Prepare 0.4.0 for public release

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,94 @@
+name: Bug report
+description: The operator behaves incorrectly in TouchDesigner
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to file a report. If this is a **security**
+        issue, please use private reporting instead — see [SECURITY.md](../blob/main/SECURITY.md).
+
+  - type: textarea
+    id: summary
+    attributes:
+      label: What happened?
+      description: What did you expect, and what did you get instead?
+      placeholder: |
+        Tasks added with add_task() stop running after the Reset pulse, but I expected ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: repro
+    attributes:
+      label: Reproduction
+      description: >
+        The smallest script that shows the problem, run against an AsyncioDAT
+        operator. It will be rendered as Python automatically. If it needs a
+        `.toe` to reproduce, attach a minimal one as well.
+      render: python
+      placeholder: |
+        import asyncio
+
+        adat = op('Asyncio1')
+
+        async def repro():
+            await asyncio.sleep(1.0)
+            print("done")
+
+        adat.add_task(repro())
+    validations:
+      required: true
+
+  - type: textarea
+    id: status
+    attributes:
+      label: Operator status output
+      description: >
+        The rows from the AsyncioDAT operator's status table, plus anything
+        relevant from the textport.
+    validations:
+      required: false
+
+  - type: input
+    id: version
+    attributes:
+      label: AsyncioDAT version
+      description: Release tag, or the commit SHA you built from.
+      placeholder: "v0.4.0, or 1a2b3c4"
+    validations:
+      required: true
+
+  - type: input
+    id: td_version
+    attributes:
+      label: TouchDesigner version
+      placeholder: "2025.32820"
+    validations:
+      required: true
+
+  - type: input
+    id: environment
+    attributes:
+      label: Platform
+      placeholder: "Windows 11, or macOS 15 (Apple Silicon)"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: origin
+    attributes:
+      label: How did you get the operator?
+      options:
+        - Downloaded a release asset
+        - Built from source
+    validations:
+      required: true
+
+  - type: textarea
+    id: notes
+    attributes:
+      label: Anything else?
+      description: Stack traces, crash dumps, or a failing test case.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Usage, parameters, and the Python API
+    url: https://github.com/Actualize-Interactive/AsyncioDAT#readme
+    about: The README covers installation, every parameter, and the full Python API — worth checking before filing.
+  - name: Report a security vulnerability
+    url: https://github.com/Actualize-Interactive/AsyncioDAT/security/advisories/new
+    about: Please report security issues privately, not as a public issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,37 @@
+name: Feature request
+description: Suggest a capability, parameter, or API addition
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem would this solve?
+      description: >
+        Describe the use case rather than the implementation. What are you
+        trying to do in TouchDesigner that the operator makes hard or
+        impossible today?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed API
+      description: >
+        If you have a shape in mind, sketch it — a Python method, a getset, an
+        operator parameter, or a callback. Additive changes are much easier to
+        accept than changes to existing signatures or parameter names, which
+        break saved `.toe` files.
+      render: python
+    validations:
+      required: false
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: >
+        Anything you tried, or workarounds you are using now — including
+        whether it can already be done through `get_event_loop()`.
+    validations:
+      required: false

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,42 @@
+<!--
+Thanks for contributing! Please keep PRs focused — one logical change per PR.
+See CONTRIBUTING.md for build, test, and style expectations.
+-->
+
+## What does this change?
+
+<!-- A short description, and the issue it closes (e.g. "Closes #12"). -->
+
+## Why?
+
+<!-- The motivation or use case. For a bug fix, what was going wrong. -->
+
+## How was it tested?
+
+<!--
+Which suites you ran, and on what. The unit suites run anywhere; the
+TouchDesigner integration suite needs a local install. State your
+TouchDesigner version if you ran it.
+-->
+
+## Checklist
+
+- [ ] The project builds on my platform (`.\build.ps1` or `./build.sh`).
+- [ ] The unit suites pass (`cmake --workflow --preset dev`).
+- [ ] The TouchDesigner integration suite passes, or is not affected
+      (`.\run_td_tests.ps1` / `./run_td_tests.sh`).
+- [ ] New or changed behavior is covered by tests.
+- [ ] `README.md` / `TESTING.md` updated for any change to parameters, the
+      Python API, or the callbacks.
+- [ ] `CHANGELOG.md` has an entry under `[Unreleased]`, if user-visible.
+
+## Breaking changes
+
+<!--
+Operator parameter names and the Python API are meant to be stable — renaming a
+parameter breaks every saved .toe that uses it. If this changes an existing
+name or contract, describe the break and what users must do. Write "None"
+otherwise.
+-->
+
+None

