repomatic 7.2.0__tar.gz → 7.3.0__tar.gz

{repomatic-7.2.0 → repomatic-7.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: repomatic
-Version: 7.2.0
+Version: 7.3.0
 Summary: 🏭 Automate repository maintenance, releases, and CI/CD workflows
 Keywords: changelog-formatter,dependabot-alternative,github-actions,github-labels,github-workflow,gitignore,mailmap,mypy,nuitka,python-automation,release-automation,repository-automation,repository-management,reusable-workflows,software-factory,sphinx-doc,typo,uv,workflow-reusable
 Author: Kevin Deldycke
@@ -46,7 +46,7 @@ Classifier: Typing :: Typed
 Requires-Dist: arrow>=1.3
 Requires-Dist: backports-strenum>=1 ; python_full_version < '3.11'
 Requires-Dist: boltons>=25
-Requires-Dist: click-extra>=8.3
+Requires-Dist: click-extra>=8.5
 Requires-Dist: extra-platforms>=12.0.2
 Requires-Dist: packaging>=17
 Requires-Dist: py-walk>=0.3.1
@@ -58,7 +58,7 @@ Requires-Dist: wcmatch>=10
 Requires-Python: >=3.10
 Project-URL: Changelog, https://github.com/kdeldycke/repomatic/blob/main/changelog.md
 Project-URL: Documentation, https://kdeldycke.github.io/repomatic
-Project-URL: Download, https://github.com/kdeldycke/repomatic/releases/tag/v7.2.0
+Project-URL: Download, https://github.com/kdeldycke/repomatic/releases/tag/v7.3.0
 Project-URL: Funding, https://github.com/sponsors/kdeldycke
 Project-URL: Homepage, https://github.com/kdeldycke/repomatic
 Project-URL: Issues, https://github.com/kdeldycke/repomatic/issues

{repomatic-7.2.0 → repomatic-7.3.0}/pyproject.toml

@@ -5,7 +5,7 @@ requires = [ "uv-build>=0.9,<0.12" ]
 [project]
 # Docs: https://packaging.python.org/en/latest/guides/writing-pyproject-toml/
 name = "repomatic"
-version = "7.2.0"
+version = "7.3.0"
 description = "🏭 Automate repository maintenance, releases, and CI/CD workflows"
 readme = "readme.md"
 keywords = [
@@ -84,10 +84,16 @@ dependencies = [
   "backports-strenum>=1; python_version<'3.11'",
   # boltons 25.0.0 dropped Python 3.9, matching our requires-python >= 3.10.
   "boltons>=25",
-  # click-extra 8.3 adds the `click:config` Sphinx directive and the
-  # `schema_field_infos()` introspection API that `configuration.md` and
-  # `show-config` are built on.
-  "click-extra>=8.3",
+  # click-extra 8.5 ships the `python:render` `:mirror:` regions and extends
+  # `refresh-directives` to refresh them (update_mirror_blocks), with the
+  # fence-aware scanner that stops `update-docs` phase 4 from rewriting
+  # examples nested in code fences. 8.5 also carries the
+  # `make_schema_callable(warn_unknown=...)` unknown-key warning
+  # `load_repomatic_config` opts into, and the `click_extra.sphinx.
+  # myst_docstrings` extension `docs/conf.py` loads (absorbed from
+  # `repomatic.myst_docstrings`). (8.3 brought the `click:config` directive
+  # and `schema_field_infos()` that `configuration.md` and `show-config` use.)
+  "click-extra>=8.5",
   # extra-platforms 12.0.2 reimplemented is_macos() with sys.platform, avoiding
   # the platform.platform() shell-out to ``cmd /c ver`` on Windows that broke
   # under patched subprocess in tests and triggered a CPython 3.10.x bug.
@@ -122,7 +128,7 @@ dependencies = [
 ]
 urls.Changelog = "https://github.com/kdeldycke/repomatic/blob/main/changelog.md"
 urls.Documentation = "https://kdeldycke.github.io/repomatic"
-urls.Download = "https://github.com/kdeldycke/repomatic/releases/tag/v7.2.0"
+urls.Download = "https://github.com/kdeldycke/repomatic/releases/tag/v7.3.0"
 urls.Funding = "https://github.com/sponsors/kdeldycke"
 urls.Homepage = "https://github.com/kdeldycke/repomatic"
 urls.Issues = "https://github.com/kdeldycke/repomatic/issues"
@@ -206,7 +212,7 @@ exclude-newer = "1 week"
 # `exclude-newer`, returning the package to the normal cooldown. repomatic is
 # pinned to git main (no PyPI release to freeze), so it keeps a permanent
 # "0 day" span.
-exclude-newer-package = { repomatic = "0 day" }
+exclude-newer-package = { click-extra = "2026-07-24T00:00:00Z", repomatic = "0 day" }
 # Package is at root level, not in "./src/".
 build-backend.module-root = ""
 
