repomatic 7.5.0__tar.gz → 7.7.0__tar.gz

{repomatic-7.5.0 → repomatic-7.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: repomatic
-Version: 7.5.0
+Version: 7.7.0
 Summary: 🏭 Automate repository maintenance, releases, and CI/CD workflows
 Keywords: changelog-formatter,dependabot-alternative,github-actions,github-labels,github-workflow,gitignore,mailmap,mypy,nuitka,python-automation,release-automation,repository-automation,repository-management,reusable-workflows,software-factory,sphinx-doc,typo,uv,workflow-reusable
 Author: Kevin Deldycke
@@ -59,7 +59,7 @@ Requires-Dist: wcmatch>=10
 Requires-Python: >=3.10
 Project-URL: Changelog, https://github.com/kdeldycke/repomatic/blob/main/changelog.md
 Project-URL: Documentation, https://kdeldycke.github.io/repomatic
-Project-URL: Download, https://github.com/kdeldycke/repomatic/releases/tag/v7.5.0
+Project-URL: Download, https://github.com/kdeldycke/repomatic/releases/tag/v7.7.0
 Project-URL: Funding, https://github.com/sponsors/kdeldycke
 Project-URL: Homepage, https://github.com/kdeldycke/repomatic
 Project-URL: Issues, https://github.com/kdeldycke/repomatic/issues
@@ -145,7 +145,7 @@ See the **[full documentation](https://kdeldycke.github.io/repomatic/)** for:
 - [CLI parameters](https://kdeldycke.github.io/repomatic/cli.html)
 - [Reusable workflow reference](https://kdeldycke.github.io/repomatic/workflows.html) (all 14 workflows with job descriptions)
 - [Security practices and token setup](https://kdeldycke.github.io/repomatic/security.html)
-- [Claude Code skills](https://kdeldycke.github.io/repomatic/skills.html)
+- [Claude Code skills](https://kdeldycke.github.io/repomatic/skills.html) and [agents](https://kdeldycke.github.io/repomatic/agents.html), also installable as a [Claude Code plugin](https://kdeldycke.github.io/repomatic/plugin.html)
 - [API reference](https://kdeldycke.github.io/repomatic/repomatic.html)
 - [Project history](https://kdeldycke.github.io/repomatic/history.html)
 

{repomatic-7.5.0 → repomatic-7.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ requires = ["uv-build>=0.8"]
 
 [project]
 name = "repomatic"
-version = "7.5.0"
+version = "7.7.0"
 description = "🏭 Automate repository maintenance, releases, and CI/CD workflows"
 readme = "readme.md"
 keywords = [
@@ -92,7 +92,7 @@ email = "kevin@deldycke.com"
 [project.urls]
 Changelog = "https://github.com/kdeldycke/repomatic/blob/main/changelog.md"
 Documentation = "https://kdeldycke.github.io/repomatic"
-Download = "https://github.com/kdeldycke/repomatic/releases/tag/v7.5.0"
+Download = "https://github.com/kdeldycke/repomatic/releases/tag/v7.7.0"
 Funding = "https://github.com/sponsors/kdeldycke"
 Homepage = "https://github.com/kdeldycke/repomatic"
 Issues = "https://github.com/kdeldycke/repomatic/issues"
@@ -146,7 +146,7 @@ module-root = ""
 [tool.nuitka]
 copyright = "Kevin Deldycke <kevin@deldycke.com> and contributors. Distributed under GPL-2.0-or-later license."
 file-description = "🏭 Automate repository maintenance, releases, and CI/CD workflows"
-file-version = "7.5.0"
+file-version = "7.7.0"
 include-data-dir = [
     "repomatic/data/awesome_template=repomatic/data/awesome_template",
     "repomatic/data/skills=repomatic/data/skills",
@@ -156,7 +156,7 @@ include-package-data = ["click_extra"]
 linux-icon = "docs/assets/icon.png"
 macos-app-icon = "docs/assets/icon.icns"
 product-name = "Repomatic"
-product-version = "7.5.0"
+product-version = "7.7.0"
 windows-icon-from-ico = "docs/assets/icon.ico"
 
