Complete Python project base template, reviewed and CI green.

What's included

• Docker — multi-stage build (dev for dev containers, prod for deployment), two-layer builder pattern for correct hatchling builds and optimal layer caching
• Dev container — VS Code devcontainer from the dev Dockerfile target; non-root devuser, named .venv volume, auto-syncs on create
• uv + pyproject.toml — all project config in one file: Ruff, Mypy (strict), pytest, bandit, pip-audit
• VS Code — settings, recommended extensions, and debug launch configs pre-wired (Ruff format-on-save, Mypy extension, pytest panel)
• GitHub Actions CI — lint (Ruff + Mypy), tests with coverage, pip-audit dependency scan, Docker build (scoped GHA cache per target)
• GitHub Actions CodeQL — Python SAST on push/PR/weekly
• CLAUDE.md + slash commands — AI context and /test, /lint, /security, /build project commands
• uv.lock committed for reproducible installs

Review fixes applied

• pythonpath = ["src"] added so bare pytest works without editable install
• Coverage flags removed from addopts — explicit in CI only
• Pylance set to "off" — defers to mypy extension (was "basic", inconsistent with strict mypy)
• Bandit removed from CI — CodeQL covers SAST; bandit kept for local use
• Docker GHA cache scoped per target (scope=dev / scope=prod)
• enable-cache: true on all setup-uv steps
• Dead targets key removed from [tool.bandit]
• dev compose service removed (was a pytest runner with a misleading name)
• Dev Dockerfile stage: non-root devuser added, redundant build-time uv sync removed
• Readme rewritten for container-first, zero-Python audience

https://claude.ai/code/session_01TiXyp1vCmxNP2ewP4s1TGH

Generated by Claude Code