repotemplates 0.13.0__tar.gz

repotemplates-0.13.0/.gitignore

@@ -0,0 +1,31 @@
+.archive/
+# .claude/
+.hypothesis/
+.pytest_cache/
+.ruff_cache/
+.venv/
+.vscode/
+.worktrees/
+
+__pycache__/
+build/
+dist/
+*.egg-info/
+
+.DS_Store
+
+.coverage
+.coverage.*
+
+# template/ is a real, resolvable uv project, so any uv command run from inside
+# it (export, sync, run, lock) writes template/uv.lock as a side effect. That
+# lock is scaffolding input, never an artifact of this repo: init.sh
+# rsyncs template/ into each new project and only excludes __pycache__, so a
+# committed lock would seed every scaffolded repo with stale, PROJECT-named
+# pins instead of the one `uv sync` builds for it. Ignore here, not in
+# template/.gitignore — scaffolded projects do commit their own uv.lock.
+/template/uv.lock
+
+.env
+.env.*
+!.env.example

repotemplates-0.13.0/CHANGELOG.md

@@ -0,0 +1,592 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/),
+and this project adheres to [Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
+
+## [0.13.0] - 2026-11-09
+
+### Added
+
+- A `repotemplates` command line, installable as a uv tool. `repotemplates check`
+  reports a repo's template stamp and how its Claude hook scripts and the hook
+  entries in `.claude/settings.json` compare with the template: current, an earlier
+  release by number, a one-off, or missing, plus whether each Claude settings file is
+  tracked, ignored, or untracked. `--repos-dir` checks every clone under a directory
+  as one table, `--json` and `--markdown` change the output, and the exit status is 0
+  when everything is current and 1 when anything differs. The package ships the
+  template and a manifest of every release's files, so it needs no clone.
+- A publish workflow for the package, off until the `PUBLISH_ENABLED` repository
+  variable is `true`.
+- The `install-template` and `install-renovatabot` skills ship inside the package.
+  `repotemplates install` writes version-stamped stubs for Claude Code and Codex
+  (globally by default, `--local` for one repo), and `repotemplates skill <name>`
+  prints a skill from the installed release. `repotemplates path template` and
+  `repotemplates path scripts` print the directories the release ships, which the
+  skills now read instead of a checkout's `template/` and `scripts/`.
+- `repotemplates init <path>` scaffolds a repo from the template the installed release
+  ships, stamped with that release. It runs the release's own `init.sh`, which gains
+  `--template-dir` (copy a plain template directory instead of cloning) and
+  `--template-version`. The curl-to-bash path is unchanged.
+- `repotemplates check` covers more template-owned files: the pre-commit config and the
+  three workflows (compared with pins and the Python matrix masked, with a separate pin
+  verdict in which a newer pin is not drift), `dependabot.yml` and `renovate.json`
+  (exact), and `.gitignore` and `.gitattributes` (each template rule must hold, checked
+  with `git check-ignore` and `git check-attr`, and waived where the repo tracks what
+  the rule would ignore). A file the repo leaves out on purpose reads `omitted`: the
+  other updater's files, or a path in the stamp table's new `omit` list.
+- `repotemplates upgrade` applies the mechanical part of a template upgrade: it rewrites
+  the template-owned files that equal an earlier release's copy (keeping a pinned file's
+  newer pins and Python matrix, and replacing only the `hooks` block of
+  `.claude/settings.json`), raises pins that are behind, reports everything else with
+  the reason, and stamps the release only when nothing is left. `--dry-run` prints the
+  plan without writing.
+- The `install-template` skill reads `repotemplates check --json` in its preflight
+  instead of diffing template-owned files by hand, and runs `repotemplates upgrade`
+  before working through the rows that need judgment.
+
+## [0.12.0] - 2026-11-06
+
+### Changed
+
+- The repo is renamed from `proj-template` to `repotemplates`, which fits the several
+  templates it is growing to hold. GitHub redirects the old URL for clones, fetches, and web
+  links. The template's Dependabot and Renovate comments link the guides at the new URL.
+- Scaffolded repos record the template release in `[tool.repotemplates]` instead of
+  `[tool.proj-template]`; the `version` key is unchanged. The install-template skill renames
+  an old `[tool.proj-template]` table during an upgrade, so a repo never carries both. Tools
+  that read the stamp should accept either table until the fleet has moved.
+- The scaffold script is renamed from `scripts/proj-init.sh` to `scripts/init.sh`, its test
+  from `tests/proj-init.test.sh` to `tests/init.test.sh`, and the `test-proj-init` skill to
+  `test-init`. The README's suggested alias is now `repo-init`. An alias or bookmark that
+  fetches `scripts/proj-init.sh` from `main` stops working once this release merges: point it
+  at `https://raw.githubusercontent.com/gitronald/repotemplates/main/scripts/init.sh`.
+
+## [0.11.7] - 2026-10-21
+
+### Changed
+
+- The install-template skill refreshes a target's "Before finishing a task" check list in
+  `.claude/CLAUDE.md` along with the `## Development` tooling bullets. The list names the
+  checks the `Stop` hook runs, so an upgrade that brings the current hook also brings the
+  `ruff format --check` step that lists from before 0.8.2 lack.