 [tool.ruff]
@@ -205,8 +205,10 @@ Typescript = "TypeScript"
 
 [tool.typos.default.extend-words]
 astroid = "astroid"
+Contribuer = "Contribuer"
 oject = "oject"
 PNGs = "PNGs"
+quater = "quater"
 sur = "sur"
 
 [tool.mypy]
@@ -247,7 +249,7 @@ source = ["repomatic"]
 precision = 2
 
 [tool.bumpversion]
-current_version = "7.5.0"
+current_version = "7.7.0"
 parse = '(?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)(\.dev(?P<dev>\d+))?'
 serialize = [
     "{major}.{minor}.{patch}.dev{dev}",
@@ -332,9 +334,13 @@ pypi-package-history = [
     "gha-utils",
     "repokit",
 ]
+release-assets = ["repomatic-claude-plugin.zip"]
 
 [tool.repomatic.changelog]
 archive-location = "./docs/changelog-archive.md"
 
 [tool.repomatic.manpages]
 script = "repomatic.cli:repomatic"
+
+[tool.actionlint.paths."**/workflows/*"]
+ignore = ['property "job_workflow_sha" is not defined']

{repomatic-7.5.0 → repomatic-7.7.0}/pyproject.toml.orig

@@ -12,7 +12,7 @@ requires = [ "uv-build>=0.8" ]
 [project]
 # Docs: https://packaging.python.org/en/latest/guides/writing-pyproject-toml/
 name = "repomatic"
-version = "7.5.0"
+version = "7.7.0"
 description = "🏭 Automate repository maintenance, releases, and CI/CD workflows"
 readme = "readme.md"
 keywords = [
@@ -93,8 +93,8 @@ dependencies = [
   "boltons>=25",
   # click-extra 8.8.0 is the floor: repomatic delegates to the utilities absorbed
   # there — `format_size` (byte sizes in the image and cache reports), the
-  # `parse_duration`/`parse_friendly_duration`/`parse_iso8601_duration` family
-  # (uv cooldown spans in `uv.py`/`version_sync.py`), `prep_path`/`is_stdout`
+  # `parse_friendly_duration`/`parse_iso8601_duration` pair (uv cooldown spans
+  # in `uv.py`/`version_sync.py`), `prep_path`/`is_stdout`/`STDOUT_SENTINEL`
   # (CLI `--output` handling), and `config_table_to_flags` (tool flag
   # translation). Earlier floors remain in play: `binaries_page` imports
   # `click_extra.blocks` (`replace_region`, 8.7.1) to splice the binaries page
@@ -145,7 +145,7 @@ dependencies = [
 ]
 urls.Changelog = "https://github.com/kdeldycke/repomatic/blob/main/changelog.md"
 urls.Documentation = "https://kdeldycke.github.io/repomatic"
-urls.Download = "https://github.com/kdeldycke/repomatic/releases/tag/v7.5.0"
+urls.Download = "https://github.com/kdeldycke/repomatic/releases/tag/v7.7.0"
 urls.Funding = "https://github.com/sponsors/kdeldycke"
 urls.Homepage = "https://github.com/kdeldycke/repomatic"
 urls.Issues = "https://github.com/kdeldycke/repomatic/issues"
@@ -250,7 +250,7 @@ copyright = "Kevin Deldycke <kevin@deldycke.com> and contributors. Distributed u
 file-description = "🏭 Automate repository maintenance, releases, and CI/CD workflows"
 # Numeric only: Nuitka rejects PEP 440 .devN suffixes. Kept in sync with the
 # package version by the dedicated [tool.bumpversion] rule that strips the suffix.
-file-version = "7.5.0"
+file-version = "7.7.0"
 include-data-dir = [
   "repomatic/data/awesome_template=repomatic/data/awesome_template",
   "repomatic/data/skills=repomatic/data/skills",
@@ -269,7 +269,7 @@ include-package-data = [ "click_extra" ]
 linux-icon = "docs/assets/icon.png"
 macos-app-icon = "docs/assets/icon.icns"
 product-name = "Repomatic"
-product-version = "7.5.0"
+product-version = "7.7.0"
 windows-icon-from-ico = "docs/assets/icon.ico"
 
