git-worktrees 0.5.1__tar.gz → 0.6.1__tar.gz

git_worktrees-0.6.1/.github/workflows/codeql.yml

@@ -0,0 +1,48 @@
+name: CodeQL
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  # New queries reach code nobody has pushed to.
+  schedule:
+    - cron: "17 4 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }}, ${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, ubuntu-26.04]
+        language: [actions, python]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      # Neither language compiles, so build-mode none reads the source as it
+      # is and nothing has to be installed first.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+
+      # The category carries the runner, so the two uploads for one language
+      # are two analyses rather than one replacing the other.
+      - name: Analyze
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        with:
+          category: /language:${{ matrix.language }}/os:${{ matrix.os }}

{git_worktrees-0.5.1 → git_worktrees-0.6.1}/.github/workflows/publish.yml

@@ -36,7 +36,7 @@ jobs:
   # byte-for-byte what was tested and installed here.
   build:
     name: Build
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       # Reading another workflow's runs. Without it the tests guard below
@@ -127,7 +127,7 @@ jobs:
 
   publish:
     name: Publish to PyPI
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     needs: build
     # Binds this job to the trusted publisher registered for `pypi`. Add a
     # required reviewer on this environment for a manual gate before anything
@@ -163,8 +163,12 @@ jobs:
   # PyPI can take time to serve an accepted upload. Verification runs in a
   # separate job so that delay does not block the GitHub release.
   verify:
-    name: Verify PyPI install and attestations
-    runs-on: ubuntu-26.04
+    name: Verify PyPI install and attestations (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, ubuntu-26.04]
     needs: publish
     permissions:
       contents: read
@@ -188,17 +192,32 @@ jobs:
           name: dist
           path: dist/
 
-      # The install check waits for PyPI to serve the files.
+      # The install check resolves the wheel alone, so the sdist can still be
+      # missing from PyPI here. A file PyPI does not serve yet is asked again,
+      # backing off from 15s over eight attempts as the install check does;
+      # any other failure ends the job at once.
       - name: Verify attestations on PyPI
         run: |
           for f in dist/*.whl dist/*.tar.gz; do
-            uvx pypi-attestations@0.0.30 verify pypi \
-              --repository "https://github.com/$GITHUB_REPOSITORY" "pypi:${f#dist/}"
+            file="${f#dist/}"
+            delay=15
+            for attempt in 1 2 3 4 5 6 7 8; do
+              code=0
+              uvx pypi-attestations@0.0.30 verify pypi \
+                --repository "https://github.com/$GITHUB_REPOSITORY" "pypi:$file" 2>err.txt || code=$?
+              cat err.txt >&2
+              [ "$code" -ne 0 ] || break
+              grep -q "Could not find the artifact" err.txt || exit 1
+              [ "$attempt" -lt 8 ] || exit 1
+              echo "waiting ${delay}s for PyPI to serve $file (attempt $attempt/8)..." >&2
+              sleep "$delay"
+              delay=$((delay * 2))
+            done
           done
 
   release:
     name: Release
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     needs: publish
     permissions:
       contents: write

{git_worktrees-0.5.1 → git_worktrees-0.6.1}/.github/workflows/testpypi.yml

@@ -28,7 +28,7 @@ permissions:
 jobs:
   snapshot:
     name: Publish a snapshot
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     # Binds this job to the trusted publisher registered for `testpypi`.
     environment: testpypi
     permissions:

{git_worktrees-0.5.1 → git_worktrees-0.6.1}/.github/workflows/tests.yml

@@ -22,8 +22,12 @@ concurrency:
 
 jobs:
   lint:
-    name: Lint
-    runs-on: ubuntu-26.04
+    name: Lint (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, ubuntu-26.04]
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -33,7 +37,7 @@ jobs:
         with:
           python-version: "3.14"
           enable-cache: true
-          cache-suffix: ${{ github.workflow }}-${{ github.job }}
+          cache-suffix: ${{ github.workflow }}-${{ github.job }}-${{ matrix.os }}
 
       - name: Install dependencies
         run: uv sync --all-extras --locked
@@ -44,13 +48,14 @@ jobs:
         run: uv run --no-sync pre-commit run --all-files --show-diff-on-failure
 
   test:
-    name: Python ${{ matrix.python-version }}
-    runs-on: ubuntu-26.04
+    name: Python ${{ matrix.python-version }} (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
     strategy:
       # One version failing is a fact about that version, so let the others
       # finish and say which.
       fail-fast: false
       matrix:
+        os: [ubuntu-24.04, ubuntu-26.04]
         python-version: ["3.11", "3.12", "3.13", "3.14"]
 
     steps:
@@ -67,7 +72,7 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
           enable-cache: true
-          cache-suffix: ${{ github.workflow }}-${{ github.job }}
+          cache-suffix: ${{ github.workflow }}-${{ github.job }}-${{ matrix.os }}
 
