repomatic 6.31.0__tar.gz → 7.0.0__tar.gz

{repomatic-6.31.0 → repomatic-7.0.0}/PKG-INFO

@@ -1,8 +1,8 @@
 Metadata-Version: 2.4
 Name: repomatic
-Version: 6.31.0
+Version: 7.0.0
 Summary: 🏭 Automate repository maintenance, releases, and CI/CD workflows
-Keywords: changelog-formatter,dependabot-alternative,github-actions,github-labels,github-workflow,gitignore,mailmap,mypy,nuitka,python-automation,release-automation,renovate,repository-automation,repository-management,reusable-workflows,software-factory,sphinx-doc,typo,uv,workflow-reusable
+Keywords: changelog-formatter,dependabot-alternative,github-actions,github-labels,github-workflow,gitignore,mailmap,mypy,nuitka,python-automation,release-automation,repository-automation,repository-management,reusable-workflows,software-factory,sphinx-doc,typo,uv,workflow-reusable
 Author: Kevin Deldycke
 Author-email: Kevin Deldycke <kevin@deldycke.com>
 License-Expression: GPL-2.0-or-later
@@ -50,7 +50,6 @@ Requires-Dist: click-extra>=8.1
 Requires-Dist: extra-platforms>=12.0.2
 Requires-Dist: packaging>=17
 Requires-Dist: py-walk>=0.3.1
-Requires-Dist: pydriller>=2
 Requires-Dist: pyproject-metadata>=0.9
 Requires-Dist: pyyaml>=6.0.3
 Requires-Dist: tomlrt>=1.7.6
@@ -59,7 +58,7 @@ Requires-Dist: wcmatch>=10
 Requires-Python: >=3.10
 Project-URL: Changelog, https://github.com/kdeldycke/repomatic/blob/main/changelog.md
 Project-URL: Documentation, https://kdeldycke.github.io/repomatic
-Project-URL: Download, https://github.com/kdeldycke/repomatic/releases/tag/v6.31.0
+Project-URL: Download, https://github.com/kdeldycke/repomatic/releases/tag/v7.0.0
 Project-URL: Funding, https://github.com/sponsors/kdeldycke
 Project-URL: Homepage, https://github.com/kdeldycke/repomatic
 Project-URL: Issues, https://github.com/kdeldycke/repomatic/issues
@@ -89,7 +88,8 @@ A Python CLI and `pyproject.toml` configuration that let you **release Python pa
 - Cross-platform binary compilation (Linux / macOS / Windows, x86_64 / arm64)
 - Formatting autofix for Python, Markdown, JSON, Shell, and typos
 - Linting: Python types with mypy, YAML, GitHub Actions, workflow security, URLs, secrets, and Awesome lists
-- Synchronization of `uv.lock`, `.gitignore`, `.mailmap`, and Mermaid dependency graph
+- Synchronization of `uv.lock`, GitHub Action pins, workflow version literals, and `repomatic run` tool versions with configurable stabilization cooldowns
+- Synchronization of `.gitignore`, `.mailmap`, and Mermaid dependency graph
 - Label management with file-based and content-based rules
 - Inactive issue locking
 - Static image optimization
@@ -101,7 +101,7 @@ A Python CLI and `pyproject.toml` configuration that let you **release Python pa
 - [18 third-party GitHub Actions replaced](https://kdeldycke.github.io/repomatic/security.html#third-party-action-minimization) by internal CLI commands and SHA-256-verified binary downloads, keeping the supply chain attack surface minimal
 - [8 Python linters and formatters](https://kdeldycke.github.io/repomatic/security.html#ruff-consolidation) (pylint, black, isort, pyupgrade, pydocstyle, pycln, docformatter, blacken-docs) consolidated into ruff
 - [5 packaging and install tools](https://kdeldycke.github.io/repomatic/security.html#uv-consolidation) (poetry, build, twine, check-wheel-contents, pip-audit) consolidated into uv
-- All `uses:` references [pinned to full commit SHAs](https://kdeldycke.github.io/repomatic/security.html#supply-chain-security) via Renovate, with stabilization windows before adopting new versions
+- All `uses:` references [pinned to full commit SHAs](https://kdeldycke.github.io/repomatic/security.html#supply-chain-security) with stabilization windows before adopting new versions, managed entirely by self-hosted sync jobs
 - [SLSA provenance attestations](https://kdeldycke.github.io/repomatic/security.html#supply-chain-security) on every release artifact (wheels and compiled binaries)
 - [VirusTotal scanning](https://kdeldycke.github.io/repomatic/security.html#av-false-positive-submissions) of compiled binaries to seed AV vendor databases and reduce false positives
 - [Trusted Publishing](https://kdeldycke.github.io/repomatic/workflows.html#github-workflows-release-yaml-jobs) for PyPI uploads: no long-lived tokens stored as secrets