 [tool.ruff]
@@ -309,8 +309,12 @@ output-prefer-rule-codes = true
 
 [tool.typos]
 default.extend-identifiers = { Github = "GitHub", IOS = "iOS", Javascript = "JavaScript", MacOS = "macOS", PNGs = "PNGs", PyPi = "PyPI", Typescript = "TypeScript" }
-# False positives.
-default.extend-words = { astroid = "astroid", oject = "oject", PNGs = "PNGs", sur = "sur" }
+# False positives. "Contribuer" is the French for "Contributing", part of the
+# translated-readme fixture in tests/test_awesome_toc.py. "quater" is the fourth
+# term of the Latin ordinal series numbering the repo-lint checks (bis, ter,
+# quater), not a misspelling of "quarter": the unattended fix-typos job rewrote
+# it once already and had to be reverted by hand.
+default.extend-words = { astroid = "astroid", Contribuer = "Contribuer", oject = "oject", PNGs = "PNGs", quater = "quater", sur = "sur" }
 # Skip content between <!-- typos:off --> and <!-- typos:on --> markers.
 default.extend-ignore-re = [
   "(?s)<!-- typos:off -->.*?<!-- typos:on -->",
@@ -394,7 +398,7 @@ run.source = [ "repomatic" ]
 report.precision = 2
 
 [tool.bumpversion]
-current_version = "7.5.0"
+current_version = "7.7.0"
 # Parse versions with an optional .devN suffix (PEP 440).
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)(\\.dev(?P<dev>\\d+))?"
 serialize = [
@@ -517,3 +521,25 @@ exclude = [ "workflows" ]
 # the HTML docs site stay in lockstep.
 manpages.script = "repomatic.cli:repomatic"
 pypi-package-history = [ "gha-utils", "repokit" ]
+# Claude Code plugin archive packed by release.yaml's pack-plugin job and
+# attached to every GitHub release by the engine's extra-assets job. The
+# marketplace at .claude-plugin/marketplace.json installs the plugin straight
+# from this asset, so a release missing it breaks `/plugin install`.
+release-assets = [ "repomatic-claude-plugin.zip" ]
+
+[tool.actionlint]
+# actionlint reads no pyproject section of its own: repomatic serializes this one
+# to a temporary YAML config and passes it via `--config-file`. `paths` keys are
+# globs relative to the repository root, and each `ignore` entry is a regular
+# expression matched against the error message.
+#
+# `github.job_workflow_sha` is a real context property, holding the commit SHA of
+# the reusable workflow file itself, which the tool-cache keys read so they do not
+# rotate on every caller commit. GitHub documents it only as an OIDC token claim,
+# never on the `github` context reference page, so actionlint's schema lacks it.
+# Drop this entry once rhysd/actionlint#671 ships in a release.
+#
+# The glob carries no dot on purpose: click-extra expands every dotted key of
+# `pyproject.toml`, and one starting with a dot makes it warn on each repomatic
+# invocation. `**` matches dot-directories, so `.github/workflows/` is covered.
+paths."**/workflows/*".ignore = [ 'property "job_workflow_sha" is not defined' ]

