repomatic 7.6.0__tar.gz → 7.7.0__tar.gz

{repomatic-7.6.0 → repomatic-7.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: repomatic
-Version: 7.6.0
+Version: 7.7.0
 Summary: 🏭 Automate repository maintenance, releases, and CI/CD workflows
 Keywords: changelog-formatter,dependabot-alternative,github-actions,github-labels,github-workflow,gitignore,mailmap,mypy,nuitka,python-automation,release-automation,repository-automation,repository-management,reusable-workflows,software-factory,sphinx-doc,typo,uv,workflow-reusable
 Author: Kevin Deldycke
@@ -59,7 +59,7 @@ Requires-Dist: wcmatch>=10
 Requires-Python: >=3.10
 Project-URL: Changelog, https://github.com/kdeldycke/repomatic/blob/main/changelog.md
 Project-URL: Documentation, https://kdeldycke.github.io/repomatic
-Project-URL: Download, https://github.com/kdeldycke/repomatic/releases/tag/v7.6.0
+Project-URL: Download, https://github.com/kdeldycke/repomatic/releases/tag/v7.7.0
 Project-URL: Funding, https://github.com/sponsors/kdeldycke
 Project-URL: Homepage, https://github.com/kdeldycke/repomatic
 Project-URL: Issues, https://github.com/kdeldycke/repomatic/issues

{repomatic-7.6.0 → repomatic-7.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ requires = ["uv-build>=0.8"]
 
 [project]
 name = "repomatic"
-version = "7.6.0"
+version = "7.7.0"
 description = "🏭 Automate repository maintenance, releases, and CI/CD workflows"
 readme = "readme.md"
 keywords = [
@@ -92,7 +92,7 @@ email = "kevin@deldycke.com"
 [project.urls]
 Changelog = "https://github.com/kdeldycke/repomatic/blob/main/changelog.md"
 Documentation = "https://kdeldycke.github.io/repomatic"
-Download = "https://github.com/kdeldycke/repomatic/releases/tag/v7.6.0"
+Download = "https://github.com/kdeldycke/repomatic/releases/tag/v7.7.0"
 Funding = "https://github.com/sponsors/kdeldycke"
 Homepage = "https://github.com/kdeldycke/repomatic"
 Issues = "https://github.com/kdeldycke/repomatic/issues"
@@ -146,7 +146,7 @@ module-root = ""
 [tool.nuitka]
 copyright = "Kevin Deldycke <kevin@deldycke.com> and contributors. Distributed under GPL-2.0-or-later license."
 file-description = "🏭 Automate repository maintenance, releases, and CI/CD workflows"
-file-version = "7.6.0"
+file-version = "7.7.0"
 include-data-dir = [
     "repomatic/data/awesome_template=repomatic/data/awesome_template",
     "repomatic/data/skills=repomatic/data/skills",
@@ -156,7 +156,7 @@ include-package-data = ["click_extra"]
 linux-icon = "docs/assets/icon.png"
 macos-app-icon = "docs/assets/icon.icns"
 product-name = "Repomatic"
-product-version = "7.6.0"
+product-version = "7.7.0"
 windows-icon-from-ico = "docs/assets/icon.ico"
 
 [tool.ruff]
@@ -208,6 +208,7 @@ astroid = "astroid"
 Contribuer = "Contribuer"
 oject = "oject"
 PNGs = "PNGs"
+quater = "quater"
 sur = "sur"
 
 [tool.mypy]
@@ -248,7 +249,7 @@ source = ["repomatic"]
 precision = 2
 
 [tool.bumpversion]
-current_version = "7.6.0"
+current_version = "7.7.0"
 parse = '(?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)(\.dev(?P<dev>\d+))?'
 serialize = [
     "{major}.{minor}.{patch}.dev{dev}",
@@ -333,10 +334,13 @@ pypi-package-history = [
     "gha-utils",
     "repokit",
 ]
-release-assets = ["repomatic-plugin.zip"]
+release-assets = ["repomatic-claude-plugin.zip"]
 
