repomatic 6.18.2__tar.gz → 6.18.4__tar.gz

{repomatic-6.18.2 → repomatic-6.18.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: repomatic
-Version: 6.18.2
+Version: 6.18.4
 Summary: 🏭 Automate repository maintenance, releases, and CI/CD workflows
 Keywords: changelog-formatter,dependabot-alternative,github-actions,github-labels,github-workflow,gitignore,mailmap,mypy,nuitka,python-automation,release-automation,renovate,repository-automation,repository-management,reusable-workflows,software-factory,sphinx-doc,typo,uv,workflow-reusable
 Author: Kevin Deldycke
@@ -60,7 +60,7 @@ Requires-Dist: wcmatch>=10
 Requires-Python: >=3.10
 Project-URL: Changelog, https://github.com/kdeldycke/repomatic/blob/main/changelog.md
 Project-URL: Documentation, https://kdeldycke.github.io/repomatic
-Project-URL: Download, https://github.com/kdeldycke/repomatic/releases/tag/v6.18.2
+Project-URL: Download, https://github.com/kdeldycke/repomatic/releases/tag/v6.18.4
 Project-URL: Funding, https://github.com/sponsors/kdeldycke
 Project-URL: Homepage, https://github.com/kdeldycke/repomatic
 Project-URL: Issues, https://github.com/kdeldycke/repomatic/issues

{repomatic-6.18.2 → repomatic-6.18.4}/pyproject.toml

@@ -5,7 +5,7 @@ requires = [ "uv-build>=0.9" ]
 [project]
 # Docs: https://packaging.python.org/en/latest/guides/writing-pyproject-toml/
 name = "repomatic"
-version = "6.18.2"
+version = "6.18.4"
 description = "🏭 Automate repository maintenance, releases, and CI/CD workflows"
 readme = "readme.md"
 keywords = [
@@ -124,7 +124,7 @@ repomatic = "repomatic.__main__:main"
 [project.urls]
 "Changelog" = "https://github.com/kdeldycke/repomatic/blob/main/changelog.md"
 "Documentation" = "https://kdeldycke.github.io/repomatic"
-"Download" = "https://github.com/kdeldycke/repomatic/releases/tag/v6.18.2"
+"Download" = "https://github.com/kdeldycke/repomatic/releases/tag/v6.18.4"
 "Funding" = "https://github.com/sponsors/kdeldycke"
 "Homepage" = "https://github.com/kdeldycke/repomatic"
 "Issues" = "https://github.com/kdeldycke/repomatic/issues"
@@ -187,10 +187,13 @@ dependency-groups.docs = { requires-python = ">= 3.14" }
 # uv.lock for relative spans, so re-resolving never produces churn.
 exclude-newer = "1 week"
 # repomatic is pinned to git main.
-# extra-platforms 12.0.0 fixes is_macos() shelling out on Windows
-# (https://github.com/kdeldycke/extra-platforms): bypass the cooldown so the
+# Nuitka 4.1 fixes uv_build backend recognition
+# (https://github.com/Nuitka/Nuitka/issues/3750): bypass the cooldown so the
 # fix lands without waiting a week.
-exclude-newer-package = { repomatic = "0 day" }
+# GitPython 3.1.50 patches CVE-2026-42215 bypass (newline injection in
+# config_writer section parameter): bypass the cooldown to pull the security
+# fix immediately.
+exclude-newer-package = { nuitka = "0 day", repomatic = "0 day" }
 # Package is at root level, not in "./src/".
 build-backend.module-root = ""
 
@@ -275,7 +278,7 @@ run.source = [ "repomatic" ]
 report.precision = 2
 
 [tool.bumpversion]
-current_version = "6.18.2"
+current_version = "6.18.4"
 allow_dirty = true
 ignore_missing_files = true
 # Parse versions with an optional .devN suffix (PEP 440).