       - name: Install dependencies
         # --locked fails the run on a stale uv.lock, rather than quietly

{git_worktrees-0.5.1 → git_worktrees-0.6.1}/.releasetools.yaml

@@ -10,7 +10,9 @@ projects:
   - path: ./
     manifest: pyproject.toml
     changelog: CHANGELOG.md
-    bump: uv version {version}
+    # `uv version` for pyproject.toml and uv.lock, then the copies the shell
+    # plugins and the README's install lines carry.
+    bump: python3 scripts/bump_version.py {version}
 
 release:
   branch: main

{git_worktrees-0.5.1 → git_worktrees-0.6.1}/AGENTS.md

@@ -40,7 +40,7 @@ function too, so this is the agent path as much as the human one.
 
 | | changes directory | ships as |
 | --- | --- | --- |
-| `gws`, `gwp`, `gwbs`, `gwbd`, `gwnb`, `gwrot`, `gwh` | no | a console script, and nothing else |
+| `gws`, `gwp`, `gwbs`, `gwbd`, `gwbc`, `gwrot`, `gwh` | no | a console script, and nothing else |
 | a command that lands you somewhere | yes | a console script, plus a function of the same name |
 
 A binary cannot `cd` its caller. That is the only thing shell code is here for,
@@ -75,18 +75,18 @@ It calls the `gwr` function rather than `command gwr`, so the caller still
 lands where the binary says, and it has no console script of its own.
 `SHORTCUTS` in `tests/test_shims.py` lists them and holds each to one line.
 
-## Two commands are alpha
+## Two commands start branches
 
-`gwnb` and `gwrot` start branches, not worktrees. `origin new-branch` and
-`origin rotate` do the same job, only one of the two sets survives, and
-nothing has decided which. So they match `origin` rather than improve on it:
-the name format, the stem-stripping and the remote-aware collision check are
-copied, and a difference between them is a decision somebody has to make
-later. Say so wherever they are documented.
+`gwbc` and `gwrot` start branches, not worktrees, and do the job
+`origin new-branch` and `origin rotate` do. The name format, the
+stem-stripping and the remote-aware collision check are the same in both, so
+a branch either one names is one the other would have named.
 
-Exit codes are the one deliberate divergence. `origin` has a single non-zero
-code and draws no line between a usage error and a runtime one; this CLI
-keeps argparse's 2 for a usage error.
+Two divergences are deliberate. `origin` has a single non-zero exit code and
+draws no line between a usage error and a runtime one; this CLI keeps
+argparse's 2 for a usage error. And `gwrot` refuses, at exit 1, a rotation or
+catch-up that would change nothing, where `origin rotate` makes a branch at
+the same commit under a new name.
 
 ## Where shell code goes
 
@@ -105,6 +105,14 @@ zsh/plugins/worktrees/completions/_gwa
 Neither manager puts a binary on `$PATH`. The console scripts arrive through
 `uv tool install` from the published package, which is a separate step.
 
+Both plugins export `WORKTREES_PLUGIN_VERSION`, the release they came from:
+`conf.d/worktrees.fish` and `worktrees.plugin.zsh`, one assignment each.
+`gwh` and `gw version` compare it with `__version__`, in Python; the shell
+files hold the value and no logic. Nothing built can stamp a file a plugin
+manager copies from git, so `scripts/bump_version.py` writes it at release,
+along with the tag in the README's install lines, and `tests/test_version.py`
+fails when a copy disagrees with `pyproject.toml`.
+
 Nothing installs this from a checkout on the user's disk. It is consumed as a
 third-party plugin and a third-party tool, so anything that assumes a local
 clone at a known path is wrong here.
@@ -240,12 +248,33 @@ on a terminal: both are what a script reads. The colour is applied at the
 call site that formats a table, and neither path passes a code to one.
 
 `progress.py` draws a spinner on stderr and one line saying what is being
-checked, while `gws`, `gwp` and `gwr` fetch and judge. It runs only when
+checked, while `gws`, `gwp`, `gwr`, `gwbs` and `gwbd` fetch and judge. It runs only when
 stderr is a terminal that can clear a line, and never under `-q` or `-v`,
 since the verbose log writes to the line it redraws. Anything else printed on
 stderr while it spins goes through `progress.line`, which clears the spinner
 first.
 