{repomatic-7.5.0 → repomatic-7.7.0}/readme.md

@@ -77,7 +77,7 @@ See the **[full documentation](https://kdeldycke.github.io/repomatic/)** for:
 - [CLI parameters](https://kdeldycke.github.io/repomatic/cli.html)
 - [Reusable workflow reference](https://kdeldycke.github.io/repomatic/workflows.html) (all 14 workflows with job descriptions)
 - [Security practices and token setup](https://kdeldycke.github.io/repomatic/security.html)
-- [Claude Code skills](https://kdeldycke.github.io/repomatic/skills.html)
+- [Claude Code skills](https://kdeldycke.github.io/repomatic/skills.html) and [agents](https://kdeldycke.github.io/repomatic/agents.html), also installable as a [Claude Code plugin](https://kdeldycke.github.io/repomatic/plugin.html)
 - [API reference](https://kdeldycke.github.io/repomatic/repomatic.html)
 - [Project history](https://kdeldycke.github.io/repomatic/history.html)
 

{repomatic-7.5.0 → repomatic-7.7.0}/repomatic/__init__.py

@@ -17,5 +17,5 @@
 
 from __future__ import annotations
 
-__version__ = "7.5.0"
-__git_tag_sha__ = "ef51d27ea435bf5368112791288130134bd02142"
+__version__ = "7.7.0"
+__git_tag_sha__ = "2c6e58c0d2ec44e627868095eb4c22b98683c463"

{repomatic-7.5.0 → repomatic-7.7.0}/repomatic/__main__.py

@@ -35,21 +35,22 @@ from repomatic.cli import repomatic
 
 
 def main():
-    """Execute the CLI but force its name to not let Click defaults to:
+    """Execute the CLI under its canonical name, whatever the entry point.
+
+    Without `prog_name`, Click derives the displayed name from the invocation:
 
     ```{code-block} shell-session
     $ python -m repomatic --version
     python -m repomatic, version 4.0.0
     ```
 
-    Indirection via this `main()` method was [required to reconcile](https://github.com/python-poetry/poetry/issues/5981):
-
-        - plain inline package call: `python -m repomatic`,
-        - Poetry's script entry point: `repomatic = 'repomatic.__main__:main`,
-        - Nuitka's main module invocation requirement:
-          `python -m nuitka (...) repomatic/__main__.py`
+    The `main()` indirection lets three invocation styles share one entry
+    point rendering the same name:
 
-    That way we can deduce all three cases from the entry point.
+    - the plain module call: `python -m repomatic`,
+    - the `[project.scripts]` console script: `repomatic = "repomatic.__main__:main"`,
+    - Nuitka's main-module compilation requirement:
+      `python -m nuitka (...) repomatic/__main__.py`.
     """
     repomatic(prog_name=repomatic.name)
 

