Changelog

`7.10.1.dev0` (unreleased)

Warning

This version is not released yet and is under active development.

`7.10.0` (2026-08-11)

Teach the repomatic-ship skill to reconcile bundled skills and agents as a third pass, judge a false-positive autofix PR against current main before writing a lint rule for it, and tell a superseded intra-cycle measurement from a genuine contradiction.
Breaking: the update-dep-graph job moved from autofix.yaml into the release engine, its only firing moment being a release push. A required check or needs: edge naming it under Autofix must follow.
Breaking: manual version-bump commits now read [changelog] Bump minor version to `vX.Y.0`: every version-machinery commit carries the [changelog] prefix, and anything matching the old unprefixed titles must follow.
New lint-deps command and release-lane job, blocking a release whose dependencies do not all resolve from PyPI: git branches, forks, local paths, direct URLs and private indexes. Exempt a package with [tool.repomatic] lint-deps.allow.
Breaking: the default test matrix moved from ubuntu-24.04-arm and ubuntu-slim to ubuntu-26.04-arm and ubuntu-26.04, which also moves the PR Linux slot and the 3.14t smoke test. The docs link-crawl job, the Linux Nuitka build hosts and every light mechanical job move with them: ubuntu-slim is retired, measured 27-32% slower on whole-job wall-clock, so every job now runs on a test-matrix runner. Pin the old images back with test-matrix.replace.os = { "ubuntu-26.04-arm" = "ubuntu-24.04-arm" }.
Breaking: a report emitted with --output-format github-actions now travels as a file: the step output is named <key>_file and holds a path. A workflow reading steps.<id>.outputs.diff_table or .markdown must read .diff_table_file or .markdown_file instead.
New runner-images job and CLI command, opening an issue that lists GitHub's open runner-image announcements and flags the ones retiring an image the repo runs on. Opt out with runner-images = false.
Autofix jobs no longer run on version-bump pushes: the 16 remaining jobs only re-checked machine-generated, ship-gated commits, and drift stays covered by the next push and the weekly sweep.
The tool runner now retries a download up to 3 times on transient network failures, instead of failing the job on a one-off TLS or truncation error.
Standalone binary tests now run for every healthy target when a sibling build fails, instead of being skipped wholesale.
Root-caused the macOS compile-cache misses: uv's randomly-named cache path leaks into Nuitka's include flags, changing the hashed compiler arguments every run. ccache now hashes paths relative to the runner root (base_dir), insuring the Linux cache against the same leak.
repomatic init no longer writes the running version's workflow content beside a pin the cooldown held back. A repository that already carries workflows keeps them untouched until the release is adopted, instead of receiving the new triggers, concurrency groups and env: blocks against the pinned release's reusable-workflow surface.
New is_python_package metadata key. sync-bumpversion now gates on it instead of is_python_project, so the job no longer opens [tool.bumpversion] PRs against a uv virtual project ([tool.uv] package = false).
Oversized step outputs are trimmed instead of killing the step that reads them with Argument list too long.
A PR body keeps its whole report: a dependency sweep whose release notes outgrow what an environment variable carries now reaches the body through a file instead of being cut to fit.
New --prefix-file option on pr-body, and a matching GHA_PR_BODY_PREFIX_FILE variable, reading the body prefix from a file.
The setup guide issue now reopens when Actions SHA pinning is turned off, instead of closing while reporting every repository setting complete.

The windows-x64 binary shipped without its .attestation.json sidecar: a transient TLS failure on the runner skipped the upload, and immutable releases lock the asset list. The attestation itself is registered, so gh attestation verify repomatic-7.9.0-windows-x64.exe --repo kdeldycke/repomatic still verifies against GitHub's attestation service.

Note

7.9.0 is available on 🐍 PyPI and 🐙 GitHub.

Breaking: REPOMATIC_PAT now requires Administration: Read-only, and lint-repo fails without it. Regenerate the token with the setup guide's pre-filled link; steps that cannot be verified now say so instead of vanishing.
New [tool.repomatic] nuitka.dev-targets option: an ordinary push now compiles binaries only for a canary subset, ["linux-arm64"] by default. Release commits, a new weekly schedule and manual dispatches build the full 6-target fleet.
lint-repo now also verifies versionless releases/latest/download URLs in docs/install.md, catching a renamed asset that leaves the guide pointing at a 404.
sync-workflow-pins now walks npx pkg@1.2.3 version literals forward, not just npm install and uvx pins.
repomatic init now realigns a workflow's inline repomatic==X.Y.Z literal onto the pin it writes into the uses: refs, in either direction.
Nuitka compile caches now persist across runs, so a warm build skips most of the C compilation. Release commits and macOS builds opt out, so no published binary is influenced by cached objects.
Compile, binary-test and VirusTotal-scan jobs now carry execution timeouts, so a hung job frees its runner slot instead of squatting it for 6 hours.
Scheduled and manually dispatched release runs get their own concurrency group, so a later push no longer cancels them mid-build.
Binary self-tests on non-release pushes now run inside the compile job; the standalone per-target test jobs run on release commits only.
sync-gitignore no longer discards rules added by hand to the committed .gitignore: it refuses to write when the rebuild would lose one, naming the rules. New --drop-orphans flag confirms an intended loss.
The setup guide no longer asks a uv virtual project to register a PyPI Trusted Publisher, and lint-repo no longer checks one: both now gate on whether the project builds a distributable.
Fix the broken-links issue never being filed: docs.yaml ran lychee through xargs, which reported its "broken links found" exit status as a crash.
A Bad credentials 401 now fails immediately instead of retrying a token that cannot recover, so a revoked REPOMATIC_PAT reports itself plainly rather than as a chain of unrelated check failures.
New Nuitka compilation guide covering build targets, fleet cadence, compile caching, the LTO stance, and upstream workarounds.
New Build backends section in the packaging guide, covering the [tool.setuptools] package-discovery shim a distribution needs when it builds a uv-build project with setuptools.
The documentation sidebar logo now follows Furo's light and dark toggle, so the wordmark no longer renders near-black against the dark theme.

`7.8.0` (2026-08-09)

Note

7.8.0 is available on 🐍 PyPI and 🐙 GitHub.

Breaking: the Codecov integration is removed, along with the codecov component, its .github/codecov.yaml, and the coverage_cells metadata key. repomatic init prunes an untouched orphaned config; delete the CODECOV_TOKEN secret and coverage badge by hand.
Breaking: attestation bundles now carry the full filename of the asset they attest, so repomatic-manpages.attestation.json becomes repomatic-manpages.tar.gz.attestation.json. A repository declaring one extra asset gets <filename>.attestation.json in place of <package-name>-extra-assets.attestation.json.
New pack-attestation command names an attestation bundle after the asset it attests and prints the release upload list.
New coverage component: repomatic init coverage writes a [tool.coverage] section carrying branch coverage, report precision and a report.fail_under ratchet, shipped disabled.
lint-repo now warns when a release download URL in docs/install.md names a file its release does not carry.
The bundled pytest config drops --cov-branch and --cov-precision from addopts, now carried by the coverage component. Existing [tool.pytest] sections are left alone; run repomatic init coverage to pick the settings back up.
The release lane's publish-release job now checks out the repository, so uploading binaries to the release no longer fails with Failed to spawn: repomatic. 7.7.0 shipped with no standalone executables because of it.
lint-changelog re-confirms a release live before dropping its availability admonition, so a day-old cache no longer reports a just-published version as missing.
The readme's logo is now an absolute URL, so it renders on the PyPI project page instead of 404ing.
The install guide's executable table points at the last release that carries binaries, instead of a version whose upload lane failed.

`7.7.0` (2026-08-09)

Note

7.7.0 is available on 🐍 PyPI and 🐙 GitHub.

Breaking: drop the check-version command: nothing invoked it, and workflows read the minor_bump_allowed and major_bump_allowed metadata keys instead.
Breaking: drop the clean-unmodified-configs command, superseded by repomatic init --delete-unmodified.
Breaking: repomatic metadata no longer emits the toml_files, changelog_bullet_word_threshold, nuitka_enabled and nuitka_nofollow_imports keys. No workflow consumed them; the three config fields are read directly by their subcommands.
New github-housekeeping skill backfills and curates labels and milestones across a repository's full issue and PR history: taxonomy design, cache-backed bulk classification with review gates, AI-slop detection from closed-without-comment signals, and milestone assignment by changelog, git-tag, and release-date archaeology.
New pack-binaries command materializes the versionless binary aliases and prints the release upload list, replacing the release engine's shell loop: the asset naming convention now has one Python definition, shared with the install-guide freeze.
New --default-branch option on the changelog command, so a repository whose default branch is not main gets a comparison URL that round-trips through the release freeze.
init no longer writes the release lane (changelog.md, changelog.yaml, release.yaml, the PyPI publish action) into a uv virtual project ([tool.uv] package = false). Dependency locking, coverage and test tooling still apply.
init now lists each awesome-template file it writes instead of one summary line, and init labels no longer reports its regenerated files as unmodified configs to clean up.
Rename the Claude Code plugin release asset to repomatic-claude-plugin.zip, as repomatic-plugin.zip read as a plugin for repomatic. /plugin install is unaffected.
Attestation bundles are now named after the asset they cover (repomatic-manpages.attestation.json) rather than the job that produced them, so the eight binary bundles no longer overwrite each other down to a single file.
The VirusTotal detections chart now pins its CDN script with a Subresource Integrity digest, so a tampered copy is refused by the browser.
sync-workflow-pins now splices the --exclude-newer-package cooldown exemption beside the inline repomatic==X.Y.Z pin it realigns, in the single spelling the release freeze writes and the post-release unfreeze recognizes.
The changelog's [!CAUTION] admonition for a yanked release now quotes the reason PyPI recorded for the yank, when there is one.
Changelog links are discovered under any capitalization of the PyPI project_urls key, matching how source URLs were already resolved.
PyPI release lookups order same-day publications by PEP 440, so 1.10.0 is no longer ranked below 1.9.0.
Dependency-update PR bodies omit the version comparison link when the upstream repository publishes no matching tags, instead of linking to a 404.
format-images now installs and verifies its oxipng binary once per run instead of once per optimized image.
Registry binary downloads and update-checksums now carry a stall timeout, and update-checksums rejects truncated bodies instead of recording their digest as the new canonical checksum.
GitHub token validation now times out instead of hanging forever when the API is unreachable.
The zsh_files metadata key now lists only shell scripts whose shebang names zsh, so a bash .sh file is no longer linted as Zsh.
repomatic metadata no longer aborts on a src-layout project: a Nuitka entry point with no module file at the repository root is skipped with a warning.
lint-repo now reports an unreadable rulesets API as a skipped branch-protection check rather than a failed one.
The broken-links issue no longer claims broken links when lychee itself failed to run.
The release freeze now warns when it finds no changelog section for the version being released, instead of silently doing nothing.
lint-changelog --fix now exits non-zero when it could not repair every problem it reported, instead of reporting success as soon as any one fix landed.
lint-changelog --fix no longer stamps an undatable orphaned version with a 0000-00-00 placeholder date, and files a datable one in order even when every existing heading is a .devN development section.
sync-uv-lock parses uv.lock once per phase instead of once per lookup, cutting several hundred milliseconds off each run.
Fix downstream tool caches frozen at their first write: the reusable workflows' cache keys hashed a file that only exists upstream. Keys now rotate with the reusable workflow's own commit SHA.
Fix init misreading a thin caller's trailing comment or odd-indented job line as extra downstream jobs, which silently flipped the file onto the explicit-permissions contract or duplicated the managed job's tail below the regenerated lanes.
Fix init mishandling a consumer's extra release jobs: the extra needs: edges declared on the release lane were dropped, and a blank line accumulated above the jobs on every sync.
Fix init --output-dir scanning the current directory for unmodified configs, which made --delete-unmodified act on the wrong tree.
Fix the generated release.yaml emitting a bare needs: (which GitHub rejects at startup) when every canonical edge is filtered out.
Fix a [tool.repomatic.workflow] paths override emitting entries like **/*.py unquoted when the canonical block held no quoted entry to copy, which parsed as a YAML alias and left the workflow silently ignored.
Fix repomatic metadata crashing on a repository carrying a tag the version parser refuses, like v1.2.3_hotfix.
Fix sync-action-pins and sync-workflow-pins silently reverting each other's edits when one sync-deps run bumps both kinds of pin in the same workflow file.
Fix a mid-resolve failure of sync-uv-lock leaving synced policy pins beside a stale lockfile for the CI job to commit: the project is now restored to its pre-run state on any error.
Fix sync-mailmap crashing with UnboundLocalError on a repository that has no .mailmap yet, the exact bootstrap its default --create-if-missing advertises.
Fix the sponsor labeller treating an empty pull_request event payload as a pull request.
Fix issue-filing jobs failing to record a new issue when gh prints a notice above the issue URL.
Fix update-dep-graph failing on Windows when a dependency's SBOM metadata contains non-ASCII characters.
Fix cache clean scoping: --namespace no longer wipes binaries and tool configs, --tool no longer wipes HTTP responses, and --max-age now applies to cached configs instead of deleting them all.
Fix repomatic run mypy aborting with Unable to find lockfile in a repository without a uv.lock: the tool now runs in an isolated, cooldown-gated environment when there is no lockfile to freeze.
Fix binary tools executing a just-deleted staging copy when the cache write is lost (Docker overlay runners) or the cache root is unwritable: the fallback copy now survives for the whole process.
Fix the published plugin manifest declaring the post-release .devN version rather than the release it ships with.
Fix image optimization leaving a .bak file in the working tree when interrupted.