{repomatic-6.18.2 → repomatic-6.18.4}/repomatic/__init__.py

@@ -17,5 +17,5 @@
 
 from __future__ import annotations
 
-__version__ = "6.18.2"
-__git_tag_sha__ = "bc1a04cee565d9ccdf32b167972799b66dfbf3a6"
+__version__ = "6.18.4"
+__git_tag_sha__ = "ba0f8e2bc9d7967d598f7f4f1f10ff923edcc1a7"

{repomatic-6.18.2 → repomatic-6.18.4}/repomatic/config.py

@@ -486,10 +486,11 @@ class Config:
 
     Use this to opt into components that are excluded by default (`labels`,
     `skills`). Each entry is subtracted from the effective exclude set
-    (defaults + user `exclude`) and bypasses `RepoScope` filtering,
-    so scope-restricted files (like awesome-only skills) are included
-    regardless of repository type. Qualified entries (`component/file`)
-    implicitly select the parent component. Same syntax as `exclude`.
+    (defaults + user `exclude`) and bypasses `RepoScope` filtering, so
+    scope-restricted components (like awesome-only skills or Python-only
+    `publish-pypi-action`) are included regardless of repository type.
+    Qualified entries (`component/file`) implicitly select the parent
+    component. Same syntax as `exclude`.
     """
 
     labels: LabelsConfig = field(

{repomatic-6.18.2 → repomatic-6.18.4}/repomatic/data/autofix.yaml

@@ -22,8 +22,12 @@ jobs:
 
   setup-guide:
     name: 📖 Setup guide
-    # Only run on push to the default branch, not on workflow_call from downstream.
-    if: github.event_name == 'push'
+    # Run on push to the default branch and on manual workflow_dispatch
+    # re-runs. Not gated against workflow_call invocations from downstream
+    # callers: when called that way the job runs in the caller's repo
+    # context (via GITHUB_REPOSITORY) and manages the caller's own
+    # setup-guide issue.
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-slim
     permissions:
       issues: write
@@ -35,7 +39,7 @@ jobs:
           GH_TOKEN: ${{ secrets.REPOMATIC_PAT || github.token }}
           REPOMATIC_PAT: ${{ secrets.REPOMATIC_PAT }}
           HAS_VIRUSTOTAL_API_KEY: ${{ secrets.VIRUSTOTAL_API_KEY && 'true' || '' }}
-        run: uvx --no-progress 'repomatic==6.18.2' setup-guide
+        run: uvx --no-progress 'repomatic==6.18.4' setup-guide
 
