dycw-actions 0.7.1__py3-none-any.whl → 0.8.4__py3-none-any.whl

actions/pre_commit/conformalize_repo/lib.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import sys
 from contextlib import contextmanager, suppress
+from hashlib import blake2b
 from itertools import product
 from pathlib import Path
 from re import MULTILINE, escape, search, sub
@@ -11,49 +12,52 @@ from subprocess import CalledProcessError
 from typing import TYPE_CHECKING, Literal, assert_never
 
 import tomlkit
-from ruamel.yaml.scalarstring import LiteralScalarString
 from tomlkit import TOMLDocument, table
 from tomlkit.exceptions import NonExistentKey
 from utilities.inflect import counted_noun
-from utilities.pathlib import get_repo_root
 from utilities.re import extract_groups
 from utilities.subprocess import ripgrep
 from utilities.text import repr_str, strip_and_dedent
+from utilities.throttle import throttle
 from utilities.version import ParseVersionError, Version, parse_version
-from utilities.whenever import HOUR, get_now
-from whenever import ZonedDateTime
-from xdg_base_dirs import xdg_cache_home
+from utilities.whenever import HOUR
 
 from actions import __version__
-from actions.action_dicts.lib import (
-    run_action_pre_commit_dict,
-    run_action_publish_dict,
-    run_action_pyright_dict,
-    run_action_pytest_dict,
-    run_action_ruff_dict,
-    run_action_tag_dict,
-)
-from actions.constants import YAML_INSTANCE
-from actions.logging import LOGGER
-from actions.pre_commit.conformalize_repo.constants import (
+from actions.constants import (
     ACTIONS_URL,
     BUMPVERSION_TOML,
-    CONFORMALIZE_REPO_SUB_CMD,
     COVERAGERC_TOML,
-    DOCKERFMT_URL,
     ENVRC,
+    GITEA_PULL_REQUEST_YAML,
+    GITEA_PUSH_YAML,
     GITHUB_PULL_REQUEST_YAML,
     GITHUB_PUSH_YAML,
     GITIGNORE,
     MAX_PYTHON_VERSION,
-    PATH_CONFIGS,
+    PATH_THROTTLE_CACHE,
     PRE_COMMIT_CONFIG_YAML,
-    PRE_COMMIT_HOOKS_URL,
     PYPROJECT_TOML,
     PYRIGHTCONFIG_JSON,
     PYTEST_TOML,
     README_MD,
     RUFF_TOML,
+    YAML_INSTANCE,
+)
+from actions.logging import LOGGER
+from actions.pre_commit.conformalize_repo.action_dicts import (
+    action_publish_package_dict,
+    action_pyright_dict,
+    action_pytest_dict,
+    action_ruff_dict,
+    action_run_hooks_dict,
+    action_tag_commit_dict,
+    update_ca_certificates_dict,
+)
+from actions.pre_commit.conformalize_repo.constants import (
+    CONFORMALIZE_REPO_SUB_CMD,
+    DOCKERFMT_URL,
+    PATH_CONFIGS,
+    PRE_COMMIT_HOOKS_URL,
     RUFF_URL,
     SHELLCHECK_URL,
     SHFMT_URL,
@@ -67,6 +71,7 @@ from actions.pre_commit.replace_sequence_strs.constants import (
 )
 from actions.pre_commit.touch_empty_py.constants import TOUCH_EMPTY_PY_SUB_CMD
 from actions.pre_commit.touch_py_typed.constants import TOUCH_PY_TYPED_SUB_CMD
+from actions.pre_commit.update_requirements.constants import UPDATE_REQUIREMENTS_SUB_CMD
 from actions.pre_commit.utilities import (
     ensure_aot_contains,
     ensure_contains,
@@ -83,36 +88,41 @@ from actions.pre_commit.utilities import (
     yield_toml_doc,
     yield_yaml_dict,
 )
-from actions.utilities import logged_run, write_text
+from actions.utilities import logged_run
 
 if TYPE_CHECKING:
     from collections.abc import Iterator, MutableSet
 
     from tomlkit.items import Table
-    from utilities.types import PathLike
-
-    from actions.types import StrDict
+    from typed_settings import Secret
+    from utilities.types import PathLike, StrDict
 
