Complete adoption and accessibility hardening

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,79 @@
+name: Bug report
+description: Report a reproducible generator, CLI, or generated-code problem
+title: "[bug]: "
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the report. Remove secrets and reduce private specifications to the smallest OpenAPI fragment that still fails.
+  - type: input
+    id: version
+    attributes:
+      label: Version or commit
+      description: Output of `openapi-to-rust --version`, or the commit SHA.
+      placeholder: openapi-to-rust 0.6.0
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Affected area
+      options:
+        - CLI or configuration
+        - Generated models
+        - Generated HTTP client
+        - Generated SSE client
+        - Generated Axum server
+        - Packaging or installation
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: spec
+    attributes:
+      label: Minimal OpenAPI fragment
+      description: Paste YAML or JSON, or link to a public stable document.
+      render: yaml
+    validations:
+      required: true
+  - type: textarea
+    id: config
+    attributes:
+      label: Configuration and command
+      description: Include relevant TOML and the exact command. Redact credentials.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: behavior
+    attributes:
+      label: Actual behavior
+      description: Include the complete error and the relevant generated signature or wire output.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: OS, `rustc --version`, and installation method.
+      placeholder: macOS 15; rustc 1.88.0; cargo install --locked
+    validations:
+      required: true
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I removed credentials and private API data.
+          required: true
+        - label: I searched existing issues for this behavior.
+          required: true
+        - label: This is not a security vulnerability.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Usage questions and design discussion
+    url: https://github.com/gpu-cli/openapi-to-rust/discussions
+    about: Ask for help or explore an idea before filing a concrete issue.
+  - name: Private security report
+    url: https://github.com/gpu-cli/openapi-to-rust/security/advisories/new
+    about: Report suspected vulnerabilities privately; never include them in a public issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,52 @@
+name: Feature request
+description: Propose a concrete OpenAPI, generator, or ergonomics improvement
+title: "[feature]: "
+labels: [enhancement]
+body:
+  - type: textarea
+    id: use_case
+    attributes:
+      label: Use case
+      description: What are you trying to generate or build, and why is the current output insufficient?
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - OpenAPI or JSON Schema support
+        - Generated models
+        - Generated HTTP or SSE client
+        - Generated Axum server
+        - CLI and configuration
+        - Packaging, docs, or integrations
+    validations:
+      required: true
+  - type: textarea
+    id: spec
+    attributes:
+      label: Representative OpenAPI fragment
+      description: Show the smallest wire shape or operation that motivates the request, when applicable.
+      render: yaml
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Desired generated API or behavior
+      description: Include a small Rust sketch when the request changes generated code.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Describe current workarounds and compatibility tradeoffs.
+  - type: checkboxes
+    id: compatibility
+    attributes:
+      label: Compatibility
+      options:
+        - label: I considered whether this changes existing generated Rust APIs or wire behavior.
+          required: true
+        - label: I searched existing issues and discussions for this request.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,28 @@
+## Summary
+
+<!-- What user-visible problem does this solve? Link the issue when one exists. -->
+
+## Generated compatibility
+
+<!-- Delete items that do not apply and explain each applicable change. -->
+
+- Generated model or method signatures:
+- Query/path/header/body wire behavior:
+- Generated runtime dependencies or features:
+- Configuration defaults or migrations:
+- Remaining unsupported OpenAPI shapes:
+
+## Validation
+
+- [ ] Added or updated a focused fixture and behavioral regression test.
+- [ ] Reviewed every changed snapshot; no unrelated churn is included.
+- [ ] `cargo fmt --check`
+- [ ] `cargo clippy --all-features -- -D warnings`
+- [ ] `cargo test --all-features`
+- [ ] Ran `scripts/install-smoke.sh` for packaging/dependency changes.
+- [ ] Ran a targeted or full `scripts/spec-compile.sh` for generator changes.
+- [ ] Updated README, rustdoc, or changelog for user-visible behavior.
+
+## Notes for reviewers
+
+<!-- Call out risk, intentionally deferred work, and the smallest useful review path. -->

.github/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  schedule:
+    - cron: "17 6 * * 1"
+  workflow_dispatch:
 
 env:
   CARGO_TERM_COLOR: always
@@ -14,9 +17,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: true
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo test --all-features
+      - name: Verify checked-in conformance reports
+        run: |
+          CONFORMANCE_REPORT=1 cargo test --test conformance --test conformance_json_schema
+          git diff --exit-code -- tests/conformance/coverage-report.md tests/conformance/json-schema-2020-12-report.md
 
   clippy:
     runs-on: ubuntu-latest
@@ -47,21 +56,43 @@ jobs:
         env:
           RUSTDOCFLAGS: -D warnings
 
-  # Regression guard: generate clients for our two production-target specs
-  # (OpenAI + Anthropic) and `cargo check` the result. Catches breakage
-  # where a generator change still passes unit tests but emits invalid
-  # Rust against the specs we actually ship clients for.
-  #
-  # The full corpus (54 specs) is verified locally via
-  # `scripts/spec-compile.sh` (no args) — but cargo-checking 50+
-  # generated crates exceeded CI's 6-hour job limit on the largest
-  # specs (microsoft-graph, cloudflare). Local + this CI gate is
-  # sufficient: regressions to anthropic/openai will fail PRs, and
-  # contributors can run the full corpus before pushing.
+  install-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - run: scripts/install-smoke.sh
+
+  msrv:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.88.0
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo check --all-targets --all-features
+
+  # Fast tier: every supported corpus document must generate, while the two
+  # production-target specs must also compile from their exact dependency
+  # fragments. The full compile tier runs separately on a schedule/manual run.
   spec-compile:
+    if: github.event_name != 'schedule' && github.event_name != 'workflow_dispatch'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
+      - run: SPEC_COMPILE_PARSE_ONLY=1 scripts/spec-compile.sh
       - run: scripts/spec-compile.sh anthropic openai
+
+  full-spec-compile:
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 240
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - run: scripts/spec-compile.sh