 [tool.repomatic.changelog]
 archive-location = "./docs/changelog-archive.md"
 
 [tool.repomatic.manpages]
 script = "repomatic.cli:repomatic"
+
+[tool.actionlint.paths."**/workflows/*"]
+ignore = ['property "job_workflow_sha" is not defined']

{repomatic-7.6.0 → repomatic-7.7.0}/pyproject.toml.orig

@@ -12,7 +12,7 @@ requires = [ "uv-build>=0.8" ]
 [project]
 # Docs: https://packaging.python.org/en/latest/guides/writing-pyproject-toml/
 name = "repomatic"
-version = "7.6.0"
+version = "7.7.0"
 description = "🏭 Automate repository maintenance, releases, and CI/CD workflows"
 readme = "readme.md"
 keywords = [
@@ -145,7 +145,7 @@ dependencies = [
 ]
 urls.Changelog = "https://github.com/kdeldycke/repomatic/blob/main/changelog.md"
 urls.Documentation = "https://kdeldycke.github.io/repomatic"
-urls.Download = "https://github.com/kdeldycke/repomatic/releases/tag/v7.6.0"
+urls.Download = "https://github.com/kdeldycke/repomatic/releases/tag/v7.7.0"
 urls.Funding = "https://github.com/sponsors/kdeldycke"
 urls.Homepage = "https://github.com/kdeldycke/repomatic"
 urls.Issues = "https://github.com/kdeldycke/repomatic/issues"
@@ -250,7 +250,7 @@ copyright = "Kevin Deldycke <kevin@deldycke.com> and contributors. Distributed u
 file-description = "🏭 Automate repository maintenance, releases, and CI/CD workflows"
 # Numeric only: Nuitka rejects PEP 440 .devN suffixes. Kept in sync with the
 # package version by the dedicated [tool.bumpversion] rule that strips the suffix.
-file-version = "7.6.0"
+file-version = "7.7.0"
 include-data-dir = [
   "repomatic/data/awesome_template=repomatic/data/awesome_template",
   "repomatic/data/skills=repomatic/data/skills",
@@ -269,7 +269,7 @@ include-package-data = [ "click_extra" ]
 linux-icon = "docs/assets/icon.png"
 macos-app-icon = "docs/assets/icon.icns"
 product-name = "Repomatic"
-product-version = "7.6.0"
+product-version = "7.7.0"
 windows-icon-from-ico = "docs/assets/icon.ico"
 
 [tool.ruff]
@@ -310,8 +310,11 @@ output-prefer-rule-codes = true
 [tool.typos]
 default.extend-identifiers = { Github = "GitHub", IOS = "iOS", Javascript = "JavaScript", MacOS = "macOS", PNGs = "PNGs", PyPi = "PyPI", Typescript = "TypeScript" }
 # False positives. "Contribuer" is the French for "Contributing", part of the
-# translated-readme fixture in tests/test_awesome_toc.py.
-default.extend-words = { astroid = "astroid", Contribuer = "Contribuer", oject = "oject", PNGs = "PNGs", sur = "sur" }
+# translated-readme fixture in tests/test_awesome_toc.py. "quater" is the fourth
+# term of the Latin ordinal series numbering the repo-lint checks (bis, ter,
+# quater), not a misspelling of "quarter": the unattended fix-typos job rewrote
+# it once already and had to be reverted by hand.
+default.extend-words = { astroid = "astroid", Contribuer = "Contribuer", oject = "oject", PNGs = "PNGs", quater = "quater", sur = "sur" }
 # Skip content between <!-- typos:off --> and <!-- typos:on --> markers.
 default.extend-ignore-re = [
   "(?s)<!-- typos:off -->.*?<!-- typos:on -->",
@@ -395,7 +398,7 @@ run.source = [ "repomatic" ]
 report.precision = 2
 