 
 def conformalize_repo(
     *,
+    ci__ca_certificates: bool = SETTINGS.ci__ca_certificates,
+    ci__gitea: bool = SETTINGS.ci__gitea,
+    ci__token: str | None = SETTINGS.ci__token,
+    ci__pull_request__pre_commit: bool = SETTINGS.ci__pull_request__pre_commit,
+    ci__pull_request__pyright: bool = SETTINGS.ci__pull_request__pyright,
+    ci__pull_request__pytest__macos: bool = SETTINGS.ci__pull_request__pytest__macos,
+    ci__pull_request__pytest__ubuntu: bool = SETTINGS.ci__pull_request__pytest__ubuntu,
+    ci__pull_request__pytest__windows: bool = SETTINGS.ci__pull_request__pytest__windows,
+    ci__pull_request__pytest__sops_age_key: str
+    | None = SETTINGS.ci__pull_request__pytest__sops_age_key,
+    ci__pull_request__ruff: bool = SETTINGS.ci__pull_request__ruff,
+    ci__push__publish: bool = SETTINGS.ci__push__publish,
+    ci__push__publish__username: str | None = SETTINGS.ci__push__publish__username,
+    ci__push__publish__password: Secret[str]
+    | None = SETTINGS.ci__push__publish__password,
+    ci__push__publish__publish_url: Secret[str]
+    | None = SETTINGS.ci__push__publish__publish_url,
+    ci__push__tag: bool = SETTINGS.ci__push__tag,
+    ci__push__tag__all: bool = SETTINGS.ci__push__tag__all,
     coverage: bool = SETTINGS.coverage,
     description: str | None = SETTINGS.description,
     envrc: bool = SETTINGS.envrc,
     envrc__uv: bool = SETTINGS.envrc__uv,
-    envrc__uv__native_tls: bool = SETTINGS.envrc__uv__native_tls,
-    github__pull_request__pre_commit: bool = SETTINGS.github__pull_request__pre_commit,
-    github__pull_request__pre_commit__gitea: bool = SETTINGS.github__pull_request__pre_commit__gitea,
-    github__pull_request__pyright: bool = SETTINGS.github__pull_request__pyright,
-    github__pull_request__pytest__macos: bool = SETTINGS.github__pull_request__pytest__macos,
-    github__pull_request__pytest__ubuntu: bool = SETTINGS.github__pull_request__pytest__ubuntu,
-    github__pull_request__pytest__windows: bool = SETTINGS.github__pull_request__pytest__windows,
-    github__pull_request__ruff: bool = SETTINGS.github__pull_request__ruff,
-    github__push__publish: bool = SETTINGS.github__push__publish,
-    github__push__tag: bool = SETTINGS.github__push__tag,
-    github__push__tag__major: bool = SETTINGS.github__push__tag__major,
-    github__push__tag__major_minor: bool = SETTINGS.github__push__tag__major_minor,
-    github__push__tag__latest: bool = SETTINGS.github__push__tag__latest,
     gitignore: bool = SETTINGS.gitignore,
     package_name: str | None = SETTINGS.package_name,
     pre_commit__dockerfmt: bool = SETTINGS.pre_commit__dockerfmt,
@@ -122,7 +132,6 @@ def conformalize_repo(
     pre_commit__shell: bool = SETTINGS.pre_commit__shell,
     pre_commit__taplo: bool = SETTINGS.pre_commit__taplo,
     pre_commit__uv: bool = SETTINGS.pre_commit__uv,
-    pre_commit__uv__script: str | None = SETTINGS.pre_commit__uv__script,
     pyproject: bool = SETTINGS.pyproject,
     pyproject__project__optional_dependencies__scripts: bool = SETTINGS.pyproject__project__optional_dependencies__scripts,
     pyproject__tool__uv__indexes: list[
@@ -140,27 +149,31 @@ def conformalize_repo(
     ruff: bool = SETTINGS.ruff,
     run_version_bump: bool = SETTINGS.run_version_bump,
     script: str | None = SETTINGS.script,
+    uv__native_tls: bool = SETTINGS.uv__native_tls,
 ) -> None:
     LOGGER.info(
         strip_and_dedent("""
             Running '%s' (version %s) with settings:
+             - ci__ca_certificates                                = %s
+             - ci__gitea                                          = %s
+             - ci__token                                          = %s
+             - ci__pull_request__pre_commit                       = %s
+             - ci__pull_request__pyright                          = %s
+             - ci__pull_request__pytest__macos                    = %s
+             - ci__pull_request__pytest__ubuntu                   = %s
+             - ci__pull_request__pytest__windows                  = %s
+             - ci__pull_request__pytest__sops_age_key             = %s
+             - ci__pull_request__ruff                             = %s
+             - ci__push__publish                                  = %s