`7.6.0` (2026-08-08)

Note

7.6.0 is available on 🐍 PyPI and 🐙 GitHub.

Breaking: the labels component is now ephemeral: labels.toml and the two labeller YAMLs are staged only when named explicitly (repomatic init labels). A repository that committed them sees them reported as excluded files on disk, removable with init --delete-excluded.
New fix-awesome-toc command deletes the table-of-contents entries awesome-lint forbids from readme.md and every readme.{lang}.md beside it, matching translated sections by position rather than by their English name.
The bundled skills and agents are now published as a Claude Code plugin: /plugin marketplace add kdeldycke/repomatic then /plugin install repomatic@kdeldycke. Needs Claude Code 2.1.224 or later. Addresses #2378.
New pack-plugin command builds the attested repomatic-plugin.zip asset every GitHub release now carries, with the marketplace URL pinned to the release tag.
New init plugin component merges the plugin's marketplace and enablement keys into a repository's .claude/settings.json, leaving every other setting untouched. New [tool.repomatic] settings.location moves the destination.
lint-repo now checks a repository's own pr-body --template-file templates: they belong in .github/pr-templates/, must exist, and must carry a title and a bare footer: false.
A failed extra-assets job now leaves the GitHub release as a draft instead of publishing it without the declared assets. A skipped job still publishes, so repositories declaring no extra assets are unaffected.
sync-labels now exports to a scratch directory instead of the repository root, so it no longer leaves three untracked files behind. Both committed and downloaded extra-labels/ files are applied, a download shadowing a committed file of the same name.
The generated downstream release.yaml now carries the canonical deny-by-default permissions: {}, so a consumer job appended below the managed lanes no longer runs with the repository's default token scopes.
The generated release.yaml keeps the extra needs: edges a consumer declares on its release lane, so a caller-side asset build can gate the engine. Edges naming a managed lane, a vanished job, or an upstream-only job are still dropped.
Fix init downgrading the upstream uses: pins of a repository that adopted a release still inside the minimum-release-age window. The cooldown now gates adoptions only, and a rollback to an older repomatic is honored.
init no longer closes with "commit the generated files and push" on a run that produced nothing but ephemeral output.
Fix the broken-links and setup-guide jobs dying on a recurring issue that the autolock workflow had locked. A conversation lock blocking a close or reopen comment is now cleared and the write retried.
Fix repomatic run finding no binary on a Linux distribution extra-platforms cannot name, which broke every registry tool inside the AlmaLinux-based manylinux build container.
Fix a crash when pyproject.toml is removed while being read, which now falls back to an empty configuration as documented.
Re-lock uv.lock in the release freeze commit, so a release no longer ships with its version ahead of its own lock entry. The desync made the Windows binary builds fail.

`7.5.0` (2026-08-07)

Note

7.5.0 is available on 🐍 PyPI and 🐙 GitHub.

Breaking: bundled skills drop model and disable-model-invocation, so every skill is now model-invocable and runs on the session model. The recommended model moved to the spec's compatibility field.
Breaking: workflows now run the CLI from uv.lock with uv run --frozen instead of uvx --from ., so installs are hash-verified. The release freeze still pins downstream to uvx 'repomatic==X.Y.Z'.
minimum-release-age now defaults to 1 week (was 8 days) and [tool.uv] exclude-newer tracks it, closing the band where uv.lock could pin a version CI then refused to install.
Reject a dependency floor naming a release still inside the cooldown window, which would ship a package that downstream repos and uvx users cannot resolve.
Fix the sync-* updaters adopting a release published on the cutoff day itself, which uv then refused to resolve because it applies the window to the hour rather than the day.
sync-workflow-pins now warns when a pin already in the tree sits inside the cooldown, instead of only judging the version it is about to write.
A lint-repo check that cannot read its GitHub API response now reports one "could not query API" outcome instead of separate unreachable-API and unparsable-JSON messages.
Fix prepare-release and sync-github-releases reading ./changelog.md instead of the configured changelog.location.
Fix a PR body template's footer: false being ignored, appending the attribution footer to a template that opted out of it.
Fix template and skill frontmatter truncating at a value that embeds ---, dropping every field below it.
Trim the hand-maintained example dumps from metadata's module and nuitka_matrix docstrings, which had drifted from the values they claimed to show.
Fix docstrings where a brace placeholder against a closing backtick rendered as a spurious role, swallowing the prose after it.
Every workflow now gates package installs behind the minimum-release-age cooldown, so no uvx, uv pip install, npm install or npx resolves a release published inside the window.
A thin caller carrying extra downstream jobs now gets a top-level permissions: {}, and on its managed job the union of the scopes the reusable workflow's jobs declare. Callers with no extra jobs are untouched.
astral-sh/setup-uv steps now pin the uv version, bumped by sync-workflow-pins once a release clears the cooldown, instead of installing the newest build satisfying required-version.
repomatic run mdformat provisions its own shfmt at the registry-pinned version, so formatting shell blocks in Markdown no longer needs a system shfmt.
New path_tools field on a tool spec, naming registry tools whose binary must be on PATH while it runs.
Fix repomatic run mdformat aborting on Windows ARM64, where shfmt publishes no binary: a companion missing for the platform is now skipped with a warning.
Fix the macOS binary builds, which crashed in code signing once skills joined the bundled data: an --include-data-dir source holding symlinks is now staged symlink-free. Reported upstream as Nuitka/Nuitka#3994.
The format-markdown job drops back to the lean ubuntu-slim runner, and its awesome-list fixup uses sed instead of gawk.
apt-get replaces apt in every workflow step, with --no-install-recommends throughout.
Add gh to the repomatic run registry. The release engine's attestation check now uses it instead of adding GitHub's RPM repository to the build container and installing an unpinned gh.
A tool's strip_components accepts a per-platform mapping, like archive_format already did.
Add oxipng to the repomatic run registry, bumped to 10.1.1. format-images now uses the pinned, checksum-verified build instead of a hand-fetched .deb installed with dpkg.
Dependency-updater reports now close on the Held back by cooldown section, below Cooldown bypasses, so a PR opens on what the run changed instead of what it left alone.
sync-tool-versions leaves autofix.yaml for a new upstream-only self-maintenance.yaml, and polls daily instead of weekly. Downstream autofix.yaml loses the four steps it could never run.
sync-tool-versions now also bumps the packages pinned alongside a tool in its uvx environment, like mdformat's plugin set, reporting them like every other row.
Fix get_source_url returning a bug-tracker or changelog sub-path instead of the repository root, and matching project_urls keys case-sensitively.
The bundled ruff config sets output-prefer-rule-codes, so diagnostics report ISC004 instead of implicit-string-concatenation-in-collection-literal. Requires ruff 0.16.1.
repomatic init holds the derived upstream workflow pin back to the newest release past the minimum-release-age cooldown; --no-cooldown pins the running version immediately.
Commands honoring --output now log their destination uniformly, always naming what is written instead of mixing Save updated results to and a subject-less Write to.
Align bundled skills with the Agent Skills specification: babysit-ci gains its required name field, and allowed-tools moves to the spec's space-separated form.
Skills are now installed as whole folders, so one can ship the spec's optional scripts/, references/ and assets/ directories alongside its SKILL.md.
Add [tool.repomatic.flavor] with agent and ci keys, declaring the ecosystems a repository targets. Values are extra-platforms trait IDs.
[tool.repomatic.labels.extra] entries now carry labelmaker's full per-label specification, adding rename-from in-place renames, multi-color lists, and the create, update, enforce-case and on-rename-clash knobs. An unknown field now warns instead of being dropped silently.
New release-assets filename list in [tool.repomatic]: each named asset is built by a caller-side job, attested like the compiled binaries, and attached to the release draft before publication locks it.
The man-page tarball is now attested like the compiled binaries, with its sigstore bundle attached as a manpages.attestation.json release asset.
skills.location and agents.location now default to the layout of the configured flavor.agent, and still win when set explicitly.
repomatic run mdformat drops the mdformat-ruff plugin and its separate ruff pin, and the bundled ruff config drops extend-include: ruff formats fenced Python blocks in Markdown on its own.
Teach the repomatic-ship and babysit-ci skills to act on the first failing CI job instead of waiting out full matrices, pay down pre-existing and ⁉️-probe test debt before the first push, and hold prose-only pushes while binary matrices drain.
Chart the /repomatic-ship convergence loop (first-failing-job fixes, push timing, debt paydown) on the skills docs page.
Re-base the release PR onto the current main HEAD after every build by also running prepare-release on workflow_run, so a reconciliation commit that misses changelog.yaml's paths: filter no longer leaves the PR stale.
/repomatic-topics pre-approves the Agent tool instead of the retired Task name.
Add a history documentation page retracing the project from its 2021 reusable-workflow origins through the gha-utils CLI to the repomatic rename.
Recenter the readme and the workflows page on the CLI-first design: workflows only trigger CLI commands, with local-run examples and links to the standalone binaries and history pages.
Document Agent Skills spec conformance, and argument-hint as the single accepted deviation, on the skills documentation page.
Correct the readme and benchmark page: both carried stale reusable-workflow counts, and listed jpegoptim among the tools repomatic run manages when it never was.

`7.4.1` (2026-08-01)

Note

7.4.1 is available on 🐍 PyPI and 🐙 GitHub.