 [tool.bumpversion]
-current_version = "7.6.0"
+current_version = "7.7.0"
 # Parse versions with an optional .devN suffix (PEP 440).
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)(\\.dev(?P<dev>\\d+))?"
 serialize = [
@@ -522,4 +525,21 @@ pypi-package-history = [ "gha-utils", "repokit" ]
 # attached to every GitHub release by the engine's extra-assets job. The
 # marketplace at .claude-plugin/marketplace.json installs the plugin straight
 # from this asset, so a release missing it breaks `/plugin install`.
-release-assets = [ "repomatic-plugin.zip" ]
+release-assets = [ "repomatic-claude-plugin.zip" ]
+
+[tool.actionlint]
+# actionlint reads no pyproject section of its own: repomatic serializes this one
+# to a temporary YAML config and passes it via `--config-file`. `paths` keys are
+# globs relative to the repository root, and each `ignore` entry is a regular
+# expression matched against the error message.
+#
+# `github.job_workflow_sha` is a real context property, holding the commit SHA of
+# the reusable workflow file itself, which the tool-cache keys read so they do not
+# rotate on every caller commit. GitHub documents it only as an OIDC token claim,
+# never on the `github` context reference page, so actionlint's schema lacks it.
+# Drop this entry once rhysd/actionlint#671 ships in a release.
+#
+# The glob carries no dot on purpose: click-extra expands every dotted key of
+# `pyproject.toml`, and one starting with a dot makes it warn on each repomatic
+# invocation. `**` matches dot-directories, so `.github/workflows/` is covered.
+paths."**/workflows/*".ignore = [ 'property "job_workflow_sha" is not defined' ]

{repomatic-7.6.0 → repomatic-7.7.0}/repomatic/__init__.py

@@ -17,5 +17,5 @@
 
 from __future__ import annotations
 
-__version__ = "7.6.0"
-__git_tag_sha__ = "07e3ef8ae5685c7dfc4af43001b6fc67501396b1"
+__version__ = "7.7.0"
+__git_tag_sha__ = "2c6e58c0d2ec44e627868095eb4c22b98683c463"

{repomatic-7.6.0 → repomatic-7.7.0}/repomatic/__main__.py

@@ -35,21 +35,22 @@ from repomatic.cli import repomatic
 
 
 def main():
-    """Execute the CLI but force its name to not let Click defaults to:
+    """Execute the CLI under its canonical name, whatever the entry point.
+
+    Without `prog_name`, Click derives the displayed name from the invocation:
 
     ```{code-block} shell-session
     $ python -m repomatic --version
     python -m repomatic, version 4.0.0
     ```
 
-    Indirection via this `main()` method was [required to reconcile](https://github.com/python-poetry/poetry/issues/5981):
-
-        - plain inline package call: `python -m repomatic`,
-        - Poetry's script entry point: `repomatic = 'repomatic.__main__:main`,
-        - Nuitka's main module invocation requirement:
-          `python -m nuitka (...) repomatic/__main__.py`
+    The `main()` indirection lets three invocation styles share one entry
+    point rendering the same name:
 
-    That way we can deduce all three cases from the entry point.
+    - the plain module call: `python -m repomatic`,
+    - the `[project.scripts]` console script: `repomatic = "repomatic.__main__:main"`,
+    - Nuitka's main-module compilation requirement:
+      `python -m nuitka (...) repomatic/__main__.py`.
     """
     repomatic(prog_name=repomatic.name)
 

{repomatic-7.6.0 → repomatic-7.7.0}/repomatic/awesome_toc.py

@@ -235,7 +235,7 @@ def fix_awesome_toc(root: Path | None = None) -> dict[Path, list[str]]:
     reference = root / REFERENCE_README
     reference_headings: list[str] | None = None
     if reference.is_file():
-        reference_headings = headings(reference.read_text(encoding="utf-8"))
+        reference_headings = headings(reference.read_text(encoding="UTF-8"))
     else:
         logging.warning(
             f"No {REFERENCE_README} in {root}: translations can only be matched "
@@ -244,13 +244,13 @@ def fix_awesome_toc(root: Path | None = None) -> dict[Path, list[str]]:
 
     report: dict[Path, list[str]] = {}
     for readme in _readmes(root):
-        content = readme.read_text(encoding="utf-8")
+        content = readme.read_text(encoding="UTF-8")
         forbidden = forbidden_headings_for(content, reference_headings)
         updated, removed = strip_toc_entries(content, forbidden)
         if not removed:
             logging.debug(f"No forbidden ToC entry in {readme}.")
             continue
-        readme.write_text(updated, encoding="utf-8")
+        readme.write_text(updated, encoding="UTF-8")
         logging.info(f"Removed {len(removed)} ToC entries from {readme}.")
         report[readme] = removed
     return report