+             - ci__push__publish__username                        = %s
+             - ci__push__publish__password                        = %s
+             - ci__push__publish__publish_url                     = %s
+             - ci__push__tag                                      = %s
+             - ci__push__tag__all                                 = %s
              - coverage                                           = %s
              - description                                        = %s
              - envrc                                              = %s
              - envrc__uv                                          = %s
-             - envrc__uv__native_tls                              = %s
-             - github__pull_request__pre_commit                   = %s
-             - github__pull_request__pre_commit__gitea            = %s
-             - github__pull_request__pyright                      = %s
-             - github__pull_request__pytest__macos                = %s
-             - github__pull_request__pytest__ubuntu               = %s
-             - github__pull_request__pytest__windows              = %s
-             - github__pull_request__ruff                         = %s
-             - github__push__publish                              = %s
-             - github__push__tag                                  = %s
-             - github__push__tag__major                           = %s
-             - github__push__tag__major_minor                     = %s
-             - github__push__tag__latest                          = %s
              - gitignore                                          = %s
              - package_name                                       = %s
              - pre_commit__dockerfmt                              = %s
@@ -170,7 +183,6 @@ def conformalize_repo(
              - pre_commit__shell                                  = %s
              - pre_commit__taplo                                  = %s
              - pre_commit__uv                                     = %s
-             - pre_commit__uv__script                             = %s
              - pyproject                                          = %s
              - pyproject__project__optional_dependencies__scripts = %s
              - pyproject__tool__uv__indexes                       = %s
@@ -186,26 +198,30 @@ def conformalize_repo(
              - ruff                                               = %s
              - run_version_bump                                   = %s
              - script                                             = %s
+             - uv__native__tls                                    = %s
         """),
         conformalize_repo.__name__,
         __version__,
+        ci__ca_certificates,
+        ci__gitea,
+        ci__token,
+        ci__pull_request__pre_commit,
+        ci__pull_request__pyright,
+        ci__pull_request__pytest__macos,
+        ci__pull_request__pytest__ubuntu,
+        ci__pull_request__pytest__windows,
+        ci__pull_request__pytest__sops_age_key,
+        ci__pull_request__ruff,
+        ci__push__publish,
+        ci__push__publish__username,
+        ci__push__publish__password,
+        ci__push__publish__publish_url,
+        ci__push__tag,
+        ci__push__tag__all,
         coverage,
         description,
         envrc,
         envrc__uv,
-        envrc__uv__native_tls,
-        github__pull_request__pre_commit,
-        github__pull_request__pre_commit__gitea,
-        github__pull_request__pyright,
-        github__pull_request__pytest__macos,
-        github__pull_request__pytest__ubuntu,
-        github__pull_request__pytest__windows,
-        github__pull_request__ruff,
-        github__push__publish,
-        github__push__tag,
-        github__push__tag__major,
-        github__push__tag__major_minor,
-        github__push__tag__latest,
         gitignore,
         package_name,
         pre_commit__dockerfmt,
@@ -215,7 +231,6 @@ def conformalize_repo(
         pre_commit__shell,
         pre_commit__taplo,
         pre_commit__uv,
-        pre_commit__uv__script,
         pyproject,
         pyproject__project__optional_dependencies__scripts,
         pyproject__tool__uv__indexes,