@@ -219,7 +225,7 @@ copyright = "Kevin Deldycke <kevin@deldycke.com> and contributors. Distributed u
 file-description = "🏭 Automate repository maintenance, releases, and CI/CD workflows"
 # Numeric only: Nuitka rejects PEP 440 .devN suffixes. Kept in sync with the
 # package version by the dedicated [tool.bumpversion] rule that strips the suffix.
-file-version = "7.2.0"
+file-version = "7.3.0"
 include-data-dir = [
   "repomatic/data/awesome_template=repomatic/data/awesome_template",
 ]
@@ -237,13 +243,14 @@ include-package-data = [ "click_extra" ]
 linux-icon = "docs/assets/icon.png"
 macos-app-icon = "docs/assets/icon.icns"
 product-name = "Repomatic"
-product-version = "7.2.0"
+product-version = "7.3.0"
 windows-icon-from-ico = "docs/assets/icon.ico"
 
 [tool.ruff]
 preview = true
 fix = true
-unsafe-fixes = true
+# Disabled for the reasons documented in the bundled repomatic/data/ruff.toml.
+unsafe-fixes = false
 show-fixes = true
 # Enable reformatting of code snippets in docstrings.
 # https://docs.astral.sh/ruff/formatter/#docstring-formatting
@@ -351,7 +358,7 @@ run.source = [ "repomatic" ]
 report.precision = 2
 
 [tool.bumpversion]
-current_version = "7.2.0"
+current_version = "7.3.0"
 # Parse versions with an optional .devN suffix (PEP 440).
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)(\\.dev(?P<dev>\\d+))?"
 serialize = [

{repomatic-7.2.0 → repomatic-7.3.0}/repomatic/__init__.py

@@ -17,5 +17,5 @@
 
 from __future__ import annotations
 
-__version__ = "7.2.0"
-__git_tag_sha__ = "7336863d9f3f5faea26f887211f3f745dc963fb5"
+__version__ = "7.3.0"
+__git_tag_sha__ = "2b89c62f0953d8ef59d0d023085a9323f6c32f1d"

{repomatic-7.2.0 → repomatic-7.3.0}/repomatic/binaries_page.py

@@ -164,9 +164,28 @@ def _release_version(tag: str) -> Version | None:
 
 
 def _binary_assets(release: ReleaseWithAssets) -> list[ReleaseAsset]:
-    """Return the release's compiled binaries, sorted by filename."""
+    """Return the release's compiled binaries, sorted by filename.
+
+    Releases also carry versionless alias copies of each binary, backing the
+    stable ``releases/latest/download`` URLs (see the upload step in
+    ``_release-engine.yaml``). An alias shares its digest with its versioned
+    sibling: collapse each digest group onto its longest name (the versioned
+    one, since the alias is that same name minus the version segment) so the
+    catalog lists each binary once. Assets without a recorded digest
+    (uploaded before GitHub started recording them, mid-2025) predate the
+    aliases and are kept as-is.
+    """
+    binaries = [a for a in release.assets if a.name.endswith(BINARY_ASSET_SUFFIXES)]
+    digest_groups: dict[str, list[ReleaseAsset]] = {}
+    for asset in binaries:
+        if asset.sha256:
+            digest_groups.setdefault(asset.sha256, []).append(asset)
+    aliases: set[str] = set()
+    for group in digest_groups.values():
+        canonical = max(group, key=lambda asset: (len(asset.name), asset.name))
+        aliases.update(asset.name for asset in group if asset.name != canonical.name)
     return sorted(
-        (a for a in release.assets if a.name.endswith(BINARY_ASSET_SUFFIXES)),
+        (a for a in binaries if a.name not in aliases),
         key=lambda asset: asset.name,
     )
 