   metadata:
     name: 🧬 Project metadata
@@ -48,7 +52,7 @@ jobs:
       - name: Run repomatic metadata
         id: metadata
         run: >
-          uvx --no-progress 'repomatic==6.18.2' metadata
+          uvx --no-progress 'repomatic==6.18.4' metadata
           --format github-json --output "$GITHUB_OUTPUT"
           gitignore_exists python_files pyproject_files json_files doc_files
           markdown_files is_python_project mailmap_exists
@@ -77,16 +81,16 @@ jobs:
         # Explicit list of files is provided, as autopep8 is not able to handle find files in ".github" subdirectory.
         env:
           PYTHON_FILES: ${{ fromJSON(needs.metadata.outputs.metadata).python_files }}
-        run: echo "${PYTHON_FILES}" | xargs uvx --no-progress 'repomatic==6.18.2' run autopep8 --
+        run: echo "${PYTHON_FILES}" | xargs uvx --no-progress 'repomatic==6.18.4' run autopep8 --
       # XXX Ruff is planning to support linting and formatting in one unified command at one point.
       #     See: https://github.com/astral-sh/ruff/issues/8232
       - name: Run Ruff
         run: |
-          uvx --no-progress 'repomatic==6.18.2' run ruff -- check --output-format github
-          uvx --no-progress 'repomatic==6.18.2' run ruff -- format --output-format github
+          uvx --no-progress 'repomatic==6.18.4' run ruff -- check --output-format github
+          uvx --no-progress 'repomatic==6.18.4' run ruff -- format --output-format github
       - id: pr-metadata
         run: >
-          uvx --no-progress 'repomatic==6.18.2' pr-body --output-format github-actions
+          uvx --no-progress 'repomatic==6.18.4' pr-body --output-format github-actions
           --template format-python
           --output "$GITHUB_OUTPUT"
       - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
@@ -120,11 +124,11 @@ jobs:
           PYPROJECT_FILES: ${{ fromJSON(needs.metadata.outputs.metadata).pyproject_files }}
         run: |
           rc=0
-          echo "${PYPROJECT_FILES}" | xargs uvx --no-progress 'repomatic==6.18.2' run pyproject-fmt -- || rc=$?
+          echo "${PYPROJECT_FILES}" | xargs uvx --no-progress 'repomatic==6.18.4' run pyproject-fmt -- || rc=$?
           [ "$rc" -eq 0 ] || [ "$rc" -eq 123 ] || exit "$rc"
       - id: pr-metadata
         run: >
-          uvx --no-progress 'repomatic==6.18.2' pr-body --output-format github-actions
+          uvx --no-progress 'repomatic==6.18.4' pr-body --output-format github-actions
           --template format-pyproject
           --output "$GITHUB_OUTPUT"
       - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
@@ -157,7 +161,7 @@ jobs:
       - name: Auto-format Markdown
         env:
           MARKDOWN_FILES: ${{ fromJSON(needs.metadata.outputs.metadata).markdown_files }}
-        run: echo "${MARKDOWN_FILES}" | xargs -n1 uvx --no-progress 'repomatic==6.18.2' run mdformat --
+        run: echo "${MARKDOWN_FILES}" | xargs -n1 uvx --no-progress 'repomatic==6.18.4' run mdformat --
       - name: Markdown fixes for Awesome Lists
         if: startsWith(github.event.repository.name, 'awesome-')
         # Remove forbidden TOC entries: https://github.com/sindresorhus/awesome-lint/blob/v2.2.2/rules/toc.js#L14-L18
@@ -172,7 +176,7 @@ jobs:
           -exec gawk -i inplace '!/^- \[(Contents|Contributing|Footnotes|Related Lists)\]\(#.+\)$/{print}' "{}" \;
       - id: pr-metadata
         run: >
-          uvx --no-progress 'repomatic==6.18.2' pr-body --output-format github-actions
+          uvx --no-progress 'repomatic==6.18.4' pr-body --output-format github-actions
           --template format-markdown
           --output "$GITHUB_OUTPUT"
       - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
@@ -207,10 +211,10 @@ jobs:
       - name: Format shell scripts
         env:
           SHELL_FILES: ${{ fromJSON(needs.metadata.outputs.metadata).shfmt_files }}
-        run: echo "${SHELL_FILES}" | xargs uvx --no-progress 'repomatic==6.18.2' run shfmt --
+        run: echo "${SHELL_FILES}" | xargs uvx --no-progress 'repomatic==6.18.4' run shfmt --
       - id: pr-metadata