{repomatic-6.31.0 → repomatic-7.0.0}/pyproject.toml

@@ -5,7 +5,7 @@ requires = [ "uv-build>=0.9" ]
 [project]
 # Docs: https://packaging.python.org/en/latest/guides/writing-pyproject-toml/
 name = "repomatic"
-version = "6.31.0"
+version = "7.0.0"
 description = "🏭 Automate repository maintenance, releases, and CI/CD workflows"
 readme = "readme.md"
 keywords = [
@@ -20,7 +20,6 @@ keywords = [
   "nuitka",
   "python-automation",
   "release-automation",
-  "renovate",
   "repository-automation",
   "repository-management",
   "reusable-workflows",
@@ -86,9 +85,8 @@ dependencies = [
   # boltons 25.0.0 dropped Python 3.9, matching our requires-python >= 3.10.
   "boltons>=25",
   # 8.1.0 is the first release carrying the APIs repomatic uses: the `test-suite`
-  # engine (renamed from `test-plan`), the `CONFIG_PATH_METADATA_KEY` /
-  # `NORMALIZE_KEYS_METADATA_KEY` schema-metadata constants, and the
-  # `@sort_by_option` / `ColumnSpec` `columns=` table registry.
+  # engine (renamed from `test-plan`) and the `CONFIG_PATH_METADATA_KEY` /
+  # `NORMALIZE_KEYS_METADATA_KEY` schema-metadata constants.
   "click-extra>=8.1",
   # extra-platforms 12.0.2 reimplemented is_macos() with sys.platform, avoiding
   # the platform.platform() shell-out to ``cmd /c ver`` on Windows that broke
@@ -101,8 +99,6 @@ dependencies = [
   # XXX Replace py-walk with wcmatch once the latter supports gitignore files:
   # https://github.com/facelessuser/wcmatch/issues/226
   "py-walk>=0.3.1",
-  # pydriller 2.0 redesigned the API; Git, Commit, and Repository are core 2.x classes.
-  "pydriller>=2",
   # pyproject-metadata 0.9 added PEP 639 (license expressions) and PEP 685 (extras
   # normalization); our StandardMetadata.from_pyproject() call benefits from these.
   "pyproject-metadata>=0.9",
@@ -126,7 +122,7 @@ dependencies = [
 ]
 urls.Changelog = "https://github.com/kdeldycke/repomatic/blob/main/changelog.md"
 urls.Documentation = "https://kdeldycke.github.io/repomatic"
-urls.Download = "https://github.com/kdeldycke/repomatic/releases/tag/v6.31.0"
+urls.Download = "https://github.com/kdeldycke/repomatic/releases/tag/v7.0.0"
 urls.Funding = "https://github.com/sponsors/kdeldycke"
 urls.Homepage = "https://github.com/kdeldycke/repomatic"
 urls.Issues = "https://github.com/kdeldycke/repomatic/issues"
@@ -207,7 +203,7 @@ exclude-newer = "1 week"
 # "0 day" span. click-extra is held at its 8.1.0 release date so the lock adopts
 # it before the 1-week cooldown elapses; sync-uv-lock prunes this entry once
 # 8.1.0 ages past `exclude-newer`.
-exclude-newer-package = { click-extra = "2026-06-25T00:00:00Z", repomatic = "0 day" }
+exclude-newer-package = { repomatic = "0 day" }
 # Package is at root level, not in "./src/".
 build-backend.module-root = ""
 
