security + CI: mirror unsloth's hardening stack onto zoo (greenfield .github/)

.github/CODEOWNERS

@@ -0,0 +1,37 @@
+# Inspired from https://github.com/vllm-project/vllm/blob/main/.github/CODEOWNERS
+# Mirrors unslothai/unsloth's CODEOWNERS shape, scoped to zoo's layout.
+
+/unsloth_zoo/rl_replacements.py @Datta0 @pluesclues @danielhanchen
+/unsloth_zoo/compiler.py @danielhanchen
+/unsloth_zoo/compiler_replacements.py @danielhanchen
+/unsloth_zoo/device_type.py @danielhanchen
+/unsloth_zoo/tokenizer_utils.py @mmathew23 @danielhanchen
+/unsloth_zoo/saving_utils.py @rolandtannous @danielhanchen
+/unsloth_zoo/peft_utils.py @danielhanchen
+/unsloth_zoo/loss_utils.py @danielhanchen
+
+# Temporary model-specific patch subsystem.
+/unsloth_zoo/temporary_patches/*.py @danielhanchen
+/unsloth_zoo/temporary_patches/gemma*.py @danielhanchen
+/unsloth_zoo/temporary_patches/qwen3*.py @danielhanchen
+/unsloth_zoo/temporary_patches/gpt_oss.py @danielhanchen
+/unsloth_zoo/temporary_patches/moe_*.py @Datta0 @danielhanchen
+/unsloth_zoo/temporary_patches/mxfp4.py @Datta0 @danielhanchen
+/unsloth_zoo/temporary_patches/bitsandbytes.py @danielhanchen
+
+# MLX subsystem (macOS arm64 only).
+/unsloth_zoo/mlx_*.py @danielhanchen
+/unsloth_zoo/mlx_cce/*.py @danielhanchen
+
+# MoE / fused / flex attention kernels.
+/unsloth_zoo/fused_losses/*.py @danielhanchen
+/unsloth_zoo/flex_attention/*.py @danielhanchen
+
+# Security + CI infrastructure ported from unsloth via this PR.
+/.github/workflows/security-audit.yml @danielhanchen
+/scripts/scan_packages.py @danielhanchen
+/scripts/lint_workflow_triggers.py @danielhanchen
+/scripts/enforce_kwargs_spacing.py @danielhanchen
+/tests/security/ @danielhanchen
+/.github/dependabot.yml @danielhanchen
+/.github/CODEOWNERS @danielhanchen

.github/FUNDING.yml

@@ -0,0 +1,13 @@
+# These are supported funding model platforms
+
+github: unslothai
+patreon: # Replace with a single Patreon username
+open_collective: # Replace with a single Open Collective username
+ko_fi: # unsloth
+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+otechie: # Replace with a single Otechie username
+lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
+custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

.github/ISSUE_TEMPLATE/bug---issue.md

@@ -0,0 +1,22 @@
+---
+name: Bug / Issue
+about: Bug / Issue
+title: "[Bug] Please fill in your issue title here."
+labels: bug
+assignees: ''
+
+---
+Note: Please do not remove the questions. Answer beside them.
+1. Did you update? `pip install --upgrade unsloth unsloth_zoo`
+2. `Colab` or `Kaggle` or local / cloud
+3. Number GPUs used, use `nvidia-smi`
+4. Which notebook? Please link!
+5. Which Unsloth version, TRL version, transformers version, PyTorch version?
+6. Which trainer? `SFTTrainer`, `GRPOTrainer` etc
+
+```python
+Put Minimal code to reproduce error here ###Remove Hugging Face token###
+###Please make sure to check formatting properly, edit if needed.###
+```
+
+🦥 You can also ask via our Reddit page: https://reddit.com/r/unsloth/

.github/ISSUE_TEMPLATE/feature-request.md

@@ -0,0 +1,21 @@
+---
+name: Feature Request
+about: New features, model support, ideas
+title: "[Feature]"
+labels: feature request
+assignees: ''
+
+---
+
+For new models, have you tried:
+```python
+from unsloth import FastModel
+model, tokenizer = FastModel.from_pretrained(
+    "microsoft/Phi-4-multimodal-instruct",
+    trust_remote_code = True,
+)
+from transformers import AutoModelForSequenceClassification
+model, tokenizer = FastModel.from_pretrained(
+    auto_model = AutoModelForSequenceClassification,
+)
+```

.github/dependabot.yml

@@ -0,0 +1,51 @@
+---
+# Mirrors the shape of unslothai/unsloth's .github/dependabot.yml,
+# scoped to unsloth-zoo's actual surface:
+#   - github-actions (this very directory once the workflows land)
+#   - pip (root pyproject.toml -- zoo is published to PyPI as `unsloth_zoo`)
+#
+# Dropped entries that exist on the unsloth repo but are N/A here:
+#   - bun / npm  (no package-lock.json / bun.lock anywhere in zoo)
+#   - cargo      (no Cargo.toml / Cargo.lock anywhere in zoo)
+#
+# Add a real entry IF and WHEN one of those manifests lands.
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      # github-actions refs are git tags / SHAs, not semver -- the
+      # `semver-minor-days` / `semver-patch-days` knobs are rejected by
+      # Dependabot's validator for this ecosystem. Only the
+      # `default-days` floor applies. (Pinned via PR #5397 on unsloth
+      # after the validator surfaced the bug on a sibling repo.)
+      default-days: 7
+    groups:
+      actions:
+        patterns: ["*"]
+      actions-security:
+        applies-to: security-updates
+        patterns: ["*"]
+
+  # pip dependencies for the unsloth_zoo wheel. Weekly version-update
+  # PRs are grouped + cooled-down 7 days; security-advisory PRs flow
+  # through the *-security group independently. The cooldown is the
+  # supply-chain gate -- it matches studio/frontend/.npmrc
+  # min-release-age=7 over on the unsloth repo, so we never auto-ingest
+  # a freshly-published tarball.
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
+    groups:
+      python:
+        patterns: ["*"]
+      python-security:
+        applies-to: security-updates
+        patterns: ["*"]