         run: >
-          uvx --no-progress 'repomatic==6.18.2' pr-body --output-format github-actions
+          uvx --no-progress 'repomatic==6.18.4' pr-body --output-format github-actions
           --template format-shell
           --output "$GITHUB_OUTPUT"
       - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
@@ -249,12 +253,12 @@ jobs:
           JSON_FILES: ${{ fromJSON(needs.metadata.outputs.metadata).json_files }}
         run: |
           echo "${JSON_FILES}" | xargs \
-            uvx --no-progress 'repomatic==6.18.2' run biome -- \
+            uvx --no-progress 'repomatic==6.18.4' run biome -- \
             format --write --no-errors-on-unmatched \
             --json-parse-allow-comments=true --json-parse-allow-trailing-commas=true
       - id: pr-metadata
         run: >
-          uvx --no-progress 'repomatic==6.18.2' pr-body --output-format github-actions
+          uvx --no-progress 'repomatic==6.18.4' pr-body --output-format github-actions
           --template format-json
           --output "$GITHUB_OUTPUT"
       - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
@@ -286,10 +290,10 @@ jobs:
           restore-keys: |
             repomatic-bin-${{ runner.os }}-${{ runner.arch }}-typos-
       - name: Fix typos
-        run: uvx --no-progress 'repomatic==6.18.2' run typos
+        run: uvx --no-progress 'repomatic==6.18.4' run typos
       - id: pr-metadata
         run: >
-          uvx --no-progress 'repomatic==6.18.2' pr-body --output-format github-actions
+          uvx --no-progress 'repomatic==6.18.4' pr-body --output-format github-actions
           --template fix-typos
           --output "$GITHUB_OUTPUT"
       - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
@@ -326,14 +330,14 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.REPOMATIC_PAT || github.token }}
         run: >
-          uvx --no-progress 'repomatic==6.18.2' fix-vulnerable-deps
+          uvx --no-progress 'repomatic==6.18.4' fix-vulnerable-deps
           --repo "${{ github.repository }}"
           --output "$GITHUB_OUTPUT" --output-format github-actions
       - id: pr-metadata
         env:
           REPOMATIC_DIFF_TABLE: ${{ steps.fix.outputs.diff_table }}
         run: >
-          uvx --no-progress 'repomatic==6.18.2' pr-body --output-format github-actions
+          uvx --no-progress 'repomatic==6.18.4' pr-body --output-format github-actions
           --template fix-vulnerable-deps
           --output "$GITHUB_OUTPUT"
       - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
@@ -358,11 +362,11 @@ jobs:
       - uses: astral-sh/setup-uv@6ee6290f1cbc4156c0bdd66691b2c144ef8df19a # v7.4.0
       - name: Sync repomatic-managed files
         run: >
-          uvx --no-progress 'repomatic==6.18.2' init
+          uvx --no-progress 'repomatic==6.18.4' init
           --delete-unmodified --delete-excluded
       - id: pr-metadata
         run: >
-          uvx --no-progress 'repomatic==6.18.2' pr-body --output-format github-actions
+          uvx --no-progress 'repomatic==6.18.4' pr-body --output-format github-actions
           --template sync-repomatic
           --output "$GITHUB_OUTPUT"
       - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
@@ -404,13 +408,13 @@ jobs:
       - name: Format images
         id: format
         run: >
-          uvx --no-progress 'repomatic==6.18.2' format-images
+          uvx --no-progress 'repomatic==6.18.4' format-images
           --output "$GITHUB_OUTPUT" --output-format github-actions
       - id: pr-metadata
         env:
           GHA_PR_BODY_PREFIX: ${{ steps.format.outputs.markdown }}
         run: >
-          uvx --no-progress 'repomatic==6.18.2' pr-body --output-format github-actions
+          uvx --no-progress 'repomatic==6.18.4' pr-body --output-format github-actions
           --template format-images
           --output "$GITHUB_OUTPUT"
       - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
@@ -439,10 +443,10 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: astral-sh/setup-uv@6ee6290f1cbc4156c0bdd66691b2c144ef8df19a # v7.4.0