+
+## [0.11.6] - 2026-10-21
+
+### Security
+
+- The template's publish workflow pins `pypa/gh-action-pypi-publish` v1.14.3, which fixes
+  GHSA-5xjx-3w67-w9x9. The fix upgrades the action's bundled `certifi` and `sigstore` to drop
+  the emSign root certificates, whose intermediates were revoked after a key compromise
+  (certifi GHSA-6q48-6c7w-9gw2). The TestPyPI example in the trusted-publishers guide pins the
+  same release.
+
+### Changed
+
+- The scaffolded `pyproject.toml` cuts its multi-line comments to one line each, two for the
+  sdist `only-include` note. The repo's own `pyproject.toml` does the same.
+- The scaffolded `[tool.ruff]` narrows `extend-exclude` from `*.md` to `.planners/` and
+  `CHANGELOG.md`. ruff now formats Python fences in the README and `docs/`, and leaves plans
+  and the changelog alone, since they quote code as it was.
+- The scaffolded `dev` group pins `ruff>=0.17,<0.18`, and the `ruff-pre-commit` hook moves to
+  v0.17.1 to match. The template sets `select` and `target-version`, so 0.17's new defaults
+  for both do not apply; imports with trailing pragma comments may be reformatted.
+
+## [0.11.5] - 2026-10-19
+
+### Removed
+
+- The template no longer ships `.claude/settings.local.json`. Its permission lists duplicated
+  the global `~/.claude/settings.json` baseline. `.claude/settings.json` still carries the
+  `Stop` lint and type-check hook.
+- The install-template skill no longer treats a target's `settings.local.json` as
+  template-managed. An upgrade leaves the file alone, because it holds the user's own grants.
+  This includes a copy seeded by templates 0.8.5 through 0.11.4. For `settings.json`, the
+  skill merges in the `Stop` hook and keeps everything else the repo has.
+
+### Fixed
+
+- The install-template skill's close-out pulls the base branch before it deletes the local
+  upgrade branch. `git branch -d` checks against the local base, so it refused a branch
+  merged on GitHub until the merge was pulled.
+
+## [0.11.4] - 2026-10-19
+
+### Changed
+
+- The install-template skill's upgrade mode no longer writes a `template-upgrade` plan in
+  the target repo. The PR body records the repo's classification, the action per sync-matrix
+  row, the owner's answers, and what was skipped. A plan is written only when the upgrade
+  spans sessions or the user asks, through `/planners`. The sync matrix still scaffolds
+  `.planners/` in a repo that lacks it.
+
+## [0.11.3] - 2026-10-19
+
+### Changed
+
+- The scaffolded `test.yml` keeps one single-line comment, on `UV_PYTHON`, and drops the one
+  on the repeated `--python`. The full rationale for both stays in the install-template skill.
+- The scaffolded `renovate.yml`, `publish.yml`, `dependabot.yml`, and
+  `.pre-commit-config.yaml` cut their multi-line comments to one line each. The rationale
+  stays in the guides under `docs/guides/`.
+- The scaffolded workflows pin `astral-sh/setup-uv` v10.3.0, `actions/upload-artifact`
+  v7.0.2, `actions/download-artifact` v8.0.2, `actions/create-github-app-token` v3.3.0, and
+  `renovatebot/github-action` v46.3.8, each by commit SHA.
+- The scaffolded `ruff-pre-commit` hook moves to v0.16.10, still within the `ruff<0.17`
+  pin, and the `dev` group raises its floors to `pyrefly>=1.3.2` and `pytest>=9.1.1`.
+
+## [0.11.2] - 2026-10-10
+
+### Changed
+
+- The scaffolded Stop hook (`.claude/hooks/lint-typecheck.sh`) checks the whole uv
+  workspace from inside a member package. It still walks up to the nearest
+  `pyproject.toml`, but when the git toplevel of the session's directory (the worktree root
+  inside a worktree) declares `[tool.uv.workspace]`, it checks from there instead. It used to
+  stop at the member, so it linted only that package and passed while CI failed on the rest
+  of the repo. A nested project that is not a workspace member keeps its own root. The hook
+  is template-owned plumbing, so an upgrade replaces an older copy without asking.
+- The scaffolded `dev` group pins `ruff>=0.16,<0.17`, the same minor as the
+  `ruff-pre-commit` hook, so the commit hook and CI apply one rule set. The install-template
+  skill and the pre-commit guide say to keep the two in step.
+- The scaffolded `[tool.ruff]` sets `extend-exclude = ["*.md"]`, so ruff 0.16 no longer
+  reformats Python fences in READMEs, changelogs, and plans.
+- The install-template skill says to commit annotation chunks with `--no-verify` and gate on
+  `pre-commit run --all-files`, since the whole-tree pyrefly hook fails every partial chunk.
+
+## [0.11.1] - 2026-09-27
+
+### Changed
+
+- Template pinned versions bumped: `astral-sh/setup-uv` v10.0.1 -> v10.2.0 in both `test.yml`
+  and `publish.yml`, and `renovatebot/github-action` v46.2.1 -> v46.3.3 in `renovate.yml`.
