repomatic 7.3.0__tar.gz → 7.3.1__tar.gz

{repomatic-7.3.0 → repomatic-7.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: repomatic
-Version: 7.3.0
+Version: 7.3.1
 Summary: 🏭 Automate repository maintenance, releases, and CI/CD workflows
 Keywords: changelog-formatter,dependabot-alternative,github-actions,github-labels,github-workflow,gitignore,mailmap,mypy,nuitka,python-automation,release-automation,repository-automation,repository-management,reusable-workflows,software-factory,sphinx-doc,typo,uv,workflow-reusable
 Author: Kevin Deldycke
@@ -58,7 +58,7 @@ Requires-Dist: wcmatch>=10
 Requires-Python: >=3.10
 Project-URL: Changelog, https://github.com/kdeldycke/repomatic/blob/main/changelog.md
 Project-URL: Documentation, https://kdeldycke.github.io/repomatic
-Project-URL: Download, https://github.com/kdeldycke/repomatic/releases/tag/v7.3.0
+Project-URL: Download, https://github.com/kdeldycke/repomatic/releases/tag/v7.3.1
 Project-URL: Funding, https://github.com/sponsors/kdeldycke
 Project-URL: Homepage, https://github.com/kdeldycke/repomatic
 Project-URL: Issues, https://github.com/kdeldycke/repomatic/issues

{repomatic-7.3.0 → repomatic-7.3.1}/pyproject.toml

@@ -5,7 +5,7 @@ requires = [ "uv-build>=0.9,<0.12" ]
 [project]
 # Docs: https://packaging.python.org/en/latest/guides/writing-pyproject-toml/
 name = "repomatic"
-version = "7.3.0"
+version = "7.3.1"
 description = "🏭 Automate repository maintenance, releases, and CI/CD workflows"
 readme = "readme.md"
 keywords = [
@@ -128,7 +128,7 @@ dependencies = [
 ]
 urls.Changelog = "https://github.com/kdeldycke/repomatic/blob/main/changelog.md"
 urls.Documentation = "https://kdeldycke.github.io/repomatic"
-urls.Download = "https://github.com/kdeldycke/repomatic/releases/tag/v7.3.0"
+urls.Download = "https://github.com/kdeldycke/repomatic/releases/tag/v7.3.1"
 urls.Funding = "https://github.com/sponsors/kdeldycke"
 urls.Homepage = "https://github.com/kdeldycke/repomatic"
 urls.Issues = "https://github.com/kdeldycke/repomatic/issues"
@@ -225,7 +225,7 @@ copyright = "Kevin Deldycke <kevin@deldycke.com> and contributors. Distributed u
 file-description = "🏭 Automate repository maintenance, releases, and CI/CD workflows"
 # Numeric only: Nuitka rejects PEP 440 .devN suffixes. Kept in sync with the
 # package version by the dedicated [tool.bumpversion] rule that strips the suffix.
-file-version = "7.3.0"
+file-version = "7.3.1"
 include-data-dir = [
   "repomatic/data/awesome_template=repomatic/data/awesome_template",
 ]
@@ -243,7 +243,7 @@ include-package-data = [ "click_extra" ]
 linux-icon = "docs/assets/icon.png"
 macos-app-icon = "docs/assets/icon.icns"
 product-name = "Repomatic"
-product-version = "7.3.0"
+product-version = "7.3.1"
 windows-icon-from-ico = "docs/assets/icon.ico"
 
 [tool.ruff]
@@ -343,11 +343,18 @@ addopts = [
   "--cov",
   "--cov-report=term",
   "--numprocesses=auto",
+  # Import test modules via importlib instead of prepending their root dir to
+  # sys.path. Avoids "import file mismatch" collection errors when an installed
+  # copy of the package coexists with the source tree, as in distro builds.
+  "--import-mode=importlib",
 ]
 # https://docs.pytest.org/en/latest/customize.html#pyproject-toml
 markers = [
   "once: Tests that only need to run once, not across the full CI matrix.",
 ]
+# Restrict collection to the test suite, so pytest never descends into the
+# package or an installed copy of it in dual-copy builds.
+testpaths = [ "tests" ]
 # Make sure tests that are expected to fail do not resurrect and start working all of a sudden.
 xfail_strict = true
 
@@ -358,7 +365,7 @@ run.source = [ "repomatic" ]
 report.precision = 2
 
 [tool.bumpversion]
-current_version = "7.3.0"
+current_version = "7.3.1"
 # Parse versions with an optional .devN suffix (PEP 440).
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)(\\.dev(?P<dev>\\d+))?"
 serialize = [