+Every message on stderr goes through `render.fail`, `render.warn` or
+`render.note`, a usage error and a cancelled picker included. On a terminal
+each leads with its symbol, `✗`, `!` or `→`, and its first line makes flags
+and quoted commands bold, paths dim and shas yellow. A path is a word that
+starts with `/`, `~/`, `./` or `../`, taken whole, so a directory named `-x`
+is not a flag and a uuid inside one is not a sha. A failure prints every line
+red; a warning or a note dims the lines after its first.
+
+A branch name is wrapped in `render.branch` and a ref such as `origin/main` in
+`render.ref` where the message is built, since no pattern tells a branch from
+prose; the passes after leave those alone. A branch is bold magenta wherever
+it prints: a table, the picker, a message, a result line. A prompt is
+`render.ask`, the question bold and the answers it takes dim. The line that
+puts a branch back is `render.restore`, painted the way a table paints a
+branch and a sha, and it pastes the same. Off a terminal it is the words
+alone, so a test or a log reads what the code wrote. `-v` prints each command once it has run, as
+`render.trace` lays it out: the line that pastes back, what it printed,
+indented, its exit code when that is not 0 or is the only answer, then a
+blank line. Printing after the run keeps a command and its answer together
+when eight threads are asking at once.
+
 ## A recent fetch, and a forge answer that cannot change, are reused
 
 The README's "What is reused, and for how long" table lists every case and

{git_worktrees-0.5.1 → git_worktrees-0.6.1}/CHANGELOG.md

@@ -17,6 +17,77 @@ not in here, whatever it cost to build.
 A release closes with a `### Choices` section when a decision in it is worth
 the reader's time: what was chosen, and what the alternative failed to do.
 
+## 0.6.1 - 2026-11-02
+
+### Added
+
+`gwh` says which release the shell plugin in this shell came from, and whether
+it matches the commands. When the plugin is older, it names the tag to pin it
+to, and when newer, it gives the `uv tool upgrade git-worktrees` to run.
+`gw version` says the same on stderr, and its stdout is still the version
+alone. Both plugins export `WORKTREES_PLUGIN_VERSION` for this. A shell whose
+plugin predates this release reports none.
+
+### Changed
+
+The README installs the plugins at the release's tag, `fisher install
+MihaiBojin/worktrees@v0.6.1` for fish and `branch:v0.6.1` for Antidote, and
+says how to move each to another release. Moving an existing install onto a
+tag takes an edit to `fish_plugins` and `fisher update`, or `antidote purge
+MihaiBojin/worktrees` before editing the tag.
+
+## 0.6.0 - 2026-11-02
+
+### Changed
+
+`gwnb` is now `gwbc`, and `gw new-branch` is now `gw branch create`. Update
+the fish or zsh plugin so the new name completes. `gwbc` and `gwrot` are no
+longer marked alpha.
+
+`gwrot` prints the branch it left and the one it is on now, each with its
+commit, and exits 1 when a rotation or catch-up would change nothing.
+
+On a terminal, every command colours its output the same way: errors red
+behind ✗, warnings behind !, notes behind →, branches bold magenta, refs
+blue, commits yellow, paths dim, and each verdict in one colour wherever it
+appears. Piped or redirected output, and any run with `NO_COLOR` set, stays
+plain.
+
+`gwl`, `gws`, `gwp` and `gwr` list the main checkout first, then the other
+worktrees from oldest to newest.
+
+`-v` prints each git and `gh` command after it runs, with what it printed and
+its exit code indented beneath it.
+
+`gwp` names the worktrees it removed.
+
+### Added
+
+`gws` and `gwbs` take `--only VERDICT`, repeatable, to show only the rows
+marked `remove`, `keep` or `unknown`, in the table and in `--json`. The counts
+under the table still cover every row. Both also take `-f` for
+`--force-refresh`.
+
+`gwrot -f` is short for `gwrot --force-refresh`.
+
+`gwbd` shows each branch's verdict in its selector and in the list it prints
+before asking, and a `--dry-run` ends by saying how many branches would go.
+
+`gwbs` and `gwbd` show a spinner on stderr while they judge, with a line
+naming the branch, the check in progress and how far through the list they
+are, such as `fix-parser: was it squash-merged into main? (4 of 18)`. `gwbd`
+keeps it running while it rechecks each branch before deleting it. It stays
+off when stderr is not a terminal, on `TERM=dumb`, and under `-q` or `-v`.
+
+`gwl` names each remote above the picker as host and path, such as
+`origin: github.com/org/repo`, for SSH and HTTPS remotes alike and without
+any user name or token the URL carries.
+
+### Fixed
+
+`gwbd` says why it kept each branch it was asked to delete, rather than
+exiting 3 with nothing printed.
+
 ## 0.5.1 - 2026-09-29
 
 ### Added

git_worktrees-0.6.1/Makefile

@@ -0,0 +1,9 @@
+.PHONY: local-install reset
+
+# The working copy, in place of anything published.
+local-install:
+	uv tool install --force --from . git-worktrees
+
+# Undoes local-install: the latest release from PyPI, and only its commands.
+reset:
+	uv tool install --force git-worktrees