+  Neither bump changes an input the template workflows use.
+
+## [0.11.0] - 2026-09-27
+
+### Added
+
+- `proj-init.sh` checks for `git`, `rsync`, `gh`, `uv`, and `stanza` before creating anything
+  and names every missing tool at once. A missing `gh` or `stanza` used to fail partway
+  through and leave a half-built project directory that blocked the re-run.
+- The README lists the scaffold script's prerequisites and how to set up a checkout of
+  proj-template for development.
+- Dependabot version updates for the proj-template repo's own workflow actions and dev
+  tooling.
+
+### Changed
+
+- CI runs the `shellcheck` pinned in `uv.lock` instead of the one the runner ships, so CI
+  and a local run use the same version.
+- The scaffolded `.pre-commit-config.yaml` sets `default_stages: [pre-commit]`, so a merge
+  runs only the `planners-index` hook. Previously the ruff, pyrefly, and `planners-validate`
+  hooks also ran on the `post-merge` stage and each reported "Skipped".
+- The scaffolded ruff lint hook uses the id `ruff-check` in place of `ruff`, which
+  ruff-pre-commit keeps only as a legacy alias.
+- The proj-template repo has a tooling-only root `pyproject.toml` whose `dev` group supplies
+  `pre-commit` and `shellcheck`, so contributors run `uv sync` instead of installing either
+  machine-wide. It has no `[project]` table; `VERSION` stays the only version source. A root
+  `.python-version` pins the interpreter so `uv sync --locked` resolves the same
+  `requires-python` on every machine.
+
+## [0.10.1] - 2026-09-27
+
+### Fixed
+
+- Scaffolded repos now carry the full planners integration: a `.gitattributes` marking
+  `.planners/README.md merge=union`, the `planners-index` post-merge hook in
+  `.pre-commit-config.yaml`, and `proj-init.sh` installs the `post-merge` hook stage so
+  that hook actually runs. Previously the template shipped neither the attribute nor the
+  hook, so new projects failed `planners install --check`.
+- The `install-template` skill's upgrade mode and the pre-commit guide install both hook
+  types (`pre-commit install --hook-type pre-commit --hook-type post-merge`), and the
+  skill's sync matrix merges `.gitattributes`. A plain `pre-commit install` registered only
+  `pre-commit`, so an upgraded repo got the `planners-index` hook configured but never run.
+
+### Changed
+
+- The scaffolded `planners-validate` hook runs `uv run planners validate` instead of bare
+  `planners validate`, matching the other local hooks.
+- `tests/proj-init.test.sh` asserts that a scaffold carries `.gitattributes` and the
+  `planners-index` hook, and that `proj-init.sh` installs the `post-merge` hook type.
+- The `install-template` skill's upgrade mode names two worktree traps that cost a real upgrade
+  time. Plan edits made after the worktree exists must target the worktree's copy of `plan.md` —
+  the file exists at both paths, so an edit aimed at the repo root lands on the mainline and the
+  follow-up commit reports "nothing to commit" from a clean worktree. And `pre-commit install`
+  run inside a worktree rewrites the *shared* `.git/hooks/pre-commit` with that worktree's venv
+  as `INSTALL_PYTHON`, which exits zero and skips every hook once the worktree is removed; the
+  skill now repairs it right after the verification run instead of at teardown.
+
+## [0.10.0] - 2026-09-11
+
+### Added
+
+- `proj-init.sh --source <repo>` scaffolds from a local proj-template checkout or a fork's git URL
+  instead of the GitHub repo. It still clones, so the output is exactly the source's committed
+  tree — a checkout's gitignored strays (`template/uv.lock`, `.venv`) never leak in. Without
+  `--branch` it clones the source's HEAD: `main` on GitHub, or whatever branch a local checkout
+  has checked out. The script prints the commit it scaffolded from, and refuses a source with no
+  `template/MODULE__NAME/` before creating anything.
+- Tests and CI for the scaffolding scripts: `tests/proj-init.test.sh` scaffolds from the checkout
+  with `gh`, `uv`, and `stanza` stubbed and asserts on the result; `tests/portability.test.sh`
+  fails on constructs that break on macOS (`sed -i`, `\b`, bash 4 syntax); and
+  `.github/workflows/test.yml` runs both on `ubuntu-latest` and `macos-latest`, checks the two
+  scaffolds are byte-identical, and runs `shellcheck`.
+
+### Changed
+
+- Template placeholders are renamed `PROJECT` to `PROJECT__NAME` and `MODULE` to `MODULE__NAME`.
+  Neither can occur inside another identifier, so substitution is a plain literal match with no
+  `\b` word boundaries. `PROJECT__NAME` is still a valid package name, so `template/` keeps
+  resolving as a uv project (`__PROJECT__` would not). Existing scaffolded repos are unaffected.
+
+### Fixed
+
+- `proj-init.sh` runs on stock macOS. Under bash 3.2 `${LICENSE,,}` aborted with a syntax error,
+  and BSD `sed` read the `\b` word boundaries as a literal `b` — so the placeholder pass matched
+  nothing, the script still printed "Done", and the new repo shipped with its placeholders intact.