{repomatic-7.3.0 → repomatic-7.3.1}/repomatic/__init__.py

@@ -17,5 +17,5 @@
 
 from __future__ import annotations
 
-__version__ = "7.3.0"
-__git_tag_sha__ = "2b89c62f0953d8ef59d0d023085a9323f6c32f1d"
+__version__ = "7.3.1"
+__git_tag_sha__ = "c81fb2e6fa884cb62ef46e69b8c8db44fa6fad15"

{repomatic-7.3.0 → repomatic-7.3.1}/repomatic/changelog.py

@@ -959,7 +959,16 @@ def lint_changelog_dates(
         archive_headings = Changelog(
             archive_path.read_text(encoding="UTF-8")
         ).extract_all_version_headings()
-    all_known = set(pypi_data) | set(github_releases) | set(tag_versions)
+    # The changelog documents only final releases. Exclude pre-releases
+    # (dev/alpha/beta/rc) so a published `X.Y.Z.dev0` tag, PyPI upload, or
+    # GitHub prerelease is never mistaken for a missing changelog entry: an
+    # orphan insertion would both drop a spurious pre-release section and
+    # rewrite the adjacent release's comparison-URL base to point at it.
+    all_known = {
+        v
+        for v in (set(pypi_data) | set(github_releases) | set(tag_versions))
+        if not Version(v).is_prerelease
+    }
     orphans = all_known - changelog_headings - archive_headings
     if orphans:
         for orphan in sorted(orphans, key=Version):
@@ -1004,6 +1013,11 @@ def lint_changelog_dates(
 
     date_corrections: dict[str, str] = {}
     abandoned = frozenset(abandoned_versions)
+    # Point maintainers at the remedy: a version that is intentionally absent
+    # from the reference source is declared once in config, not re-flagged.
+    abandoned_hint = (
+        "list under [tool.repomatic] abandoned-versions if intentionally unpublished"
+    )
 
     for version, changelog_date in releases:
         if use_pypi:
@@ -1018,10 +1032,10 @@ def lint_changelog_dates(
                         f"  {version}: predates PyPI (first: {first_pypi_version})"
                     )
                     continue
-                logging.warning(f"⚠ {version}: not found on PyPI")
+                logging.warning(f"⚠ {version}: not found on PyPI ({abandoned_hint})")
                 emit_annotation(
                     AnnotationLevel.WARNING,
-                    f"Version {version} not found on PyPI",
+                    f"Version {version} not found on PyPI ({abandoned_hint})",
                 )
                 continue
             ref_date = release.date
@@ -1033,10 +1047,12 @@ def lint_changelog_dates(
                 if version in abandoned:
                     logging.info(f"  {version}: abandoned (skipped per config)")
                     continue
-                logging.warning(f"⚠ {version}: not found on {source}")
+                logging.warning(
+                    f"⚠ {version}: not found on {source} ({abandoned_hint})"
+                )
                 emit_annotation(
                     AnnotationLevel.WARNING,
-                    f"Version {version} not found on {source}",
+                    f"Version {version} not found on {source} ({abandoned_hint})",
                 )
                 continue
             ref_date = tag_date