@@ -220,7 +216,7 @@ copyright = "Kevin Deldycke <kevin@deldycke.com> and contributors. Distributed u
 file-description = "🏭 Automate repository maintenance, releases, and CI/CD workflows"
 # Numeric only: Nuitka rejects PEP 440 .devN suffixes. Kept in sync with the
 # package version by the dedicated [tool.bumpversion] rule that strips the suffix.
-file-version = "6.31.0"
+file-version = "7.0.0"
 include-data-dir = [
   "repomatic/data/awesome_template=repomatic/data/awesome_template",
 ]
@@ -238,7 +234,7 @@ include-package-data = [ "click_extra" ]
 linux-icon = "docs/assets/icon.png"
 macos-app-icon = "docs/assets/icon.icns"
 product-name = "Repomatic"
-product-version = "6.31.0"
+product-version = "7.0.0"
 windows-icon-from-ico = "docs/assets/icon.ico"
 
 [tool.ruff]
@@ -249,6 +245,13 @@ show-fixes = true
 # Enable reformatting of code snippets in docstrings.
 # https://docs.astral.sh/ruff/formatter/#docstring-formatting
 format.docstring-code-format = true
+# PLW1514: `open` and friends called without an explicit `encoding` argument.
+#   Windows defaults text I/O to cp1252, so a bare `open()`, `read_text()` or
+#   `write_text()` breaks on non-ASCII content, and only on Windows runners.
+#   Preview rule; its type inference misses unannotated `Path` locals, so
+#   PEP 597's `PYTHONWARNDEFAULTENCODING=1` remains the complete runtime net.
+#   See: https://docs.astral.sh/ruff/rules/unspecified-encoding/
+lint.extend-select = [ "PLW1514" ]
 # D400: First line should end with a period.
 #   Allows docstrings to end up with any punctuation, not just a period.
 #   See: https://github.com/astral-sh/ruff/issues/1858#issuecomment-1382640623
@@ -311,10 +314,7 @@ pretty = true
 warn_unused_configs = true
 overrides = [
   { module = [
-    "bumpversion.*",
-    "gitdb.*",
     "py_walk.*",
-    "pydriller.*",
     "vt",
   ], ignore_missing_imports = true },
 ]
@@ -325,7 +325,6 @@ addopts = [
   "--cov",
   "--cov-report=term",
   "--numprocesses=auto",
-  "--dist=loadgroup",
 ]
 # https://docs.pytest.org/en/latest/customize.html#pyproject-toml
 markers = [
@@ -341,7 +340,7 @@ run.source = [ "repomatic" ]
 report.precision = 2
 
 [tool.bumpversion]
-current_version = "6.31.0"
+current_version = "7.0.0"
 # Parse versions with an optional .devN suffix (PEP 440).
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)(\\.dev(?P<dev>\\d+))?"
 serialize = [
@@ -425,6 +424,14 @@ exclude = [
   "^https://www\\.npmjs\\.com/package/.*$",
   # star-history.com fragments are JS-rendered and invisible to lychee.
   "^https://star-history\\.com/.*$",
+  # githubstatus.com returns 405 to HEAD requests from bots.
+  "githubstatus\\.com",
+  # Local intra-docs heading fragments are Sphinx cross-references, validated
+  # at doc build time via `myst_heading_anchors`. Lychee's GitHub-style slugger
+  # strips dots (`cache.dir` → `cachedir`) and cannot see MyST `(target)=`
+  # anchors, so it would false-positive links that resolve fine in the rendered
+  # docs. Anchored to `file://` so external `.../docs/*.md#` URLs stay checked.
+  "^file://.*/docs/[\\w.-]+\\.md#",
 ]
 exclude_path = [
   # Template files contain $variable placeholders that are not real URLs.
@@ -441,5 +448,6 @@ abandoned-versions = [
   "6.0.0",
   "6.18.0",
 ]
+changelog.archive-location = "./docs/changelog-archive.md"
 exclude = [ "workflows" ]
 pypi-package-history = [ "gha-utils", "repokit" ]