+  The script now needs only bash 3.2 and POSIX `sed`/`grep`, edits files without `sed -i` while
+  keeping their modes, and exits with a clear error when run under a shell that is not bash, such
+  as `dash`.
+- `proj-init.sh` rejects an empty option value such as `--branch ""` instead of silently falling
+  back to the default, so an unset variable passed as a flag cannot scaffold the wrong branch.
+
+## [0.9.2] - 2026-09-09
+
+### Fixed
+
+- `proj-init.sh` no longer corrupts `CLAUDE_PROJECT_DIR` when substituting placeholders. The
+  content pass ran an unanchored `s/PROJECT/<name>/g`, which also rewrote the variable inside
+  `.claude/settings.json` and `.claude/hooks/lint-typecheck.sh` — so every freshly scaffolded repo
+  got a Stop hook pointing at a variable that does not exist, silently falling back to the cwd,
+  which is the exact failure that variable was added in 0.8.2 to fix. Both placeholders are now
+  matched with `\b` word boundaries; `_` is a word character, so `CLAUDE_PROJECT_DIR` cannot match
+  while every real placeholder still does.
+- `proj-init.sh` no longer strips the executable bit from `.claude/hooks/lint-typecheck.sh`. The
+  substitution pass wrote through `sed > file.tmp && mv`, which replaced each file with a fresh
+  0644 one; a non-executable hook command fails, so the scaffolded lint/type-check gate never ran.
+  The pass now uses `sed -i`, which preserves file modes.
+- `proj-init.sh` falls back to the GitHub login when an account has no display name set. `.name` is
+  `null` for those accounts and jq renders it as the string `null`, which was written into the
+  scaffolded LICENSE as `Copyright (c) <year> null`.
+- `proj-init.sh` no longer writes an empty LICENSE when the license fetch fails. `gh api | sed >
+  LICENSE` reported the exit status of `sed`, so a failed fetch left `set -e` unfired and produced
+  an empty file; the body is now captured in a command substitution, where the failure aborts.
+- `proj-init.sh` rejects a second path argument instead of silently scaffolding the last one, and
+  renames `MODULE` paths by basename so a destination nested under a directory named `MODULE` no
+  longer has its parent rewritten into a failing `mv`.
+- `proj-init.sh` no longer assigns its template clone to `TMPDIR`, a standard environment variable
+  that child processes read to place their own temporary files. It now uses `TEMPLATE_TMP`.
+- `proj-init.sh` runs under `set -euo pipefail` rather than `set -e` alone, so an unset variable and
+  a failing stage anywhere in a pipeline both stop the scaffold instead of passing silently. The
+  placeholder-substitution pass reads its file list from a variable rather than a pipeline, so a
+  failing `sed` aborts instead of dying in a subshell, and `grep`'s "no matches" exit 1 is tolerated
+  explicitly while a real `grep` error still stops the run.
+- `proj-init.sh` validates `--branch` with `git check-ref-format --branch`, rejecting a leading `-`
+  (which `git clone` would read as an option), embedded spaces, and `..`.
+- `proj-init.sh` now validates `--license` before interpolating it into the GitHub API path.
+  The value went straight into `gh api "licenses/${LICENSE}"`, so a key containing `/` or `..`
+  walked the path and called a different endpoint (`--license ../user` reaching `/user`), and a
+  `?` appended a query string. Keys are now normalized to lowercase — the endpoint is
+  case-insensitive, so `--license MIT` keeps working — and must match `^[a-z0-9][a-z0-9.-]*$`,
+  which all 13 keys GitHub currently returns satisfy.
+
+## [0.9.1] - 2026-09-09
+
+### Fixed
+
+- `proj-init.sh` no longer breaks when your GitHub display name contains a sed metacharacter. The
+  name is fetched with `gh api user --jq .name` and substituted into the LICENSE body, so a name
+  like "Ada / Lovelace" aborted the scaffold mid-run (`set -e` on a failed `s///`) and one like
+  "Smith & Co" silently wrote `[fullname]` into the license instead of the name. Escaping is now
+  centralized in a `sed_escape` helper, which the version stamp added in 0.9.0 also uses. The helper
+  also folds newlines to spaces, since sed reads a literal newline in a replacement as an
+  unterminated command and aborts the same way.
+
+## [0.9.0] - 2026-09-09
+
+### Added
+
+- Scaffolded repos now carry a `[tool.proj-template]` table in `pyproject.toml` recording the
+  template release they came from, so template drift is auditable from inside each repo without a
+  central registry or a new file. `proj-init.sh` stamps it from the *cloned* `VERSION` rather than
+  the local checkout's, so `--branch dev` records the prerelease actually applied. The table is
+  inert to package consumers: build backends translate only `[project]`, so it never reaches the
+  wheel or the PyPI metadata.
+- `install-template` gained a matrix row and note for re-stamping the version on upgrade, including
+  the rule that a partial upgrade must not stamp the newer release.
+
+### Changed
+
+- The sdist `only-include` comment in `template/pyproject.toml` no longer implies the list is
+  exhaustive: hatchling force-includes `pyproject.toml`, `PKG-INFO`, and `.gitignore` in every
+  sdist regardless of the list, and neither `exclude` nor `ignore-vcs` drops them.
