chore: prepare SDK for open source

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @Si40Code @Ray-56

.github/pull_request_template.md

@@ -6,16 +6,13 @@ Describe the SDK behavior, documentation, or release workflow change.
 
 - [ ] I kept this change within the supported server SDK scope.
 - [ ] I did not add browser/client-side patterns that expose CALL-E API keys.
+- [ ] I did not include private collaboration links or unconfirmed public repository references.
 - [ ] I updated tests, examples, or docs when behavior changed.
+- [ ] I updated the changelog when the change affects package users.
 - [ ] I ran the relevant local checks.
 
 ## Local checks
 
 ```bash
-uv run pytest -q
-uv run ruff check .
-uv run mypy src/calle
-uv run python -m py_compile examples/create_and_wait.py examples/webhook_server.py
-uv build
-uvx twine check dist/*
+bash scripts/validate.sh
 ```

.github/workflows/ci.yml

@@ -6,21 +6,28 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.11"
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@v8.1.0
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
           enable-cache: true
 

.github/workflows/public-repo-hygiene.yml

@@ -0,0 +1,29 @@
+name: Public repository hygiene
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, reopened, edited, ready_for_review]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+
+      - name: Scan tracked text and pull request metadata
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title || '' }}
+          PR_BODY: ${{ github.event.pull_request.body || '' }}
+        run: python3 scripts/check_public_repo_hygiene.py