Prepare 0.2.0 for public release

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,78 @@
+name: Bug report
+description: Something in the library behaves incorrectly
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to file a report. If this is a **security**
+        issue, please use private reporting instead — see [SECURITY.md](../blob/main/SECURITY.md).
+
+  - type: textarea
+    id: summary
+    attributes:
+      label: What happened?
+      description: What did you expect, and what did you get instead?
+      placeholder: |
+        Evaluating a channel with HandleMode::Flat at t=... returns ..., but I expected ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: repro
+    attributes:
+      label: Reproduction
+      description: >
+        The smallest program that shows the problem. A few lines using
+        `anim::Animation` and `create_keyframe` is usually enough, and it
+        will be rendered as C++ automatically.
+      render: cpp
+      placeholder: |
+        #include <anim.hpp>
+
+        int main() {
+            anim::Animation animation("repro");
+            anim::Channel& channel = animation.create_channel("value");
+            channel.create_keyframe(0.0, 0.0);
+            channel.create_keyframe(1.0, 1.0);
+            // ...
+        }
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Release tag or commit SHA.
+      placeholder: "v0.2.0, or 1a2b3c4"
+    validations:
+      required: true
+
+  - type: input
+    id: environment
+    attributes:
+      label: Compiler and platform
+      placeholder: "MSVC 2022 / Windows 11, GCC 13 / Ubuntu 24.04, AppleClang 16 / macOS 15"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: build_type
+    attributes:
+      label: Build configuration
+      options:
+        - Release
+        - Debug
+        - RelWithDebInfo
+        - Other / not sure
+    validations:
+      required: true
+
+  - type: textarea
+    id: notes
+    attributes:
+      label: Anything else?
+      description: Stack traces, sanitizer output, or a failing test case.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: API documentation
+    url: https://actualize-interactive.github.io/anim/
+    about: The full API reference and guide — worth checking before filing.
+  - name: Report a security vulnerability
+    url: https://github.com/Actualize-Interactive/anim/security/advisories/new
+    about: Please report security issues privately, not as a public issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,32 @@
+name: Feature request
+description: Suggest a capability or API addition
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem would this solve?
+      description: >
+        Describe the use case rather than the implementation. What are you
+        trying to do that the library makes hard or impossible today?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed API
+      description: >
+        If you have a shape in mind, sketch it. Additive changes are much
+        easier to accept than changes to existing public signatures.
+      render: cpp
+    validations:
+      required: false
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Anything you tried, or workarounds you are using now.
+    validations:
+      required: false

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,31 @@
+<!--
+Thanks for contributing! Please keep PRs focused — one logical change per PR.
+See CONTRIBUTING.md for build, test, and style expectations.
+-->
+
+## What does this change?
+
+<!-- A short description, and the issue it closes (e.g. "Closes #12"). -->
+
+## Why?
+
+<!-- The motivation or use case. For a bug fix, what was going wrong. -->
+
+## Checklist
+
+- [ ] The build and full test suite pass locally (`./build.sh` or `.\build.ps1`).
+- [ ] New or changed behavior is covered by tests.
+- [ ] Public API changes are documented with Doxygen comments in `include/`.
+- [ ] Naming follows the conventions in CONTRIBUTING.md (PascalCase types and
+      enumerators, lower_snake_case functions and variables).
+- [ ] `CHANGELOG.md` has an entry under `[Unreleased]`, if user-visible.
+
+## Breaking changes
+
+<!--
+Public interfaces are meant to be stable. If this changes an existing public
+signature or its contract, describe the break and what callers must do. Write
+"None" otherwise.
+-->
+
+None

.github/dependabot.yml

@@ -0,0 +1,29 @@
+version: 2
+
+updates:
+  # Keep the workflow actions current. The repository has no package-manager
+  # manifest for Dependabot to track: C++ dependencies (Catch2, GLFW, ImGui,
+  # ImPlot, glad) are pinned as FetchContent git tags in CMakeLists.txt, which
+  # Dependabot cannot parse, so those are bumped by hand.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    commit-message:
+      prefix: "ci"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  # Documentation toolchain (Sphinx, Breathe, Exhale, the RTD theme).
+  - package-ecosystem: "pip"
+    directory: "/docs/sphinx"
+    schedule:
+      interval: "monthly"
+    commit-message:
+      prefix: "docs"
+    groups:
+      sphinx:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -7,10 +7,8 @@ on:
     branches: [ main ]
   workflow_dispatch:
 