{repomatic-7.2.0 → repomatic-7.3.0}/repomatic/changelog.py

@@ -762,7 +762,8 @@ def warn_on_long_bullets(changelog: Changelog, threshold: int) -> None:
     """Warn about over-long bullets in the unreleased section, non-fatally.
 
     A changelog entry is a release note, not a commit message: one short
-    sentence stating what changed (see `CLAUDE.md` § Changelog entry length).
+    sentence stating what changed. Canonical guideline:
+    https://github.com/kdeldycke/repomatic/blob/main/claude.md#changelog-entry-length
     Each unreleased bullet longer than `threshold` words emits a
     {data}`logging.WARNING` and a GitHub Actions warning annotation, without
     affecting the lint exit code.
@@ -792,7 +793,9 @@ def warn_on_long_bullets(changelog: Changelog, threshold: int) -> None:
                     f"Changelog entry {index} for {version} runs {words} words, "
                     f"over the {threshold}-word guideline. A changelog entry is "
                     f"a release note, not a commit message: keep it to one short "
-                    f"sentence (see CLAUDE.md, Changelog entry length).",
+                    f"sentence, per the canonical guideline "
+                    f"https://github.com/kdeldycke/repomatic/blob/main/claude.md"
+                    f"#changelog-entry-length",
                 )
 
 

{repomatic-7.2.0 → repomatic-7.3.0}/repomatic/cli.py

@@ -29,7 +29,6 @@ from pathlib import Path
 
 import tomlrt
 from click_extra import (
-    DEFAULT_JOBS,
     UNPROCESSED,
     Choice,
     ClickException,
@@ -336,13 +335,7 @@ def _require_token(module, attr):
 # names (e.g., "setup-guide" is both a config key and a subcommand). Config
 # access goes exclusively through config_schema + get_tool_config().
 @group(config_schema=Config, schema_strict=False, included_params=())
-# Resolve the default job count eagerly (an integer instead of the "auto"
-# keyword) so JobCount.convert() never emits its sequential-execution warning
-# for a value the user never set: on 1-CPU hosts (ubuntu-slim CI runners, docs
-# builders) that warning fires on every bare invocation and leaks into the
-# merged output captured by `{click:run}` doc renders and CliRunner tests.
-# show_default restores the machine-independent "auto" label in help screens.
-@jobs_option(default=DEFAULT_JOBS, show_default="auto")
+@jobs_option()
 def repomatic():
     pass
 
@@ -734,15 +727,6 @@ init_project.help = init_project.help.format(
 )
 
 
-def _table_headers(header_defs: tuple[tuple[str, str], ...]) -> tuple[str, ...]:
-    """Return the column labels from `(label, column_id)` header definitions.
-
-    `ctx.print_table` takes `(table_data, headers)`; the column IDs drive
-    `--sort-by` through the matching `SortByOption`, not the rendered header row.
-    """
-    return tuple(label for label, _ in header_defs)
-
-
 _metadata_sort = SortByOption(*METADATA_KEYS_HEADER_DEFS, default="key")
 
 
@@ -793,9 +777,7 @@ def metadata(ctx, format, overwrite, output, list_keys, keys):
             current_version is_python_project
     """
     if list_keys:
-        ctx.print_table(
-            metadata_keys_reference(), _table_headers(METADATA_KEYS_HEADER_DEFS)
-        )
+        ctx.print_table(metadata_keys_reference(), METADATA_KEYS_HEADER_DEFS)
         ctx.exit(0)
 
