repomatic 6.31.0__tar.gz → 7.1.0__tar.gz

{repomatic-6.31.0 → repomatic-7.1.0}/PKG-INFO

@@ -1,8 +1,8 @@
 Metadata-Version: 2.4
 Name: repomatic
-Version: 6.31.0
+Version: 7.1.0
 Summary: 🏭 Automate repository maintenance, releases, and CI/CD workflows
-Keywords: changelog-formatter,dependabot-alternative,github-actions,github-labels,github-workflow,gitignore,mailmap,mypy,nuitka,python-automation,release-automation,renovate,repository-automation,repository-management,reusable-workflows,software-factory,sphinx-doc,typo,uv,workflow-reusable
+Keywords: changelog-formatter,dependabot-alternative,github-actions,github-labels,github-workflow,gitignore,mailmap,mypy,nuitka,python-automation,release-automation,repository-automation,repository-management,reusable-workflows,software-factory,sphinx-doc,typo,uv,workflow-reusable
 Author: Kevin Deldycke
 Author-email: Kevin Deldycke <kevin@deldycke.com>
 License-Expression: GPL-2.0-or-later
@@ -46,11 +46,10 @@ Classifier: Typing :: Typed
 Requires-Dist: arrow>=1.3
 Requires-Dist: backports-strenum>=1 ; python_full_version < '3.11'
 Requires-Dist: boltons>=25
-Requires-Dist: click-extra>=8.1
+Requires-Dist: click-extra>=8.3
 Requires-Dist: extra-platforms>=12.0.2
 Requires-Dist: packaging>=17
 Requires-Dist: py-walk>=0.3.1
-Requires-Dist: pydriller>=2
 Requires-Dist: pyproject-metadata>=0.9
 Requires-Dist: pyyaml>=6.0.3
 Requires-Dist: tomlrt>=1.7.6
@@ -59,7 +58,7 @@ Requires-Dist: wcmatch>=10
 Requires-Python: >=3.10
 Project-URL: Changelog, https://github.com/kdeldycke/repomatic/blob/main/changelog.md
 Project-URL: Documentation, https://kdeldycke.github.io/repomatic
-Project-URL: Download, https://github.com/kdeldycke/repomatic/releases/tag/v6.31.0
+Project-URL: Download, https://github.com/kdeldycke/repomatic/releases/tag/v7.1.0
 Project-URL: Funding, https://github.com/sponsors/kdeldycke
 Project-URL: Homepage, https://github.com/kdeldycke/repomatic
 Project-URL: Issues, https://github.com/kdeldycke/repomatic/issues
@@ -89,7 +88,8 @@ A Python CLI and `pyproject.toml` configuration that let you **release Python pa
 - Cross-platform binary compilation (Linux / macOS / Windows, x86_64 / arm64)
 - Formatting autofix for Python, Markdown, JSON, Shell, and typos
 - Linting: Python types with mypy, YAML, GitHub Actions, workflow security, URLs, secrets, and Awesome lists
-- Synchronization of `uv.lock`, `.gitignore`, `.mailmap`, and Mermaid dependency graph
+- Synchronization of `uv.lock`, GitHub Action pins, workflow version literals, and `repomatic run` tool versions with configurable stabilization cooldowns
+- Synchronization of `.gitignore`, `.mailmap`, and Mermaid dependency graph
 - Label management with file-based and content-based rules
 - Inactive issue locking
 - Static image optimization
@@ -101,7 +101,7 @@ A Python CLI and `pyproject.toml` configuration that let you **release Python pa
 - [18 third-party GitHub Actions replaced](https://kdeldycke.github.io/repomatic/security.html#third-party-action-minimization) by internal CLI commands and SHA-256-verified binary downloads, keeping the supply chain attack surface minimal
 - [8 Python linters and formatters](https://kdeldycke.github.io/repomatic/security.html#ruff-consolidation) (pylint, black, isort, pyupgrade, pydocstyle, pycln, docformatter, blacken-docs) consolidated into ruff
 - [5 packaging and install tools](https://kdeldycke.github.io/repomatic/security.html#uv-consolidation) (poetry, build, twine, check-wheel-contents, pip-audit) consolidated into uv
-- All `uses:` references [pinned to full commit SHAs](https://kdeldycke.github.io/repomatic/security.html#supply-chain-security) via Renovate, with stabilization windows before adopting new versions
+- All `uses:` references [pinned to full commit SHAs](https://kdeldycke.github.io/repomatic/security.html#supply-chain-security) with stabilization windows before adopting new versions, managed entirely by self-hosted sync jobs
 - [SLSA provenance attestations](https://kdeldycke.github.io/repomatic/security.html#supply-chain-security) on every release artifact (wheels and compiled binaries)
 - [VirusTotal scanning](https://kdeldycke.github.io/repomatic/security.html#av-false-positive-submissions) of compiled binaries to seed AV vendor databases and reduce false positives
 - [Trusted Publishing](https://kdeldycke.github.io/repomatic/workflows.html#github-workflows-release-yaml-jobs) for PyPI uploads: no long-lived tokens stored as secrets