.github/dependabot.yml

@@ -0,0 +1,29 @@
+version: 2
+
+updates:
+  # Keep the workflow actions current. The only package-manager manifest in the
+  # repository is the pytest requirements file below: the C++ dependency
+  # (toml11) is pinned as a FetchContent git tag in CMakeLists.txt, which
+  # Dependabot cannot parse, so it is bumped by hand.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    commit-message:
+      prefix: "ci"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  # Test-only Python dependencies (pytest and friends).
+  - package-ecosystem: "pip"
+    directory: "/tests/python"
+    schedule:
+      interval: "monthly"
+    commit-message:
+      prefix: "test"
+    groups:
+      pytest:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -5,73 +5,67 @@ on:
     branches: [ main ]
   pull_request:
     branches: [ main ]
+  workflow_dispatch:
 
-# Some third-party JS actions (e.g. setup-cmake) still ship on Node.js 20; opt
-# their JS actions into Node 24 ahead of the forced cutover (2026-06-02).
-# Remove once all actions ship Node 24.
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+permissions:
+  contents: read
 
 jobs:
   build:
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
     strategy:
-      fail-fast: false
       matrix:
         os: [windows-latest, macos-latest]
-        build_type: [Release]
-
-    runs-on: ${{ matrix.os }}
+      fail-fast: false
 
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
-    - name: Setup CMake
-      uses: jwlawson/actions-setup-cmake@v2
+    - name: Setup cmake
+      uses: lukka/get-cmake@v4.4.0
       with:
-        cmake-version: '3.25'
+        cmakeVersion: '4.4.0'
 
     # TouchDesigner embeds CPython 3.11, so we build against 3.11. setup-python
-    # provides the headers + import library that CMake's Development.Module
-    # component needs (Python itself is not vendored in the repo).
+    # provides the headers and import library that CMake's Development.Module
+    # component needs (Python itself is not vendored in the repository).
     - name: Setup Python 3.11
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v7
       with:
         python-version: '3.11'
 
     - name: Configure CMake
       run: >
-        cmake -B build
-        -DCMAKE_BUILD_TYPE=${{ matrix.build_type }}
+        cmake -B build -S .
+        -DCMAKE_BUILD_TYPE=Release
         -DPython3_ROOT_DIR="${{ env.pythonLocation }}"
         -DASYNCIODAT_BUILD_TESTS=ON
 
-    - name: Build project
-      run: cmake --build build --config ${{ matrix.build_type }}
-
-    - name: List build outputs
-      shell: bash
-      run: ls -R build/bin
+    - name: Build
+      run: cmake --build build --config Release --parallel 2
 
-    # Unit tests (Catch2 + pytest) — no TouchDesigner required.
+    # tests/cpp (Catch2) and tests/python (pytest) only — the tests/td
+    # integration suite needs a licensed TouchDesigner and a GPU, so it runs
+    # locally via run_td_tests.ps1 / run_td_tests.sh instead.
     - name: Install test dependencies
       run: python -m pip install --upgrade pip -r tests/python/requirements.txt
 
-    - name: Run unit tests
-      run: ctest --test-dir build -C ${{ matrix.build_type }} --output-on-failure
+    - name: Test
+      run: ctest --test-dir build -C Release --output-on-failure
 
     - name: Upload build artifact (Windows)
       if: runner.os == 'Windows'
       uses: actions/upload-artifact@v7
       with:
-        name: AsyncioDAT-windows-${{ matrix.build_type }}
-        path: build/bin/${{ matrix.build_type }}/AsyncioDAT.dll
+        name: AsyncioDAT-windows
+        path: build/bin/Release/AsyncioDAT.dll
         if-no-files-found: error
 
     - name: Upload build artifact (macOS)
       if: runner.os == 'macOS'
       uses: actions/upload-artifact@v7
       with:
-        name: AsyncioDAT-macos-${{ matrix.build_type }}
+        name: AsyncioDAT-macos
         path: build/bin/AsyncioDAT.plugin
         if-no-files-found: error