Add two review links to the release PR's How-to release checklist: the draft dev pre-release and the full changes against main.
Teach the repomatic-ship pre-push gate to read the latest conclusive ancestor CI run when HEAD's own runs are still in-flight, catching a pre-existing platform-gated failure before the first push.
Lower the uv required-version floor from >=0.12 to >=0.11.15, the actual resolver minimum.
Extend the uvx script-equals-package guard to the pipx run <script> install check, so 📦 Package install no longer fails permanently for projects whose CLI script differs from their package name.

`7.4.0` (2026-07-31)

Note

7.4.0 is available on 🐍 PyPI and 🐙 GitHub.

Breaking: Rename update-deps-graph to update-dep-graph across the CLI command, autofix job, PR branch, and body template, aligning with the dependency-graph config key. Close any open update-deps-graph pull request; the next run reopens it on the new branch.
Breaking: repomatic init component selectors are now case-sensitive, validated by the same code path as the exclude and include configuration entries.
Lower the compiled-binary OS floors: Linux glibc 2.28, built and self-tested in manylinux_2_28 containers (RHEL 8, Debian 10, Ubuntu 20.04 and later), and macOS 11.0 (Apple silicon) / 10.15 (Intel) via uv's embedded python-build-standalone interpreter.
Enforce each binary's OS floor at build time: verify-binary parses ELF, Mach-O and PE headers natively and no longer needs exiftool.
Keep tkinter and its Tcl/Tk stack out of compiled binaries via the new [tool.repomatic] nuitka.nofollow-imports setting (default ["tkinter"], set to [] to bundle it).
Emit man pages for repomatic's own CLI on docs builds and attach a repomatic-manpages.tar.gz asset to each release.
Add update-docs --check to report out-of-date self-updating content and exit non-zero without writing, for CI drift detection. The docs update script must accept its own --check flag to participate.
Add a check_sha_pinning_required lint check and setup-guide step for GitHub's sha_pinning_required Actions setting, the platform-enforced backstop for action SHA pinning.
Unify the lint-repo checks on one tri-state result protocol: skipped checks now print ℹ instead of a misleading ✓.
Key the CI tool-binary caches on tool_registry.py instead of the whole runner module, so engine-only changes stop invalidating cached tools.
Report sync-deps and update-checksums progress as a ✓/✘ trail with a running tally and a timed summary.
Warn about unknown [tool.repomatic] keys once per project and process, instead of on every configuration re-load.
Loosen the uv required-version pin to a lower bound (>=0.12), dropping the per-minor upper cap so uv can update across minors without a manual bump.
Move the docs link checker from ubuntu-slim to ubuntu-24.04-arm: the crawl outgrew the slim runner's 15-minute job cap.
Extend the bundled lychee configuration with generic excludes: GitHub issue-comment fragments, release binary downloads, and DOI-to-Zenodo redirects.
Declare least-privilege permissions on the canonical release.yaml, clearing the workflow check_workflow_permissions lint.
Extend the check_workflow_permissions lint to flag a reusable-workflow call inheriting an empty top-level permissions: {} without its own grants: the misconfiguration that aborts a run at startup.
Block install-time scripts and apply the minimum-release-age cooldown on every npm install of awesome-lint, hardening both the runtime and CI-provisioning paths against supply-chain attacks.
Surface uv audit's stderr when it exits without emitting JSON, replacing the bare produced no output error.
Keep metadata from crashing when git refuses the repository (dubious ownership, unresolvable range): it now logs git's stderr and continues.
Accept sur (macOS Big Sur, Homebrew's big_sur bottle tag) as a valid word in the bundled typos configuration, so fix-typos stops correcting it to sure.
Document the minimum OS requirement of each binary target, and the distributions it opens execution to, in a new Minimum OS requirements section that downstream binaries pages link to.
Document how to verify a downloaded binary's build-provenance attestation with gh attestation verify on the installation page.
Order the installation docs' Python-compatibility table newest-first, so the latest release and Python version read from the upper-left.
Rename the binaries page chart markers to binaries-chart/binaries-chart-end, aligning on click-extra's  /  marker grammar; pages carrying older markers are migrated on their next refresh.
Fix the click-extra {matrix} directive link on the installation page, and realign page octicons with the sphinx-docs agent's extended icon registry.
Emit an absolute og:image URL for social previews: ogp_site_url now backs ogp_image in the docs configuration.
Pin the install guide's versioned CLI examples (pkg@X.Y.Z, pkg==X.Y.Z) to the release in the prepare-release freeze step.
Direct the babysit-ci skill to announce its early exit and name the still-unverified release.yaml binary run, instead of stopping on a silent idle.
Harden the repomatic-ship skill: forbid detached Monitor polling, read the whole unreleased changelog section at invocation, and align every convention description its docs pass corrects.
Extend the sphinx-docs agent and sphinx-docs-sync skill: the {click:run} --version trap, thin-schema combined CLI page, Cloudflare-blocked intersphinx probes, mdformat seed-block collapse, plus release-asset, self-healing-marker, and linkcheck audit guards.
Note in the repomatic-ship skill that changelog released sections are immutable, and that a workflow cache-key line-length fix cannot lift hashFiles() into a workflow-level env:.

`7.3.1` (2026-07-28)

Note

7.3.1 is available on 🐍 PyPI and 🐙 GitHub.

Refresh the bundled pytest defaults to the canonical configuration: importlib import mode, tests/-restricted collection, the once marker, parallel runs via pytest-xdist, and --cov-report=xml left to the test workflow's command line.
Mark the validate-arch job of tests.yaml as canonical-repository-only: downstream repos drop the job and its build_targets metadata field when adapting the workflow.
Point the lint-changelog not found on PyPI warning at its remedy: list intentionally-unpublished releases under [tool.repomatic] abandoned-versions.
Fix the post-release re-trigger of changelog.yaml: its workflow_run filter still watched the pre-emoji Build & release workflow name and never fired.
Fix lint-changelog --fix treating a published pre-release (X.Y.Z.dev0, rc, alpha, beta) as a missing changelog entry, which inserted a spurious section and rewrote the adjacent release's comparison URL.
Fix the update-docs autofix job opening a duplicate of the format-pyproject pull request: it now reformats pyproject.toml only when update-docs changed it.
Skip the bare uvx <script> invocation of the package-install smoke job when the CLI script is not named after its package.
Restructure the repomatic-ship skill: rules shared by every spawned agent move to a single section, and accumulated incident notes compress into their operative rules.
Harden the repomatic-ship release checks: dispatch release.yaml past a content-skipped binary matrix, revert formatter moves whole, read the freeze scope from the regenerated release PR, and verify {click:run} blocks against the live CLI.
Direct the repomatic-ship docs pass to advance version samples lagging the released tag up to it.
Note in the repomatic-ship and babysit-ci skills that CI log fetches write under ~/.cache/gh and need the sandbox off.

`7.3.0` (2026-07-23)

Note

7.3.0 is available on 🐍 PyPI and 🐙 GitHub.

Breaking: Move the MyST docstring toolchain upstream to click-extra, now floored at 8.5: the repomatic.myst_docstrings Sphinx extension becomes click_extra.sphinx.myst_docstrings (point conf.py at the new module path), and the convert-to-myst command becomes click-extra convert-to-myst.
Warn on unknown [tool.repomatic] keys through click-extra's schema layer, covering nested tables too; the warning now names keys in snake_case.
Upload each release binary under a versionless alias, so the stable releases/latest/download URLs keep resolving across releases.
Mark the upstream toolkit's lockstep-aligned pin with a ⛓️ lockstep docs link in the sync-workflow-pins PR table, instead of an empty Released cell.
Add a ⚙️ emoji to the Configuration section heading of PR bodies, and swap the Held back by cooldown section's 🔜 emoji for ⏸️.
Disable ruff's unsafe-fixes in the bundled defaults, so --fix and the autofix workflow only apply semantics-preserving fixes.
Expose GITHUB_TOKEN to the Sphinx linkcheck step of the docs workflow, so a repo's conf.py can authenticate its github.com checks via linkcheck_request_headers.
Space out the Windows exiftool install with step-level retries, absorbing Chocolatey community-feed outages that punch through choco's own --retry-count.
Fix the exclude and include configuration reference to list agents among the default-excluded components.
Exclude once-marked tests from every test-matrix cell and run them in a dedicated single-runner once-tests job with its own coverage upload.
Teach the repomatic-ship and babysit-ci skills that the Nuitka binary matrix only exists on projects enabling [tool.repomatic] nuitka.enabled, and how to verify binary-less releases.
Fix the repomatic-ship local-gate tool recipes: pass biome and shfmt their args forms, and smoke checksum-pinned tools with no matching files via --version only.
Broaden the repomatic-ship review scopes: version samples are audited against the last freeze commit's file list, and platform-gated tests are reviewed with the inputs they consume.
Require the repomatic-ship sweep agents to message their final reports to the orchestrator, with one chase on a silent idle.
Point the changelog over-length warning and the repomatic-changelog skill at the canonical entry-length guideline URL, which downstream CLAUDE.md copies lack.

`7.2.0` (2026-07-16)

Note

7.2.0 is available on 🐍 PyPI and 🐙 GitHub.

Breaking: the release-prep command is renamed prepare-release, matching the job, template, and PR branch it drives.
Breaking: the version-check command is renamed check-version.
Add cancel-runs: cancels a branch's in-progress and queued workflow runs, replacing the bash block in cancel-runs.yaml; run listings now paginate past the first page.
Add [tool.repomatic] binaries.sync: set to false to stop the release pipeline from committing the binaries catalog and scan records to the default branch.
Add sync-dep-sources, a fifth sync-deps updater: once the release named by a git-tracked dependency's .dev floor ships on PyPI, it drops the [tool.uv.sources] override, tightens the floor, and freezes the adopted release through the cooldown. Disable with [tool.repomatic] dep-sources.sync.
Dialect, ArchiveFormat, and WorkflowFormat now carry their dispatch as enum methods (serialize, extract, write_workflow).
Rename cross-module internals to public names: COMPONENTS_BY_NAME, is_source_repo, format_released, format_upload_date, date_to_utc_cutoff.
The sponsor-labeller job in labels.yaml is renamed sponsor-label, matching the CLI command it runs.
Remove the dead get_default_repo and list_open_issues helpers and the unused REQUIRED_PAT_PERMISSIONS constant.
update-deps-graph now keeps only directly-declared dependencies inside the --group and --extra boxes, renders transitive dependencies as plain ovals, and counts an extra's transitives as depth 2 under --level.
The unsubscribe workflow's GraphQL phase now re-validates each item's staleness client-side and reports the items it holds back.
The unsubscribe.yaml workflow now streams per-thread progress to the job log.
Generated PR and issue bodies now use ## section headings, with Release notes nested as a ### subsection; release bodies embedded in dropdowns get their headings demoted below the per-version heading.
Generated PR bodies drop the boilerplate Description section, and the Workflow metadata block becomes a compact list led by a Documentation link to the job's section of the workflows reference.
The Cooldown bypasses PR section is now a single table: 🧹 cleared:, 📌 frozen:, and 🚧 unreleased: rows with a Held until expiry column.
Diff tables label added and removed packages with 🆕 new: and 🗑️ removed: prefixes ahead of the version.
sync-action-pins and sync-workflow-pins PR bodies now report an action or package pinned at several versions as a single row spanning from the oldest pin.
The update-docs job now re-formats pyproject.toml files with pyproject-fmt after running the project's update script.
GitHub Releases API reads now resolve their token like every other GitHub access (REPOMATIC_PAT first), instead of hitting the anonymous rate limit.
PyPI, npm, and GitHub API lookups now retry once on a truncated response instead of crashing with IncompleteRead.
The release freeze and unfreeze steps now cover .yml workflow files alongside .yaml.
The gitignore.io template download now times out after 10 seconds instead of hanging on a stalled connection.
Version bumps no longer overwrite the cff-version: schema field in citation.cff when it coincides with the package version.
sync-action-pins no longer rewrites uses: pins inside files repomatic init deploys verbatim, like the publish-pypi composite action.
The run typos guidance now recommends extend-ignore-re guards for encoded hashes and intentional-typo examples.
Document the scan job contract and the release-lane direct-commit exception.

