[F-2026-17758] Missing upstream security patch train after fork point

.github/ISSUE_TEMPLATE/issue-template.md

@@ -0,0 +1,51 @@
+---
+name: Issue
+about: Report a bug or request a feature
+title: "[Bug] <summary>" or "[Feature] <summary>"
+labels: needs-triage
+assignees: ''
+---
+
+## Type
+
+<!-- Please check one -->
+- [ ] Bug
+- [ ] Feature
+- [ ] Proposal / Discussion
+
+## Summary
+
+<!--
+Describe the issue or request in 1–2 sentences.
+Include relevant context or background.
+-->
+
+## Reproduction (for bugs)
+
+<!--
+Include minimal steps to reproduce the bug. Example:
+
+1. Run `make start`
+2. Submit a tx via `evm.send()`
+3. Observe panic in logs
+-->
+
+## Impact
+
+<!--
+Explain the potential severity and who is affected.
+E.g., critical bug for validators, minor UX issue, etc.
+-->
+
+## Related
+
+<!--
+Link related issues or PRs.
+-->
+
+## Checklist
+
+- [ ] Linked to a GitHub Issue (or this is the Issue)
+- [ ] Repro steps included (for bugs)
+- [ ] Impact described
+- [ ] I understand minor typo/style doc fixes will not be accepted

.github/PULL_REQUEST_TEMPLATE.md

@@ -21,19 +21,3 @@ I have...
 - [ ] tackled an existing issue or discussed with a team member
 - [ ] left instructions on how to review the changes
 - [ ] targeted the `main` branch
-
-## Reviewers Checklist
-
-**All** items are required.
-Please add a note if the item is not applicable
-and please add your handle next to the items reviewed
-if you only reviewed selected items.
-
-I have...
-
-- [ ] added a relevant changelog entry to the `Unreleased` section in `CHANGELOG.md`
-- [ ] confirmed all author checklist items have been addressed
-- [ ] confirmed that this PR does not change production code
-- [ ] reviewed content
-- [ ] tested instructions (if applicable)
-- [ ] confirmed all CI checks have passed

.github/workflows/check-changelog.yml

@@ -0,0 +1,53 @@
+on:
+  pull_request:
+    types: [ opened, synchronize, reopened, ready_for_review, edited ]
+    paths: [ "**/*.go" ]
+name: Changelog Reminder
+jobs:
+  remind:
+    name: Changelog Reminder
+    runs-on: ubuntu-latest
+    if: ${{ !github.event.pull_request.draft }}
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check PR title for semantic commit type
+        run: |
+          # Get the PR title
+          PR_TITLE="${{ github.event.pull_request.title }}"
+          echo "PR Title: $PR_TITLE"
+
+          # Check if PR title starts with feat, refactor, or fix
+          if echo "$PR_TITLE" | grep -qE "^(feat|refactor|fix)(\(.+\))?!?:"; then
+            echo "✅ PR title has relevant semantic commit type (feat, refactor, or fix)"
+            echo "has_relevant_pr_title=true" >> $GITHUB_ENV
+          else
+            echo "ℹ️ PR title doesn't have relevant semantic commit type. Skipping changelog check."
+            echo "has_relevant_pr_title=false" >> $GITHUB_ENV
+          fi
+
+      - name: Check if CHANGELOG.md was modified
+        if: env.has_relevant_pr_title == 'true'
+        run: |
+          # Get the list of changed files in this PR
+          CHANGED_FILES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD)
+
+          # Check if CHANGELOG.md (case insensitive) is in the changed files
+          if echo "$CHANGED_FILES" | grep -qi "changelog\.md"; then
+            echo "✅ CHANGELOG.md has been modified in this PR"
+            echo "changelog_modified=true" >> $GITHUB_ENV
+          else
+            echo "❌ CHANGELOG.md has not been modified in this PR"
+            echo "changelog_modified=false" >> $GITHUB_ENV
+          fi
+
+      - name: Fail if changelog not updated
+        if: env.has_relevant_pr_title == 'true' && env.changelog_modified == 'false'
+        run: |
+          echo "::error::CHANGELOG.md must be updated for PRs with feat, refactor, or fix commits"
+          exit 1

.github/workflows/codeql-analysis.yml

@@ -18,7 +18,7 @@ permissions: read-all
 jobs:
   analyze:
     name: Analyze
-    runs-on: ubuntu-latest
+    runs-on: depot-ubuntu-24.04-8
     permissions:
       actions: read
       contents: read