repomatic-7.7.0/repomatic/awesome_toc.py

@@ -0,0 +1,277 @@
+# Copyright Kevin Deldycke <kevin@deldycke.com> and contributors.
+#
+# This program is Free Software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+
+"""Remove the table-of-contents entries awesome-lint forbids.
+
+Backs the `fix-awesome-toc` command, which runs on `awesome-*` repositories
+right after `repomatic run mdformat` regenerates the ToC of every readme.
+
+```{note}
+This is the one operation that has no job, PR branch or template of its own,
+against the rule in `claude.md` § Naming conventions for automated operations.
+It corrects what `format-markdown` just wrote, so it has to share that job's
+working tree: given its own job, the two would land in separate PRs and undo
+each other on every push, `format-markdown` re-adding the entries this command
+had removed.
+```
+
+`mdformat-toc` lists every heading in range and offers no exclusion mechanism
+of its own, so the entries have to be deleted afterwards. Upstream tracks the
+feature in [hukkin/mdformat-toc#17](https://github.com/hukkin/mdformat-toc/issues/17)
+and [hukkin/mdformat-toc#20](https://github.com/hukkin/mdformat-toc/pull/20);
+this module can go once either lands and grows a way to express the exclusion
+in the ToC marker.
+"""
+
+from __future__ import annotations
+
+import logging
+import re
+from pathlib import Path
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Iterable, Iterator, Sequence
+
+FORBIDDEN_HEADINGS: tuple[str, ...] = (
+    "Contents",
+    "Contributing",
+    "Footnotes",
+    "Related Lists",
+)
+"""Headings awesome-lint refuses to see listed in the table of contents.
+
+Mirrors the roster in
+[awesome-lint's `toc.js`](https://github.com/sindresorhus/awesome-lint/blob/v2.2.2/rules/toc.js#L14-L18),
+plus the heading owning the ToC itself (`Contents`), whose entry trips
+`remark-lint:awesome-toc`:
+
+```
+✖  26:1  ToC item "Contents" does not match corresponding heading "Meta"
+```
+
+These are the English names, the only ones awesome-lint knows. A translated
+readme names the same sections in its own language, which is why matching on
+this roster alone is not enough: see {func}`forbidden_headings_for`.
+"""
+
+README_RE = re.compile(r"^readme(\.[^.]+)?\.md$")
+"""Match `readme.md` and every `readme.{lang}.md` translation beside it.
+
+Only the repository root is scanned. The `find ./` this replaced walked the
+whole tree, which on a checkout carrying a `node_modules/` directory would
+have reached a few hundred vendored readmes.
+"""
+
+REFERENCE_README = "readme.md"
+"""The English readme, whose heading positions every translation is mapped onto."""
+
+HEADING_RE = re.compile(r"^\#{1,6}[ \t]+(?P<text>.+?)[ \t]*\#*[ \t]*$", re.MULTILINE)
+"""Match an ATX heading and capture its text, closing sequence excluded."""
+
+TOC_ENTRY_RE = re.compile(r"^[ \t]*- \[(?P<text>.+)\]\(#[^)]*\)$")
+"""Match one `mdformat-toc` list entry and capture its link text."""
+
+TOC_START_RE = re.compile(r"^<!--\s*mdformat-toc\s+start\b.*-->$", re.IGNORECASE)
+"""Match the opening marker of an `mdformat-toc` block."""
+
+TOC_END_RE = re.compile(r"^<!--\s*mdformat-toc\s+end\s*-->$", re.IGNORECASE)
+"""Match the closing marker of an `mdformat-toc` block."""
+
+FENCE_RE = re.compile(r"^[ \t]*(?P<fence>`{3,}|~{3,})")
+"""Match the delimiter of a fenced code block."""
+
+
+def _strip_fenced_blocks(content: str) -> str:
+    """Blank out fenced code blocks so their `#` lines are not read as headings.
+
+    Replaces the content of every fence with empty lines, keeping the line
+    count intact so positions elsewhere are unaffected.
+
+    :param content: The full Markdown document.
+    :return: The document with fenced blocks blanked out.
+    """
+    lines = content.splitlines()
+    kept: list[str] = []
+    fence: str | None = None
+    for line in lines:
+        match = FENCE_RE.match(line)
+        if fence is None:
+            if match:
+                fence = match.group("fence")[0]
+                kept.append("")
+                continue
+        elif match and match.group("fence")[0] == fence:
+            fence = None
+            kept.append("")
+            continue
+        kept.append("" if fence else line)
+    return "\n".join(kept)
+
+
+def headings(content: str) -> list[str]:
+    """List the ATX heading texts of a Markdown document, in document order.
+
+    :param content: The full Markdown document.
+    :return: Every heading text, code fences excluded.
+    """
+    return [m.group("text") for m in HEADING_RE.finditer(_strip_fenced_blocks(content))]
+
+
+def forbidden_headings_for(
+    content: str,
+    reference_headings: Sequence[str] | None = None,
+) -> set[str]:
+    """Resolve which heading texts must not appear in *content*'s ToC.
+
+    Always includes the English {data}`FORBIDDEN_HEADINGS` that awesome-lint
+    knows, since a translation routinely leaves some of them untranslated.
+
+    On top of that, when *reference_headings* is given and the document has the
+    same number of headings, the heading occupying each forbidden position in