@@ -231,6 +246,7 @@ def conformalize_repo(
         ruff,
         run_version_bump,
         script,
+        uv__native_tls,
     )
     modifications: set[Path] = set()
     add_bumpversion_toml(
@@ -255,52 +271,63 @@ def conformalize_repo(
         uv=pre_commit__uv,
         script=script,
     )
-    if coverage:
-        add_coveragerc_toml(modifications=modifications)
-    if envrc or envrc__uv or envrc__uv__native_tls:
-        add_envrc(
-            modifications=modifications,
-            uv=envrc__uv,
-            uv__native_tls=envrc__uv__native_tls,
-            python_version=python_version,
-            script=script,
-        )
     if (
-        github__pull_request__pre_commit
-        or github__pull_request__pre_commit__gitea
-        or github__pull_request__pyright
-        or github__pull_request__pytest__windows
-        or github__pull_request__pytest__macos
-        or github__pull_request__pytest__ubuntu
-        or github__pull_request__ruff
+        ci__pull_request__pre_commit
+        or ci__pull_request__pyright
+        or ci__pull_request__pytest__macos
+        or ci__pull_request__pytest__ubuntu
+        or ci__pull_request__pytest__windows
+        or (ci__pull_request__pytest__sops_age_key is not None)
+        or ci__pull_request__ruff
     ):
-        add_github_pull_request_yaml(
+        add_ci_pull_request_yaml(
+            certificates=ci__ca_certificates,
+            gitea=ci__gitea,
+            token=ci__token,
             modifications=modifications,
-            pre_commit=github__pull_request__pre_commit,
-            pre_commit__gitea=github__pull_request__pre_commit__gitea,
-            pyright=github__pull_request__pyright,
-            pytest__windows=github__pull_request__pytest__windows,
-            pytest__macos=github__pull_request__pytest__macos,
-            pytest__ubuntu=github__pull_request__pytest__ubuntu,
+            pre_commit=ci__pull_request__pre_commit,
+            pyright=ci__pull_request__pyright,
+            pytest__macos=ci__pull_request__pytest__macos,
+            pytest__ubuntu=ci__pull_request__pytest__ubuntu,
+            pytest__windows=ci__pull_request__pytest__windows,
+            pytest__sops_age_key=ci__pull_request__pytest__sops_age_key,
             pytest__timeout=pytest__timeout,
             python_version=python_version,
+            repo_name=repo_name,
             ruff=ruff,
             script=script,
+            uv__native_tls=uv__native_tls,
         )
     if (
-        github__push__publish
-        or github__push__tag
-        or github__push__tag__major_minor
-        or github__push__tag__major
-        or github__push__tag__latest
+        ci__push__publish
+        or (ci__push__publish__username is not None)
+        or (ci__push__publish__password is not None)
+        or (ci__push__publish__publish_url is not None)
+        or ci__push__tag
+        or ci__push__tag__all
     ):
-        add_github_push_yaml(
+        add_ci_push_yaml(
+            certificates=ci__ca_certificates,
+            gitea=ci__gitea,
+            token=ci__token,
+            modifications=modifications,
+            publish=ci__push__publish,
+            publish__username=ci__push__publish__username,
+            publish__password=ci__push__publish__password,
+            publish__publish_url=ci__push__publish__publish_url,
+            tag=ci__push__tag,
+            tag__all=ci__push__tag__all,
+            uv__native_tls=uv__native_tls,
+        )
+    if coverage:
+        add_coveragerc_toml(modifications=modifications)
+    if envrc or envrc__uv:
+        add_envrc(
             modifications=modifications,
-            publish=github__push__publish,
-            tag=github__push__tag,
-            tag__major_minor=github__push__tag__major_minor,
-            tag__major=github__push__tag__major,
-            tag__latest=github__push__tag__latest,
+            uv=envrc__uv,
+            uv__native_tls=uv__native_tls,
+            python_version=python_version,
+            script=script,
         )
     if gitignore:
         add_gitignore(modifications=modifications)
@@ -401,150 +428,69 @@ def _add_bumpversion_toml_file(path: PathLike, template: str, /) -> Table:
 ##
 