+
+## [0.8.5] - 2026-09-09
+
+### Changed
+
+- `docs/guides/github-automation.md` now states why the config files link back to it as absolute
+  GitHub URLs rather than relative paths — `docs/` sits outside `template/`, so a scaffolded repo
+  gets the configs but never the guide — along with the editing rule that follows from it (thin
+  comments in the configs, rationale in the guide) and what to grep if the guide is ever moved.
+  `template/.github/workflows/renovate.yml` was the one back-link still written as a bare
+  `docs/guides/github-automation.md` path, unresolvable in the repos that receive it; it now
+  carries the same absolute URL as `dependabot.yml` and `renovate.json`.
+- `template/.github/dependabot.yml` lost its `target-branch` rationale comment, which restated the
+  guide's Dependabot section (the options-reference quote, the manifest-scan scoping, the
+  security-updates caveat) in full. The header keeps the guide link — absolute, since a scaffolded
+  repo has no local `docs/` copy — plus a two-line note that Dependabot reads the file from the
+  default branch only, the one fact that makes an edit to this file silently do nothing and so
+  worth having where the edit happens.
+- The template's Claude permissions moved out of `.claude/settings.json` into a new
+  `.claude/settings.local.json`, leaving `settings.json` to carry only the shared `Stop` hook.
+  `settings.local.json` is the file Claude Code writes machine-local permission grants to, so
+  scaffolded repos now accumulate their own grants in the same file the template seeds — and it
+  stays untracked in every target (`.claude/` is gitignored there) while proj-template tracks its
+  copy as the payload upgrades ship from. `git push` also moved from `ask` to `allow`.
+- `install-template` skill: the `.claude/settings*.json` row is now ask-first and exempt from the
+  "stale template content replaces silently" path. A target's `settings.local.json` diverges by
+  design — Claude Code appends every grant the user accepts there — so an upgrade must show what
+  adopting the template's copy would change (entries added, entries removed, and entries that move
+  between `allow`/`ask`/`deny`, each with its direction) rather than overwriting grants the user
+  chose. Moves need their own approval; hook `command`/`timeout` changes in `settings.json` stay
+  silent-replace, since those are template-owned plumbing.
+- The template's `test.yml` now passes `--python ${{ matrix.python-version }}` to `uv sync` as well
+  as setting the job-level `UV_PYTHON`. The flag is redundant — `UV_PYTHON` already governs that
+  step and every bare `uv run` after it — but the sync step is the one whose interpreter choice the
+  rest of the job inherits, so restating it there means a copied-out sync line, or an edit that
+  drops the `env` block, keeps testing the intended interpreter instead of silently falling back to
+  `.python-version` and running the same Python in every matrix cell. A comment records that the
+  restatement is deliberate, so a later reader does not "clean it up".
+- `install-template` skill: the `test.yml` sync row and reconcile notes now cover the `--python`
+  flag on `uv sync` alongside the `UV_PYTHON` env pin, with an explicit "don't simplify this away"
+  note. Without it the flag reads as redundant on inspection — which it is — and an upgrade that
+  tidied it out would leave the repo one `env`-block edit away from the silently-no-op matrix the
+  neighbouring note already warns about.
+- Template pinned version bumped: `astral-sh/setup-uv` v9.0.0 -> v10.0.1, in both `test.yml` and
+  `publish.yml`. v10's breaking change disables `enable-cache: auto` for the `pull_request_target`,
+  `workflow_run`, and `release` events; neither template workflow uses those triggers (`test.yml`
+  runs on `push`/`pull_request`, `publish.yml` on `push: tags`), so nothing changes for a scaffolded
+  repo beyond picking up v10's checksum-verification and manifest-timeout fixes.
+
+## [0.8.4] - 2026-09-09
+
+### Fixed
+
+- The template's `dependabot.yml` now sets `target-branch: dev` for both ecosystems, so
+  dependency-update PRs open against the active branch instead of the default one. Previously they
+  targeted `main`, so every batch had to be retargeted by hand before it could merge into `dev`, and
+  Dependabot resolved manifests against `main` rather than the tree the updates would merge into.
+  The `github-automation` guide claimed this was a Dependabot limitation ("it can't target `dev`
+  directly") and used it to motivate the Renovate option; that was incorrect — `target-branch` is a
+  supported option and GitHub documents this exact use case. The guide now states the real
+  constraint instead: `dependabot.yml` is read from the default branch, so edits to it stay inert
+  until they reach `main`. Renovate's other advantages (no silent digest mutation, fail-closed
+  cooldown, no auto-merge) are unaffected.
+- `install-template` skill: the `dependabot.yml` sync row now reconciles `target-branch`
+  alongside `groups` and `cooldown`, so a repo upgraded from an older template revision picks
+  up the change above instead of silently keeping PRs pointed at the default branch. The
+  accompanying note gates the edit on the repo actually having a `dev` branch — scaffolded
+  repos always do, but an older or non-template repo may not, and pointing Dependabot at a
+  missing branch stops its updates.