       - name: Sync .gitignore
-        run: uvx --no-progress 'repomatic==6.18.2' sync-gitignore
+        run: uvx --no-progress 'repomatic==6.18.4' sync-gitignore
       - id: pr-metadata
         run: >
-          uvx --no-progress 'repomatic==6.18.2' pr-body --output-format github-actions
+          uvx --no-progress 'repomatic==6.18.4' pr-body --output-format github-actions
           --template sync-gitignore
           --output "$GITHUB_OUTPUT"
       - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
@@ -469,10 +473,10 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: astral-sh/setup-uv@6ee6290f1cbc4156c0bdd66691b2c144ef8df19a # v7.4.0
       - name: Sync bumpversion config
-        run: uvx --no-progress 'repomatic==6.18.2' sync-bumpversion
+        run: uvx --no-progress 'repomatic==6.18.4' sync-bumpversion
       - id: pr-metadata
         run: >
-          uvx --no-progress 'repomatic==6.18.2' pr-body --output-format github-actions
+          uvx --no-progress 'repomatic==6.18.4' pr-body --output-format github-actions
           --template sync-bumpversion
           --output "$GITHUB_OUTPUT"
       - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
@@ -502,10 +506,10 @@ jobs:
           fetch-depth: 0
       - uses: astral-sh/setup-uv@6ee6290f1cbc4156c0bdd66691b2c144ef8df19a # v7.4.0
       - name: Sync .mailmap
-        run: uvx --no-progress 'repomatic==6.18.2' sync-mailmap --skip-if-missing
+        run: uvx --no-progress 'repomatic==6.18.4' sync-mailmap --skip-if-missing
       - id: pr-metadata
         run: >
-          uvx --no-progress 'repomatic==6.18.2' pr-body --output-format github-actions
+          uvx --no-progress 'repomatic==6.18.4' pr-body --output-format github-actions
           --template sync-mailmap
           --output "$GITHUB_OUTPUT"
       - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
@@ -534,14 +538,14 @@ jobs:
       - id: sync
         name: Sync uv.lock
         run: >
-          uvx --no-progress 'repomatic==6.18.2' sync-uv-lock
+          uvx --no-progress 'repomatic==6.18.4' sync-uv-lock
           --no-table --release-notes
           --output "$GITHUB_OUTPUT" --output-format github-actions
       - id: pr-metadata
         env:
           REPOMATIC_DIFF_TABLE: ${{ steps.sync.outputs.diff_table }}
         run: >
-          uvx --no-progress 'repomatic==6.18.2' pr-body --output-format github-actions
+          uvx --no-progress 'repomatic==6.18.4' pr-body --output-format github-actions
           --template sync-uv-lock
           --output "$GITHUB_OUTPUT"
       - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
@@ -572,10 +576,10 @@ jobs:
       - uses: astral-sh/setup-uv@6ee6290f1cbc4156c0bdd66691b2c144ef8df19a # v7.4.0
       - name: Generate graph
         # Package name and output path are auto-detected from pyproject.toml.
-        run: uvx --no-progress 'repomatic==6.18.2' update-deps-graph
+        run: uvx --no-progress 'repomatic==6.18.4' update-deps-graph
       - id: pr-metadata
         run: >
-          uvx --no-progress 'repomatic==6.18.2' pr-body --output-format github-actions
+          uvx --no-progress 'repomatic==6.18.4' pr-body --output-format github-actions
           --template update-deps-graph
           --output "$GITHUB_OUTPUT"
       - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
@@ -607,10 +611,10 @@ jobs:
       - uses: astral-sh/setup-uv@6ee6290f1cbc4156c0bdd66691b2c144ef8df19a # v7.4.0
       - name: Update docs
         # Runs sphinx-apidoc, converts RST stubs to MyST if applicable, then runs docs/docs_update.py.
-        run: uvx --no-progress 'repomatic==6.18.2' update-docs
+        run: uvx --no-progress 'repomatic==6.18.4' update-docs
       - id: pr-metadata
         run: >
-          uvx --no-progress 'repomatic==6.18.2' pr-body --output-format github-actions
+          uvx --no-progress 'repomatic==6.18.4' pr-body --output-format github-actions
           --template update-docs
           --output "$GITHUB_OUTPUT"
       - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1