+    the reference is forbidden here too. That positional mapping is what carries
+    the rule across languages: repomatic cannot know that `贡献` translates
+    `Contributing`, but it can see that both sit at the same index of a readme
+    and its translation. Headings survive formatting untouched, so the mapping
+    holds even against an already-stripped reference.
+
+    :param content: The Markdown document to resolve the roster for.
+    :param reference_headings: Headings of {data}`REFERENCE_README`, if any.
+    :return: The heading texts whose ToC entry must be deleted.
+    """
+    forbidden = set(FORBIDDEN_HEADINGS)
+    if not reference_headings:
+        return forbidden
+
+    own_headings = headings(content)
+    if len(own_headings) != len(reference_headings):
+        logging.warning(
+            f"Heading count differs from {REFERENCE_README} "
+            f"({len(own_headings)} vs {len(reference_headings)}): "
+            "falling back to English heading names only."
+        )
+        return forbidden
+
+    forbidden.update(
+        own_headings[index]
+        for index, heading in enumerate(reference_headings)
+        if heading in FORBIDDEN_HEADINGS
+    )
+    return forbidden
+
+
+def _toc_bounds(lines: Sequence[str]) -> tuple[int, int] | None:
+    """Locate the `mdformat-toc` block in *lines*.
+
+    :param lines: The document split into lines.
+    :return: The start and end marker indices, or `None` when either is absent.
+    """
+    start = end = None
+    for index, line in enumerate(lines):
+        if start is None:
+            if TOC_START_RE.match(line):
+                start = index
+        elif TOC_END_RE.match(line):
+            end = index
+            break
+    if start is None or end is None:
+        return None
+    return start, end
+
+
+def strip_toc_entries(content: str, forbidden: set[str]) -> tuple[str, list[str]]:
+    """Delete the ToC entries of *content* whose link text is *forbidden*.
+
+    Only the `mdformat-toc` block is touched: a list item elsewhere in the
+    document that happens to link the same heading is left alone.
+
+    :param content: The full Markdown document.
+    :param forbidden: Heading texts whose entry must go.
+    :return: The updated document and the link texts that were deleted.
+    """
+    lines = content.splitlines(keepends=True)
+    bounds = _toc_bounds([line.rstrip("\r\n") for line in lines])
+    if bounds is None:
+        return content, []
+    start, end = bounds
+
+    kept: list[str] = []
+    removed: list[str] = []
+    for index, line in enumerate(lines):
+        if start < index < end:
+            match = TOC_ENTRY_RE.match(line.rstrip("\r\n"))
+            if match and match.group("text") in forbidden:
+                removed.append(match.group("text"))
+                continue
+        kept.append(line)
+    return "".join(kept), removed
+
+
+def fix_awesome_toc(root: Path | None = None) -> dict[Path, list[str]]:
+    """Strip the forbidden ToC entries from every readme under *root*.
+
+    Reads {data}`REFERENCE_README` first so its heading positions can be mapped
+    onto each translation, then rewrites every readme that changed. Idempotent:
+    a second run finds nothing left to delete.
+
+    :param root: Directory holding the readmes. Defaults to the current one.
+    :return: The deleted entries, keyed by the readme they came from.
+    """
+    root = Path.cwd() if root is None else root
+
+    reference = root / REFERENCE_README
+    reference_headings: list[str] | None = None
+    if reference.is_file():
+        reference_headings = headings(reference.read_text(encoding="UTF-8"))
+    else:
+        logging.warning(
+            f"No {REFERENCE_README} in {root}: translations can only be matched "
+            "on English heading names."
+        )
+
+    report: dict[Path, list[str]] = {}
+    for readme in _readmes(root):
+        content = readme.read_text(encoding="UTF-8")
+        forbidden = forbidden_headings_for(content, reference_headings)
+        updated, removed = strip_toc_entries(content, forbidden)
+        if not removed:
+            logging.debug(f"No forbidden ToC entry in {readme}.")
+            continue
+        readme.write_text(updated, encoding="UTF-8")
+        logging.info(f"Removed {len(removed)} ToC entries from {readme}.")
+        report[readme] = removed
+    return report
+
+
+def _readmes(root: Path) -> Iterator[Path]:
+    """Yield the readmes of *root*, the reference first.
+
+    The reference goes first so its own entries are gone before a translation
+    is compared against it, which keeps a partial failure from leaving the
+    English readme dirtier than its translations.
+
+    :param root: Directory to scan.
+    :return: Each matching readme path, sorted after the reference.
+    """
+    matches: Iterable[Path] = sorted(
+        path for path in root.iterdir() if path.is_file() and README_RE.match(path.name)
+    )
+    for path in matches:
+        if path.name == REFERENCE_README:
+            yield path
+    for path in matches:
+        if path.name != REFERENCE_README:
+            yield path