{repomatic-7.6.0 → repomatic-7.7.0}/repomatic/binaries_page.py

@@ -57,7 +57,8 @@ from pathlib import Path
 
 from click_extra.blocks import replace_region
 
-from .binary import NUITKA_BUILD_TARGETS
+from .binary import BINARY_ASSET_SUFFIXES, NUITKA_BUILD_TARGETS
+from .bundle import get_data_content
 from .github.releases import parse_release_version
 from .virustotal import VIRUSTOTAL_GUI_URL
 
@@ -68,11 +69,21 @@ if TYPE_CHECKING:
     from .github.releases import ReleaseAsset, ReleaseWithAssets
     from .virustotal import ScanRecord
 
-BINARY_ASSET_SUFFIXES = (".bin", ".exe")
-"""File extensions identifying compiled binaries among release assets.
+CHART_JS_URL = "https://cdn.jsdelivr.net/npm/chart.js@4.5.0/dist/chart.umd.min.js"
+"""Pinned CDN artifact drawing the detections trend chart.
 
-Same set the `scan-virustotal` command uploads and the release workflow
-downloads (`--pattern` flags in `_release-engine.yaml`).
+The one external artifact this module publishes into every downstream
+repository's docs, so it carries a checksum beside the pin: bump the version
+by hand together with {data}`CHART_JS_SRI`.
+"""
+
+CHART_JS_SRI = "sha384-XcdcwHqIPULERb2yDEM4R0XaQKU3YnDsrTmjACBZyfdVVqjh6xQ4/DCMd7XLcA6Y"
+"""Subresource Integrity digest of {data}`CHART_JS_URL`.
+
+The browser refuses the script if the CDN bytes stop matching. Recompute on
+every version bump as the sha384 of the exact artifact, verified against the
+same file inside the npm registry tarball before trusting the CDN copy:
+`hashlib.sha384(artifact_bytes)` then base64.
 """
 
 CSV_HEADERS = (
@@ -186,13 +197,14 @@ def _binary_assets(release: ReleaseWithAssets) -> list[ReleaseAsset]:
     """Return the release's compiled binaries, sorted by filename.
 