`7.1.0` (2026-07-08)

Note

7.1.0 is available on 🐍 PyPI and 🐙 GitHub.

Breaking: scan-virustotal no longer writes scan tables into GitHub release notes; the --update-release and --repo options are removed, and --binaries-dir is now required.
Add sync-binaries: regenerates docs/assets/binaries.csv and its docs/binaries.md page, a catalog of every released binary with download links, VirusTotal analyses, and a detection trend chart.
sync-binaries --backfill-records recovers detection snapshots from the VirusTotal tables of legacy release notes into the scan history file.
The release pipeline now records each binary's flagged / total snapshot in docs/assets/virustotal-scans.json and refreshes the binaries page instead of editing release notes.
The documentation build gains sphinx-datatables, rendering the binaries catalog as a searchable, sortable table; downstream repos can opt in with the same extension.
Add git-commit-push: commits files and pushes them, rebasing and retrying on rejection, for release jobs publishing generated files to the default branch.
Add a global --jobs option controlling how many parallel workers commands may use, defaulting to one fewer than the host's logical CPUs.
update-checksums, sync-tool-versions, and sync-deps now download artifacts and resolve updates concurrently, sized by --jobs; Ctrl+C aborts the fan-out promptly and --verbosity DEBUG collapses it to sequential.
sync-uv-lock PR bodies gain a Cooldown bypasses section: each active exclude-newer-package freeze with the date it expires and is cleared from pyproject.toml, plus the entries the run froze or pruned.
The Held back by cooldown table now also lists releases blocked by an exclude-newer-package freeze, not only those inside the global exclude-newer window.
update-docs gains a fourth phase refreshing self-updating {matrix} directive blocks in docs/ and readme.md; the Python compatibility matrix in the installation docs now renders from those markers instead of an in-repo generator.
The CLI, configuration, and tool-runner references in the docs render live through the click:tree, click:config, and {python:render} directives; the checked-in generated tables and docs/docs_update.py are removed.
Each tool section in the tool-runner reference shows Stars and Last release badges; the separate Comparison table is removed.
Require click-extra >= 8.3, adding the --export-config option, --theme auto terminal-background detection, and the click:config Sphinx directive.
Label added and removed packages in dependency report tables consistently after the version, with 🆕 and 🗑️ status emoji.
sync-workflow-pins now aligns the inline repomatic pin to the newest uses: ref version, bypassing the release-age cooldown.
sync-action-pins now converges actions pinned at several versions onto the highest pin, even when no newer release clears the cooldown.
Trim oversized PR and issue bodies to GitHub's 65536-character limit, preserving the refresh tip, metadata block, and attribution footer.
Add the humanized age next to Released dates in fix-vulnerable-deps reports, matching the other dependency updaters.
update-deps-graph now places a package declared by several groups or extras in the box where most of its dependents live, drawing the duplicates with a dashed border and a dotted identity link to the real node.
The setup guide and lint-repo now flag a missing REPOMATIC_NOTIFICATIONS_PAT secret when notification.unsubscribe is enabled.
Exclude VirusTotal analysis links from lychee broken-link checks.
Update the av-false-positive skill to start from the scan history file and to record post-submission re-scans into it.
The babysit-ci and repomatic-ship skills now mandate sleeps between CI polls and document GitHub API rate-limit exhaustion, whose symptoms masquerade as PAT permission errors.
Fix sync-uv-lock reporting No dependency changes and writing no PR body when a run only prunes or freezes cooldown bypasses in pyproject.toml.
Fix downstream manual dispatches of the unsubscribe workflow ignoring their inputs and always running live: generated thin callers now forward workflow_dispatch inputs to the reusable workflow.
The publish-pypi composite action and the unsubscribe workflow no longer trigger setup-uv's cache-invalidation and Empty workdir detected warnings on downstream runs, which execute without a checkout.
The PR-creation steps of the changelog workflow now time out after 10 minutes instead of hanging when the GitHub API is rate-limit starved.
Fix the binary cache purging fresh entries whose release archive carries an old build date: cached binaries are now aged by their store time, not the archive's mtime.
repomatic run now reports a truncated tool download as got X of Y bytes instead of a SHA-256 mismatch, which read as a stale checksum or a tampered artifact.
Rebuild binaries on pushes that only touch .github/workflows/_release-engine.yaml: the release workflow split left the engine lane outside the binary-affecting paths.
Disable mouse zoom on the class inheritance diagrams of the documentation's API sections, so they no longer hijack page scrolling; the fullscreen viewer keeps zoom.

`7.0.0` (2026-07-02)

Note

7.0.0 is available on 🐍 PyPI and 🐙 GitHub.

Breaking: Remove the Renovate integration: the renovate.yaml workflow, the bundled renovate.json5, the check-renovate command, and the Dependabot-to-Renovate migration are gone, replaced by self-hosted dependency updates (below). Downstream repos prune the orphaned files on their next repomatic init.
Breaking: repomatic update-checksums is now registry-only: the workflow-file argument and the --registry flag are removed, so it only refreshes the binary tool checksums.
Add sync-deps, the single entry point for dependency updates: runs every enabled updater or a named subset in parallel and applies them in order, with a --dry-run preview.
Add sync-tool-versions: bumps each repomatic run tool to its latest release past the cooldown and refreshes the binary tool checksums in the same pass.
Add sync-action-pins: bumps SHA-pinned GitHub Actions to their latest release past the cooldown, resolving each release tag to its commit SHA.
Add sync-workflow-pins: bumps the npm and PyPI version literals embedded in workflow YAML past the cooldown.
Add [tool.repomatic] minimum-release-age (default 8 days), the shared stabilization cooldown for the sync updaters, plus per-updater tool-versions.sync, action-pins.sync, and workflow-pins.sync toggles.
repomatic run now runs npm-backed tools, starting with awesome-lint, installed from the npm registry with per-tarball integrity and the minimum-release-age cooldown; the lint-awesome job now calls repomatic run awesome-lint.
Add a [tool.repomatic] changelog.archive-location option pointing at an archive file for older release sections, so lint-changelog treats archived versions as documented instead of flagging them as orphans.
Dependency-updater PR bodies now share sync-uv-lock's format: a cooldown cutoff date, a Held back by cooldown section, and a Release notes dropdown between them.
repomatic run now applies the minimum-release-age cooldown to the transitive dependencies of its uvx-installed tools; binary and uv run tools stay pinned as before.
The autofix workflow now runs the dependency updaters weekly on a schedule, so quiet repositories still pick up dependency, tool, and action-pin updates.
REPOMATIC_PAT no longer requires the Commit statuses permission; lint-repo now warns when a token still grants it so it can be tightened.
Drop the pydriller dependency: Git history operations now invoke the git CLI directly, shrinking the install and compiled-binary footprint.
repomatic run now animates a spinner while downloading a tool whose server omits a Content-Length, where it previously showed nothing.
The generated Python compatibility matrix in install.md now covers pre-classifier releases, falling back to requires-python, Poetry, or setup.py metadata to infer supported versions.
Fix update-deps-graph rendering only one of several extras or dependency groups that share a directly-declared dependency; each now gets its own subgraph.
Fix broken documentation links: the standalone-binary downloads (versionless 404s), the pipx installation guide, and the GitHub matrix-strategy reference.

`6.31.0` (2026-06-27)

Note

6.31.0 is available on 🐍 PyPI and 🐙 GitHub.

sync-uv-lock PRs now list newer releases held back by the exclude-newer cooldown, with the date each ages out of the window.
sync-uv-lock package tables now annotate each release date with a relative hint (2 days ago, in 3 days).
Autofix PR bodies now document every relevant [tool.repomatic] option in their Configuration section.
The test workflow uploads coverage to Codecov from one runner per OS, not from every matrix cell.
Drop the Codecov Test Analytics (test results) upload and the junit.xml file it generated.
update-checksums --registry now maintains binary tool checksums in a dedicated repomatic/tool_checksums.py module.
Update pyproject-fmt to 2.25.1, which keeps comments inside inline tables when format-pyproject reorders their keys.
Fix the PyPI availability admonition missing from GitHub release notes.
Fix repomatic run biome failing with a SHA-256 mismatch: Biome 2.5.0's binary checksums were stale, breaking JSON, JavaScript, and TypeScript format jobs.
Fix [tool.repomatic] workflow.sync = false being ignored: it now skips workflow sync like the other *.sync toggles.

`6.30.0` (2026-06-24)

Note

6.30.0 is available on 🐍 PyPI and 🐙 GitHub.

Breaking: The test and release workflows now run click-extra test-suite (the test-plan engine renamed in click-extra 8.1), reading the suite from ./tests/cli-test-suite.toml. Requires click-extra >= 8.1.
repomatic lint-repo now fails when a workflow's inline repomatic==X.Y.Z pin lags the version of its uses: ref.
The test workflow skips the Codecov upload on free-threaded Python (3.14t), where codecov-cli cannot build its test-results-parser extension.
In generated dependency graphs, thick arrows now mark only the root package's direct dependencies; a transitive edge that points at a primary dependency stays thin, so optional extras no longer read as a primary dependency chain.
The release workflow now cancels superseded runs on rapid non-release pushes to main, so intermediate commits no longer pile up redundant binary builds; release commits still run to completion.

`6.29.0` (2026-06-22)

Note

6.29.0 is available on 🐍 PyPI and 🐙 GitHub.

Breaking: Remove the repomatic test-plan command and [tool.repomatic] test-plan config. The declarative test-plan engine moved upstream to click-extra; run click-extra test-plan instead, configured via [tool.click-extra.test-plan].
Add repomatic show-test-matrix to render the CI test matrix as a Python-version by OS grid in any --table-format.
Add repomatic init uv to sync the canonical [tool.uv] pins (required-version, exclude-newer) into pyproject.toml; sync-uv-lock applies the same sync, so every machine resolves uv.lock with the same uv.
Require click-extra >= 8; the manpages release job now uses click-extra wrap --man to generate man pages.
The binary download progress bar now respects --no-progress and --accessible, hiding it when progress output is turned off.
Move the Sphinx linkcheck output to docs/_linkcheck/ (mirroring docs/_build/); broken-links --output-json now defaults there and the generated .gitignore excludes it.
repomatic run now warns when --check targets a post-processed formatter (currently mdformat): check mode bypasses the fixup, so its exit status can mislead.
sync-uv-lock now reverts a re-lock that changed no package versions, so uv's machine-dependent re-spelling of equivalent uv.lock environment markers no longer opens empty sync PRs that ping-pong between contributors and CI.
Documentation pages that cover a Python module now end with that module's API reference.
Test the free-threaded 3.14t build as a stable single-runner smoke test instead of across the full cross-platform matrix; 3.15 stays continue-on-error.

`6.28.1` (2026-06-19)

Note

6.28.1 is available on 🐍 PyPI and 🐙 GitHub.

Fix test-matrix.full-include matrices emitting combinations that exclude should have removed; they now follow GitHub's documented include/exclude algorithm.

