Shared contributing guide for repos and boilerplate fixes

[tomaslink]

PIPELINE-4672

Summary

Makes this template's CONTRIBUTING.md the single contributing guide for every repo created from it (pipelines and services), and ports the boilerplate fixes found while standardizing pipe-encounters (PIPELINE-3367) and pipe-anchorages.

Shared contributing guide

• CONTRIBUTING.md and docs/contributing/ take pipe-docs' newer text, made generic for services as well as pipelines. The guide describes the tooling this template ships (Makefile, Docker, uv), so it lives here, next to it.
• Repos link to it from their README: a clone step with the repo's own URL (renamed by init_project.py), then a link to the guide.
• init_project.py removes CONTRIBUTING.md and docs/contributing/ from new projects and keeps links to the template's guide when renaming.
• Fixes in the guide: requirements are compiled with uv pip compile (uv doesn't use pip-tools), and the venv is activated with . .venv/bin/activate (executing ./.venv/bin/activate fails, or only affects a subshell).
• Why not pipe-docs: pipe-docs is private, while this template and the pipe repos are public, so links to it 404 for outsiders. pipe-docs will link here instead (follow-up).

Boilerplate fixes

• CI: the "Python 3.13" job actually ran on 3.12 (make uv pins .python-version to 3.12 and uv venv follows it; see Using CPython 3.12.3 in the logs). The venv now gets --python from the matrix. Codecov never uploaded: the condition required Python 3.12, which isn't in the matrix. checkout@v6 in the Docker job.
• Makefile: python -m codespell fails (No module named codespell); the module is codespell_lib. make hooks no longer installs a commit-msg hook (none is configured).
• pyproject: drop pyyaml, rich, rich-argparse and types-PyYAML (nothing imports them; every new project inherited them) and the unused pip-tools; requires-python >= 3.12 to match the Docker image; Changelog URL → GitHub releases; drop coverage's parallel mode.
• .dockerignore: exclude .git and .venv; the dev stage's COPY . . copied a local .venv (157 MB here) into the image.
• .python-version (3.12) is now tracked, so local venvs use the same Python as the Docker image.
• Cloud Build: replace the unused cloudbuild.yaml with the Terraform triggers in cloudbuild/ (cloudbuild-trigger module v0.6.7, as in pipe-anchorages/pipe-encounters). The module defines the build itself (--target prod); init_project.py renames the project in the .tf files.
• Cleanup: README links to files that no longer exist, .gitignore leftovers (test/ silently ignored any test/ folder), pre-commit-hooks v6.0.0, and trailing whitespace / final newlines flagged by the template's own hooks (trailing-whitespace now keeps Markdown line breaks).
• Fixes the Pygments Dependabot alert (it came through rich).

Test dependencies: a dependency group, compiled

requirements-test.txt held hand-written ranges that nothing compiled or upgraded, so test runs weren't reproducible and Dependabot only flagged the pytest tmpdir advisory because ~=8.3 blocked the fix (9.0.3).

• Test dependencies are now a PEP 735 test dependency group in pyproject.toml (not published with the package), with pytest ~=9.0 and pytest-cov ~=7.0.
• requirements-test.txt is compiled from it with uv pip compile --group test -c requirements.txt, so it's pinned against the production pins. The test image still installs just the test dependencies on top of the production image, as before.
• make reqs / make reqs-upgrade compile both files; their containers now run as the host user, so the compiled files aren't owned by root.
• Major versions stay a deliberate pyproject.toml change; reqs-upgrade moves within the ranges.

Verification

• pytest: 10 passed; flake8: clean.
• make reqs and make reqs-upgrade in the dev container produce the pinned requirements-test.txt, owned by the host user.
• Simulated CI native job on Python 3.13 (make install-test, pip install ., make test): passes.
• make docker-build && make docker-test: passes; the dev image no longer contains .git/.venv; the prod image's CLI runs.
• python init_project.py my-service on a copy: the README clone step becomes my-service, guide links still point here, CONTRIBUTING.md and docs/contributing/ are removed, and cloudbuild/*.tf get repo_name = "my-service".
• terraform fmt -check and terraform validate (with -backend=false) pass for cloudbuild/.

Follow-ups

• PIPELINE-4673: example CLI built on gfw-common (stacked on this PR).
• pipe-docs: replace its guide with a link to this one.
• Apply the test dependency group workflow to the pipe repos.

🤖 Generated with Claude Code