{repomatic-6.31.0 → repomatic-7.1.0}/pyproject.toml

@@ -5,7 +5,7 @@ requires = [ "uv-build>=0.9" ]
 [project]
 # Docs: https://packaging.python.org/en/latest/guides/writing-pyproject-toml/
 name = "repomatic"
-version = "6.31.0"
+version = "7.1.0"
 description = "🏭 Automate repository maintenance, releases, and CI/CD workflows"
 readme = "readme.md"
 keywords = [
@@ -20,7 +20,6 @@ keywords = [
   "nuitka",
   "python-automation",
   "release-automation",
-  "renovate",
   "repository-automation",
   "repository-management",
   "reusable-workflows",
@@ -85,11 +84,10 @@ dependencies = [
   "backports-strenum>=1; python_version<'3.11'",
   # boltons 25.0.0 dropped Python 3.9, matching our requires-python >= 3.10.
   "boltons>=25",
-  # 8.1.0 is the first release carrying the APIs repomatic uses: the `test-suite`
-  # engine (renamed from `test-plan`), the `CONFIG_PATH_METADATA_KEY` /
-  # `NORMALIZE_KEYS_METADATA_KEY` schema-metadata constants, and the
-  # `@sort_by_option` / `ColumnSpec` `columns=` table registry.
-  "click-extra>=8.1",
+  # click-extra 8.3 adds the `click:config` Sphinx directive and the
+  # `schema_field_infos()` introspection API that `configuration.md` and
+  # `show-config` are built on.
+  "click-extra>=8.3",
   # extra-platforms 12.0.2 reimplemented is_macos() with sys.platform, avoiding
   # the platform.platform() shell-out to ``cmd /c ver`` on Windows that broke
   # under patched subprocess in tests and triggered a CPython 3.10.x bug.
@@ -101,8 +99,6 @@ dependencies = [
   # XXX Replace py-walk with wcmatch once the latter supports gitignore files:
   # https://github.com/facelessuser/wcmatch/issues/226
   "py-walk>=0.3.1",
-  # pydriller 2.0 redesigned the API; Git, Commit, and Repository are core 2.x classes.
-  "pydriller>=2",
   # pyproject-metadata 0.9 added PEP 639 (license expressions) and PEP 685 (extras
   # normalization); our StandardMetadata.from_pyproject() call benefits from these.
   "pyproject-metadata>=0.9",
@@ -126,7 +122,7 @@ dependencies = [
 ]
 urls.Changelog = "https://github.com/kdeldycke/repomatic/blob/main/changelog.md"
 urls.Documentation = "https://kdeldycke.github.io/repomatic"
-urls.Download = "https://github.com/kdeldycke/repomatic/releases/tag/v6.31.0"
+urls.Download = "https://github.com/kdeldycke/repomatic/releases/tag/v7.1.0"
 urls.Funding = "https://github.com/sponsors/kdeldycke"
 urls.Homepage = "https://github.com/kdeldycke/repomatic"
 urls.Issues = "https://github.com/kdeldycke/repomatic/issues"
@@ -166,6 +162,9 @@ docs = [
   "sphinx-autodoc-typehints>=2.4",
   # sphinx-copybutton 0.5.2 stabilized the copy button behavior for code blocks.
   "sphinx-copybutton>=0.5.2",
+  # sphinx-datatables 1.0.0 is the first stable release; makes the binaries
+  # catalog table searchable and sortable client-side (pulls sphinxcontrib-jquery).
+  "sphinx-datatables>=1",
   # sphinx-design 0.6 introduced the current directive syntax for cards, grids, and tabs.
   "sphinx-design>=0.6",
   # sphinxcontrib-mermaid 1.2.3 fixed mermaid_d3_zoom configuration support.
@@ -174,12 +173,14 @@ docs = [
   "sphinxext-opengraph>=0.13",
 ]
 # types-boltons: first stub release covering boltons 25.0 API (FrozenDict, unique, flatten,
-# strip_ansi). types-pyyaml: stub release covering PyYAML 6.0 (safe_load, safe_dump, full_load).
+# strip_ansi). types-docutils: covers the docutils.nodes imports in docs/conf.py.
+# types-pyyaml: stub release covering PyYAML 6.0 (safe_load, safe_dump, full_load).
 typing = [
   # backports-strenum: provides StrEnum stubs for mypy --python-version 3.10 analysis;
   # not in main deps (version-gated to Python<3.11 there), so added here unconditionally.
   "backports-strenum>=1",
   "types-boltons>=25.0.0.20250822",
+  "types-docutils>=0.22.3.20251115",
   "types-pyyaml>=6.0.12.9",
 ]
 