`6.28.0` (2026-06-19)

Note

6.28.0 is available on 🐍 PyPI and 🐙 GitHub.

repomatic test-plan runs its cases in parallel by default (one fewer than the CPU count); pass --jobs 1 for sequential execution.
Add [tool.repomatic] test-matrix.full-include config: declare full-matrix-only job rows as explicit combinations (each merged onto the shipped-config defaults), a readable alternative to a long test-matrix.exclude list.
Run the pull-request test matrix on ubuntu-24.04-arm for faster Linux CI; the full test matrix still covers x86 Linux.
repomatic metadata no longer prints spurious --overwrite or $GITHUB_OUTPUT warnings when writing to stdout.
Add a test-matrix guide to the docs: choosing matrix targets, a GitHub-runner speed inventory, and a worked example.

`6.27.0` (2026-06-18)

Note

6.27.0 is available on 🐍 PyPI and 🐙 GitHub.

Breaking: Replace fix-vulnerable-deps with audit. repomatic audit reports vulnerable dependencies read-only; repomatic audit --fix performs the previous upgrade behavior.
Stop forcing pyproject-fmt table expansion: project.urls, project.scripts, and similar sections now use its default compact (dotted-key) form.
Recognize each bundled tool's native config files more accurately (biome, gitleaks, ruff, typos, zizmor, and others) and their config-file CLI flags.
Preserve comments when materializing a [tool.X] section from pyproject.toml to a tool's native TOML config file (like .gitleaks.toml), instead of dropping them.
Update pyproject-fmt to 2.25.0, fixing the format-pyproject job writing invalid TOML when it reformats [tool.repomatic.labels] rule tables.
Align the bundled [tool.bumpversion] and [tool.lychee] templates with pyproject-fmt's canonical output, ending the reformatting pull-request loops they triggered.
Fix cooldown bypasses ([tool.uv] exclude-newer-package) never expiring: sync-uv-lock now freezes each one at its locked version instead of a latest-tracking "0 day" span, and prunes it once that version ages past exclude-newer.
Fix uv.lock ping-ponging on every sync-uv-lock run: exclude-newer-package freezes are now explicit UTC timestamps, not bare dates that uv re-expands in the locking machine's timezone.
Fix the repomatic.myst_docstrings Sphinx extension corrupting two adjacent inline-code spans in a docstring when the second span starts with an underscore.
Fix the manpages release job: attach the man-page tarball to the release draft before publishing, so it no longer fails under GitHub immutable releases.

`6.26.0` (2026-06-17)

Note

6.26.0 is available on 🐍 PyPI and 🐙 GitHub.

Add [tool.repomatic] nuitka.extras config to sync listed [project.optional-dependencies] extras into the venv before the Nuitka build, so optional features land in the binary.
Add [tool.repomatic.labels] extra, file-rules, and content-rules config for inline label definitions and labeller rules, replacing the silently-ignored extra-file-rules and extra-content-rules fields.
Stop version-bump PRs from upgrading dependencies: the bump and release jobs now run plain uv lock, leaving dependency refreshes to the sync-uv-lock job.
Add a [tool.repomatic] changelog.bullet-word-threshold config: lint-changelog warns (non-fatally) about unreleased changelog bullets longer than the threshold (40 words by default).

`6.25.1` (2026-06-13)

Note

6.25.1 is available on 🐍 PyPI and 🐙 GitHub.

Fix uvx repomatic@X.Y.Z failing for end users with No solution found by dropping the bump-my-version dependency and reading the current version natively from .bumpversion.toml or [tool.bumpversion].
Remove the uv-overrides.txt file and all UV_OVERRIDE workflow env blocks.
Render the Mermaid dependency graph in docs/install.md under a new Default dependencies section.

`6.25.0` (2026-06-13)

Note

6.25.0 is available on 🐍 PyPI and 🐙 GitHub.

Add man page generation to the release and docs pipelines via a manpages job, activated by [tool.repomatic.manpages] config keys (script, asset-name); requires click-extra>=7.19.
Validate [project.scripts] entries when building the Nuitka matrix, rejecting path-shaped, empty, or malformed script names up front with a clear error.
Replace the tomlkit and tomli dependencies with tomlrt for all TOML reads and comment-preserving writes.
Annotate gh and PAT permission check failures with the current githubstatus.com summary, and surface raw stderr on non-403 failures instead of misreporting missing scopes.
Recognize friendly durations (24 hours, 30 minutes) and ISO 8601 durations (PT24H, P7D) in [tool.uv].exclude-newer when computing the repomatic sync-uv-lock cooldown.
Fix UV_OVERRIDE not reaching Renovate's child processes during update-checksums.
Add [tool.repomatic] abandoned-versions to lint-changelog, reporting listed versions as skipped instead of warning that they are missing from PyPI.
Tighten /repomatic-ship's pre-push gate with ruff format --check and a repomatic --version dependency-resolution smoke run.

`6.24.0` (2026-05-28)

Note

6.24.0 is available on 🐍 PyPI and 🐙 GitHub.

Publish to PyPI right after the wheel builds instead of waiting for the full release engine, by splitting the build into a _release-build.yaml lane that release.yaml's publish-pypi job depends on.

`6.23.0` (2026-05-28)

Note

6.23.0 is available on 🐍 PyPI and 🐙 GitHub.

Split release.yaml into a thin entry workflow and a new reusable _release-engine.yaml engine; the entry keeps publish-pypi so PyPI Trusted Publisher OIDC resolves to each repo's own release.yaml.
Remove the release-publish-pypi-job.yaml data fragment; release.yaml is now the single source for the publish-pypi job.
Require uv >= 0.11.15 for the vulnerability scan and parse uv audit --output-format json directly, raising a clear error on unsupported uv versions and deduplicating advisories across sources by alias.
Refine /repomatic-ship to re-consolidate the changelog after the babysit phase and re-dispatch changelog.yaml after a code-only fix push so the release PR stays current.
Extend /babysit-ci to also monitor autofix.yaml, diagnosing and fixing crashed mechanical-fix jobs instead of leaving them red on main.
Fix release.yaml's compile-binaries and test-binaries jobs aborting every non-release run with Unexpected value '' on projects with nuitka.enabled = false.

`6.22.0` (2026-05-25)

Note

6.22.0 is available on 🐍 PyPI and 🐙 GitHub.

repomatic init now prunes downstream orphans of renamed or removed skills, agents, and workflows; locally modified copies are reported for manual review, never deleted. Pass --keep-removed to report without deleting, or --delete-removed-modified to also delete modified ones.
/repomatic-ship now closes with a reflect step that reviews the session for friction and proposes fixes to the upstream repomatic source.
Fix the downstream caller's publish-pypi job aborting every non-release release.yaml run with Unexpected value '' when its strategy.matrix is empty.
Fix /repomatic-ship and /babysit-ci dropping the Co-Authored-By: Claude trailer on their autonomous commits; both skills now require it self-containedly.
/babysit-ci now treats a workflow run that fails with no individual job failure as a real workflow-level error to investigate.
Fix the documentation site's live CLI-help and example blocks rendering empty since click-extra 7.15.0 made execution directives opt-in.
Seed each tool section in the tool-runner docs with a runnable repomatic run example and a minimal [tool.X] snippet.

`6.21.0` (2026-05-25)

Note

6.21.0 is available on 🐍 PyPI and 🐙 GitHub.

Replace the repomatic-release skill with repomatic-ship, a release orchestrator that reconciles changelog, code, and docs, then commits, pushes, and babysits CI until the release PR is ready. Review-gated by default, fully autonomous under --dangerously-skip-permissions.
Add a modernize mode to the repomatic-deps skill that reads upgraded dependencies' changelogs and refactors code to adopt their new features, gating each change on the test suite.
Extend the babysit-ci skill to also monitor and triage the Nuitka compile-binaries job in release.yaml.
Decouple the downstream caller's publish-pypi job from the run's overall result: it now runs under always() and gates on a new package_built output, so a cleanly built wheel publishes even when an unrelated job fails.
Remove the repomatic-sync, repomatic-lint, and repomatic-test skills, which only wrapped CLI commands CI already runs on every push.
Fix the bump-version job in changelog.yaml leaving an orphan version-bump PR open after a competing bump merged into main.
Enable myst-parser's alert extension so GitHub-style alerts (> [!NOTE], > [!IMPORTANT]) render as admonitions on the documentation site.
Give each tool section in the tool-runner docs a hand-maintained extra-docs region preserved across regenerations, seeded for Nuitka, and add Nuitka to the page's [tool.X]-support table.

`6.20.0` (2026-05-24)

Note

6.20.0 is available on 🐍 PyPI and 🐙 GitHub.

Breaking: remove [tool.repomatic] nuitka.extra-args. Configure Nuitka flags through [tool.nuitka] in pyproject.toml instead (--include-data-files=SRC=DEST becomes include-data-files = ["SRC=DEST"]).
repomatic run nuitka now installs the pinned Nuitka, reads [tool.nuitka] from pyproject.toml, and passes the section as CLI flags; Nuitka appears in repomatic run --list.
Build Nuitka binaries on Python 3.14.
Switch [tool.typos] sync to ONGOING: canonical proper-noun identifiers merge into a pre-existing [tool.typos] section instead of skipping it, preserving local keys and entries.
Add [[tool.bumpversion.files]] rules to the bundled template so downstream Python repos sync [tool.nuitka]'s numeric version keys without rewriting them on [project] bumps.
Add test-matrix.unstable config: matrix-key dicts (like {click-version = "main"}) that mark matching full-matrix combinations continue-on-error in CI.
Add a lint-repo check warning when a [tool.repomatic.test-matrix] exclude entry references a runner or Python version absent from the live matrix axes.
Add workflow_dispatch triggers to release.yaml and update-checksums.yaml for manual re-runs.

`6.19.0` (2026-05-21)

Note

6.19.0 is available on 🐍 PyPI and 🐙 GitHub.

Add repomatic close-stale-bump-pr --part minor|major to close orphan version-bump PRs left by races between the changelog.yaml schedule and a competing push.
Expand sponsor benefits in the awesome template's contributing.md: sponsors get a dedicated entry in the matching section and a waiver on the licensing-marker requirement.
Switch the Sync uv.lock steps in changelog.yaml from uv sync to uv lock --upgrade, folding pending transitive refreshes into the bump commit.
Make lint-changelog --fix refuse to rewrite admonitions when an upstream GitHub or PyPI lookup looks unhealthy, instead of applying a corrupted view.
Skip CI for automated version-bump operations across tests.yaml, lint.yaml, labels.yaml, and release.yaml via a unified metadata gate.
Reduce CI scheduling with paths-ignore/paths: filters and per-job gates that skip lint jobs when no relevant files changed.
Bump Biome from 2.4.14 to 2.4.15.

`6.18.4` (2026-05-14)

Note

6.18.4 is available on 🐍 PyPI and 🐙 GitHub.

Replace RepoScope.NON_AWESOME with PYTHON_ONLY, gating Python-flavored components on a PEP 621 [project].name so dotfiles repos carrying pyproject.toml only for [tool.*] config skip them by default.
The bundled release-publish-pypi-job.yaml fragment now participates in the @main to @vX.Y.Z rewrite, so wheels built from a freeze commit ship with the pinned action ref.
Bump Biome from 2.4.13 to 2.4.14 and Lychee from 0.24.1 to 0.24.2.
Fix fix-vulnerable-deps placing exclude-newer-package at the end of [tool.uv], which triggered a spurious format-pyproject PR on the next run.

`6.18.3` (2026-05-11)

Note

6.18.3 is available on 🐍 PyPI and 🐙 GitHub.

