS (Intel)
+        - Linux (amd64)
+        - Linux (arm64)
+        - Other (describe below)
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs or explain output
+      description: |
+        Run with `FRUGAL_LOG_LEVEL=debug` and/or hit `/v1/routing/explain` after
+        the failing request. Paste relevant lines here. Redact any API keys.
+      render: text
+
+  - type: textarea
+    id: config
+    attributes:
+      label: Config (optional)
+      description: Any non-default env vars or edits to `~/.frugal/config/models.yaml`
+      render: text

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/brainsparker/frugal/security/advisories/new
+    about: Report security issues privately via GitHub Security Advisories. See SECURITY.md for the full disclosure policy.
+  - name: Question or discussion
+    url: https://github.com/brainsparker/frugal/discussions
+    about: For open-ended questions, design discussions, or "how do I…" — use Discussions, not Issues.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,35 @@
+name: Feature request
+description: Suggest a new capability, use case, provider, or quality-of-life improvement
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem
+      description: What can't you do today, or what's harder than it should be?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed direction
+      description: |
+        Rough shape of the solution. Bullet points are fine. Concrete is better
+        than abstract — API shape, CLI flag, config key, etc.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: What workarounds exist today? Why are they insufficient?
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Context
+      description: |
+        Anything else worth knowing — use case, prior art in other tools,
+        whether you'd be open to contributing a PR.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,28 @@
+<!--
+Title format: type(scope): summary
+  e.g.  feat(usecase): route chat by use case via X-Frugal-Use-Case
+        fix(install): serve install.sh from docs/
+        chore(deploy): pin wrangler.jsonc for Cloudflare Workers Assets
+-->
+
+## What
+
+<!-- One or two sentences. What changed? -->
+
+## Why
+
+<!-- The motivating problem or the user-visible benefit. Link issues or
+     prior discussion if relevant. -->
+
+## How to verify
+
+<!--
+- [ ] `make test` passes
+- [ ] Manually ran ...
+- [ ] Hit endpoint X and got Y
+-->
+
+## Notes for reviewers
+
+<!-- Anything non-obvious: tradeoffs considered, alternatives rejected,
+     follow-ups this PR explicitly doesn't do. Optional. -->

.github/workflows/ci.yml

@@ -0,0 +1,51 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+          cache: true
+
+      - name: Build
+        run: go build ./...
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Test
+        run: go test -race ./...
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+          cache: true
+
+      - name: Install staticcheck
+        run: go install honnef.co/go/tools/cmd/staticcheck@latest
+
+      - name: Staticcheck
+        run: staticcheck ./...
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+
+      - name: Govulncheck
+        run: govulncheck ./...

.github/workflows/dco.yml

@@ -0,0 +1,16 @@
+name: DCO
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dco:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check Developer Certificate of Origin sign-off
+        uses: tim-actions/[email protected]