     # Validate requested keys.
@@ -873,7 +855,7 @@ def show_config(ctx):
         (option, escape_type_for_gfm_table(ftype), default, desc)
         for option, ftype, default, desc in config_reference()
     ]
-    ctx.print_table(rows, _table_headers(CONFIG_REFERENCE_HEADER_DEFS))
+    ctx.print_table(rows, CONFIG_REFERENCE_HEADER_DEFS)
 
 
 TEST_MATRIX_STATE_DISPLAY = {
@@ -924,7 +906,7 @@ def show_test_matrix(ctx, emoji, matrix_name):
             (row[0], *(TEST_MATRIX_STATE_DISPLAY.get(cell, cell) for cell in row[1:]))
             for row in rows
         )
-    ctx.find_root().print_table(rows, headers)
+    ctx.print_table(rows, headers)
 
 
 @repomatic.command(
@@ -1806,69 +1788,15 @@ def update_docs() -> None:
        with ``{eval-rst}`` blocks.
     3. Run the project-specific `docs/docs_update.py` script (if present)
        to generate dynamic content.
-    4. Refresh self-updating directive blocks (like `{matrix}` compatibility
-       tables) found in `docs/` pages and `readme.md`, via
-       `click-extra refresh-directives`.
+    4. Refresh self-updating blocks (`{matrix}` compatibility tables and
+       `python:render` `:mirror:` regions) found in `docs/` pages and
+       `readme.md`, via `click-extra refresh-directives`.
 
     Configuration is read from `[tool.repomatic]` in `pyproject.toml`.
     """
     _update_docs(get_tool_config())
 
 
-@repomatic.command(
-    name="convert-to-myst",
-    short_help="Convert reST docstrings to MyST in Python files",
-    section=_section_setup,
-)
-@argument("directory", required=False, default=None)
-def convert_to_myst(directory: str | None) -> None:
-    """Convert reST docstrings to MyST markdown in Python source files.
-
-    Transforms reST markup in docstrings and `#:` comment blocks to MyST.
-    The companion Sphinx extension `repomatic.myst_docstrings` converts
-    the MyST back to reST at build time, so `sphinx.ext.autodoc` still
-    works.
-
-    If DIRECTORY is not specified, auto-detects the source package directory
-    from the project's script entry points in `pyproject.toml`.
-
-    Safe to re-run: already-converted MyST syntax does not match the reST
-    patterns, so the conversion is idempotent.
-    """
-    from .metadata import Metadata
-    from .myst_converter import convert_directory
-
-    if directory:
-        root = Path(directory)
-    else:
-        # Auto-detect source directory from project metadata.
-        meta = Metadata()
-        source_dirs: set[str] = set()
-        for _cli_id, module_id, _callable_id in meta.script_entries:
-            source_dirs.add(module_id.split(".")[0])
-
-        if not source_dirs:
-            raise ClickException(
-                "Cannot auto-detect source directory. "
-                "Specify a directory argument or add script entry points "
-                "to pyproject.toml."
-            )
-        if len(source_dirs) > 1:
-            raise ClickException(
-                f"Multiple source packages detected: {sorted(source_dirs)}. "
-                "Specify a directory argument."
-            )
-        root = Path(source_dirs.pop())
-
-    if not root.is_dir():
-        raise ClickException(f"Not a directory: {root}")
-
-    changed = convert_directory(root)
-    for filepath in changed:
-        echo(f"  Converted: {filepath}")
-    echo(f"\n{len(changed)} file(s) converted.")
-
-
 @repomatic.command(
     short_help="Manage broken links issue lifecycle", section=_section_github
 )
@@ -2312,9 +2240,7 @@ def audit(
         )
         for v in vulns
     ]
-    ctx.print_table(  # type: ignore[attr-defined]
-        rows, _table_headers(AUDIT_HEADER_DEFS)
-    )
+    ctx.print_table(rows, AUDIT_HEADER_DEFS)
 