.github/workflows/publish.yml

@@ -8,7 +8,30 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy,rustfmt
+      - uses: Swatinem/rust-cache@v2
+      - name: Verify tag matches crate version
+        run: |
+          package_version="$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[0].version')"
+          test "${GITHUB_REF_NAME}" = "v${package_version}"
+      - run: cargo fmt --check
+      - run: cargo clippy --all-features -- -D warnings
+      - run: cargo test --all-features
+      - run: cargo doc --no-deps --all-features
+        env:
+          RUSTDOCFLAGS: -D warnings
+      - run: scripts/install-smoke.sh
+
   publish:
+    needs: verify
     runs-on: ubuntu-latest
     environment: crates-io
     permissions:
@@ -21,7 +44,7 @@ jobs:
       - name: Authenticate with crates.io
         id: crates-io-auth
         uses: rust-lang/crates-io-auth-action@v1
-      - run: cargo publish
+      - run: cargo publish --locked
         env:
           CARGO_REGISTRY_TOKEN: ${{ steps.crates-io-auth.outputs.token }}
       - name: Create GitHub Release

CHANGELOG.md

@@ -0,0 +1,92 @@
+# Changelog
+
+All notable changes are recorded here. This project follows semantic versioning,
+with one pre-1.0 qualification: a minor release may change generated Rust APIs
+when correcting output that was wrong or incomplete on the wire.
+
+## [Unreleased]
+
+### Added
+
+- Direct generation from a local OpenAPI document or bounded HTTPS URL:
+  `openapi-to-rust generate <SOURCE>`.
+- `openapi-to-rust init <SOURCE>`, plus deterministic `--dry-run`, `--check`,
+  `--quiet`, and `--json` generation modes.
+- Optional `[client].operations` selection and model pruning shared with the
+  server operation scope.
+- `Default` for all-optional request models, required-field constructors,
+  fluent optional setters, and opt-in operation builders.
+- A complete `REQUIRED_DEPS.toml` for the exact generated output.
+- `base64_url_unpadded` as a spec-wide `format: byte` strategy for RFC 7515
+  URL-safe, unpadded data.
+- Contributor, support, security, conduct, issue-form, and pull-request
+  scaffolding, plus a docs.rs library overview and compile-checked example.
+- The public CLI as Cargo's default binary, so plain `cargo run -- ...` works
+  even though feature-gated internal maintenance binaries are declared.
+
+### Fixed
+
+- README compatibility, corpus, and conformance claims; pull-request and
+  scheduled full-corpus CI tiers; and release preflight checks.
+- Canonical `[generator.types]` configuration parsing, strict unknown-field
+  rejection, config-relative paths, and actionable migration errors.
+- `cargo install --locked openapi-to-rust` packaging: only the public CLI is
+  installed, packaged inputs are complete, and obsolete duplicate dependency
+  versions were removed.
+- Server query extraction now mirrors generated client serialization for typed
+  form, repeated-array, comma-delimited, and deep-object query parameters.
+- Generated client requests now support non-JSON bodies, optional bodies,
+  typed headers, path encoding, and collision-safe operation signatures.
+
+## [0.6.0] - 2026-07-13
+
+### Added
+
+- OpenAPI `style`/`explode`-aware client serialization for object and array
+  query parameters, including form-exploded objects, comma-joined form values,
+  deep-object parameters, and repeated arrays.
+- Shared-target full-corpus compile tooling in `scripts/spec-compile.sh`.
+
+### Changed
+
+- Regenerated client signatures use typed objects and arrays instead of opaque
+  `Option<impl AsRef<str>>` arguments for the supported query styles. This is a
+  source-breaking correction for regenerated pre-1.0 clients.
+
+## [0.5.3] - 2026-07-11
+
+- Added working generated serde codecs for `time::Date` and `time::Time`.
+
+## [0.5.2] - 2026-07-11
+
+- Honored integer and number formats for query and path parameters.
+
+## [0.5.1] - 2026-07-07
+
+- Restricted the crates.io package to the source, manifest, README, and license.
+
+## [0.5.0] - 2026-07-07
+
+### Added
+
+- Opt-in Axum server generation with operation selectors, per-tag traits,
+  typed response enums, router factories, SSE response support, and model
+  pruning.
+- OpenAPI 3.1 modeling and experimental parsing for selected OpenAPI 3.2
+  fields and methods.
+- Typed scalar strategies, typed `additionalProperties`, operation-level typed
+  errors, strict extension parsing, webhook ingestion, and SSE auto-detection.
+- End-to-end OpenAI Responses and Anthropic Messages server examples.
+
+### Fixed
+
+- Numerous real-spec generation failures involving operation identifiers,
+  signed enum values, recursive unions, parameter collisions, optional request
+  bodies, range response codes, and path-segment encoding.
+
+[Unreleased]: https://github.com/gpu-cli/openapi-to-rust/compare/v0.6.0...HEAD
+[0.6.0]: https://github.com/gpu-cli/openapi-to-rust/releases/tag/v0.6.0
+[0.5.3]: https://github.com/gpu-cli/openapi-to-rust/compare/v0.5.2...v0.5.3
+[0.5.2]: https://github.com/gpu-cli/openapi-to-rust/compare/v0.5.1...v0.5.2
+[0.5.1]: https://github.com/gpu-cli/openapi-to-rust/compare/v0.5.0...v0.5.1
+[0.5.0]: https://github.com/gpu-cli/openapi-to-rust/tree/v0.5.0