v1.2.0

v1.2.0 (2026-10-02)

Ci

• ci(release): tag on every push to main, not just manual dispatch

copier copy/update always resolve to this repo's latest git tag, and
requirements*.txt in generated projects now stay fresh via copier update
(see auto-update-deps.yml) rather than being resolved locally -- so a stale
tag now means stale dependency pins, not just a stale template. Run
python-semantic-release version on every push to main; it's a no-op when
there's nothing releasable since the last tag, so this is safe to run
unconditionally. workflow_dispatch stays available for an on-demand run.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013YrxuwVb1yJKbjnxzMm76D (afe7b01)

• ci(deps): add scheduled dependency-update workflow for this repo

.github/dependabot.yml bumps GitHub Actions pins in this repo's own
.github/workflows/.yml (Dependabot's github-actions ecosystem can't see
template/.github/workflows/.yml). The weekly .github/workflows/deps-update.yml
runs tox -e update_deps for this repo's own requirements-dev.txt and
.pre-commit-config.yaml, then runs scripts/sync_generated_deps.py to refresh
the shipped template/requirements*.txt.jinja and
template/.pre-commit-config.yaml from a freshly resolved throwaway project.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013YrxuwVb1yJKbjnxzMm76D (1ec5a09)

Documentation

• docs: document dependency automation and release-on-push changes

Update CLAUDE.md and README.md for the preceding commits: the
include_dep_automation copier question, this repo's own dependabot.yml/
deps-update.yml, requirements*.txt shipping as resolved template payload,
and release.yml now tagging on every push to main instead of only via
workflow_dispatch.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013YrxuwVb1yJKbjnxzMm76D (dc3bd96)

Feature

• feat(copier): add opt-in dependency automation for generated projects

Add an include_dep_automation copier question (default true) that gates
template/.github/dependabot.yml (GitHub Actions pin bumps) and
template/.github/workflows/auto-update-deps.yml, which now pulls fresh
template payload via copier update --defaults --skip-answered on a weekly
schedule instead of running tox -e update_deps itself -- since
requirements*.txt now ship as template payload (previous commit), the
generated project no longer needs to resolve its own pins locally.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013YrxuwVb1yJKbjnxzMm76D (f13aacf)

• feat(template): ship resolved requirements as template payload

Generated projects previously had to run tox -e update_deps (pip-compile)
before tox -e py/bare tox would even work, since requirements*.txt weren't
shipped. Ship them pre-resolved as real template payload instead, kept fresh
by scripts/sync_generated_deps.py, which generates a throwaway project from
this checkout, resolves its own pins via tox -e update_deps, and copies the
result back into template/requirements*.txt.jinja (swapping the throwaway
project's dummy name back for the {{ project_name }} placeholder so
pip-compile's # via <name> (pyproject.toml) annotation still renders
correctly for whatever name a real project picks).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013YrxuwVb1yJKbjnxzMm76D (412b140)

Test

• test: cover sync_generated_deps._require

Close a 100%-coverage gap left by the previous commit: _require() (resolves
git/tox to full paths, satisfying bandit's B607 partial-path check) had no
direct test.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013YrxuwVb1yJKbjnxzMm76D (4e9ef20)

• test: add drift safety net for shared action/version pins

Dependabot's github-actions ecosystem only scans the literal .github/workflows/
path, so it can't see template/.github/workflows/*.yml, and a few tool versions
are pinned as literal strings in run: steps rather than uses: refs -- both
invisible to any automated updater. Assert that wherever the same action or
tool version is pinned in more than one place (root vs. template workflows),
those places agree, so a bump missed in one spot fails CI instead of silently
drifting.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013YrxuwVb1yJKbjnxzMm76D (41dc8fb)