     if output:
         markdown = format_vulnerability_table(vulns)
@@ -2644,7 +2570,7 @@ def _print_sync_table(
         if show_released:
             row = (*row, format_released(dates.get(name, ""), reference_date))
         rows.append(row)
-    ctx.find_root().print_table(rows, headers)  # type: ignore[attr-defined]
+    ctx.print_table(rows, headers)
 
 
 def _print_held_back_table(
@@ -2671,7 +2597,7 @@ def _print_held_back_table(
         )
         for pkg in held_back
     ]
-    ctx.find_root().print_table(rows, headers)  # type: ignore[attr-defined]
+    ctx.print_table(rows, headers)
 
 
 def _print_bypass_table(ctx: Context, forecasts: list[BypassForecast]) -> None:
@@ -2687,7 +2613,7 @@ def _print_bypass_table(ctx: Context, forecasts: list[BypassForecast]) -> None:
         (forecast.name, forecast.held_version, forecast.expires)
         for forecast in forecasts
     ]
-    ctx.find_root().print_table(rows, headers)  # type: ignore[attr-defined]
+    ctx.print_table(rows, headers)
 
 
 def _emit_version_sync_report(
@@ -3571,7 +3497,7 @@ def run_cmd(
             (spec.name, spec.version, resolve_config_source(spec))
             for spec in TOOL_REGISTRY.values()
         ]
-        ctx.print_table(rows, _table_headers(TOOL_LIST_HEADER_DEFS))
+        ctx.print_table(rows, TOOL_LIST_HEADER_DEFS)
         ctx.exit(0)
 
     if tool_name is None:
@@ -3664,7 +3590,7 @@ def show(ctx):
             _format_age(cfg_entry.mtime),
         ))
 
-    ctx.print_table(rows, _table_headers(CACHE_LIST_HEADER_DEFS))
+    ctx.print_table(rows, CACHE_LIST_HEADER_DEFS)
     total_count = len(bin_entries) + len(http_entries) + len(cfg_entries)
     echo(f"\nTotal: {total_count} file(s), {format_file_size(total_size)}")
 

{repomatic-7.2.0 → repomatic-7.3.0}/repomatic/config.py

@@ -23,7 +23,6 @@ Defines the `Config` dataclass, its TOML serialization helpers, and the
 
 from __future__ import annotations
 
-import logging
 from dataclasses import dataclass, field
 from textwrap import dedent
 
@@ -631,8 +630,8 @@ class Config:
     exclude: list[str] = field(default_factory=list)
     """Additional components and files to exclude from repomatic operations.
 
-    Additive to the default exclusions (`labels`, `skills`). Bare names
-    exclude an entire component (e.g., `"workflows"`). Qualified
+    Additive to the default exclusions (`agents`, `labels`, `skills`). Bare
+    names exclude an entire component (e.g., `"workflows"`). Qualified
     `component/identifier` entries exclude a specific file within a component
     (e.g., `"workflows/debug.yaml"`, `"skills/repomatic-audit"`,
     `"labels/labeller-content-based.yaml"`).
@@ -650,9 +649,9 @@ class Config:
     include: list[str] = field(default_factory=list)
     """Components and files to force-include, overriding default exclusions.
 
-    Use this to opt into components that are excluded by default (`labels`,
-    `skills`). Each entry is subtracted from the effective exclude set
-    (defaults + user `exclude`) and bypasses `RepoScope` filtering, so
+    Use this to opt into components that are excluded by default (`agents`,
+    `labels`, `skills`). Each entry is subtracted from the effective exclude
+    set (defaults + user `exclude`) and bypasses `RepoScope` filtering, so
     scope-restricted components (like awesome-only skills or Python-only
     `publish-pypi-action`) are included regardless of repository type.
     Qualified entries (`component/file`) implicitly select the parent
@@ -1000,18 +999,10 @@ def load_repomatic_config(
     tool_section = pyproject_data.get("tool", {})
     user_config: dict[str, Any] = tool_section.get("repomatic", {})
 