{repomatic-6.18.2 → repomatic-6.18.4}/repomatic/data/changelog.yaml

@@ -62,7 +62,7 @@ jobs:
       - name: Run repomatic metadata
         id: metadata
         run: >
-          uvx --no-progress 'repomatic==6.18.2' metadata
+          uvx --no-progress 'repomatic==6.18.4' metadata
           --format github-json --output "$GITHUB_OUTPUT"
           minor_bump_allowed major_bump_allowed release_commits_matrix
 
@@ -90,10 +90,10 @@ jobs:
       - name: Fix changelog dates and admonitions
         env:
           GH_TOKEN: ${{ github.token }}
-        run: uvx --no-progress 'repomatic==6.18.2' lint-changelog --fix
+        run: uvx --no-progress 'repomatic==6.18.4' lint-changelog --fix
       - id: pr-metadata
         run: >
-          uvx --no-progress 'repomatic==6.18.2' pr-body --output-format github-actions
+          uvx --no-progress 'repomatic==6.18.4' pr-body --output-format github-actions
           --template fix-changelog
           --output "$GITHUB_OUTPUT"
       - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
@@ -135,14 +135,14 @@ jobs:
         if: fromJSON(needs.metadata.outputs.metadata)[format('{0}_bump_allowed', matrix.part)]
       - name: ${{ matrix.part }} version bump
         if: fromJSON(needs.metadata.outputs.metadata)[format('{0}_bump_allowed', matrix.part)]
-        run: uvx --no-progress 'repomatic==6.18.2' run bump-my-version -- bump --verbose ${{ matrix.part }}
+        run: uvx --no-progress 'repomatic==6.18.4' run bump-my-version -- bump --verbose ${{ matrix.part }}
       - name: Sync uv.lock
         if: fromJSON(needs.metadata.outputs.metadata)[format('{0}_bump_allowed', matrix.part)]
         run: uv --no-progress sync
       - id: pr-metadata
         if: fromJSON(needs.metadata.outputs.metadata)[format('{0}_bump_allowed', matrix.part)]
         run: >
-          uvx --no-progress 'repomatic==6.18.2' pr-body --output-format github-actions
+          uvx --no-progress 'repomatic==6.18.4' pr-body --output-format github-actions
           --template bump-version
           --part "${{ matrix.part }}"
           --output "$GITHUB_OUTPUT"
@@ -175,17 +175,17 @@ jobs:
       # --- Freeze commit: freeze everything to the release version. ---
       - name: Strip dev suffix for release
         # Bump the "dev" part: .dev0 → release (omitted), producing a clean X.Y.Z version.
-        run: uvx --no-progress 'repomatic==6.18.2' run bump-my-version -- bump --verbose dev
+        run: uvx --no-progress 'repomatic==6.18.4' run bump-my-version -- bump --verbose dev
       - name: Extract version
         id: get_version
         run: >
           echo "current_version=$(
-          uvx --no-progress 'repomatic==6.18.2' run bump-my-version -- show current_version
+          uvx --no-progress 'repomatic==6.18.4' run bump-my-version -- show current_version
           )" | tee -a "$GITHUB_OUTPUT"
       - name: Prepare release
         # Updates changelog and citation dates, comparison URL, and removes warning.
         # Also hard-codes version in workflow URLs for kdeldycke/repomatic repository.
-        run: uvx --no-progress 'repomatic==6.18.2' release-prep
+        run: uvx --no-progress 'repomatic==6.18.4' release-prep
       - name: Prepare repository
         env:
           GIT_AUTHOR: ${{ github.actor }}
@@ -201,11 +201,11 @@ jobs:
       - name: Re-target main branch in workflows
         # This step is only used in the original repository to automate remote URL tagging.
         if: github.repository == 'kdeldycke/repomatic'
-        run: uvx --no-progress 'repomatic==6.18.2' release-prep --post-release
+        run: uvx --no-progress 'repomatic==6.18.4' release-prep --post-release
       - name: Add new changelog entry
-        run: uvx --no-progress 'repomatic==6.18.2' changelog ./changelog.md
+        run: uvx --no-progress 'repomatic==6.18.4' changelog ./changelog.md
       - name: Version bump
-        run: uvx --no-progress 'repomatic==6.18.2' run bump-my-version -- bump --verbose patch
+        run: uvx --no-progress 'repomatic==6.18.4' run bump-my-version -- bump --verbose patch
       - name: Sync uv.lock
         run: uv --no-progress sync
       - name: Create unfreeze commit
@@ -213,12 +213,12 @@ jobs:
           CURRENT_VERSION: ${{ steps.get_version.outputs.current_version }}
         run: >
           git commit --all --message="[changelog] Post-release bump
-          v${CURRENT_VERSION} → v$(uvx --no-progress 'repomatic==6.18.2' run bump-my-version -- show current_version)"
+          v${CURRENT_VERSION} → v$(uvx --no-progress 'repomatic==6.18.4' run bump-my-version -- show current_version)"
       - id: pr-metadata
         env:
           CURRENT_VERSION: ${{ steps.get_version.outputs.current_version }}
         run: >
-          uvx --no-progress 'repomatic==6.18.2' pr-body --output-format github-actions
+          uvx --no-progress 'repomatic==6.18.4' pr-body --output-format github-actions
           --template prepare-release
           --version "${CURRENT_VERSION}"
           --output "$GITHUB_OUTPUT"

{repomatic-6.18.2 → repomatic-6.18.4}/repomatic/data/debug.yaml

@@ -37,7 +37,7 @@ jobs:
       - name: Run repomatic metadata
         id: metadata
         run: >
-          uvx --no-progress 'repomatic==6.18.2' --verbosity DEBUG metadata
+          uvx --no-progress 'repomatic==6.18.4' --verbosity DEBUG metadata
           --format github-json --output "$GITHUB_OUTPUT"
           build_targets
       - name: Extend matrix with ubuntu-slim