@@ -204,10 +205,8 @@ exclude-newer = "1 week"
 # bypasses at that date and prunes each entry once its held version ages past
 # `exclude-newer`, returning the package to the normal cooldown. repomatic is
 # pinned to git main (no PyPI release to freeze), so it keeps a permanent
-# "0 day" span. click-extra is held at its 8.1.0 release date so the lock adopts
-# it before the 1-week cooldown elapses; sync-uv-lock prunes this entry once
-# 8.1.0 ages past `exclude-newer`.
-exclude-newer-package = { click-extra = "2026-06-25T00:00:00Z", repomatic = "0 day" }
+# "0 day" span.
+exclude-newer-package = { click-extra = "2026-07-10T00:00:00Z", repomatic = "0 day" }
 # Package is at root level, not in "./src/".
 build-backend.module-root = ""
 
@@ -220,7 +219,7 @@ copyright = "Kevin Deldycke <kevin@deldycke.com> and contributors. Distributed u
 file-description = "🏭 Automate repository maintenance, releases, and CI/CD workflows"
 # Numeric only: Nuitka rejects PEP 440 .devN suffixes. Kept in sync with the
 # package version by the dedicated [tool.bumpversion] rule that strips the suffix.
-file-version = "6.31.0"
+file-version = "7.1.0"
 include-data-dir = [
   "repomatic/data/awesome_template=repomatic/data/awesome_template",
 ]
@@ -238,7 +237,7 @@ include-package-data = [ "click_extra" ]
 linux-icon = "docs/assets/icon.png"
 macos-app-icon = "docs/assets/icon.icns"
 product-name = "Repomatic"
-product-version = "6.31.0"
+product-version = "7.1.0"
 windows-icon-from-ico = "docs/assets/icon.ico"
 
 [tool.ruff]
@@ -249,6 +248,13 @@ show-fixes = true
 # Enable reformatting of code snippets in docstrings.
 # https://docs.astral.sh/ruff/formatter/#docstring-formatting
 format.docstring-code-format = true
+# PLW1514: `open` and friends called without an explicit `encoding` argument.
+#   Windows defaults text I/O to cp1252, so a bare `open()`, `read_text()` or
+#   `write_text()` breaks on non-ASCII content, and only on Windows runners.
+#   Preview rule; its type inference misses unannotated `Path` locals, so
+#   PEP 597's `PYTHONWARNDEFAULTENCODING=1` remains the complete runtime net.
+#   See: https://docs.astral.sh/ruff/rules/unspecified-encoding/
+lint.extend-select = [ "PLW1514" ]
 # D400: First line should end with a period.
 #   Allows docstrings to end up with any punctuation, not just a period.
 #   See: https://github.com/astral-sh/ruff/issues/1858#issuecomment-1382640623
@@ -311,10 +317,8 @@ pretty = true
 warn_unused_configs = true
 overrides = [
   { module = [
-    "bumpversion.*",
-    "gitdb.*",
     "py_walk.*",
-    "pydriller.*",
+    "sphinxcontrib.mermaid",
     "vt",
   ], ignore_missing_imports = true },
 ]
@@ -325,7 +329,6 @@ addopts = [
   "--cov",
   "--cov-report=term",
   "--numprocesses=auto",
-  "--dist=loadgroup",
 ]
 # https://docs.pytest.org/en/latest/customize.html#pyproject-toml
 markers = [
@@ -341,7 +344,7 @@ run.source = [ "repomatic" ]
 report.precision = 2
 