Fix autofix.yaml's setup-guide job being skipped on workflow_dispatch re-runs.
Fix release.yaml's publish-pypi job running against downstream callers and failing PyPI trusted publishing with a job_workflow_ref mismatch.
Switch the compile-binaries job from --onefile to --mode=onefile, the documented spelling since Nuitka 4.0.

`6.18.2` (2026-05-08)

Note

6.18.2 is available on 🐍 PyPI and 🐙 GitHub.

Fix release.yaml uploading distributions to PyPI without PEP 740 attestations; the build job now signs each dist file and ships the .publish.attestation sidecars alongside it.

`6.18.1` (2026-05-08)

Note

6.18.1 is available on 🐍 PyPI and 🐙 GitHub.

Fix the publish-pypi composite action verifying build attestations on every workspace file instead of just the downloaded distribution artifacts.

`6.18.0` (2026-05-07)

Note

6.18.0 is available on 🐙 GitHub.

Warning

6.18.0 is not available on 🐍 PyPI.

Breaking: drop PYPI_TOKEN from the release.yaml workflow_call.secrets: interface. Regenerate the thin-caller workflow with repomatic init workflows and register a PyPI Trusted Publisher for your own release.yaml.
Add the publish-pypi composite action that publishes via OIDC Trusted Publishing with build-attestation verification; each downstream thin-caller now runs a generated publish-pypi job.
Add a check_pypi_trusted_publisher probe to lint-repo and a setup-guide-pypi-trusted-publisher step that points to a pre-filled PyPI publisher settings URL and stays open until the first OIDC-attested upload.
Add release_commits_matrix and package_name outputs to the reusable release.yaml so callers can drive their own matrix and gate jobs on a release commit.
New composite actions under .github/actions/ now participate in @main ↔ @vX.Y.Z ref freeze/unfreeze without code changes.
Fix sync-repomatic proposing to delete .github/actions/publish-pypi/action.yaml when it matched the bundled default; the file must stay on disk for GitHub Actions to resolve the uses: path.

`6.17.0` (2026-05-04)

Note

6.17.0 is available on 🐍 PyPI and 🐙 GitHub.

Add --template-file <path> and --template-arg KEY=VALUE flags to repomatic pr-body so downstream repos can render project-specific PR templates without forking. --template and --template-file are mutually exclusive.
Fix backslash-escaped brackets rendering literally in docs/configuration.md **Type:** lines (like list\[dict[str, str]\]).
Fix doubled heading anchors on docs/configuration.html and docs/workflows.html (like #dev-release-sync-dev-release-sync).
Collapse the most recent Python compatibility matrix row in docs/install.md to a major-version wildcard (like 6.x) so the table stays stable across minor releases.

`6.16.0` (2026-04-29)

Note

6.16.0 is available on 🐍 PyPI and 🐙 GitHub.

Add the sphinx-docs agent to the agents component, deployed by repomatic init agents or via [tool.repomatic] include = ["agents"].
Add three [tool.repomatic.workflow] knobs for customizing paths: filters in generated thin callers: extra-paths appends repo-specific entries, ignore-paths strips canonical entries absent downstream, and paths replaces a filter wholesale per workflow.
Add a Python compatibility matrix to docs/install.md, auto-generated from the Programming Language :: Python classifiers declared at every release tag.
Render each command's --help live in docs/cli.md via {click:run} directives instead of captured plain-text help blocks.
Replace the Type column in the docs/configuration.md summary table with a one-line description derived from each option's docstring, and lead each per-option section with that one-liner.
Detect vulnerable dependencies from the GitHub Advisory Database alongside the PyPA database: fix-vulnerable-deps now unions uv audit with Dependabot alerts and credits each entry's source. Configurable via [tool.repomatic] vulnerable-deps.sources.
Fix generated thin-caller fidelity: triggers mirror the canonical workflow verbatim instead of always injecting workflow_dispatch, universal path entries are preserved, and repomatic workflow lint now flags extra triggers absent upstream.
Fix sync-uv-lock and fix-vulnerable-deps PR bodies showing 1-01-01 as the exclude-newer cutoff when pyproject.toml configures a relative span like "1 week".
Fix broken documentation links in all 18 PR body templates, now pointing at the published configuration.html and workflows.html anchors with each option name linked to its own anchor.
Fix release.yaml discarding healthy binaries when one matrix cell crashed: the compile-binaries matrix sets fail-fast: false and publish-release uploads whatever built.
Fix update-docs ↔ format-markdown ping-pong on docs/cli.md and docs/configuration.md.
Bump pinned uv to 0.11.8 and mdformat-pelican to 1.0.0, fixing non-ASCII anchor links being percent-encoded on every format-markdown run.

`6.15.0` (2026-04-27)

Note

6.15.0 is available on 🐍 PyPI and 🐙 GitHub.

Decode percent-encoded non-ASCII characters in Markdown link destinations back to their original form, so non-ASCII anchors no longer get rewritten to %XX on every format-markdown run.
Add 💸/🆓 licensing markers to the awesome-list contributing guide, issue template, and PR template (English and Chinese mirrors): 💸 for a paid version atop an OSS core, 🆓 for fully open-source.
Add the agents component to repomatic init for deploying Claude Code agents (grunt-qa, qa-engineer) downstream. Excluded by default; opt in via [tool.repomatic] include = ["agents"]. Destination set by [tool.repomatic] agents.location.
Add docs/benchmark.md comparing repomatic against ten alternatives across template sync, repo governance, release automation, and changelog lifecycle.
Switch MyST admonitions to backtick fences (```{note}) instead of colon fences project-wide so mdformat preserves them; the convert-to-myst command now emits backtick fences.
Expand the myst_docstrings Sphinx extension: convert plain triple-backtick code fences and footnotes to reST, and run MyST-to-reST conversion before sphinx_autodoc_typehints.
Upgrade lychee to 0.24.1, which reads its [tool.lychee] config directly from pyproject.toml so repomatic drops the TOML translation bridge.
Fix repomatic init reporting unchanged files as updated; re-running against an unchanged tree is now a true no-op.
Fix update-docs ↔ format-markdown ping-pong on docs/tool-runner.md.

`6.14.0` (2026-04-20)

Note

6.14.0 is available on 🐍 PyPI and 🐙 GitHub.

Add a Sphinx documentation site (Furo theme, MyST-Parser) splitting the monolithic readme.md into focused pages: installation, configuration, CLI parameters, reusable workflows, security, skills, and a tool runner tutorial. Deployed via docs.yaml.
Add the repomatic.myst_docstrings Sphinx extension and repomatic.myst_converter utility, converting MyST markdown in docstrings to reST at build time so sphinx.ext.autodoc works unmodified. convert-to-myst rewrites source files in place.
Add a --sort-by option to the show-config, metadata --list-keys, run --list, and cache show commands; each defaults to a natural sort column and accepts any column name.
Add an incremental mode to the brand-assets skill: when base SVGs already exist, skip the design menu and fill gaps directly.
Add a check_stale_gh_pages_branch lint check and setup-guide instructions for deleting leftover gh-pages branches after switching to GitHub Actions deployment.
Fix Matrix.prune() keeping exclude directives that reference keys absent from the matrix axes, which GitHub Actions rejects.
Fix the setup-guide Pages step for Sphinx projects: reopen the issue when Pages is unconfigured, and offer both first-time-enable and update commands.
Fix the sponsor-label job in labels.yaml missing an actions/checkout step, which caused it to fail.

`6.13.0` (2026-04-15)

Note

6.13.0 is available on 🐍 PyPI and 🐙 GitHub.

Add nuitka.entry-points config option to select which [project.scripts] entries produce Nuitka binaries; aliases pointing to the same callable are deduplicated by default.
Add two-phase VirusTotal scanning: an initial table with scan links, then a --poll pass that fills in a Detections column of flagged / total engine counts.
Add av-false-positive skill to scan release binaries on VirusTotal and generate per-vendor false-positive submission files for flagged artifacts.
Add update-checksums.yaml workflow that recomputes SHA-256 checksums for binary tools bumped by Renovate and commits the fix to the PR branch.
Include release notes for every intermediate version in sync-uv-lock PR bodies, not just the target version.
Config include entries now bypass RepoScope filtering, matching explicit CLI component naming; qualified entries like skills/awesome-triage implicitly select their parent component.
Add baseline criteria for GitHub repositories in awesome list contributing guidelines: minimum 50 stars, not archived, and updated within 3 years.
Add --min-savings-bytes option to format-images (default 1024) to skip images whose absolute byte savings are negligible.
Add cross-platform binary support (macOS arm64/x64, Linux arm64/x64, Windows x64) for actionlint, biome, gitleaks, labelmaker, lychee, shfmt, and typos, plus ZIP archive extraction.
Show a progress bar during binary tool downloads when the server reports Content-Length; interactive terminals only, silent in CI.
Verify cached binaries with a two-layer integrity model: the registry checksum at download time and a .sha256 sidecar on every cache hit.
Enable [tool.actionlint] config support, translating it to .github/actionlint.yaml at invocation time.
Cache downloaded tool binaries across CI runs with actions/cache, keyed per tool, OS, and architecture.
Replace peaceiris/actions-gh-pages with GitHub's native actions/upload-pages-artifact and actions/deploy-pages for documentation deployment, plus a lint-repo check that the Pages source is set to GitHub Actions.
Add benchmark-update skill to create and maintain competitive benchmark pages (docs/benchmark.md) with audit, init, add, and refresh-badges modes.
Add upstream-audit skill to create and maintain upstream contribution tracking pages (docs/upstream.md) with audit, init, refresh, and sync-git modes.
Upgrade the macOS Intel runner from macos-15-intel to macos-26-intel across binary builds, the test matrix, and Nuitka compilation.
Run the lint-repo workflow job on all repositories, not just Python projects, so generic checks apply to awesome lists too.
Centralize GitHub token resolution with priority REPOMATIC_PAT > GH_TOKEN > GITHUB_TOKEN and automatic fallback to GITHUB_TOKEN on an expired PAT; --has-pat on setup-guide and lint-repo now auto-detects from REPOMATIC_PAT.
Fix exclude-newer-package pruning in pyproject.toml to remove orphaned comments and emit pyproject-fmt-compatible inline tables.
Give a clear error when exiftool is not installed instead of a bare FileNotFoundError, and verify it is on PATH after the Windows install step.
Create parent directories for --output file paths in repomatic run, fixing lychee write errors when the output directory is missing.
Sanitize @mentions, #issue references, and github.com URLs in Lychee and Sphinx linkcheck output before embedding them in the broken-links issue.

`6.12.0` (2026-04-13)

Note

6.12.0 is available on 🐍 PyPI and 🐙 GitHub.