{repomatic-6.18.2 → repomatic-6.18.4}/repomatic/data/docs.yaml

@@ -26,7 +26,7 @@ jobs:
       - name: Run repomatic metadata
         id: metadata
         run: >
-          uvx --no-progress 'repomatic==6.18.2' metadata
+          uvx --no-progress 'repomatic==6.18.4' metadata
           --format github-json --output "$GITHUB_OUTPUT"
           is_python_project is_sphinx doc_files
 
@@ -117,7 +117,7 @@ jobs:
         run: |
           exit_code=0
           echo "${DOC_FILES}" | xargs \
-            uvx --no-progress 'repomatic==6.18.2' run lychee -- \
+            uvx --no-progress 'repomatic==6.18.4' run lychee -- \
             --format markdown --output ./lychee/out.md \
             --hidden --suggest --no-progress --include-fragments --exclude-all-private \
             || exit_code=$?
@@ -127,5 +127,5 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           LYCHEE_EXIT_CODE: ${{ steps.lychee_run.outputs.exit_code }}
         run: |
-          uvx --no-progress 'repomatic==6.18.2' broken-links \
+          uvx --no-progress 'repomatic==6.18.4' broken-links \
             ${LYCHEE_EXIT_CODE:+--lychee-exit-code "${LYCHEE_EXIT_CODE}"}

{repomatic-6.18.2 → repomatic-6.18.4}/repomatic/data/labels.yaml

@@ -43,7 +43,7 @@ jobs:
       - name: Sync labels
         env:
           GH_TOKEN: ${{ github.token }}
-        run: uvx --no-progress 'repomatic==6.18.2' sync-labels
+        run: uvx --no-progress 'repomatic==6.18.4' sync-labels
 
   metadata:
     name: 🧬 Project metadata
@@ -58,7 +58,7 @@ jobs:
       - name: Run repomatic metadata
         id: metadata
         run: >
-          uvx --no-progress 'repomatic==6.18.2' metadata
+          uvx --no-progress 'repomatic==6.18.4' metadata
           --format github-json --output "$GITHUB_OUTPUT"
           is_bot
 
@@ -77,7 +77,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: astral-sh/setup-uv@6ee6290f1cbc4156c0bdd66691b2c144ef8df19a # v7.4.0
       - name: Dump default rules
-        run: uvx --no-progress 'repomatic==6.18.2' init labels
+        run: uvx --no-progress 'repomatic==6.18.4' init labels
       - name: Apply rules
         uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
         with:
@@ -99,7 +99,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: astral-sh/setup-uv@6ee6290f1cbc4156c0bdd66691b2c144ef8df19a # v7.4.0
       - name: Dump default rules
-        run: uvx --no-progress 'repomatic==6.18.2' init labels
+        run: uvx --no-progress 'repomatic==6.18.4' init labels
       - name: Apply rules
         uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4
         with:
@@ -124,4 +124,4 @@ jobs:
       - name: Add sponsor label
         env:
           GH_TOKEN: ${{ github.token }}
-        run: uvx --no-progress 'repomatic==6.18.2' sponsor-label
+        run: uvx --no-progress 'repomatic==6.18.4' sponsor-label

{repomatic-6.18.2 → repomatic-6.18.4}/repomatic/data/lint.yaml

@@ -37,7 +37,7 @@ jobs:
       - name: Run repomatic metadata
         id: metadata
         run: >
-          uvx --no-progress 'repomatic==6.18.2' metadata
+          uvx --no-progress 'repomatic==6.18.4' metadata
           --format github-json --output "$GITHUB_OUTPUT"
           is_bot python_files yaml_files workflow_files zsh_files
           is_python_project
@@ -55,7 +55,7 @@ jobs:
           GH_TOKEN: ${{ secrets.REPOMATIC_PAT || github.token }}
           REPOMATIC_PAT: ${{ secrets.REPOMATIC_PAT }}
           HAS_VIRUSTOTAL_API_KEY: ${{ secrets.VIRUSTOTAL_API_KEY && 'true' || '' }}
-        run: uvx --no-progress 'repomatic==6.18.2' lint-repo
+        run: uvx --no-progress 'repomatic==6.18.4' lint-repo
 