 
-def add_coveragerc_toml(*, modifications: MutableSet[Path] | None = None) -> None:
-    with yield_toml_doc(COVERAGERC_TOML, modifications=modifications) as doc:
-        html = get_table(doc, "html")
-        html["directory"] = ".coverage/html"
-        report = get_table(doc, "report")
-        exclude_also = get_array(report, "exclude_also")
-        ensure_contains(exclude_also, "@overload", "if TYPE_CHECKING:")
-        report["fail_under"] = 100.0
-        report["skip_covered"] = True
-        report["skip_empty"] = True
-        run = get_table(doc, "run")
-        run["branch"] = True
-        run["data_file"] = ".coverage/data"
-        run["parallel"] = True
-
-
-##
-
-
-def add_envrc(
+def add_ci_pull_request_yaml(
     *,
+    certificates: bool = SETTINGS.ci__ca_certificates,
+    gitea: bool = SETTINGS.ci__gitea,
+    token: str | None = SETTINGS.ci__token,
     modifications: MutableSet[Path] | None = None,
-    uv: bool = SETTINGS.envrc__uv,
-    uv__native_tls: bool = SETTINGS.envrc__uv__native_tls,
-    python_version: str = SETTINGS.python_version,
-    script: str | None = SETTINGS.script,
-) -> None:
-    with yield_text_file(ENVRC, modifications=modifications) as context:
-        shebang = strip_and_dedent("""
-            #!/usr/bin/env sh
-            # shellcheck source=/dev/null
-        """)
-        if search(escape(shebang), context.output, flags=MULTILINE) is None:
-            context.output += f"\n\n{shebang}"
-
-        echo = strip_and_dedent("""
-            # echo
-            echo_date() { echo "[$(date +'%Y-%m-%d %H:%M:%S')] $*" >&2; }
-        """)
-        if search(escape(echo), context.output, flags=MULTILINE) is None:
-            context.output += f"\n\n{echo}"
-
-        if uv:
-            uv_text = _add_envrc_uv_text(
-                native_tls=uv__native_tls, python_version=python_version, script=script
-            )
-            if search(escape(uv_text), context.output, flags=MULTILINE) is None:
-                context.output += f"\n\n{echo}"
-
-
-def _add_envrc_uv_text(
-    *,
-    native_tls: bool = SETTINGS.envrc__uv__native_tls,
-    python_version: str = SETTINGS.python_version,
-    script: str | None = SETTINGS.script,
-) -> str:
-    lines: list[str] = [
-        strip_and_dedent("""
-            # uv
-            export UV_MANAGED_PYTHON='true'
-        """)
-    ]
-    if native_tls:
-        lines.append("export UV_NATIVE_TLS='true'")
-    lines.append(
-        strip_and_dedent(f"""
-            export UV_PRERELEASE='disallow'
-            export UV_PYTHON='{python_version}'
-            if ! command -v uv >/dev/null 2>&1; then
-                echo_date "ERROR: 'uv' not found" && exit 1
-            fi
-            activate='.venv/bin/activate'
-            if [ -f $activate ]; then
-                . $activate
-            else
-                uv venv
-            fi
-        """)
-    )
-    args: list[str] = ["uv", "sync"]
-    if script is None:
-        args.extend(["--all-extras", "--all-groups"])
-    args.extend(["--active", "--locked"])
-    if script is not None:
-        args.extend(["--script", script])
-    lines.append(join(args))
-    return "\n".join(lines)
-
-
-##
-
-
-def add_github_pull_request_yaml(
-    *,
-    modifications: MutableSet[Path] | None = None,
-    pre_commit: bool = SETTINGS.github__pull_request__pre_commit,
-    pre_commit__gitea: bool = SETTINGS.github__pull_request__pre_commit__gitea,
-    pyright: bool = SETTINGS.github__pull_request__pyright,
-    pytest__macos: bool = SETTINGS.github__pull_request__pytest__macos,
-    pytest__ubuntu: bool = SETTINGS.github__pull_request__pytest__ubuntu,
-    pytest__windows: bool = SETTINGS.github__pull_request__pytest__windows,
+    pre_commit: bool = SETTINGS.ci__pull_request__pre_commit,
+    pyright: bool = SETTINGS.ci__pull_request__pyright,
+    pytest__macos: bool = SETTINGS.ci__pull_request__pytest__macos,
+    pytest__ubuntu: bool = SETTINGS.ci__pull_request__pytest__ubuntu,
+    pytest__windows: bool = SETTINGS.ci__pull_request__pytest__windows,
+    pytest__sops_age_key: str | None = SETTINGS.ci__pull_request__pytest__sops_age_key,
     pytest__timeout: int | None = SETTINGS.pytest__timeout,