+
+## [0.8.3] - 2026-09-08
+
+### Changed
+
+- Template pinned version bumped: the `ruff-pre-commit` hook to v0.16.6.
+
+## [0.8.2] - 2026-09-08
+
+### Changed
+
+- `install-template` skill: the upgrade path now triages every managed file by diffing it against `template/` before applying a sync-matrix row, instead of treating "the file exists" as satisfied. A file that is absent or identical is applied silently; one that diverges but carries nothing the template lacks is replaced and reported (the repo is simply on an older template revision); one that carries content the template would drop or change — a customized value, an extra entry, a different command or timeout — is put to the user before being touched. Those questions are gathered across the whole matrix and asked in a single batched round offering replace / merge / keep, with the answers recorded in the upgrade plan's Log so the next upgrade does not re-litigate them.
+
+### Fixed
+
+- The template's `Stop` hook now runs `ruff format --check .` alongside `ruff check` and `pyrefly`, mirroring the checks the test workflow enforces. The linter does not police layout — quote style, wrapping, trailing-comma expansion — so the gate previously stayed green on code CI would reject.
+- The template's `Stop` hook now resolves paths independently of the agent's working directory. `.claude/settings.json` invokes the hook through `${CLAUDE_PROJECT_DIR:-.}` rather than a relative path, which previously failed whenever the agent's directory was not the project root, and `lint-typecheck.sh` walks up from the working directory to the nearest `pyproject.toml` before running `ruff` and `pyrefly` — so work inside a git worktree under `.worktrees/` is checked against that worktree's own tree and `.venv`, not the main checkout — falling back to `CLAUDE_PROJECT_DIR` when the directory sits outside any project.
+
+### Security
+
+- Raise the template's `pytest` dev-dependency floor to `>=9.0.3`, past GHSA-6w46-j5rx-g56g (insecure `/tmp/pytest-of-{user}` tmpdir handling, affecting `< 9.0.3`). The previous `>=9.0.2` floor resolved to a safe version in practice but permitted a vulnerable one.
+
+## [0.8.1] - 2026-09-06
+
+### Changed
+
+- Template workflows (`test.yml`, `publish.yml`, `renovate.yml`) now ship actions pinned to commit SHAs with a `# vX.Y.Z` comment (e.g. `actions/checkout@3d3c42e…  # v7.0.1`) instead of bare version tags. This reverses the 0.6.0 switch to tags, which assumed Dependabot would not keep SHA pins current; in practice Dependabot bumps the SHA and the comment together, as observed in a downstream repo that had re-pinned to SHAs. The `install-template` skill now syncs pins to the template's SHAs and converts bare tags on upgrade, and the `install-renovatabot` skill and the GitHub automation guide describe `helpers:pinGitHubActionDigests` as a backstop for newly added actions rather than the step that introduces SHA pins; the TestPyPI snippet in the trusted-publishers guide uses the same pinned form.
+- GitHub automation guide: drop the stale claim that Dependabot has no release cooldown (the template has configured one since 0.6.2).
+
+## [0.8.0] - 2026-09-05
+
+### Added
+
+- Coverage configuration in the template `pyproject.toml`: `pytest` now runs with `--cov` by default via `addopts`, and a `[tool.coverage]` section sets the package as `source`, enables branch coverage, excludes common boilerplate lines, and enforces a `fail_under = 50` floor that projects can raise. The test workflow runs plain `uv run pytest` and inherits the same settings. The scaffolded placeholder test now invokes the CLI through `typer.testing.CliRunner` so a fresh project starts above the floor. The `install-template` sync matrix merges `[tool.coverage.*]` into upgraded repos.
+- Plan 006 (parked): options for publishing coverage to Codecov, Coveralls, or a workflow artifact.
+
+### Changed
+
+- `install-template` skill: apply the gitignored `.claude/*` payload in the main checkout rather than the upgrade worktree, where it would vanish on removal; pin `fail_under` to an existing repo's current total; prefer bare `--cov` over `--cov=<pkg>`; and refresh the template-owned `## Development` bullets in an existing `.claude/CLAUDE.md` instead of never touching its content.
+- `test-proj-init` skill: assert the scaffold's coverage table lists the renamed module and reports the floor as reached.
+
+## [0.7.0] - 2026-08-09
+
+### Added
+
+- `test-proj-init` repo skill: end-to-end verification of `proj-init.sh` — scaffold a dash-named project (exercising the `PROJECT`/`MODULE` placeholder split), verify placeholders, build, CLI, tests, and GitHub repo state, with a local-only mode that creates no repo.
+
+### Changed
+
+- `proj-init.sh` now installs `planners` as a global uv tool when it is missing — the scaffolded pre-commit hook shells out to `planners` on PATH, so a fresh machine no longer fails its first commit.
+- Template pinned versions bumped: `actions/checkout` v7.0.1, `astral-sh/setup-uv` v9.0.0, `pypa/gh-action-pypi-publish` v1.14.2, `renovatebot/github-action` v46.2.1, and the ruff pre-commit hook v0.16.1.