Breaking: rename the shell_files metadata key to shfmt_files, and exclude Zsh files and .sh files with a Zsh shebang from shfmt processing.
Add repomatic cache subcommands (show, clean, path) and a global binary cache for downloaded tools; cached binaries are re-verified against their checksum and auto-purged after 30 days (configurable via REPOMATIC_CACHE_MAX_AGE). Add --no-cache to repomatic run to bypass it.
Add an HTTP response cache for PyPI metadata and GitHub release bodies to avoid redundant API calls, plus --namespace on repomatic cache clean for targeted cleanup.
Route generated tool configs through the cache directory and pass them explicitly via --config, instead of writing to /tmp or the repository root.
Add --version, --checksum, and --skip-checksum options to repomatic run to override the pinned tool version and SHA-256 verification at invocation time.
Add structured logging to repomatic run: --verbosity INFO reports config precedence, the full command, and exit code; DEBUG adds parsed config details.
Add skills.location config option to override the Claude Code skills directory (default ./.claude/skills/).
Add changelog.location config option to override the changelog file path (default ./changelog.md), honored by all CLI commands.
Add .claude/package-skills.sh to package each Claude Code skill as a ZIP for manual upload to Claude Desktop.
Sanitize @mentions, #issue references, and github.com URLs in upstream release notes embedded in sync-uv-lock PR bodies to prevent auto-linking and backlink cross-references.
Use the REPOMATIC_PAT token in all peter-evans/create-pull-request steps so created PRs trigger other workflows.
Make the uv sync step in lint-types conditional on is_python_project, so repos with Python files but no lockfile can still be type-checked.
Fix format-json failing with a --config-path error when a [tool.biome] section exists.
Improve the file-bug-report skill to check organization-level community health files before per-repo files.

`6.11.3` (2026-04-09)

Note

6.11.3 is available on 🐍 PyPI and 🐙 GitHub.

Add a lint-repo check warning when the GitHub Actions fork PR approval policy is weaker than first_time_contributors, with a setup guide step to fix it.
Add a readme.md supply chain security section mapping Astral's security practices to concrete repomatic implementations.
Fix rst_to_myst conversion leaving RST backslash escapes in headings and not wrapping dotted module names in backticks.
Fix the format-pyproject autofix job failing with exit code 123.
Disable the uv cache in the publish-pypi release job, which has no checkout and emitted spurious cache-miss warnings.

`6.11.2` (2026-04-08)

Note

6.11.2 is available on 🐍 PyPI and 🐙 GitHub.

Add the shfmt shell formatter to the tool runner (repomatic run shfmt).
Add a format-shell autofix job to auto-format shell scripts with shfmt.
Replace the crazy-max/ghaction-virustotal action with a native repomatic scan-virustotal command, fixing the silently skipped release-body update.
Deduplicate release attestations: Python packages are now attested once in build-package instead of three times, and .gitignore is no longer accidentally attested.

`6.11.1` (2026-04-08)

Note

6.11.1 is available on 🐍 PyPI and 🐙 GitHub.

Parallelize the release workflow: compile-binaries starts right after metadata, and publish-pypi runs concurrently with create-tag and create-release, with binary and attestation uploads deferred to publish-release.
Fall back to the PyPI project_urls changelog link when a package has no GitHub Release, so release notes render a [Changelog] link instead of omitting the package.
Fix the release workflow uploading the attestation bundle before the GitHub release draft existed.
Skip exclude-newer-package exemptions for packages whose fixed version already falls within the exclude-newer cooldown window.
Fix --delete-excluded not detecting scope-excluded component files that still exist on disk.
Fix awesome-template sync overwriting pyproject.toml instead of merging, which stripped user-managed [tool.*] sections.
Fix repomatic init <component> silently ignoring an explicitly requested component when its scope did not match the repo.
Fix --delete-excluded removing opt-in workflow files in the source repo by skipping config-key exclusions there.
Fix the format-pyproject autofix step running with no input files and masking tool errors.

`6.11.0` (2026-04-07)

Note

6.11.0 is available on 🐍 PyPI.

Warning

6.11.0 is not available on 🐙 GitHub.

Preserve extra downstream jobs when syncing thin-caller workflows; the managed job is regenerated in place while project-specific jobs, comments, and blank lines are kept.
Add a VirusTotal scanning job to the release workflow that uploads compiled binaries to seed AV databases. Requires the optional VIRUSTOTAL_API_KEY repository secret.
Verify each attestation in CI right after actions/attest with gh attestation verify.
Upload Sigstore attestation bundles (.jsonl) as GitHub release assets for compiled binaries and Python packages, enabling offline verification.
Add a lint-repo warning when VIRUSTOTAL_API_KEY is missing and Nuitka binary compilation is active.
Add a VirusTotal API key setup step to the setup guide issue, shown only when Nuitka compilation is active.
Remove the one-time bumpversion dev-versioning migration code now that all downstream repos use PEP 440 dev versioning.

`6.10.0` (2026-04-03)

Note

6.10.0 is available on 🐍 PyPI and 🐙 GitHub.

Breaking: Remove the -o short option from pr-body and format-images; use --output.
Add brand-assets skill to create and export project logo/banner SVG assets to light/dark PNG variants.
Add babysit-ci skill to monitor CI test workflows, diagnose failures, fix code, and loop until stable jobs pass.
Add file-bug-report skill to write upstream bug reports from contribution guidelines, issue templates, and community norms.
Add test-matrix.replace and test-matrix.remove config to swap or drop axis values in the test matrices.
Add sync_mode=ONGOING for tool configs to repeatedly sync while preserving local additions, starting with sync-bumpversion keeping local [[tool.bumpversion.files]] entries.
Add --output-format [markdown|github-actions] to sync-uv-lock, fix-vulnerable-deps, pr-body, and format-images, replacing implicit $GITHUB_OUTPUT detection.
Add .claude/scheduled_tasks.lock to the default .gitignore extra content.
Add a collapsible workflow metadata table (trigger, actor, commit, job, workflow, run link) to issue lifecycle comments.
Make the setup-guide issue body a set of collapsible per-step sections with status indicators, and close it only once PAT, permissions, vulnerability alerts, and branch protection are all verified.
Add --release-notes/--no-release-notes and --table/--no-table flags to sync-uv-lock, defaulting to a terminal table and reserving markdown for --output.
Prune stale exclude-newer-package entries from pyproject.toml before relocking in sync-uv-lock.
Make the renovate component opt-in, and exclude renovate and codecov from awesome-list repositories.
Remove Python 3.15t (free-threaded) from the default test matrix.
Warn instead of crashing on unknown [tool.repomatic] configuration keys.
Echo metadata output to stderr when --output targets a file, so computed matrices stay visible in CI logs.
Add the repomatic update-docs command to run sphinx-apidoc, RST-to-MyST conversion, and docs/docs_update.py in one step.
Add docs.apidoc-extra-args, docs.apidoc-exclude, and docs.update-script configuration options.
Move the sync-uv-lock job from renovate.yaml to autofix.yaml so it runs on every push to main.
Fix a CLI crash when test-matrix.variations or test-matrix.replace contain nested keys.

`6.9.0` (2026-03-31)

Note

6.9.0 is available on 🐍 PyPI and 🐙 GitHub.

Breaking: Rename the config subcommand to show-config (it now resolves typed [tool.repomatic] config via click-extra).
Breaking: Remove the prebake-version and prebake-tag-sha commands; use click-extra prebake instead.
Add per-project test matrix configuration via [tool.repomatic.test-matrix], supporting exclude, include, and variations.
Replace the audit-deps lint job with a fix-vulnerable-deps autofix job that opens PRs upgrading vulnerable packages.
Add a codecov bundled component that syncs .github/codecov.yaml to suppress noisy PR comments.
Support tool-runner config for tools that discover config from the working directory rather than a --config flag.
Move the mdformat number default to a bundled mdformat.toml so downstream repos can override it.
Expand PAT validation in lint-repo and check-renovate with repository scope, tag ruleset, and permission checks.
Auto-exclude changelog.md for awesome-list repositories.
Migrate from actions/attest-build-provenance to actions/attest.
Run granular PAT permission checks in setup-guide, keeping the issue open with a diagnostic table when permissions are incomplete.
Fix the setup-guide job so PAT detection works everywhere.
Fix an infinite cycle between the migrate-to-renovate and sync-repomatic jobs.
Include git stderr in git-tag CLI error messages.

`6.8.0` (2026-03-27)

Note

6.8.0 is available on 🐍 PyPI and 🐙 GitHub.

Breaking: Rename repomatic init --delete-redundant to --delete-unmodified, which now also removes config files identical to bundled defaults.
Breaking: Remove the deprecated WORKFLOW_UPDATE_GITHUB_PAT secret and its fallbacks; downstream repos must use REPOMATIC_PAT.
Breaking: Stop persisting [tool.ruff] defaults into downstream pyproject.toml; bundled ruff config is now injected at runtime when none exists.
Breaking: Remove the sync-renovate command, autofix job, renovate.sync config toggle, and PR body template; sync-repomatic and runtime materialization replace them.
Breaking: Merge /repomatic-deps-review into /repomatic-deps, which now supports graph and review modes.
Move the test matrix definition into repomatic metadata so it is available in job-level if: conditions.
Reduce CI jobs on pull requests by skipping release builds, experimental Python versions, and redundant verification tests; the full matrix still runs on push to main.
Make exclude config additive to the default exclusions (labels, skills), and add an include config to force-include default-excluded components.
Auto-exclude the awesome-triage skill for non-awesome repositories.
Add --delete-excluded to repomatic init to remove excluded files that still exist on disk.
Replace the sync-workflows and clean-unmodified-configs autofix jobs with a single sync-repomatic job that syncs and prunes managed files in one PR.
Add PAT capability and repo configuration checks to lint-repo (Renovate config, Dependabot security updates off, vulnerability alerts on, PAT permissions).
Add stale draft release detection to lint-repo, warning about draft releases whose tag does not end with .dev0.
Relax the abandoned-dependency threshold from 1 year to 2 years in the Renovate config.
Fix thin-caller generation rendering workflow_dispatch inputs as Python dicts instead of YAML.
Add the /sphinx-docs-sync skill for cross-project Sphinx documentation comparison and synchronization.
Add the /translation-sync skill to detect and draft fixes for stale readme.*.md and contributing.*.md translations; auto-excluded for non-awesome repos.
Streamline Dependabot guidance in the setup-guide issue.
Allow repomatic init to accept qualified component/file selectors (like repomatic init skills/repomatic-topics).
Only auto-include the awesome-template component for awesome-* repos when no explicit components are given.
Add a package version diff table to sync-uv-lock PRs, listing updated, added, and removed packages with PyPI links and collapsible release notes.
Document file naming conventions in claude.md: prefer .yaml over .yml and lowercase filenames, with a table of GitHub exceptions.
Fix awesome-template URL rewriting to also process .yml files in .github/.
Auto-exclude the changelog.yaml, debug.yaml, and release.yaml workflows for awesome-* repositories.
Materialize the bundled renovate.json5 at runtime when absent, so downstream repos can safely delete their own copy.
Pin GitHub Actions to SHA digests via Renovate's helpers:pinGitHubActionDigestsToSemver preset.
Add top-level permissions: {} to all workflow files, requiring each job to declare its own minimal permissions.
Fix sync-repomatic deleting the upstream repo's own skills.
Generalize the opt_in_key config option into config_key/config_default.

`6.7.0` (2026-03-24)

Note

6.7.0 is available on 🐍 PyPI and 🐙 GitHub.

Breaking: Remove the sync-skills, workflow create, and workflow sync commands; repomatic init handles all three.
Bundle awesome-template boilerplate files in repomatic instead of cloning kdeldycke/awesome-template at runtime.
Format every pyproject.toml in the repo in the format-pyproject job, not just the root file.
Add a branch protection checklist to the setup-guide issue, linking to a pre-filled ruleset creation form.
Add an opt-in unsubscribe.yaml reusable workflow for scheduled cleanup of closed notification threads, enabled via notification.unsubscribe = true and requiring REPOMATIC_NOTIFICATIONS_PAT.
Surface actual gh CLI error messages in unsubscribe-threads warnings.
Enable delete-branch: true on all peter-evans/create-pull-request invocations so stale automation PRs auto-close.
Add gitleaks to the tool runner with binary download and [tool.gitleaks] config bridge, and migrate lint-secrets to repomatic run gitleaks.
Move lychee config from lychee.toml to [tool.lychee] in pyproject.toml.
Fix the format-images job by installing oxipng from its GitHub release .deb so it runs on ubuntu-slim.