-# checkout/cache still ship on Node.js 20; opt their JS actions into Node 24
-# ahead of the forced cutover (2026-06-02). Remove once the actions ship Node 24.
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+permissions:
+  contents: read
 
 jobs:
   build:
@@ -22,24 +20,24 @@ jobs:
       fail-fast: false
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Setup cmake
-      uses: lukka/get-cmake@latest
+      uses: lukka/get-cmake@v4.4.0
       with:
-        cmakeVersion: '3.26.0'
+        cmakeVersion: '4.4.0'
 
     - name: Cache CMake Build
-      uses: actions/cache@v4
+      uses: actions/cache@v6
       with:
         path: |
           build
           ~/.ccache
           ~/Library/Caches/ccache # macOS
           ~\AppData\Local\ccache  # Windows
-        key: ${{ runner.os }}-cmake-${{ hashFiles('**/CMakeLists.txt') }}
+        key: ${{ runner.os }}-cmake4.4.0-${{ hashFiles('**/CMakeLists.txt') }}
         restore-keys: |
-          ${{ runner.os }}-cmake-
+          ${{ runner.os }}-cmake4.4.0-
 
     - name: Install system dependencies (Ubuntu)
       if: matrix.os == 'ubuntu-latest'

.github/workflows/docs.yml

@@ -18,19 +18,14 @@ concurrency:
   group: pages
   cancel-in-progress: false
 
-# checkout still ships on Node.js 20; opt JS actions into Node 24 ahead of the
-# forced cutover (2026-06-02). Remove once the actions ship Node 24.
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: '3.x'
 
@@ -46,7 +41,7 @@ jobs:
         run: bash docs/build_docs.sh
 
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: docs/build/html
 
@@ -61,4 +56,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/release.yml

@@ -6,10 +6,8 @@ on:
       - 'v*.*.*'
   workflow_dispatch:
 
-# checkout/cache still ship on Node.js 20; opt their JS actions into Node 24
-# ahead of the forced cutover (2026-06-02). Remove once the actions ship Node 24.
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+permissions:
+  contents: read
 
 jobs:
   # Build and test on every platform as the release gate.
@@ -22,26 +20,26 @@ jobs:
     timeout-minutes: 15
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
 
     - name: Setup cmake
-      uses: lukka/get-cmake@latest
+      uses: lukka/get-cmake@v4.4.0
       with:
-        cmakeVersion: '3.26.0'
+        cmakeVersion: '4.4.0'
 
     - name: Cache CMake Build
-      uses: actions/cache@v4
+      uses: actions/cache@v6
       with:
         path: |
           build
           ~/.ccache
           ~/Library/Caches/ccache # macOS
           ~\AppData\Local\ccache  # Windows
-        key: ${{ runner.os }}-cmake-${{ hashFiles('**/CMakeLists.txt') }}
+        key: ${{ runner.os }}-cmake4.4.0-${{ hashFiles('**/CMakeLists.txt') }}
         restore-keys: |
-          ${{ runner.os }}-cmake-
+          ${{ runner.os }}-cmake4.4.0-
 
     - name: Install system dependencies (Ubuntu)
       if: matrix.os == 'ubuntu-latest'
@@ -66,15 +64,15 @@ jobs:
     permissions:
       contents: write
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     # One platform-independent, buildable source archive (headers + sources +
     # CMake config). GitHub also attaches auto-generated "Source code" archives.
     - name: Package source archive
-      run: zip -r anim-${{ github.ref_name }}-src.zip include src cmake CMakeLists.txt README.md LICENSE CONTRIBUTING.md
+      run: zip -r anim-${{ github.ref_name }}-src.zip include src cmake CMakeLists.txt README.md LICENSE CONTRIBUTING.md CHANGELOG.md
 
     - name: Create Release
-      uses: softprops/action-gh-release@v2
+      uses: softprops/action-gh-release@v3
       with:
         files: anim-${{ github.ref_name }}-src.zip
         name: Release ${{ github.ref_name }}

.gitignore

@@ -43,13 +43,17 @@ cmake-build-*/
 *.swp
 *~
 
-# CMake generated files
+# CMake generated files (from an accidental in-source build; out-of-source
+# artifacts are already covered by the build directory rules above).
+# Listed by name rather than as *.cmake so hand-written modules under cmake/
+# are not silently ignored.
 CMakeCache.txt
 CMakeFiles/
 cmake_install.cmake
+CTestTestfile.cmake
+CPackConfig.cmake
+CPackSourceConfig.cmake
 Makefile
-*.cmake
-!anim-config.cmake.in
 
 # Generated test outputs
 Testing/