{repomatic-7.5.0 → repomatic-7.7.0}/repomatic/binaries_page.py

@@ -57,7 +57,8 @@ from pathlib import Path
 
 from click_extra.blocks import replace_region
 
-from .binary import NUITKA_BUILD_TARGETS
+from .binary import BINARY_ASSET_SUFFIXES, NUITKA_BUILD_TARGETS
+from .bundle import get_data_content
 from .github.releases import parse_release_version
 from .virustotal import VIRUSTOTAL_GUI_URL
 
@@ -68,11 +69,21 @@ if TYPE_CHECKING:
     from .github.releases import ReleaseAsset, ReleaseWithAssets
     from .virustotal import ScanRecord
 
-BINARY_ASSET_SUFFIXES = (".bin", ".exe")
-"""File extensions identifying compiled binaries among release assets.
+CHART_JS_URL = "https://cdn.jsdelivr.net/npm/chart.js@4.5.0/dist/chart.umd.min.js"
+"""Pinned CDN artifact drawing the detections trend chart.
 
-Same set the `scan-virustotal` command uploads and the release workflow
-downloads (`--pattern` flags in `_release-engine.yaml`).
+The one external artifact this module publishes into every downstream
+repository's docs, so it carries a checksum beside the pin: bump the version
+by hand together with {data}`CHART_JS_SRI`.
+"""
+
+CHART_JS_SRI = "sha384-XcdcwHqIPULERb2yDEM4R0XaQKU3YnDsrTmjACBZyfdVVqjh6xQ4/DCMd7XLcA6Y"
+"""Subresource Integrity digest of {data}`CHART_JS_URL`.
+
+The browser refuses the script if the CDN bytes stop matching. Recompute on
+every version bump as the sha384 of the exact artifact, verified against the
+same file inside the npm registry tarball before trusting the CDN copy:
+`hashlib.sha384(artifact_bytes)` then base64.
 """
 
 CSV_HEADERS = (
@@ -186,13 +197,14 @@ def _binary_assets(release: ReleaseWithAssets) -> list[ReleaseAsset]:
     """Return the release's compiled binaries, sorted by filename.
 