     python_version: str = SETTINGS.python_version,
-    ruff: bool = SETTINGS.github__pull_request__ruff,
+    repo_name: str | None = SETTINGS.repo_name,
+    ruff: bool = SETTINGS.ci__pull_request__ruff,
     script: str | None = SETTINGS.script,
+    uv__native_tls: bool = SETTINGS.uv__native_tls,
 ) -> None:
-    with yield_yaml_dict(
-        GITHUB_PULL_REQUEST_YAML, modifications=modifications
-    ) as dict_:
+    path = GITEA_PULL_REQUEST_YAML if gitea else GITHUB_PULL_REQUEST_YAML
+    with yield_yaml_dict(path, modifications=modifications) as dict_:
         dict_["name"] = "pull-request"
         on = get_dict(dict_, "on")
         pull_request = get_dict(on, "pull_request")
         branches = get_list(pull_request, "branches")
         ensure_contains(branches, "master")
         schedule = get_list(on, "schedule")
-        ensure_contains(schedule, {"cron": "0 0 * * *"})
+        ensure_contains(schedule, {"cron": get_cron_job(repo_name=repo_name)})
         jobs = get_dict(dict_, "jobs")
         if pre_commit:
             pre_commit_dict = get_dict(jobs, "pre-commit")
             pre_commit_dict["runs-on"] = "ubuntu-latest"
             steps = get_list(pre_commit_dict, "steps")
+            if certificates:
+                ensure_contains(steps, update_ca_certificates_dict("pre-commit"))
             ensure_contains(
                 steps,
-                run_action_pre_commit_dict(
-                    repos=LiteralScalarString(
-                        strip_and_dedent("""
-                            dycw/actions
-                            pre-commit/pre-commit-hooks
-                        """)
-                    ),
-                    gitea=pre_commit__gitea,
+                action_run_hooks_dict(
+                    token=token, repos=["pre-commit/pre-commit-hooks"], gitea=gitea
                 ),
             )
         if pyright:
             pyright_dict = get_dict(jobs, "pyright")
             pyright_dict["runs-on"] = "ubuntu-latest"
             steps = get_list(pyright_dict, "steps")
+            if certificates:
+                ensure_contains(steps, update_ca_certificates_dict("pyright"))
             ensure_contains(
                 steps,
-                run_action_pyright_dict(
-                    python_version=python_version, with_requirements=script
+                action_pyright_dict(
+                    token=token,
+                    python_version=python_version,
+                    with_requirements=script,
+                    native_tls=uv__native_tls,
                 ),
             )
-        if pytest__macos or pytest__ubuntu or pytest__windows:
+        if (
+            pytest__macos
+            or pytest__ubuntu
+            or pytest__windows
+            or (pytest__sops_age_key is not None)
+            or pytest__timeout
+        ):
             pytest_dict = get_dict(jobs, "pytest")
             env = get_dict(pytest_dict, "env")
             env["CI"] = "1"
@@ -553,11 +499,16 @@ def add_github_pull_request_yaml(
             )
             pytest_dict["runs-on"] = "${{matrix.os}}"
             steps = get_list(pytest_dict, "steps")
+            if certificates:
+                ensure_contains(steps, update_ca_certificates_dict("pytest"))
             ensure_contains(
                 steps,
-                run_action_pytest_dict(
+                action_pytest_dict(
+                    token=token,
                     python_version="${{matrix.python-version}}",
+                    sops_age_key=pytest__sops_age_key,
                     resolution="${{matrix.resolution}}",
+                    native_tls=uv__native_tls,
                     with_requirements=script,
                 ),
             )
@@ -581,22 +532,30 @@ def add_github_pull_request_yaml(
             ruff_dict = get_dict(jobs, "ruff")
             ruff_dict["runs-on"] = "ubuntu-latest"
             steps = get_list(ruff_dict, "steps")
-            ensure_contains(steps, run_action_ruff_dict())
+            if certificates:
+                ensure_contains(steps, update_ca_certificates_dict("steps"))
+            ensure_contains(steps, action_ruff_dict(token=token))
 