     Releases also carry versionless alias copies of each binary, backing the
-    stable ``releases/latest/download`` URLs (see the upload step in
-    ``_release-engine.yaml``). An alias shares its digest with its versioned
-    sibling: collapse each digest group onto its longest name (the versioned
-    one, since the alias is that same name minus the version segment) so the
-    catalog lists each binary once. Assets without a recorded digest
-    (uploaded before GitHub started recording them, mid-2025) predate the
-    aliases and are kept as-is.
+    stable ``releases/latest/download`` URLs (created by
+    {func}`~repomatic.binary.pack_binary_assets`, which
+    `release-assets` runs in the release engine). An alias shares its digest
+    with its versioned sibling: collapse each digest group onto its longest
+    name (the versioned one, since {func}`~repomatic.binary.versionless_alias`
+    only ever strips the version segment) so the catalog lists each binary
+    once. Assets without a recorded digest (uploaded before GitHub started
+    recording them, mid-2025) predate the aliases and are kept as-is.
     """
     binaries = [a for a in release.assets if a.name.endswith(BINARY_ASSET_SUFFIXES)]
     digest_groups: dict[str, list[ReleaseAsset]] = {}
@@ -275,6 +287,15 @@ def render_chart_section(records: Sequence[ScanRecord]) -> str:
         ],
         sort_keys=True,
     )
+    # The chart script ships as a bundled data file so it reads (and lints) as
+    # JavaScript instead of sixty quoted Python strings. Placeholder tokens are
+    # substituted with str.replace, never str.format: the script is full of
+    # literal braces.
+    script = (
+        get_data_content("vt-trend-chart.js")
+        .replace("__VT_TREND_PAYLOAD__", payload)
+        .replace("__VT_DANGER_PCT__", str(FLAGGED_DANGER_PCT))
+    )
     return (
         "## VirusTotal detections\n\n"
         "Share of antivirus engine verdicts flagging the binaries of each "
@@ -283,62 +304,9 @@ def render_chart_section(records: Sequence[ScanRecord]) -> str:
         "there up.\n\n"
         "```{raw} html\n"
         '<div style="height: 320px;"><canvas id="vt-trend"></canvas></div>\n'
-        '<script src="https://cdn.jsdelivr.net/npm/chart.js@4.5.0/dist/'
-        'chart.umd.min.js"></script>\n'
-        "<script>\n"
-        f"const VT_TREND = {payload};\n"
-        f"const VT_DANGER_PCT = {FLAGGED_DANGER_PCT};\n"
-        "const vtCss = getComputedStyle(document.documentElement);\n"
-        "const vtColor = (name, fallback) =>\n"
-        "    vtCss.getPropertyValue(name).trim() || fallback;\n"
-        "const vtTint = (p) => {\n"
-        '    if (p.pct === 0) { return vtColor("--sd-color-success", "#28a745"); }\n'
-        "    return p.pct >= VT_DANGER_PCT\n"
-        '        ? vtColor("--sd-color-danger", "#dc3545")\n'
-        '        : vtColor("--sd-color-warning", "#f0b37e");\n'
-        "};\n"
-        'new Chart(document.getElementById("vt-trend"), {\n'
-        '    type: "line",\n'
-        "    data: {\n"
-        "        datasets: [{\n"
-        "            data: VT_TREND.map((p) => ({x: Date.parse(p.date), y: p.pct})),\n"
-        '            borderColor: "#88888866",\n'
-        "            pointBackgroundColor: VT_TREND.map(vtTint),\n"
-        "            pointBorderColor: VT_TREND.map(vtTint),\n"
-        "            pointRadius: 4,\n"
-        "            tension: 0.2,\n"
-        "        }],\n"
-        "    },\n"
-        "    options: {\n"
-        "        maintainAspectRatio: false,\n"
-        "        plugins: {\n"
-        "            legend: {display: false},\n"
-        "            tooltip: {callbacks: {\n"
-        "                title: (items) => VT_TREND[items[0].dataIndex].tag,\n"
-        "                label: (item) => {\n"
-        "                    const p = VT_TREND[item.dataIndex];\n"
-        '                    return p.flagged + " / " + p.total\n'
-        '                        + " verdicts flagged (" + p.pct + "%)";\n'
-        "                },\n"
-        "            }},\n"
-        "        },\n"
-        "        scales: {\n"
-        "            x: {\n"
-        '                type: "linear",\n'
-        "                ticks: {\n"
-        "                    maxTicksLimit: 8,\n"
-        "                    callback: (value) =>\n"
-        "                        new Date(value).toISOString().slice(0, 10),\n"
-        "                },\n"
-        "            },\n"
-        "            y: {\n"
-        "                beginAtZero: true,\n"
-        '                title: {display: true, text: "Flagged verdicts (%)"},\n'
-        "            },\n"
-        "        },\n"
-        "    },\n"
-        "});\n"
-        "</script>\n"
+        f'<script src="{CHART_JS_URL}" integrity="{CHART_JS_SRI}" '
+        'crossorigin="anonymous"></script>\n'
+        f"<script>\n{script}</script>\n"
         "```"
     )
 

{repomatic-7.6.0 → repomatic-7.7.0}/repomatic/binary.py

@@ -26,6 +26,8 @@ from __future__ import annotations
 
 import hashlib
 import logging
+import re
+import shutil
 import struct
 from pathlib import Path
 
