[tae898]

Closes #251

Ports the parts of ArcadeData/arcadedb's GitHub automation that fit a Python bindings repository and need no secret, App or repository setting. Same table as the issue:

Upstream file	Status	Here
classify-issue.yml	adapted	classify-issue.yml: rule-based only. The package comes from the bug form dropdown (native, jvm), topic words give vector, performance, concurrency, timeseries; only labels that exist are added, never removed. Upstream's model call (labels, severity:*) and the sponsor high_priority job are not ported
label-issue-in-progress.yml	ported	label-issue-in-progress.yml, same trigger and logic (GitHub's closingIssuesReferences)
dependabot-auto-merge.yml	adapted	dependabot-auto-merge.yml plus .github/scripts/dependabot_merge.py. Upstream merges on one human approval with no green condition. Here it polls hourly and squash-merges patch and minor updates only when the check list is not empty, every check succeeded and the PR is mergeable and clean; majors and grouped updates stay open. Pinned to the inspected head SHA
milestones (done by hand upstream)	adapted	assign-milestone.yml: on merge, the PR and the issues it closes get the open milestone due first, if they have none. Dependabot PRs and issues closed as not planned are skipped
pull_request_template.md	adapted	.github/pull_request_template.md: Closes #N, timed A/B result for performance changes, docs touched, test and pre-commit checklist
ISSUE_TEMPLATE.md	adapted	ISSUE_TEMPLATE/bug_report.yml and feature_request.yml (package dropdown feeds the classifier), config.yml linking engine bugs to the upstream repository; the existing release.md stays
gitignore-hygiene.yml	ported	gitignore-hygiene.yml, the tracked-file check (the second check is for Java source trees)
dependency-review-config.yml and the Dependency Review job of studio-security-audit.yml	adapted	dependency-review.yml and dependency-review-config.yml: moderate or worse vulnerabilities and GPL, AGPL, SSPL licences fail a PR; the npm-specific parts are dropped
dependabot.yml	already in place	unchanged: pip and github-actions, weekly, 3-day cooldown
merge-related-issues.yml	not ported	asks a model to group issues and closes them; needs a token (see below)
claude.yml, claude-code-review.yml	not ported	need a Claude token and the Claude GitHub app (see below)
license-compliance.yml	not ported	Maven based; here the dependency floor audit (pip-audit) and scripts/verify_wheel_licences.py cover it
reuse-compliance.yml	not ported	reuse lint fails on this repository today (no LICENSES/Apache-2.0.txt, files under native/ and scripts/ without headers, an invalid expression in native/wheel/THIRD_PARTY_NOTICES.md); the workflow would be red on every PR
.github/scripts/check-*	not ported	guards for the Maven, GraalVM and Java test layout of the engine repository

How each was checked (nothing was run on GitHub yet; the first real runs are this PR and the next issue or Dependabot PR):

• uvx --from actionlint-py actionlint .github/workflows/*.yml with the repository's .github/actionlint.yaml: no findings, and the actionlint pre-commit hook passed. (uvx actionlint itself does not resolve, the PyPI name is actionlint-py.)
• uvx pre-commit run --files <changed files> run twice: black reformatted the new script on the first run, everything passed on the second.
• All new YAML parses with yaml.safe_load; the three github-script bodies pass node --check; the classifier regexes were run against a sample issue form body.
• dependabot_merge.py: compile() and pyflakes are clean; asserts cover major versus minor and patch (4 to 5, v7.0.1 to v7.0.2, >=1.0 to >=2.0.0, 1.2 to 1.10), a grouped title, and an empty, pending, failed or skipped check list; it was run against the titles and check lists of the last four merged Dependabot PRs and against the live repository with --dry-run (no open Dependabot PR, so no decision to show).
• ci.adoc and CLAUDE.md describe the new workflows; the docs build is checked by docs.yml on this PR.
• Checked locally and not added: reuse lint fails with 354 findings, so reuse-compliance.yml stays out.

What each new workflow needs. classify-issue.yml: issues: write; label-issue-in-progress.yml: issues: write, pull-requests: read; assign-milestone.yml: issues: write, pull-requests: read, and an open milestone (it does nothing without one); dependabot-auto-merge.yml: contents: write, pull-requests: write, runs only on ArcadeData/arcadedb-python, a merge by GITHUB_TOKEN starts no push workflow on main; dependency-review.yml: contents: read and the dependency graph on; gitignore-hygiene.yml: contents: read. All third-party actions are pinned to a full commit SHA with the version in a comment. The Actions setting "Read and write permissions" for the default token is not needed, each workflow declares its own.

Left for the maintainers, with what each would need, in the issue: the Claude workflows and the model-based classifier (token and App), sponsor priority, GitHub auto-merge with branch protection, and REUSE compliance.

This PR has no milestone: it is automation, not release content.

🤖 Generated with Claude Code