 
 ##
 
 
-def add_github_push_yaml(
+def add_ci_push_yaml(
     *,
+    certificates: bool = SETTINGS.ci__ca_certificates,
+    gitea: bool = SETTINGS.ci__gitea,
+    token: str | None = SETTINGS.ci__token,
     modifications: MutableSet[Path] | None = None,
-    publish: bool = SETTINGS.github__push__publish,
-    tag: bool = SETTINGS.github__push__tag,
-    tag__major_minor: bool = SETTINGS.github__push__tag__major_minor,
-    tag__major: bool = SETTINGS.github__push__tag__major,
-    tag__latest: bool = SETTINGS.github__push__tag__latest,
+    publish: bool = SETTINGS.ci__push__publish,
+    publish__username: str | None = SETTINGS.ci__push__publish__username,
+    publish__password: Secret[str] | None = SETTINGS.ci__push__publish__password,
+    publish__publish_url: Secret[str] | None = SETTINGS.ci__push__publish__publish_url,
+    tag: bool = SETTINGS.ci__push__tag,
+    tag__all: bool = SETTINGS.ci__push__tag__all,
+    uv__native_tls: bool = SETTINGS.uv__native_tls,
 ) -> None:
-    with yield_yaml_dict(GITHUB_PUSH_YAML, modifications=modifications) as dict_:
+    path = GITEA_PUSH_YAML if gitea else GITHUB_PUSH_YAML
+    with yield_yaml_dict(path, modifications=modifications) as dict_:
         dict_["name"] = "push"
         on = get_dict(dict_, "on")
         push = get_dict(on, "push")
@@ -611,15 +570,28 @@ def add_github_push_yaml(
             permissions["id-token"] = "write"
             publish_dict["runs-on"] = "ubuntu-latest"
             steps = get_list(publish_dict, "steps")
-            ensure_contains(steps, run_action_publish_dict())
-        if tag or tag__major_minor or tag__major or tag__latest:
+            if certificates:
+                ensure_contains(steps, update_ca_certificates_dict("publish"))
+            ensure_contains(
+                steps,
+                action_publish_package_dict(
+                    token=token,
+                    username=publish__username,
+                    password=publish__password,
+                    publish_url=publish__publish_url,
+                    native_tls=uv__native_tls,
+                ),
+            )
+        if tag:
             tag_dict = get_dict(jobs, "tag")
             tag_dict["runs-on"] = "ubuntu-latest"
             steps = get_list(tag_dict, "steps")
+            if certificates:
+                ensure_contains(steps, update_ca_certificates_dict("tag"))
             ensure_contains(
                 steps,
-                run_action_tag_dict(
-                    major_minor=tag__major_minor, major=tag__major, latest=tag__latest
+                action_tag_commit_dict(
+                    major_minor=tag__all, major=tag__all, latest=tag__all
                 ),
             )
 
@@ -627,6 +599,98 @@ def add_github_push_yaml(
 ##
 
 
+def add_coveragerc_toml(*, modifications: MutableSet[Path] | None = None) -> None:
+    with yield_toml_doc(COVERAGERC_TOML, modifications=modifications) as doc:
+        html = get_table(doc, "html")
+        html["directory"] = ".coverage/html"
+        report = get_table(doc, "report")
+        exclude_also = get_array(report, "exclude_also")
+        ensure_contains(exclude_also, "@overload", "if TYPE_CHECKING:")
+        report["fail_under"] = 100.0
+        report["skip_covered"] = True
+        report["skip_empty"] = True
+        run = get_table(doc, "run")
+        run["branch"] = True
+        run["data_file"] = ".coverage/data"
+        run["parallel"] = True
+
+
+##
+
+
+def add_envrc(
+    *,
+    modifications: MutableSet[Path] | None = None,
+    uv: bool = SETTINGS.envrc__uv,
+    uv__native_tls: bool = SETTINGS.uv__native_tls,
+    python_version: str = SETTINGS.python_version,
+    script: str | None = SETTINGS.script,
+) -> None:
+    with yield_text_file(ENVRC, modifications=modifications) as context:
+        shebang = strip_and_dedent("""
+            #!/usr/bin/env sh
+            # shellcheck source=/dev/null
+        """)
+        if search(escape(shebang), context.output, flags=MULTILINE) is None:
+            context.output += f"\n\n{shebang}"
+
+        echo = strip_and_dedent("""
+            # echo
+            echo_date() { echo "[$(date +'%Y-%m-%d %H:%M:%S')] $*" >&2; }
+        """)
+        if search(escape(echo), context.output, flags=MULTILINE) is None:
+            context.output += f"\n\n{echo}"
+
+        if uv:
+            uv_text = _add_envrc_uv_text(
+                native_tls=uv__native_tls, python_version=python_version, script=script
+            )
+            if search(escape(uv_text), context.output, flags=MULTILINE) is None:
+                context.output += f"\n\n{echo}"
+
+
+def _add_envrc_uv_text(
+    *,
+    native_tls: bool = SETTINGS.uv__native_tls,
+    python_version: str = SETTINGS.python_version,
+    script: str | None = SETTINGS.script,
+) -> str:
+    lines: list[str] = [
+        strip_and_dedent("""
+            # uv
+            export UV_MANAGED_PYTHON='true'
+        """)
+    ]
+    if native_tls:
+        lines.append("export UV_NATIVE_TLS='true'")
+    lines.append(
+        strip_and_dedent(f"""
+            export UV_PRERELEASE='disallow'
+            export UV_PYTHON='{python_version}'
+            if ! command -v uv >/dev/null 2>&1; then
+                echo_date "ERROR: 'uv' not found" && exit 1
+            fi
+            activate='.venv/bin/activate'
+            if [ -f $activate ]; then
+                . $activate
+            else
+                uv venv
+            fi
+        """)
+    )
+    args: list[str] = ["uv", "sync"]
+    if script is None:
+        args.extend(["--all-extras", "--all-groups"])
+    args.extend(["--active", "--locked"])
+    if script is not None:
+        args.extend(["--script", script])
+    lines.append(join(args))
+    return "\n".join(lines)
+
+
+##
+
+
 def add_gitignore(*, modifications: MutableSet[Path] | None = None) -> None:
     with yield_text_file(GITIGNORE, modifications=modifications) as context:
         text = (PATH_CONFIGS / "gitignore").read_text()
@@ -695,6 +759,7 @@ def add_pre_commit_config_yaml(
             )
             _add_pre_commit_config_repo(dict_, ACTIONS_URL, TOUCH_EMPTY_PY_SUB_CMD)
             _add_pre_commit_config_repo(dict_, ACTIONS_URL, TOUCH_PY_TYPED_SUB_CMD)
+            _add_pre_commit_config_repo(dict_, ACTIONS_URL, UPDATE_REQUIREMENTS_SUB_CMD)
         if ruff:
             _add_pre_commit_config_repo(
                 dict_, RUFF_URL, "ruff-check", args=("add", ["--fix"])
@@ -1050,6 +1115,20 @@ def check_versions() -> None:
 ##
 