-    # Warn about unknown top-level keys before loading. Collect all known
-    # TOML key prefixes (e.g., "test-matrix", "nuitka", "workflow") so we
-    # can flag unrecognized entries without crashing.
-    known_keys = {info.key.split(".")[0] for info in schema_field_infos(Config)}
-    for key in user_config:
-        if key.replace("_", "-") not in known_keys:
-            logging.warning(
-                "Unknown [tool.repomatic] option: %s (ignored).",
-                key,
-            )
-
-    schema_callable = make_schema_callable(Config, strict=False)
+    # The [tool.repomatic] section is schema-only (the CLI group runs with
+    # included_params=()), so warn_unknown flags any key the schema does not
+    # know as a typo, nested tables included.
+    schema_callable = make_schema_callable(Config, strict=False, warn_unknown=True)
     assert schema_callable is not None
     config: Config = schema_callable(user_config)
     return config

{repomatic-7.2.0 → repomatic-7.3.0}/repomatic/data/_release-engine.yaml

@@ -51,7 +51,7 @@ jobs:
       - name: Run repomatic metadata
         id: metadata
         run: >
-          uvx --no-progress 'repomatic==7.2.0' metadata
+          uvx --no-progress 'repomatic==7.3.0' metadata
           --format github-json --output "$GITHUB_OUTPUT"
           new_commits_matrix release_commits_matrix build_targets nuitka_matrix
           nuitka_extras is_python_project package_name current_version
@@ -132,7 +132,7 @@ jobs:
           # NUITKA_PYTHON_FLAGS holds the entry point's --python-flag (if any),
           # meant to word-split.
           # shellcheck disable=SC2086
-          uvx --no-progress 'repomatic==7.2.0' run nuitka -- \
+          uvx --no-progress 'repomatic==7.3.0' run nuitka -- \
             ${NUITKA_PYTHON_FLAGS} \
             --output-filename="${BIN_NAME}" "${MODULE_PATH}"
       - name: Upload Nuitka crash report
@@ -154,8 +154,18 @@ jobs:
       - name: Install exiftool - Windows
         if: runner.os == 'Windows'
         shell: pwsh
+        # choco's --retry-count retries back-to-back, too fast to outlive a community-feed
+        # outage (406/504 responses): space three step-level attempts a minute apart.
         run: |
-          choco install exiftool --no-progress --yes --retry-count=3
+          $attempts = 3
+          foreach ($try in 1..$attempts) {
+            choco install exiftool --no-progress --yes --retry-count=3
+            if ($LASTEXITCODE -eq 0) { break }
+            if ($try -lt $attempts) {
+              Write-Warning "choco install exiftool failed (attempt ${try}/${attempts}), retrying in 60 seconds."
+              Start-Sleep -Seconds 60
+            }
+          }
           if (-not (Get-Command exiftool -ErrorAction SilentlyContinue)) {
             Write-Error "exiftool not found on PATH after choco install"
             exit 1
@@ -166,7 +176,7 @@ jobs:
           BIN_NAME: ${{ matrix.bin_name }}
         shell: bash
         run: >
-          uvx --no-progress 'repomatic==7.2.0'
+          uvx --no-progress 'repomatic==7.3.0'
           verify-binary --target "${TARGET}" --binary "${BIN_NAME}"
       - name: Upload binaries
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -285,7 +295,7 @@ jobs:
           CURRENT_VERSION: ${{ matrix.current_version }}
           COMMIT: ${{ matrix.commit }}
         run: >
-          uvx --no-progress 'repomatic==7.2.0' git-tag
+          uvx --no-progress 'repomatic==7.3.0' git-tag
           --tag "v${CURRENT_VERSION}"
           --commit "${COMMIT}"
           --skip-existing
@@ -326,7 +336,7 @@ jobs:
         continue-on-error: true
         env:
           GH_TOKEN: ${{ secrets.REPOMATIC_PAT || github.token }}
-        run: uvx --no-progress 'repomatic==7.2.0' sync-dev-release --live --delete