`6.6.0` (2026-03-23)

Note

6.6.0 is available on 🐍 PyPI and 🐙 GitHub.

Breaking: downstream repos with yamllint or zizmor in their [tool.repomatic] exclude list must remove those entries.
Remove yamllint and zizmor init components; the tool runner falls back to bundled default configs at runtime. Default exclude is now ["labels", "skills"].
Add repomatic clean-redundant-configs command and autofix job that removes native config files identical to bundled defaults; repomatic init warns about redundant configs on disk.
Rename the WORKFLOW_UPDATE_GITHUB_PAT secret to REPOMATIC_PAT; workflows accept both names. Old-name repos get a migration issue that auto-closes once REPOMATIC_PAT is detected.
Add a setup-guide toggle to [tool.repomatic] to suppress the setup guide issue.
Pre-fill the fine-grained PAT creation form via URL and provide gh CLI commands for adding the secret, configuring Dependabot, and triggering a verify run.
Add a lint-repo check that warns when the owner has GitHub Sponsors enabled but .github/FUNDING.yml is missing.

`6.5.0` (2026-03-23)

Note

6.5.0 is available on 🐍 PyPI and 🐙 GitHub.

Breaking: the old init.exclude and workflow.sync-exclude keys are no longer recognized and raise a hard error.
Breaking: remove legacy [tool.gha-utils] and [tool.repokit] config migration; rename old sections to [tool.repomatic] manually.
Replace init.exclude and workflow.sync-exclude with a unified exclude key: bare names exclude whole components, component/identifier entries exclude specific files.
Add repomatic run <tool> for unified tool invocation with managed config resolution (native file, [tool.X], bundled default, bare); use --list to see managed tools and their active config source.
Register actionlint, autopep8, biome, bump-my-version, labelmaker, lychee, mdformat, mypy, pyproject-fmt, ruff, typos, yamllint, and zizmor with repomatic run, and migrate all workflow tool invocations to it.
Add a yamllint init component, excluded from init by default like zizmor.
Add repomatic update-checksums --registry to refresh SHA-256 hashes for binary tools.
Add [tool.lychee] and [tool.biome] config translation, so downstream repos can configure lychee and biome from pyproject.toml without separate config files.

`6.4.1` (2026-03-11)

Note

6.4.1 is available on 🐍 PyPI and 🐙 GitHub.

Add a github-json output dialect to repomatic metadata that bundles all keys into a single metadata output, accessed via fromJSON(needs.metadata.outputs.metadata).key_name.
Add key filtering to repomatic metadata: pass key names as arguments to output only those values.
Add a --list-keys flag to repomatic metadata to list all available keys with descriptions.
Rename the project-metadata job and step IDs to metadata across all workflows.
Rename the linters init component to zizmor; default init.exclude is now ["labels", "skills", "zizmor"].
Remove the sync-zizmor job, CLI command, and zizmor.sync toggle; zizmor.yaml is now user-owned and created by repomatic init zizmor if missing.
Rename the bump-versions job to bump-version in changelog.yaml.
Upgrade zizmor to 1.23.0 and re-enable the template-injection audit.
Fix repomatic metadata list values breaking GitHub Actions ${{ }} interpolation: lists are now pre-formatted (file lists as quoted strings, plain lists space-separated, dict lists as JSON).
Fix repomatic workflow sync --format header-only erroring when a target workflow file is absent downstream; missing default files are skipped and named missing files warn instead.
Enable parallel test execution by default via --numprocesses=auto.

`6.4.0` (2026-03-10)

Note

6.4.0 is available on 🐍 PyPI and 🐙 GitHub.

Rename optimize-images to format-images, aligning it with the format-* naming convention, and add a matching PR body template.
Allow --prefix and --template to be combined in repomatic pr-body; the prefix is prepended before the rendered template.
Add awesome-template-sync, bumpversion-sync, dev-release-sync, gitignore-sync, labels-sync, mailmap-sync, uv-lock-sync, and zizmor-sync toggles to [tool.repomatic], so each sync operation can be individually disabled.
Rename sync-linter-configs to sync-zizmor (and linter-sync to zizmor-sync), naming the sync job after the tool it syncs.
Add a repomatic sync-labels command wrapping labelmaker with toggle check, profile detection, and extra label file handling.
Replace AndreasAugustin/actions-template-sync with a native repomatic sync-awesome-template command.
Add repomatic init typos to sync the shared typos spell-checker config into pyproject.toml, with proper-noun corrections and  /  block markers.
Skip Ruff config injection in format-python for non-Python projects, and skip sync-bumpversion for non-Python projects.
Use TOML sub-keys for grouped [tool.repomatic] options (like nuitka.enabled, gitignore.location, test-plan.file); only pypi-package-history stays flat.
Add a workflow-source-paths option to [tool.repomatic]: thin-caller and header-only workflows gain paths: filters for the project's source directory, auto-derived from [project.name].
Add a repomatic config command that renders the [tool.repomatic] reference table.
Add ### Configuration sections to PR body templates listing the relevant [tool.repomatic] options.

`6.3.2` (2026-03-08)

Note

6.3.2 is available on 🐍 PyPI and 🐙 GitHub.

Add --all-extras to the uv sync step in tests.yaml to catch incompatibilities between optional dependency groups.
Add a test-package-install job to tests.yaml that verifies every [project.scripts] entry point installs and runs via uvx, uv run --with, module invocation, uv tool install, and pipx run, from PyPI and GitHub. Add a cli_scripts metadata output.
Sync customManagers to downstream renovate.json5 so Renovate can update inline version pins in workflow files.
Fix thin-caller generation stripping paths and paths-ignore filters, which incorrectly restricted CI triggers downstream.
Fix the optimize-images job failing on ubuntu-slim where oxipng is unavailable.
Add a citation.cff date-released update to the bundled bumpversion.toml template so downstream repos keep their release date in sync on version bumps.

`6.3.1` (2026-03-07)

Note

6.3.1 is available on 🐍 PyPI and 🐙 GitHub.

Sync the repomatic-audit skill to downstream repos.

`6.3.0` (2026-03-06)

Note

6.3.0 is available on 🐍 PyPI and 🐙 GitHub.

repomatic init now always overwrites managed files (workflows, configs, skills) by default; remove the --overwrite flag. changelog.md is never overwritten once it exists.
repomatic init output now distinguishes created, updated, and skipped files, and warns about excluded files still on disk.
Auto-remove legacy .claude/skills/gha-*/ skill directories during repomatic init, completing the gha-utils to repomatic rename.
sync-bumpversion, sync-linter-configs, and sync-skills now report both created and updated files.
sync-bumpversion now replaces the whole [tool.bumpversion] section from the bundled template instead of applying incremental migrations.
Use the short SHA in release workflow job names instead of the full commit hash.

`6.2.1` (2026-03-06)

Note

6.2.1 is available on 🐍 PyPI and 🐙 GitHub.

Fix actions/checkout wiping downloaded Python package artifacts before gh release create could attach them, so release drafts now include the distribution files.
Fix fix-changelog marking releases as not available on GitHub while the release was still a draft.

`6.2.0` (2026-03-05)

Note

6.2.0 is available on 🐍 PyPI and 🐙 GitHub.

Add the repomatic optimize-images CLI command (lossless oxipng for PNG, jpegoptim for JPEG), replacing calibreapp/image-actions.
Add the sync-dev-release CLI command and workflow job to maintain a rolling dev pre-release on GitHub with the latest binaries and Python package.
Add the repomatic-topics skill for optimizing GitHub repository topics for discoverability.
Add a lint-repo check that warns when GitHub topics are not a subset of pyproject.toml keywords.
Add the init-exclude config option to skip components during repomatic init, defaulting to ["labels", "linters", "skills"]; workflow-sync-exclude now also applies to repomatic init.
Add rename-from rules to migrate all 9 default GitHub labels.
Add the package version to compiled binary filenames (repomatic-6.2.0-linux-arm64.bin).
Automatically migrate [tool.gha-utils] and [tool.repokit] config sections to [tool.repomatic] during repomatic init; commands fall back to legacy section names when [tool.repomatic] is absent.
Support GitHub immutable releases by drafting releases then publishing them.
Replace softprops/action-gh-release with gh release create; all release operations now use the gh CLI.
Freeze readme binary download URLs to versioned /releases/download/vX.Y.Z/ paths during releases.
GitHub releases now include PyPI and GitHub availability links at creation time.
Fix Nuitka-compiled binaries silently producing no output when the entry point is a __main__.py inside a package.
Fix update-checksums leaving stale SHA-256 hashes when the hash and sha256sum --check keyword span multiple lines.
Fix Windows ARM64 test runners using x86_64 emulation by forcing native ARM64 Python via UV_PYTHON.
Fix fix-changelog producing a trailing blank line when the last changelog section is modified.

`6.1.0` (2026-02-27)

Note

6.1.0 is available on 🐍 PyPI and 🐙 GitHub.

Add the unsubscribe-threads CLI command to unsubscribe from closed, inactive GitHub notification threads.
Add the prebake-version CLI command to inject the Git commit hash into __version__ before Nuitka compilation, so binaries report the exact commit they were built from (e.g., 6.1.0.dev0+abc1234).
Add the list-skills CLI command to display all available Claude Code skills grouped by lifecycle phase.
Add the sync-github-releases CLI command to sync GitHub release notes from changelog.md.
Add the pypi-package-history config option so lint-changelog fetches releases from former package names and generates correct PyPI URLs for renamed projects.
lint-changelog now detects orphaned versions (git tags, GitHub releases, or PyPI packages with no changelog entry) and inserts placeholder sections in --fix mode.
Rename the lint-changelog workflow job to fix-changelog; the CLI command remains lint-changelog.
Make changelog entries and GitHub release bodies template-driven via release-notes.md and github-releases.md, so editing one template affects only its destination.
Group CLI commands into sections (Project setup, Release & versioning, Sync, Linting & checks, GitHub issues & PRs) in help output.
Add next-step handoff suggestions to all Claude Code skills, and document skills with a grouped table and walkthrough in readme.md.
Generate thin caller workflows with explicit secret forwarding instead of secrets: inherit.
Move zizmor config from .github/zizmor.yml to zizmor.yaml at repo root.

`6.0.1` (2026-02-24)

Note

First release under the repomatic name on PyPI, after repokit was rejected for typo-squatting (see 6.0.0 below). The GitHub repository is kdeldycke/repomatic.

Note

6.0.1 is available on 🐍 PyPI and 🐙 GitHub.

Rename project from repokit to repomatic. Rename GitHub repository from kdeldycke/repokit to kdeldycke/repomatic.

`6.0.0` (2026-02-24)

Caution

This release was deleted from PyPI. It was supposed to be published as repokit, but PyPI flagged the name as typo-squatting the pre-existing repo-kit package.

Note

6.0.0 is available on 🐙 GitHub.

Warning

6.0.0 is not available on 🐍 PyPI.

Rename project from gha-utils to repokit. Rename GitHub repository from kdeldycke/workflows to kdeldycke/repokit.

Earlier releases

Note

Releases 5.14.1 and earlier are recorded in the changelog archive.

Uh oh!

FilesExpand file tree

changelog.md

Latest commit

History

changelog.md

File metadata and controls

Changelog

Earlier releases