v1.2.1

v1.2.1 (2026-10-22)

Chore

• chore(deps): bump actions/cache from 4 to 6

Bumps actions/cache from 4 to 6.

• Release notes
• Changelog
• Commits

---

updated-dependencies:

• dependency-name: actions/cache
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  ...

Signed-off-by: dependabot[bot] <support@github.com> (a9917fe)

• chore(deps): bump trufflesecurity/trufflehog from 3.97.4 to 3.97.9

Bumps trufflesecurity/trufflehog from 3.97.4 to 3.97.9.

• Release notes
• Commits

---

updated-dependencies:

• dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.97.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  ...

Signed-off-by: dependabot[bot] <support@github.com> (a4184bb)

• chore(deps): bump actions/setup-python from 5 to 7

Bumps actions/setup-python from 5 to 7.

• Release notes
• Commits

---

updated-dependencies:

• dependency-name: actions/setup-python
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  ...

Signed-off-by: dependabot[bot] <support@github.com> (ba5e316)

• chore(deps): bump peter-evans/create-pull-request from 6 to 8

Bumps peter-evans/create-pull-request from 6 to 8.

• Release notes
• Commits

---

updated-dependencies:

• dependency-name: peter-evans/create-pull-request
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
  ...

Signed-off-by: dependabot[bot] <support@github.com> (b2ea792)

• chore(deps): bump actions/checkout from 4 to 7

Bumps actions/checkout from 4 to 7.

• Release notes
• Changelog
• Commits

---

updated-dependencies:

• dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  ...

Signed-off-by: dependabot[bot] <support@github.com> (ea25bdc)

Fix

• fix(ci): drop nonexistent find-pull-request action and sync template pins

peter-evans/find-pull-request does not exist, which broke the weekly
deps-update workflow and Dependabot's github-actions updater. The
find/close steps were redundant anyway: create-pull-request already
force-updates an open PR on the same branch. Removed from both the root
workflow and the template's auto-update-deps.yml.

Also align template workflow action pins with the root ones Dependabot
bumped (checkout v7, setup-python v7, cache v6, trufflehog v3.97.9,
create-pull-request v8), fixing pin_consistency_test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (86dc875)

v1.2.0

v1.2.0 (2026-10-02)

Ci

• ci(release): tag on every push to main, not just manual dispatch

copier copy/update always resolve to this repo's latest git tag, and
requirements*.txt in generated projects now stay fresh via copier update
(see auto-update-deps.yml) rather than being resolved locally -- so a stale
tag now means stale dependency pins, not just a stale template. Run
python-semantic-release version on every push to main; it's a no-op when
there's nothing releasable since the last tag, so this is safe to run
unconditionally. workflow_dispatch stays available for an on-demand run.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013YrxuwVb1yJKbjnxzMm76D (afe7b01)

• ci(deps): add scheduled dependency-update workflow for this repo

.github/dependabot.yml bumps GitHub Actions pins in this repo's own
.github/workflows/.yml (Dependabot's github-actions ecosystem can't see
template/.github/workflows/.yml). The weekly .github/workflows/deps-update.yml
runs tox -e update_deps for this repo's own requirements-dev.txt and
.pre-commit-config.yaml, then runs scripts/sync_generated_deps.py to refresh
the shipped template/requirements*.txt.jinja and
template/.pre-commit-config.yaml from a freshly resolved throwaway project.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013YrxuwVb1yJKbjnxzMm76D (1ec5a09)

Documentation

• docs: document dependency automation and release-on-push changes

Update CLAUDE.md and README.md for the preceding commits: the
include_dep_automation copier question, this repo's own dependabot.yml/
deps-update.yml, requirements*.txt shipping as resolved template payload,
and release.yml now tagging on every push to main instead of only via
workflow_dispatch.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013YrxuwVb1yJKbjnxzMm76D (dc3bd96)

Feature

• feat(copier): add opt-in dependency automation for generated projects

Add an include_dep_automation copier question (default true) that gates
template/.github/dependabot.yml (GitHub Actions pin bumps) and
template/.github/workflows/auto-update-deps.yml, which now pulls fresh
template payload via copier update --defaults --skip-answered on a weekly
schedule instead of running tox -e update_deps itself -- since
requirements*.txt now ship as template payload (previous commit), the
generated project no longer needs to resolve its own pins locally.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013YrxuwVb1yJKbjnxzMm76D (f13aacf)