@@ -38,6 +40,25 @@ if TYPE_CHECKING:
     from typing import Final
 
 
+BINARY_ASSET_SUFFIXES = (".bin", ".exe")
+"""File extensions identifying compiled binaries among release assets.
+
+The one definition of "a compiled release asset": `scan-virustotal` uploads
+this set, the release workflow downloads it (`--pattern` flags in
+`_release-engine.yaml`), `docs/binaries.md` lists it, and the dev-release
+asset globs derive from it.
+"""
+
+PYTHON_DIST_SUFFIXES = (".tar.gz", ".whl")
+"""File extensions identifying Python distributions among release assets.
+
+The counterpart of {data}`BINARY_ASSET_SUFFIXES`, and the same kind of single
+definition: {func}`pack_binary_assets` excludes this set from the binary
+upload list (`create-release` already attached those), and the dev-release
+asset globs add it on top of the compiled binaries.
+"""
+
+
 def compute_file_sha256(path: Path) -> str:
     """Compute the SHA-256 hex digest of a file.
 
@@ -112,19 +133,20 @@ NUITKA_BUILD_TARGETS = {
         "min_os": "10",
     },
 }
-"""List of GitHub-hosted runners used for Nuitka builds.
+"""GitHub-hosted runner matrix for Nuitka builds, keyed by target name.
 
-The key of the dictionary is the target name, which is used as a short name for
-user-friendlyness. As such, it is used to name the compiled binary.
+The key doubles as the compiled binary's short target identifier: it names the
+published release asset, so it is chosen for user-friendliness and must stay
+stable (download URLs and `docs/binaries.md` match on it).
 
 Values are dictionaries with the following keys:
 
 - `os`: Operating system name, as used in [GitHub-hosted runners](https://docs.github.com/en/actions/writing-workflows/choosing-where-your-workflow-runs/choosing-the-runner-for-a-job#standard-github-hosted-runners-for-public-repositories).
 
     ```{hint}
-    We choose to run the compilation only on the latest supported version of each
-    OS, for each architecture. Note that macOS and Windows do not have the latest
-    version available for each architecture.
+    Compilation only runs on the latest supported version of each OS, for each
+    architecture. macOS and Windows do not offer their latest version on every
+    architecture.
     ```
 
 - `platform_id`: Platform identifier, as defined by [Extra Platform](https://github.com/kdeldycke/extra-platforms).
@@ -168,6 +190,86 @@ FLAT_BUILD_TARGETS = [
 """List of build targets in a flat format, suitable for matrix inclusion."""
 