.github/workflows/install-smoke.yml

@@ -0,0 +1,110 @@
+name: install-smoke
+
+# Runs the real, public installer end-to-end on fresh runners after every
+# release. Finds the "works on my Mac" class of regressions before a user does.
+#
+# Also runs on workflow_dispatch so you can re-test without cutting a release.
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  curl-pipe-sh:
+    name: ${{ matrix.os }} / curl | bash
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Install via public URL
+        env:
+          FRUGAL_YES: "1"
+          # Authenticate the releases/latest API call so shared runner IPs
+          # don't 403 against the 60/hr anonymous rate limit.
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          curl -fsSL https://frugal.sh/install | bash
+
+      - name: Binary runs and reports a version
+        run: |
+          set -euo pipefail
+          "$HOME/.frugal/bin/frugal" --version
+
+      - name: Shell rc block was written
+        run: |
+          set -euo pipefail
+          found=0
+          for rc in "$HOME/.zshrc" "$HOME/.bashrc" "$HOME/.bash_profile"; do
+            if [ -f "$rc" ] && grep -qxF "# >>> frugal.sh >>>" "$rc"; then
+              echo "marker block present in $rc"
+              found=1
+              break
+            fi
+          done
+          if [ "$found" -ne 1 ]; then
+            echo "no shell rc got the frugal.sh marker block" >&2
+            exit 1
+          fi
+
+      - name: Uninstall is clean
+        run: |
+          set -euo pipefail
+          curl -fsSL https://frugal.sh/install | bash -s uninstall
+          if [ -d "$HOME/.frugal" ]; then
+            echo "$HOME/.frugal still exists after uninstall" >&2
+            exit 1
+          fi
+          for rc in "$HOME/.zshrc" "$HOME/.bashrc" "$HOME/.bash_profile"; do
+            if [ -f "$rc" ] && grep -qxF "# >>> frugal.sh >>>" "$rc"; then
+              echo "marker block still in $rc after uninstall" >&2
+              exit 1
+            fi
+          done
+
+  pinned-version:
+    name: ${{ matrix.os }} / FRUGAL_VERSION pin
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Derive tag
+        id: tag
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [ "${{ github.event_name }}" = "release" ]; then
+            echo "value=${{ github.event.release.tag_name }}" >> "$GITHUB_OUTPUT"
+          else
+            # Manual re-runs pin to whatever is currently latest.
+            latest="$(curl -fsSL -H "Authorization: Bearer $GITHUB_TOKEN" \
+              https://api.github.com/repos/${{ github.repository }}/releases/latest \
+              | grep '"tag_name"' | head -n1 | sed -E 's/.*"tag_name"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/')"
+            echo "value=$latest" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Install pinned version
+        env:
+          FRUGAL_YES: "1"
+          FRUGAL_VERSION: ${{ steps.tag.outputs.value }}
+        run: |
+          curl -fsSL https://frugal.sh/install | bash
+
+      - name: Binary reports the pinned version
+        run: |
+          set -euo pipefail
+          got="$("$HOME/.frugal/bin/frugal" --version)"
+          want="${{ steps.tag.outputs.value }}"
+          echo "got:  $got"
+          echo "want: $want"
+          case "$got" in
+            *"$want"*) echo "version matches" ;;
+            *)         echo "version mismatch" >&2; exit 1 ;;
+          esac

.github/workflows/release.yml

@@ -7,6 +7,7 @@ on:
 
 permissions:
   contents: write
+  id-token: write # required for keyless cosign via GitHub OIDC
 
 jobs:
   release:
@@ -16,14 +17,32 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.23"
+          go-version: "1.25"
 
       - name: Run tests
         run: go test ./...
 
       - name: Build release binaries
         run: make release
 
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3
+
+      - name: Sign binaries and checksums (keyless)
+        run: |
+          set -euo pipefail
+          cd dist
+          for f in frugal-* SHA256SUMS; do
+            cosign sign-blob --yes --bundle "${f}.sig" "${f}"
+          done
+
+      - name: Generate SBOMs (CycloneDX)
+        uses: anchore/sbom-action@v0
+        with:
+          path: .
+          format: cyclonedx-json
+          output-file: dist/frugal.cdx.json
+
       - name: Create GitHub release
         uses: softprops/action-gh-release@v2
         with:

.gitignore

@@ -0,0 +1,15 @@
+# Binaries
+/bin/
+/dist/
+
+# Go build outputs and local envs
+/frugal
+*.test
+
+# Wrangler (Cloudflare Workers Assets) local state.
+# The committed wrangler.jsonc is the source of truth; everything below is
+# generated per-machine or per-CI-run.
+.wrangler/
+.dev.vars
+wrangler-*.log
+node_modules/

ADOPTERS.md

@@ -0,0 +1,9 @@
+# Adopters
+
+Teams and individuals running Frugal in production. If that's you and you're willing to be listed, open a PR adding yourself.
+
+| Organization / Handle | Use case |
+|---|---|
+| _(be the first)_ | |
+
+Interested in being a design partner — running Frugal on a real workload with hands-on support in exchange for feedback — open an issue titled `design partner: <your use case>`.