     Releases also carry versionless alias copies of each binary, backing the
-    stable ``releases/latest/download`` URLs (see the upload step in
-    ``_release-engine.yaml``). An alias shares its digest with its versioned
-    sibling: collapse each digest group onto its longest name (the versioned
-    one, since the alias is that same name minus the version segment) so the
-    catalog lists each binary once. Assets without a recorded digest
-    (uploaded before GitHub started recording them, mid-2025) predate the
-    aliases and are kept as-is.
+    stable ``releases/latest/download`` URLs (created by
+    {func}`~repomatic.binary.pack_binary_assets`, which
+    `release-assets` runs in the release engine). An alias shares its digest
+    with its versioned sibling: collapse each digest group onto its longest
+    name (the versioned one, since {func}`~repomatic.binary.versionless_alias`
+    only ever strips the version segment) so the catalog lists each binary
+    once. Assets without a recorded digest (uploaded before GitHub started
+    recording them, mid-2025) predate the aliases and are kept as-is.
     """
     binaries = [a for a in release.assets if a.name.endswith(BINARY_ASSET_SUFFIXES)]
     digest_groups: dict[str, list[ReleaseAsset]] = {}
@@ -275,6 +287,15 @@ def render_chart_section(records: Sequence[ScanRecord]) -> str:
         ],
         sort_keys=True,
     )
+    # The chart script ships as a bundled data file so it reads (and lints) as
+    # JavaScript instead of sixty quoted Python strings. Placeholder tokens are
+    # substituted with str.replace, never str.format: the script is full of
+    # literal braces.
+    script = (
+        get_data_content("vt-trend-chart.js")
+        .replace("__VT_TREND_PAYLOAD__", payload)
+        .replace("__VT_DANGER_PCT__", str(FLAGGED_DANGER_PCT))
+    )
     return (
         "## VirusTotal detections\n\n"
         "Share of antivirus engine verdicts flagging the binaries of each "
@@ -283,62 +304,9 @@ def render_chart_section(records: Sequence[ScanRecord]) -> str:
         "there up.\n\n"
         "```{raw} html\n"
         '<div style="height: 320px;"><canvas id="vt-trend"></canvas></div>\n'
-        '<script src="https://cdn.jsdelivr.net/npm/chart.js@4.5.0/dist/'
-        'chart.umd.min.js"></script>\n'
-        "<script>\n"
-        f"const VT_TREND = {payload};\n"
-        f"const VT_DANGER_PCT = {FLAGGED_DANGER_PCT};\n"
-        "const vtCss = getComputedStyle(document.documentElement);\n"
-        "const vtColor = (name, fallback) =>\n"
-        "    vtCss.getPropertyValue(name).trim() || fallback;\n"
-        "const vtTint = (p) => {\n"
-        '    if (p.pct === 0) { return vtColor("--sd-color-success", "#28a745"); }\n'
-        "    return p.pct >= VT_DANGER_PCT\n"
-        '        ? vtColor("--sd-color-danger", "#dc3545")\n'
-        '        : vtColor("--sd-color-warning", "#f0b37e");\n'
-        "};\n"
-        'new Chart(document.getElementById("vt-trend"), {\n'
-        '    type: "line",\n'
-        "    data: {\n"
-        "        datasets: [{\n"
-        "            data: VT_TREND.map((p) => ({x: Date.parse(p.date), y: p.pct})),\n"
-        '            borderColor: "#88888866",\n'
-        "            pointBackgroundColor: VT_TREND.map(vtTint),\n"
-        "            pointBorderColor: VT_TREND.map(vtTint),\n"
-        "            pointRadius: 4,\n"
-        "            tension: 0.2,\n"
-        "        }],\n"
-        "    },\n"
-        "    options: {\n"
-        "        maintainAspectRatio: false,\n"
-        "        plugins: {\n"
-        "            legend: {display: false},\n"
-        "            tooltip: {callbacks: {\n"
-        "                title: (items) => VT_TREND[items[0].dataIndex].tag,\n"
-        "                label: (item) => {\n"
-        "                    const p = VT_TREND[item.dataIndex];\n"
-        '                    return p.flagged + " / " + p.total\n'
-        '                        + " verdicts flagged (" + p.pct + "%)";\n'
-        "                },\n"
-        "            }},\n"
-        "        },\n"
-        "        scales: {\n"
-        "            x: {\n"
-        '                type: "linear",\n'
-        "                ticks: {\n"
-        "                    maxTicksLimit: 8,\n"
-        "                    callback: (value) =>\n"
-        "                        new Date(value).toISOString().slice(0, 10),\n"
-        "                },\n"
-        "            },\n"
-        "            y: {\n"
-        "                beginAtZero: true,\n"
-        '                title: {display: true, text: "Flagged verdicts (%)"},\n'
-        "            },\n"
-        "        },\n"
-        "    },\n"
-        "});\n"
-        "</script>\n"
+        f'<script src="{CHART_JS_URL}" integrity="{CHART_JS_SRI}" '
+        'crossorigin="anonymous"></script>\n'
+        f"<script>\n{script}</script>\n"
         "```"
     )