• feat(template): ship resolved requirements as template payload

Generated projects previously had to run tox -e update_deps (pip-compile)
before tox -e py/bare tox would even work, since requirements*.txt weren't
shipped. Ship them pre-resolved as real template payload instead, kept fresh
by scripts/sync_generated_deps.py, which generates a throwaway project from
this checkout, resolves its own pins via tox -e update_deps, and copies the
result back into template/requirements*.txt.jinja (swapping the throwaway
project's dummy name back for the {{ project_name }} placeholder so
pip-compile's # via <name> (pyproject.toml) annotation still renders
correctly for whatever name a real project picks).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013YrxuwVb1yJKbjnxzMm76D (412b140)

Test

• test: cover sync_generated_deps._require

Close a 100%-coverage gap left by the previous commit: _require() (resolves
git/tox to full paths, satisfying bandit's B607 partial-path check) had no
direct test.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013YrxuwVb1yJKbjnxzMm76D (4e9ef20)

• test: add drift safety net for shared action/version pins

Dependabot's github-actions ecosystem only scans the literal .github/workflows/
path, so it can't see template/.github/workflows/*.yml, and a few tool versions
are pinned as literal strings in run: steps rather than uses: refs -- both
invisible to any automated updater. Assert that wherever the same action or
tool version is pinned in more than one place (root vs. template workflows),
those places agree, so a bump missed in one spot fails CI instead of silently
drifting.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013YrxuwVb1yJKbjnxzMm76D (41dc8fb)

v1.1.1

v1.1.1 (2026-09-07)

Fix

• fix(template): generate .copier-answers.yml in scaffolded projects

The template never shipped the conventional
{{ _copier_conf.answers_file }}.jinja file, so copier never wrote
.copier-answers.yml into generated projects -- copier doesn't create this
file automatically, the template has to provide it. This silently broke
copier update (and the auto-update-deps.yml workflow, which runs
copier update --defaults --skip-answered on a schedule) for every
generated project, since run_update requires the answers file to recover
the template URL/version it was generated from.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013YrxuwVb1yJKbjnxzMm76D (05798af)

v1.1.0

v1.1.0 (2026-09-07)

Feature

• feat(tox): pass posargs through to pre-commit for pre-push hook stage

Lets tox -e pre-commit -- --hook-stage pre-push run pip-audit/checkov
locally without a separate raw pre-commit run invocation. Plain
{posargs} string interpolation in native-TOML tox config joins multi-word
args into a single broken token, so use the {replace = "posargs", extend = true} list-splice form instead. Applied to both this repo's own tox config
and the generated project's template, and documented in both READMEs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FviW3jft55rDy8Xi5g8vd4 (4701c11)

Fix

• fix(pyproject): migrate license field to PEP 639 SPDX expression

Replace the deprecated license = { file = "LICENSE" } table form with
license = "MIT" + license-files = [ "LICENSE" ] in both this repo's own
pyproject.toml and the generated project's template. Bump the template's
build-system requirement to setuptools>=77, the minimum version that
understands PEP 639 license expressions and license-files.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013YrxuwVb1yJKbjnxzMm76D (534a776)

v1.0.2

v1.0.2 (2026-09-04)

Ci

• ci: make release tagging manual instead of automatic on push

Every push to main immediately tagged a new version, and copier copy
always resolves the latest tag with no review step in between. Switch
the root release.yml to workflow_dispatch-only so tagging is a
deliberate action, and drop CHANGELOG.md since it only duplicated the
GitHub Release notes semantic-release already publishes. Apply the
same manual trigger to the generated project's release.yml, leaving
its changelog/PyPI publish behavior untouched since it's a real
published package.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MkpJdUbmXe6dt5zmrUjNWp (c3b445a)

Documentation

• docs: document git init and update_deps as required first-time setup

A freshly copier copy'd project fails tox/tox -e py two different
ways until these run first: setuptools-scm needs a git repo to compute
the version, and requirements*.txt aren't shipped in the template so
tox -e update_deps must generate them before env_run_base can install.
Verified both failure modes and the fix in an isolated repro.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MkpJdUbmXe6dt5zmrUjNWp (ffa609d)