 
+def binary_name(package: str, target: str, version: str | None = None) -> str:
+    """Compose a compiled binary's release-asset filename.
+
+    The one definition of the naming convention:
+    ``{package}-{version}-{target}.{ext}`` for the versioned upload, and with
+    no *version* the stable alias (``{package}-{target}.{ext}``) backing the
+    `releases/latest/download` URLs. The extension comes from
+    {data}`NUITKA_BUILD_TARGETS`.
+    """
+    extension = NUITKA_BUILD_TARGETS[target]["extension"]
+    middle = f"-{version}" if version else ""
+    return f"{package}{middle}-{target}.{extension}"
+
+
+def versionless_alias(filename: str, version: str) -> str | None:
+    """Map a versioned binary filename to its stable alias, or `None`.
+
+    Strips the `-{version}-` segment (`papaya-1.2.3-linux-arm64.bin` becomes
+    `papaya-linux-arm64.bin`). Returns `None` for filenames that carry no such
+    segment or are not compiled binaries, so callers can filter and map in one
+    pass.
+    """
+    marked = f"-{version}-"
+    if marked not in filename or not filename.endswith(BINARY_ASSET_SUFFIXES):
+        return None
+    return filename.replace(marked, "-", 1)
+
+
+def binary_filename_re(package: str) -> re.Pattern[str]:
+    """Match a *package* binary filename, versioned or versionless.
+
+    Captures `target` and `ext`, both alternations derived from
+    {data}`NUITKA_BUILD_TARGETS` so a new build target extends the pattern
+    without anyone editing a regex. The release freeze rewrites both spellings
+    onto the versioned form through this; `tests/test_platform_keys.py` pins
+    the pattern against every target.
+    """
+    targets = "|".join(sorted(NUITKA_BUILD_TARGETS))
+    extensions = "|".join(
+        sorted({data["extension"] for data in NUITKA_BUILD_TARGETS.values()})
+    )
+    return re.compile(
+        rf"{re.escape(package)}(?:-[\d.]+)?-"
+        rf"(?P<target>{targets})\.(?P<ext>{extensions})"
+    )
+
+
+def pack_binary_assets(dist_dir: Path, version: str) -> list[Path]:
+    """Pack a release's upload list, materializing the versionless aliases.
+
+    Mirrors what the release engine's upload step needs: every file in
+    *dist_dir* except the Python distributions (`create-release` already
+    uploaded those), plus a byte-identical versionless alias copied beside
+    each versioned binary so the stable `releases/latest/download` URLs always
+    resolve. Aliases share their sibling's digest, which is what lets artifact
+    attestations verify them unchanged and the binaries catalog collapse them
+    (see `binaries_page._binary_assets`).
+
+    Idempotent: re-running overwrites the same aliases with the same bytes.
+
+    :param dist_dir: Directory holding the compiled binaries and attestation
+        bundles downloaded from the build jobs.
+    :param version: The release version whose binaries earn aliases.
+    :return: Sorted paths to upload, aliases included.
+    """
+    uploads = {
+        path
+        for path in dist_dir.iterdir()
+        if path.is_file() and not path.name.endswith(PYTHON_DIST_SUFFIXES)
+    }
+    for path in sorted(uploads):
+        alias = versionless_alias(path.name, version)
+        if alias is None:
+            continue
+        alias_path = dist_dir / alias
+        shutil.copy2(path, alias_path)
+        uploads.add(alias_path)
+    return sorted(uploads)
+
+
 BINARY_AFFECTING_PATHS: Final[tuple[str, ...]] = (
     ".github/workflows/_release-engine.yaml",
     ".github/workflows/release.yaml",
@@ -248,8 +350,18 @@ MACHO_FAT_MAGICS: Final[frozenset[int]] = frozenset((0xCAFEBABE, 0xCAFEBABF))
 """Big-endian magics of universal (fat) Mach-O containers, 32- and 64-bit."""
 
 LC_VERSION_MIN_MACOSX: Final[int] = 0x24
+"""Mach-O load command carrying the minimum macOS version (pre-10.14 SDKs)."""
+
 LC_BUILD_VERSION: Final[int] = 0x32
+"""Mach-O load command carrying the platform and minimum OS (10.14+ SDKs)."""
+
 MACHO_PLATFORM_MACOS: Final[int] = 1
+"""`platform` field value naming macOS inside an `LC_BUILD_VERSION` command."""
+
+_PE_PROBE_BYTES: Final[int] = 65536
+"""Upper bound read when probing for a PE header: enough to cover any
+real-world DOS-stub offset to the COFF header without reading the whole
+binary."""
 
 
 def _version_key(version: str) -> tuple[int, ...]:
@@ -352,7 +464,7 @@ def _macho_info(path: Path) -> tuple[set[int], str | None]:
 def _pe_machine(path: Path) -> int | None:
     """Return the COFF machine type of a PE executable, `None` if not PE."""
     with path.open("rb") as stream:
-        head = stream.read(65536)
+        head = stream.read(_PE_PROBE_BYTES)
     if head[:2] != b"MZ" or len(head) < 0x40:
         return None
     pe_offset = struct.unpack_from("<I", head, 0x3C)[0]

{repomatic-7.6.0 → repomatic-7.7.0}/repomatic/broken_links.py

@@ -47,6 +47,15 @@ if TYPE_CHECKING:
 ISSUE_TITLE = "Broken links"
 """Issue title used for the combined broken links report."""
 