 [tool.bumpversion]
-current_version = "6.31.0"
+current_version = "7.1.0"
 # Parse versions with an optional .devN suffix (PEP 440).
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)(\\.dev(?P<dev>\\d+))?"
 serialize = [
@@ -423,8 +426,19 @@ exclude = [
   "archive\\.ph",
   # npmjs.com returns 403 to bots.
   "^https://www\\.npmjs\\.com/package/.*$",
+  # VirusTotal analysis pages are a JS app that rate-limits bots, and the
+  # binaries page links one per released binary.
+  "^https://www\\.virustotal\\.com/gui/.*$",
   # star-history.com fragments are JS-rendered and invisible to lychee.
   "^https://star-history\\.com/.*$",
+  # githubstatus.com returns 405 to HEAD requests from bots.
+  "githubstatus\\.com",
+  # Local intra-docs heading fragments are Sphinx cross-references, validated
+  # at doc build time via `myst_heading_anchors`. Lychee's GitHub-style slugger
+  # strips dots (`cache.dir` → `cachedir`) and cannot see MyST `(target)=`
+  # anchors, so it would false-positive links that resolve fine in the rendered
+  # docs. Anchored to `file://` so external `.../docs/*.md#` URLs stay checked.
+  "^file://.*/docs/[\\w.-]+\\.md#",
 ]
 exclude_path = [
   # Template files contain $variable placeholders that are not real URLs.
@@ -441,5 +455,6 @@ abandoned-versions = [
   "6.0.0",
   "6.18.0",
 ]
+changelog.archive-location = "./docs/changelog-archive.md"
 exclude = [ "workflows" ]
 pypi-package-history = [ "gha-utils", "repokit" ]

{repomatic-6.31.0 → repomatic-7.1.0}/readme.md

@@ -21,7 +21,8 @@ A Python CLI and `pyproject.toml` configuration that let you **release Python pa
 - Cross-platform binary compilation (Linux / macOS / Windows, x86_64 / arm64)
 - Formatting autofix for Python, Markdown, JSON, Shell, and typos
 - Linting: Python types with mypy, YAML, GitHub Actions, workflow security, URLs, secrets, and Awesome lists
-- Synchronization of `uv.lock`, `.gitignore`, `.mailmap`, and Mermaid dependency graph
+- Synchronization of `uv.lock`, GitHub Action pins, workflow version literals, and `repomatic run` tool versions with configurable stabilization cooldowns
+- Synchronization of `.gitignore`, `.mailmap`, and Mermaid dependency graph
 - Label management with file-based and content-based rules
 - Inactive issue locking
 - Static image optimization
@@ -33,7 +34,7 @@ A Python CLI and `pyproject.toml` configuration that let you **release Python pa
 - [18 third-party GitHub Actions replaced](https://kdeldycke.github.io/repomatic/security.html#third-party-action-minimization) by internal CLI commands and SHA-256-verified binary downloads, keeping the supply chain attack surface minimal
 - [8 Python linters and formatters](https://kdeldycke.github.io/repomatic/security.html#ruff-consolidation) (pylint, black, isort, pyupgrade, pydocstyle, pycln, docformatter, blacken-docs) consolidated into ruff
 - [5 packaging and install tools](https://kdeldycke.github.io/repomatic/security.html#uv-consolidation) (poetry, build, twine, check-wheel-contents, pip-audit) consolidated into uv
-- All `uses:` references [pinned to full commit SHAs](https://kdeldycke.github.io/repomatic/security.html#supply-chain-security) via Renovate, with stabilization windows before adopting new versions
+- All `uses:` references [pinned to full commit SHAs](https://kdeldycke.github.io/repomatic/security.html#supply-chain-security) with stabilization windows before adopting new versions, managed entirely by self-hosted sync jobs
 - [SLSA provenance attestations](https://kdeldycke.github.io/repomatic/security.html#supply-chain-security) on every release artifact (wheels and compiled binaries)
 - [VirusTotal scanning](https://kdeldycke.github.io/repomatic/security.html#av-false-positive-submissions) of compiled binaries to seed AV vendor databases and reduce false positives
 - [Trusted Publishing](https://kdeldycke.github.io/repomatic/workflows.html#github-workflows-release-yaml-jobs) for PyPI uploads: no long-lived tokens stored as secrets

{repomatic-6.31.0 → repomatic-7.1.0}/repomatic/__init__.py

@@ -17,5 +17,5 @@
 
 from __future__ import annotations
 
-__version__ = "6.31.0"
-__git_tag_sha__ = "3a04e66e0f653c320bf6e93a8d584f4bf9605a50"
+__version__ = "7.1.0"
+__git_tag_sha__ = "8d3bdd26cb0a91c422f1b7210cb978ba75865822"