{repomatic-6.31.0 → repomatic-7.0.0}/readme.md

@@ -21,7 +21,8 @@ A Python CLI and `pyproject.toml` configuration that let you **release Python pa
 - Cross-platform binary compilation (Linux / macOS / Windows, x86_64 / arm64)
 - Formatting autofix for Python, Markdown, JSON, Shell, and typos
 - Linting: Python types with mypy, YAML, GitHub Actions, workflow security, URLs, secrets, and Awesome lists
-- Synchronization of `uv.lock`, `.gitignore`, `.mailmap`, and Mermaid dependency graph
+- Synchronization of `uv.lock`, GitHub Action pins, workflow version literals, and `repomatic run` tool versions with configurable stabilization cooldowns
+- Synchronization of `.gitignore`, `.mailmap`, and Mermaid dependency graph
 - Label management with file-based and content-based rules
 - Inactive issue locking
 - Static image optimization
@@ -33,7 +34,7 @@ A Python CLI and `pyproject.toml` configuration that let you **release Python pa
 - [18 third-party GitHub Actions replaced](https://kdeldycke.github.io/repomatic/security.html#third-party-action-minimization) by internal CLI commands and SHA-256-verified binary downloads, keeping the supply chain attack surface minimal
 - [8 Python linters and formatters](https://kdeldycke.github.io/repomatic/security.html#ruff-consolidation) (pylint, black, isort, pyupgrade, pydocstyle, pycln, docformatter, blacken-docs) consolidated into ruff
 - [5 packaging and install tools](https://kdeldycke.github.io/repomatic/security.html#uv-consolidation) (poetry, build, twine, check-wheel-contents, pip-audit) consolidated into uv
-- All `uses:` references [pinned to full commit SHAs](https://kdeldycke.github.io/repomatic/security.html#supply-chain-security) via Renovate, with stabilization windows before adopting new versions
+- All `uses:` references [pinned to full commit SHAs](https://kdeldycke.github.io/repomatic/security.html#supply-chain-security) with stabilization windows before adopting new versions, managed entirely by self-hosted sync jobs
 - [SLSA provenance attestations](https://kdeldycke.github.io/repomatic/security.html#supply-chain-security) on every release artifact (wheels and compiled binaries)
 - [VirusTotal scanning](https://kdeldycke.github.io/repomatic/security.html#av-false-positive-submissions) of compiled binaries to seed AV vendor databases and reduce false positives
 - [Trusted Publishing](https://kdeldycke.github.io/repomatic/workflows.html#github-workflows-release-yaml-jobs) for PyPI uploads: no long-lived tokens stored as secrets

{repomatic-6.31.0 → repomatic-7.0.0}/repomatic/__init__.py

@@ -17,5 +17,5 @@
 
 from __future__ import annotations
 
-__version__ = "6.31.0"
-__git_tag_sha__ = "3a04e66e0f653c320bf6e93a8d584f4bf9605a50"
+__version__ = "7.0.0"
+__git_tag_sha__ = "36523e5a56f287e814210042ca7b852147a95498"

{repomatic-6.31.0 → repomatic-7.0.0}/repomatic/changelog.py

@@ -812,6 +812,7 @@ def lint_changelog_dates(
     changelog_path: Path,
     package: str | None = None,
     *,
+    archive_path: Path | None = None,
     fix: bool = False,
     pypi_package_history: Sequence[str] = (),
     abandoned_versions: Sequence[str] = (),
@@ -853,6 +854,10 @@ def lint_changelog_dates(
       linking to adjacent versions.
 
     :param changelog_path: Path to the changelog file.
+    :param archive_path: Optional path to a frozen changelog archive. Versions
+        documented there are treated as present, suppressing false-positive
+        orphan detection (and re-insertion under `fix`) for entries split out
+        of the live changelog. Archived dates are not re-validated.
     :param package: PyPI package name. If `None`, auto-detected from
         `pyproject.toml`. If detection fails, falls back to git tags.
     :param fix: If True, fix dates and add admonitions to the file.
@@ -955,8 +960,16 @@ def lint_changelog_dates(
     # from the changelog.
     tag_versions = get_all_version_tags()
     changelog_headings = changelog.extract_all_version_headings()
+    # Versions documented in the frozen archive count as present, so entries
+    # split out of the live changelog are neither flagged nor re-inserted as
+    # orphans.
+    archive_headings: set[str] = set()
+    if archive_path and archive_path.exists():
+        archive_headings = Changelog(
+            archive_path.read_text(encoding="UTF-8")
+        ).extract_all_version_headings()
     all_known = set(pypi_data) | set(github_releases) | set(tag_versions)
-    orphans = all_known - changelog_headings
+    orphans = all_known - changelog_headings - archive_headings
     if orphans:
         for orphan in sorted(orphans, key=Version):
             logging.warning(