+- GitHub automation guide: document the **Commit statuses** permission Renovate needs to record the `minimumReleaseAge` cooldown status, the optional **Administration: read** scope (automerge-only — skip it by default), and rework first-run troubleshooting as a cascade of permission gaps rather than three independent stages.
+
+### Fixed
+
+- `proj-init.sh`: dashed project names (e.g. `my-tool`) no longer break the scaffold. The template now uses two placeholders — `PROJECT` for the project/repo name and `MODULE` for the Python module name — and the script derives the module name by mapping dashes to underscores, validating it before scaffolding. Previously a dashed name produced an invalid module directory and `uv sync` failed hatchling's wheel file-selection heuristic mid-scaffold.
+
+- Template `dependabot.yml`: drop `semver-major-days` from the `github-actions` cooldown. The granular `semver-*-days` cooldown subkeys are invalid for the `github-actions` ecosystem — GitHub rejects the entire config on one, silently disabling Dependabot (no PRs). `default-days` stays on `github-actions`; `uv` keeps both. (The 0.6.2 entry below set it on both ecosystems; only `uv` is valid.)
+
+## [0.6.3] - 2026-06-21
+
+### Changed
+
+- `install-template`: the upgrade sync matrix now reconciles each managed file's *inner* config against `template/`, not just its presence. The `test.yml` row calls out the job-level `UV_PYTHON` env pin (without it a multi-version matrix silently tests one interpreter), and the `dependabot.yml` row reconciles each ecosystem's `groups` and `cooldown` blocks.
+- `install-template`: document the intentional Dependabot repo-settings policy — alerts on, security updates (`automated-security-fixes`) off — so scheduled version-update PRs plus the release-time advisory audit stay the update path, with alerts kept on purely as a warning layer.
+
+## [0.6.2] - 2026-06-21
+
+### Added
+
+- `install-template` upgrade mode now relocates misplaced config files: when a template-managed file (e.g. a root-level `CLAUDE.md`) is genuinely the right file but in an old spot, it is `git mv`'d to the canonical path before syncing, instead of being left or duplicated. Documents that tracking `.claude/` is a per-repo decision and the `.claude/*` + `!.claude/CLAUDE.md` pattern for keeping one file tracked.
+- Template `dependabot.yml` now sets a release `cooldown` (`default-days: 5`, `semver-major-days: 14`) on both the `github-actions` and `uv` ecosystems, so dependency-update PRs wait for a release to season before opening.
+
+### Fixed
+
+- `install-template` upgrade mode now uses the conventional `.worktrees/template-upgrade` path (and `.worktrees/` gitignore entry) instead of `.claude/worktrees/`.
+
+## [0.6.1] - 2026-06-10
+
+### Changed
+
+- The `install-template` skill's upgrade mode now runs through the planners lifecycle: scaffold/activate a plan in the target repo, work in a worktree at `.claude/worktrees/template-upgrade`, open a PR into `dev`, and close the plan on merge (index regen, worktree removal, pre-commit hook re-install check).
+
+### Fixed
+
+- Template `test.yml` matrix was false green: bare `uv run` re-resolves to the `.python-version` pin (3.14), so every matrix cell ran the same interpreter regardless of `uv sync --python`. A job-level `UV_PYTHON: ${{ matrix.python-version }}` now outranks the pin, so each cell tests its own Python.
+
+## [0.6.0] - 2026-06-10
+
+### Added
+
+- `install-template` skill: scaffold a new repo from the template, or upgrade an existing repo to the latest standard via a per-file sync matrix that adapts to repo type (publishable package vs app/site), requiring green ruff/pyrefly/pre-commit checks before the Claude Stop hook lands.
+
+### Changed
+
+- Migrate this repo's plan tracking to the `.planners/` layout: plans moved to `.planners/plans/<NNN>-<slug>/plan.md` with a generated `.planners/README.md` index, `TODO.md` retired, and a `planners-validate` pre-commit hook.
+- Template scaffold now stamps the `.planners/` layout instead of `docs/` + `TODO.md`: empty plans index, `plans/.gitkeep`, and the `planners-validate` hook block in the generated `.pre-commit-config.yaml`.
+- Move `template/CLAUDE.md` into `template/.claude/`, and ignore `.claude/` in the template `.gitignore` so generated repos receive the Claude payload on disk but never track it; expand the template ignore entries (`.worktrees/`, `build/`, `dist/`, coverage files).
+- Fold the per-repo `lint-and-typecheck` skill and guide into the machine-global skill — the template no longer ships `docs/guides/lint-and-typecheck.md` or `.claude/skills/lint-and-typecheck/`.
+- Move `proj-init.sh` into `scripts/` — the raw-URL alias changes to `scripts/proj-init.sh`.
+- Ship workflow actions pinned to specific version tags (e.g. `actions/checkout@v6.0.3`) instead of commit SHAs so Dependabot, the default updater, keeps them current; Renovate enrollment re-pins to SHA digests via `helpers:pinGitHubActionDigests`.
+- Rename the `renovatabot-enroll` skill to `install-renovatabot` (script name unchanged) and document the SHA-pinning handoff in the skill and the GitHub automation guide.