 
+def get_cron_job(*, repo_name: str | None = SETTINGS.repo_name) -> str:
+    if repo_name is None:
+        minute = hour = 0
+    else:
+        digest = blake2b(repo_name.encode(), digest_size=8).digest()
+        value = int.from_bytes(digest, "big")
+        minute = value % 60
+        hour = (value // 60) % 24
+    return f"{minute} {hour} * * *"
+
+
+##
+
+
 def get_python_package_name(
     *,
     package_name: str | None = SETTINGS.package_name,
@@ -1123,23 +1202,18 @@ def run_bump_my_version(*, modifications: MutableSet[Path] | None = None) -> Non
 ##
 
 
-def run_pre_commit_update(*, modifications: MutableSet[Path] | None = None) -> None:
-    cache = xdg_cache_home() / "conformalize" / get_repo_root().name
-    try:
-        text = cache.read_text()
-    except FileNotFoundError:
-        ...
-    else:
-        prev = ZonedDateTime.parse_iso(text.rstrip("\n"))
-        if prev >= (get_now() - 12 * HOUR):
-            return
-    write_text(cache, get_now().format_iso())
+def _run_pre_commit_update(*, modifications: MutableSet[Path] | None = None) -> None:
     current = PRE_COMMIT_CONFIG_YAML.read_text()
     logged_run("pre-commit", "autoupdate", print=True)
     if (modifications is not None) and (PRE_COMMIT_CONFIG_YAML.read_text() != current):
         modifications.add(PRE_COMMIT_CONFIG_YAML)
 
 
+run_pre_commit_update = throttle(
+    delta=12 * HOUR, path=PATH_THROTTLE_CACHE / _run_pre_commit_update.__name__
+)(_run_pre_commit_update)
+
+
 ##
 
 
@@ -1266,10 +1340,10 @@ def _yield_python_version_tuple(version: str, /) -> tuple[int, int]:
 
 __all__ = [
     "add_bumpversion_toml",
+    "add_ci_pull_request_yaml",
+    "add_ci_push_yaml",
     "add_coveragerc_toml",
     "add_envrc",
-    "add_github_pull_request_yaml",
-    "add_github_push_yaml",
     "add_gitignore",
     "add_pre_commit_config_yaml",
     "add_pyproject_toml",
@@ -1278,6 +1352,7 @@ __all__ = [
     "add_readme_md",
     "add_ruff_toml",
     "check_versions",
+    "get_cron_job",
     "get_python_package_name",
     "get_version_from_bumpversion_toml",
     "get_version_from_git_show",