+LYCHEE_BROKEN_LINKS_EXIT = 2
+"""The one lychee exit code that reports on the links rather than on the run.
+
+Lychee exits 0 on success, 1 on an unexpected failure, 2 when it found broken
+links, and 3 on a config error. Only 2 is a verdict about the links; 1 and 3 say
+the run itself did not complete, so neither "broken links found" nor "no broken
+links" can be claimed from them.
+"""
+
 LYCHEE_DEFAULT_BODY = Path("./lychee/out.md")
 """Default output path used by the lychee-action GitHub Action."""
 
@@ -55,7 +64,7 @@ SPHINX_DEFAULT_OUTPUT = Path("./docs/_linkcheck/output.json")
 
 
 # ---------------------------------------------------------------------------
-# Sphinx linkcheck parsing, filtering, and report generation
+# Sphinx linkcheck parsing, filtering, and report generation.
 # ---------------------------------------------------------------------------
 
 
@@ -170,7 +179,7 @@ def generate_markdown_report(
 
 
 # ---------------------------------------------------------------------------
-# Label selection
+# Label selection.
 # ---------------------------------------------------------------------------
 
 
@@ -186,7 +195,7 @@ def get_label(repo_name: str) -> str:
 
 
 # ---------------------------------------------------------------------------
-# Combined broken links issue (Lychee + Sphinx linkcheck)
+# Combined broken links issue (Lychee + Sphinx linkcheck).
 # ---------------------------------------------------------------------------
 
 
@@ -230,7 +239,6 @@ def manage_combined_broken_links_issue(
         in the Sphinx report. Auto-composed from {attr}`Metadata.repo_url
         <repomatic.metadata.Metadata.repo_url>` and {attr}`Metadata.sha
         <repomatic.metadata.Metadata.sha>`.
-    :raises ValueError: If lychee exit code is not 0, 2, or `None`.
     :raises ValueError: If `repo_name` cannot be determined.
     """
     # Shared Metadata instance for all CI context lookups.
@@ -270,20 +278,27 @@ def manage_combined_broken_links_issue(
         sphinx_source_url = f"{md.repo_url}/blob/{md.sha}/docs"
         logging.info(f"Auto-composed source URL: {sphinx_source_url}")
 
-    # Interpret lychee exit code.
-    # Exit codes: 0 = success, 1 = unexpected failure, 2 = broken links,
-    # 3 = config error. Only treat as "broken links found" when lychee
-    # produced an output file with actual content. A non-zero exit code
-    # without output (e.g., config error, transient failure) should not
-    # create an issue that misleadingly says "No broken links found."
+    # Interpret lychee's exit code. Only LYCHEE_BROKEN_LINKS_EXIT reports on the
+    # links themselves; every other non-zero code reports that the run failed,
+    # and says nothing either way about the links.
     lychee_has_broken = False
+    lychee_failed = False
     if lychee_exit_code is not None:
-        if lychee_exit_code != 0 and lychee_body_file is not None:
-            lychee_has_broken = True
+        if lychee_exit_code == LYCHEE_BROKEN_LINKS_EXIT:
+            # An output file is required: a broken-links verdict with nothing to
+            # show would file an issue whose body claims the links are fine.
+            if lychee_body_file is not None:
+                lychee_has_broken = True
+            else:
+                logging.warning(
+                    f"Lychee exit code {lychee_exit_code} but no output file found. "
+                    "Skipping broken links report."
+                )
         elif lychee_exit_code != 0:
+            lychee_failed = True
             logging.warning(
-                f"Lychee exit code {lychee_exit_code} but no output file found. "
-                "Skipping broken links report."
+                f"Lychee failed with exit code {lychee_exit_code}, which reports a"
+                " run failure rather than broken links."
             )
         logging.info(
             f"Lychee exit code {lychee_exit_code}: "
@@ -314,6 +329,11 @@ def manage_combined_broken_links_issue(
             lychee_content = sanitize_markdown_mentions(
                 lychee_body_file.read_text(encoding="UTF-8").strip(),
             )
+        elif lychee_failed:
+            lychee_content = (
+                f"Lychee did not complete (exit code {lychee_exit_code}), so the"
+                " links it covers were not checked this run."
+            )
         else:
             lychee_content = "No broken links found."
         lychee_section = f"## Lychee\n\n{lychee_content}"