repomatic-7.0.0/repomatic/checksums.py

@@ -0,0 +1,127 @@
+# Copyright Kevin Deldycke <kevin@deldycke.com> and contributors.
+#
+# This program is Free Software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+
+"""Recompute SHA-256 checksums for the binary tool registry.
+
+Iterates every `TOOL_REGISTRY` entry with a `binary` spec, downloads each
+platform's release artifact, and rewrites stale hashes in-place in
+`tool_runner.py` (alongside the `VERSIONS` stamps). Driven by
+`repomatic update-checksums` and, with a version override, by
+`sync-tool-versions` so a version bump and its matching checksums land in one
+pass.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import logging
+import re
+import sys
+from pathlib import Path
+from urllib.request import Request, urlopen
+
+from click_extra import progressbar
+
+from .tool_runner import TOOL_REGISTRY
+
+
+def _download_sha256(url: str) -> str:
+    """Download a URL and return its SHA-256 hex digest.
+
+    :param url: The URL to download.
+    :return: Lowercase hex SHA-256 digest of the response body.
+    """
+    request = Request(url)
+    with urlopen(request) as response:
+        digest = hashlib.sha256(response.read()).hexdigest()
+    logging.debug(f"SHA-256 of {url}: {digest}")
+    return digest
+
+
+def update_registry_checksums(
+    tool_runner_path: Path,
+    version_overrides: dict[str, str] | None = None,
+) -> list[tuple[str, str, str]]:
+    """Recompute binary checksums and version stamps in `tool_runner.py`.
+
+    Iterates every `TOOL_REGISTRY` entry with a `binary` spec, downloads each
+    platform URL, computes its SHA-256, and replaces stale hashes in-place.
+    Also reconciles each tool's `VERSIONS` stamp with the version the checksums
+    were computed for, the basis of the offline staleness test.
+
+    :param tool_runner_path: Path to `tool_runner.py`.
+    :param version_overrides: Optional mapping of tool name to a version to
+        download instead of the in-memory `ToolSpec.version`. `sync-tool-versions`
+        passes this so it can bump the version in the source and refresh the
+        checksums in a single process: the in-memory registry still holds the
+        pre-bump version because the file was edited, not reimported.
+    :return: List of `(url, old_hash, new_hash)` for each updated checksum.
+        Empty if all checksums are already correct.
+    """
+    overrides = version_overrides or {}
+    original = tool_runner_path.read_text(encoding="UTF-8")
+    content = original
+    updated: list[tuple[str, str, str]] = []
+
+    # Flatten all binary platform entries for progress tracking, resolving each
+    # download URL against the override version when one is supplied.
+    entries = [
+        (
+            spec,
+            pk,
+            tmpl.format(version=overrides.get(spec.name, spec.version)),
+            spec.binary.checksums[pk],
+        )
+        for spec in TOOL_REGISTRY.values()
+        if spec.binary is not None
+        for pk, tmpl in spec.binary.urls.items()
+    ]
+
+    with progressbar(
+        entries,
+        label="Verifying checksums",
+        file=sys.stderr,
+    ) as items:
+        for spec, platform_key, url, old_hash in items:
+            logging.info(
+                f"Verifying registry checksum for {spec.name} ({platform_key})"
+            )
+            new_hash = _download_sha256(url)
+
+            if old_hash != new_hash:
+                content = content.replace(old_hash, new_hash)
+                updated.append((url, old_hash, new_hash))
+                logging.info(f"Updated checksum: {old_hash} -> {new_hash}")
+            else:
+                logging.info("Checksum unchanged.")
+
+    # Reconcile each tool's VERSIONS stamp with its target version (idempotent).
+    # The key pattern only matches the quoted-string values in `VERSIONS`, never
+    # the `ToolSpec(` registry entries or the tuple-keyed `CHECKSUMS` entries.
+    for spec in TOOL_REGISTRY.values():
+        if spec.binary is None:
+            continue
+        target = overrides.get(spec.name, spec.version)
+        content = re.sub(
+            rf'("{re.escape(spec.name)}":\s*)"[^"]*"',
+            rf'\g<1>"{target}"',
+            content,
+        )
+
+    if content != original:
+        tool_runner_path.write_text(content, encoding="UTF-8")
+
+    return updated