   lint-types:
     name: 🛡️ Lint types
@@ -76,7 +76,7 @@ jobs:
       - name: Run Mypy
         env:
           PYTHON_FILES: ${{ fromJSON(needs.metadata.outputs.metadata).python_files }}
-        run: echo "${PYTHON_FILES}" | xargs uvx --no-progress 'repomatic==6.18.2' run mypy --
+        run: echo "${PYTHON_FILES}" | xargs uvx --no-progress 'repomatic==6.18.4' run mypy --
 
   lint-yaml:
     name: 📄 Lint YAML
@@ -93,7 +93,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: astral-sh/setup-uv@6ee6290f1cbc4156c0bdd66691b2c144ef8df19a # v7.4.0
       - name: Run yamllint
-        run: uvx --no-progress 'repomatic==6.18.2' run yamllint -- .
+        run: uvx --no-progress 'repomatic==6.18.4' run yamllint -- .
 
   lint-zsh:
     name: 🐚 Lint Zsh
@@ -144,7 +144,7 @@ jobs:
             https://raw.githubusercontent.com/rhysd/actionlint/refs/tags/v1.7.12/.github/actionlint-matcher.json
           echo "::add-matcher::.github/actionlint-matcher.json"
       - name: Run actionlint
-        run: uvx --no-progress 'repomatic==6.18.2' run actionlint
+        run: uvx --no-progress 'repomatic==6.18.4' run actionlint
 
   lint-workflow-security:
     name: 🔒 Lint workflow security
@@ -160,7 +160,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: astral-sh/setup-uv@6ee6290f1cbc4156c0bdd66691b2c144ef8df19a # v7.4.0
       - name: Run zizmor
-        run: uvx --no-progress 'repomatic==6.18.2' run zizmor -- .
+        run: uvx --no-progress 'repomatic==6.18.4' run zizmor -- .
 
   lint-awesome:
     name: 🌟 Lint awesome
@@ -201,4 +201,4 @@ jobs:
           restore-keys: |
             repomatic-bin-${{ runner.os }}-${{ runner.arch }}-gitleaks-
       - name: Run gitleaks
-        run: uvx --no-progress 'repomatic==6.18.2' run gitleaks -- detect --source .
+        run: uvx --no-progress 'repomatic==6.18.4' run gitleaks -- detect --source .

{repomatic-6.18.2 → repomatic-6.18.4}/repomatic/data/release-publish-pypi-job.yaml

@@ -5,12 +5,18 @@
 # downstream's own workflow file: that path is what each downstream registers
 # with PyPI as a Trusted Publisher. See pypi/warehouse#11096 for context.
 #
-# The action ref below is a real, working default (upstream repo at `@main`).
-# `repomatic.github.workflow_sync._render_publish_pypi_job` rewrites it to
-# the requested {repo, version, sha} via the same `.replace()`-based
+# The action ref below is a real, working default (upstream repo at the
+# default branch). `repomatic.github.workflow_sync._render_publish_pypi_job`
+# rewrites it to the requested {repo, version, sha} via the same `.replace()`
 # convention `repomatic.release_prep` uses on workflow files at freeze time.
 # No bespoke templating syntax is involved: the fragment is plain YAML with
 # real values, copy-pasteable into any workflow.
+#
+# This file is itself walked by `repomatic.release_prep.freeze_workflow_urls`
+# (and its unfreeze counterpart), so wheels built from a freeze commit ship
+# with the action ref pinned to the release tag baked in: downstream
+# `repomatic init` runs from a published wheel default to that pinned ref
+# without any extra rewriting.
 publish-pypi:
   name: 🐍 Publish to PyPI (${{ matrix.short_sha }})
   needs: release
@@ -21,6 +27,6 @@ publish-pypi:
   permissions:
     id-token: write
   steps:
-    - uses: kdeldycke/repomatic/.github/actions/publish-pypi@main
+    - uses: kdeldycke/repomatic/.github/actions/publish-pypi@v6.18.4
       with:
         artifact-name: ${{ github.event.repository.name }}-${{ matrix.short_sha }}