{repomatic-7.3.0 → repomatic-7.3.1}/repomatic/data/_release-engine.yaml

@@ -36,7 +36,7 @@ jobs:
       has_virustotal_key: ${{ steps.check-vt-key.outputs.has_key }}
       metadata: ${{ steps.metadata.outputs.metadata }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Checkout pull request HEAD commit to ignore actions/checkout's merge commit. Fallback to push SHA.
           # See: https://github.com/actions/checkout/issues/504
@@ -51,7 +51,7 @@ jobs:
       - name: Run repomatic metadata
         id: metadata
         run: >
-          uvx --no-progress 'repomatic==7.3.0' metadata
+          uvx --no-progress 'repomatic==7.3.1' metadata
           --format github-json --output "$GITHUB_OUTPUT"
           new_commits_matrix release_commits_matrix build_targets nuitka_matrix
           nuitka_extras is_python_project package_name current_version
@@ -88,7 +88,7 @@ jobs:
       attestations: write
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ matrix.commit }}
       - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
@@ -113,7 +113,7 @@ jobs:
           uv --no-progress sync --frozen ${flags}
       - name: Pre-bake build metadata
         if: contains(matrix.current_version, '.dev')
-        run: uvx --no-progress 'click-extra==8.3.0' prebake all
+        run: uvx --no-progress 'click-extra==8.4.0' prebake all
       - name: Build binary
         id: build-binary
         continue-on-error: true
@@ -132,7 +132,7 @@ jobs:
           # NUITKA_PYTHON_FLAGS holds the entry point's --python-flag (if any),
           # meant to word-split.
           # shellcheck disable=SC2086
-          uvx --no-progress 'repomatic==7.3.0' run nuitka -- \
+          uvx --no-progress 'repomatic==7.3.1' run nuitka -- \
             ${NUITKA_PYTHON_FLAGS} \
             --output-filename="${BIN_NAME}" "${MODULE_PATH}"
       - name: Upload Nuitka crash report
@@ -176,7 +176,7 @@ jobs:
           BIN_NAME: ${{ matrix.bin_name }}
         shell: bash
         run: >
-          uvx --no-progress 'repomatic==7.3.0'
+          uvx --no-progress 'repomatic==7.3.1'
           verify-binary --target "${TARGET}" --binary "${BIN_NAME}"
       - name: Upload binaries
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -191,7 +191,7 @@ jobs:
         if: >-
           github.ref == 'refs/heads/main'
           && fromJSON(needs.metadata.outputs.metadata).release_commits_matrix
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
         with:
           subject-path: ${{ matrix.bin_name }}
       - name: Verify binary attestation
@@ -237,7 +237,7 @@ jobs:
     # We keep going when a job flagged as not stable fails.
     continue-on-error: ${{ matrix.state == 'unstable' }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ matrix.commit }}
       - name: Download artifact
@@ -281,7 +281,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ matrix.commit }}
           # PAT required so tag pushes trigger downstream on.push.tags workflows.
@@ -295,7 +295,7 @@ jobs:
           CURRENT_VERSION: ${{ matrix.current_version }}
           COMMIT: ${{ matrix.commit }}
         run: >
-          uvx --no-progress 'repomatic==7.3.0' git-tag
+          uvx --no-progress 'repomatic==7.3.1' git-tag
           --tag "v${CURRENT_VERSION}"
           --commit "${COMMIT}"
           --skip-existing
@@ -316,7 +316,7 @@ jobs:
       # Allow project without REPOMATIC_PAT to create a GitHub release.
       contents: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ matrix.commit }}
       - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
@@ -336,7 +336,7 @@ jobs:
         continue-on-error: true
         env:
           GH_TOKEN: ${{ secrets.REPOMATIC_PAT || github.token }}
-        run: uvx --no-progress 'repomatic==7.3.0' sync-dev-release --live --delete
+        run: uvx --no-progress 'repomatic==7.3.1' sync-dev-release --live --delete
       - name: Create GitHub release draft
         # Idempotent: skips if release already exists (e.g. workflow re-run).
         # Notes carry the PyPI availability admonition from the start: baking it
@@ -390,7 +390,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ matrix.commit }}
       - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
@@ -510,7 +510,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Scan records and the binaries page are committed on top of the
           # default branch tip, not the release commit. The PAT (when
@@ -538,7 +538,7 @@ jobs:
           VIRUSTOTAL_API_KEY: ${{ secrets.VIRUSTOTAL_API_KEY }}
           CURRENT_VERSION: ${{ matrix.current_version }}
         run: >
-          uvx --no-progress 'repomatic==7.3.0' scan-virustotal
+          uvx --no-progress 'repomatic==7.3.1' scan-virustotal
           --tag "v${CURRENT_VERSION}"
           --binaries-dir ./binaries
           --poll
@@ -551,7 +551,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: >
-          uvx --no-progress 'repomatic==7.3.0' sync-binaries
+          uvx --no-progress 'repomatic==7.3.1' sync-binaries
           --repo "${{ github.repository }}"
           --page docs/binaries.md
           --records docs/assets/virustotal-scans.json
@@ -566,7 +566,7 @@ jobs:
           CURRENT_VERSION: ${{ matrix.current_version }}
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
         run: >
-          uvx --no-progress 'repomatic==7.3.0' git-commit-push
+          uvx --no-progress 'repomatic==7.3.1' git-commit-push
           --message "Record v${CURRENT_VERSION} binaries"
           --branch "${DEFAULT_BRANCH}"
           docs/binaries.md
@@ -587,11 +587,21 @@ jobs:
       && github.ref == 'refs/heads/main'
       && !fromJSON(needs.metadata.outputs.metadata).release_commits_matrix
       && fromJSON(needs.metadata.outputs.metadata).current_version
+    # Serialise this job across overlapping release runs: the dev pre-release is a
+    # single mutable GitHub resource this job deletes, recreates and uploads to. The
+    # run-level concurrency in release.yaml cancels a superseded run mid-sync, which
+    # can leave the pre-release half-rewritten and fail the next run's sync. A
+    # dedicated per-repository group that never cancels in progress lets each sync
+    # finish cleanly before the next starts; GitHub keeps only the latest queued one,
+    # so the pre-release still converges to the newest build.
+    concurrency:
+      group: sync-dev-release-${{ github.repository }}
+      cancel-in-progress: false
     runs-on: ubuntu-slim
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
       - name: Download all build artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -602,5 +612,5 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: >
-          uvx --no-progress 'repomatic==7.3.0' sync-dev-release --live
+          uvx --no-progress 'repomatic==7.3.1' sync-dev-release --live
           --upload-assets release_assets