+
+## [0.5.3] - 2026-06-08
+
+### Changed
+
+- Restrict the scaffolded project's sdist to the package and core files via `[tool.hatch.build.targets.sdist]` `only-include` (`/PACKAGE`, `/README.md`, `/CHANGELOG.md`, `/LICENSE`), keeping internal plan files (`.planners/`), guides (`docs/`), the `.claude/` directory, tests, and tooling out of the published sdist.
+
+## [0.5.2] - 2026-06-08
+
+### Added
+
+- `renovatabot-enroll.sh` detects repository visibility and warns before enrolling a **private** repo, where the least-privilege App (no Contents permission) cannot read refs and the first Renovate run fails at init. Added a "Troubleshooting the first run" section to the GitHub automation guide mapping each failure stage to its setup gap.
+
+### Fixed
+
+- Align the enroll guide and skill with the script: drop the stale `--env-file` caveat (the script streams the key file) and correct the `.env` precondition to `RENOVATE_APP_PRIVATE_KEY_PATH`.
+
+## [0.5.1] - 2026-06-08
+
+### Changed
+
+- Rename the self-hosted Renovate enrollment tooling to **renovatabot** to match the GitHub App — `scripts/renovatabot-enroll.sh`, the `renovatabot-enroll` skill, and the credentials directory `~/.config/renovatabot`. The enroll script now stores the App key as a path (`RENOVATE_APP_PRIVATE_KEY_PATH`) and streams the file into the secret, and gains `--dry-run` and `--yes` flags with a pre-change confirmation prompt.
+- Expand the GitHub automation guide with the GitHub App install walkthrough and the exact App permissions Renovate needs: Dependabot-alerts read for security PRs, and Issues read-write for the dependency dashboard.
+
+## [0.5.0] - 2026-06-06
+
+### Added
+
+- Optional self-hosted Renovate dependency automation as a scaffold-time choice (`proj-init.sh --deps dependabot|renovate`, default `dependabot`). Choosing `renovate` ships `renovate.json` + a scheduled `renovate.yml` instead of `dependabot.yml`, with security-hardened defaults: `dev`-targeted PRs, per-ecosystem grouping, a 5-day release cooldown (`minimumReleaseAge` with `timestamp-required`), no auto-merge, no silent action-digest mutation in workflows, and a least-privilege GitHub App token so update PRs trigger CI. Dependabot remains the zero-setup default.
+- Maintainer tooling to enroll a scaffolded repo in self-hosted Renovate in one step: `scripts/renovatabot-enroll.sh <owner/repo>` (and the `renovatabot-enroll` skill) pushes the GitHub App secrets from a local `.env`, keeps Dependabot vulnerability alerts on while turning its security-update PRs off so only Renovate opens PRs (`--no-dependabot-toggle` to skip), and triggers the first Renovate run. Not shipped into scaffolded projects.
+
+### Changed
+
+- Disable the template's PyPI publish workflow by default; it now runs only when the `PUBLISH_ENABLED` repository variable is set to `true`.
+- Move the template's `.claude` permission grants from the personal `settings.local.json` into the shared, committed `settings.json`, and stop shipping a `settings.local.json` (including its `.gitignore` negations).
+
+## [0.4.0] - 2026-05-25
+
+### Added
+
+- Agentic lint/type-check integration for scaffolded projects: a committed `Stop` hook, a `CLAUDE.md` "before finishing a task" directive, a `lint-and-typecheck` skill, and a combined ruff + pyrefly guide.
+
+### Changed
+
+- Adopt the pyrefly v1.0 `strict` preset, relaxing `implicit-any` in `tests/` via a sub-config.
+- Bump ruff-pre-commit to v0.15.14, and pin `pyrefly>=1.0.0` and `ruff>=0.15` in the template's dev dependencies.
+
+## [0.3.2] - 2026-04-30
+
+### Removed
+
+- Drop GitHub issue templates from the project template.
+
+## [0.3.1] - 2026-04-28
+
+### Changed
+
+- Bump GitHub Action versions (setup-uv 8.1.0, upload-artifact v7, and download-artifact v8).
+- Run the pyrefly pre-commit hook as a local entry, and add typer as a template dependency.
+- Ignore `.env` files in the template `.gitignore`.
+
+## [0.3.0] - 2026-04-10
+
+### Added
+
+- Template infrastructure: publish workflow, Dependabot config, issue/PR templates, a `py.typed` marker, a Keep a Changelog template for scaffolded projects, and a trusted-publishers setup guide.
+
+### Fixed
+
+- Correct the publish workflow and Dependabot config.
+
+## [0.2.0] - 2026-04-09
+
+### Added
+
+- Add the pyrefly type checker to the template.
+- Add a pre-commit installation guide.
+
+## [0.1.3] - 2026-04-01
+
+### Fixed
+
+- Fix cross-platform `sed -i` compatibility in `proj-init.sh`.
+
+## [0.1.2] - 2026-03-30
+
+### Added
+
+- Add a `--branch` flag to `proj-init.sh` (defaults to `main`).
+
+## [0.1.1] - 2026-03-30
+
+### Added
+
+- Initial release: a uv-based Python project template with a clone-based `proj-init.sh` scaffold script, license selection, VERSION tracking, and dev/main branch setup.