Fix

• fix(template): drop unnecessary quotes around scripts key in pyproject.toml

project_name is validated as lowercase kebab-case, always a valid bare
TOML key, so the quoted form gets reformatted by pyproject-fmt on every
freshly generated project's first tox run, failing the pre-commit hook
unnecessarily.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MkpJdUbmXe6dt5zmrUjNWp (225bfce)

Test

• test: update pyproject scripts assertion for unquoted key

The previous commit dropped the unnecessary quotes around the scripts
key in the template output, but this test still expected the old
quoted form, breaking CI.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MkpJdUbmXe6dt5zmrUjNWp (b95958b)

v1.0.1

v1.0.1 (2026-09-04)

Fix

• fix(ci): pin trufflehog action to a real release tag

The floating @v3 tag on trufflesecurity/trufflehog no longer exists
upstream (they only publish precise vX.Y.Z tags now), which broke
the security job's "Set up job" step on push. Pin to v3.97.4 in both
this repo's own ci.yml and the copy shipped inside template/ for
generated projects.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MkpJdUbmXe6dt5zmrUjNWp (2b8b67a)

v1.0.0

v1.0.0 (2026-09-04)

Breaking

• feat!: convert repo into a Copier template

Move the CLI scaffold under template/ (Jinja-rendered where it needs
project_name/description/author substitutions, verbatim elsewhere so
GitHub Actions' ${{ }} syntax doesn't collide with Jinja) and add
copier.yml with _subdirectory: template, so copier copy https://github.com/briandcho/minimal-cli my-project scaffolds a new
CLI project.

The repo root is repurposed into meta-tooling that only tests the
template: pyproject.toml/tox no longer describe an installable
package, and tests/minimal_cli_test.py renders the template end-to-end
(via the copier API, substitution assertions, then an install + pytest
run of the generated project in a throwaway venv) instead of testing
minimal_cli.py directly.

Since copier copy resolves the latest git tag by default (not
main's HEAD), add a root release.yml that runs python-semantic-release
on every push to main to keep a current tag available - separate from
template/release.yml, which governs the generated project's own
PyPI release process.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MkpJdUbmXe6dt5zmrUjNWp (411f6c4)

Chore

• chore: pip-tools/pre-commit updates (e22402a)

Fix

• fix: install project package in tox py env for version resolution

Removing the version fallback exposed that skipsdist=true prevented
tox from installing the package into any testenv, so importlib.metadata
lookups failed under tox -e py. Drop skipsdist and use usedevelop=true
for an editable install instead.

Also add CLAUDE.md documenting repo commands and architecture.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BKGq93JoU3W9wk43yc5z6d (cc41647)

Performance

• perf: defer checkov to pre-push to speed up local pre-commit

checkov's IaC scan was adding noticeable time to every tox -e
pre-commit run. Scope it to the pre-push hook stage alongside
pip-audit, and add it as a standalone CI step so coverage isn't lost
for workflows that don't install git hooks locally.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168oeQFkLH18jZzZusZgPFY (c2a8602)

• perf: defer pip-audit to pre-push to speed up local pre-commit

pip-audit's network-bound scan was adding ~8s to every tox -e pre-commit
run. Scope it to the pre-push hook stage instead, and add it as a
standalone CI step so coverage isn't lost for workflows that don't
install git hooks locally.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168oeQFkLH18jZzZusZgPFY (2fb00e5)

Refactor

• refactor: modernize tox config to native pyproject.toml format

tox 4 supports [tool.tox] natively now, so the legacy_tox_ini escape
hatch (an embedded ini string) is no longer needed. Converted to native
tables/dotted-keys; pyproject-fmt normalized usedevelop=true to the
more idiomatic package="editable". Verified tox -av, tox -e py,
tox -e pre-commit, tox c -e update_deps, and a full tox run all behave
identically to the previous ini-based config.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BKGq93JoU3W9wk43yc5z6d (ce71895)

• refactor: drop uninstalled-package version fallback

Require the package to be installed for version resolution instead of
silently falling back to "0+unknown" when running the file directly from
an uninstalled checkout. (7d5cfbb)

v0.1.0

v0.1.0 (2026-01-18)

Feature

• feat: initial commit (a1ef5ff)