+        run: uvx --no-progress 'repomatic==7.3.0' sync-dev-release --live --delete
       - name: Create GitHub release draft
         # Idempotent: skips if release already exists (e.g. workflow re-run).
         # Notes carry the PyPI availability admonition from the start: baking it
@@ -446,6 +456,12 @@ jobs:
           merge-multiple: true
       - name: Upload binaries and attestation bundles to release
         # Exclude Python packages (.tar.gz, .whl) already uploaded by create-release.
+        # Each versioned binary is also uploaded under a versionless alias
+        # (name-<version>-<target>.<ext> duplicated as name-<target>.<ext>), so the
+        # stable releases/latest/download URLs always resolve. Aliases are
+        # byte-identical copies: artifact attestations verify them unchanged
+        # (digest-based), and the catalog recorder collapses them onto their
+        # versioned sibling (see repomatic/binaries_page.py).
         if: needs.compile-binaries.result != 'skipped'
         env:
           GH_TOKEN: ${{ secrets.REPOMATIC_PAT || github.token }}
@@ -454,6 +470,11 @@ jobs:
         run: |
           shopt -s nullglob extglob
           files=(./compile-assets/!(*.tar.gz|*.whl))
+          for binary in ./compile-assets/*-"${CURRENT_VERSION}"-*.@(bin|exe); do
+            versionless="${binary/-"${CURRENT_VERSION}"-/-}"
+            cp "${binary}" "${versionless}"
+            files+=("${versionless}")
+          done
           if [[ ${#files[@]} -gt 0 ]]; then
             gh release upload "v${CURRENT_VERSION}" \
               "${files[@]}" \
@@ -500,21 +521,24 @@ jobs:
         with:
           enable-cache: false
       - name: Download release binaries
+        # Versioned patterns leave out the versionless alias copies, which
+        # share their digest with a versioned sibling and would only submit
+        # duplicate scans.
         env:
           GH_TOKEN: ${{ github.token }}
           CURRENT_VERSION: ${{ matrix.current_version }}
         run: >
           gh release download "v${CURRENT_VERSION}"
           --repo "${{ github.repository }}"
-          --pattern "*.bin"
-          --pattern "*.exe"
+          --pattern "*-${CURRENT_VERSION}-*.bin"
+          --pattern "*-${CURRENT_VERSION}-*.exe"
           --dir ./binaries
       - name: Upload to VirusTotal and record detections
         env:
           VIRUSTOTAL_API_KEY: ${{ secrets.VIRUSTOTAL_API_KEY }}
           CURRENT_VERSION: ${{ matrix.current_version }}
         run: >
-          uvx --no-progress 'repomatic==7.2.0' scan-virustotal
+          uvx --no-progress 'repomatic==7.3.0' scan-virustotal
           --tag "v${CURRENT_VERSION}"
           --binaries-dir ./binaries
           --poll
@@ -527,7 +551,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: >
-          uvx --no-progress 'repomatic==7.2.0' sync-binaries
+          uvx --no-progress 'repomatic==7.3.0' sync-binaries
           --repo "${{ github.repository }}"
           --page docs/binaries.md
           --records docs/assets/virustotal-scans.json
@@ -542,7 +566,7 @@ jobs:
           CURRENT_VERSION: ${{ matrix.current_version }}
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
         run: >
-          uvx --no-progress 'repomatic==7.2.0' git-commit-push
+          uvx --no-progress 'repomatic==7.3.0' git-commit-push
           --message "Record v${CURRENT_VERSION} binaries"
           --branch "${DEFAULT_BRANCH}"
           docs/binaries.md
@@ -578,5 +602,5 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: >
-          uvx --no-progress 'repomatic==7.2.0' sync-dev-release --live
+          uvx --no-progress 'repomatic==7.3.0' sync-dev-release --live
           --upload-assets release_assets