v0.1.2

See CHANGELOG.md for what changed.

Built from 61375ed8d0c8a38b4d138faf52f35994ab2ee494 by this run, never from a working tree.
Provenance is attested; verify with:

gh attestation verify <file> --repo ferinazumaDEV/scaffld

SHA-256

8ec55c1f043ffd6dfaf7223010bc28982ba8e8c56c94b2e26171db432fbbab2a  scaffld-0.1.2-py3-none-any.whl
ed04f9cc51f5670ca1ed2965985c79f80a78851f00bca9a754a9a4c678b072fa  scaffld-0.1.2.tar.gz

sbom.cyclonedx.json describes the package and its runtime dependencies as installed from this wheel.

Archived at Software Heritage

Resolved on 2026-09-14 against the archive, after a Save Code Now visit that followed this tag.

• Directory (the tree this release is): swh:1:dir:20e8221d52a2fbd206a731c9bf14e83277a7ca1f
• Revision (the commit 61375ed8d0c8): swh:1:rev:61375ed8d0c8a38b4d138faf52f35994ab2ee494
• Snapshot of the visit: swh:1:snp:27f400035a475cd69c842c8af54458ae112cf8d2
• Resolve: https://archive.softwareheritage.org/swh:1:dir:20e8221d52a2fbd206a731c9bf14e83277a7ca1f;origin=https://github.com/ferinazumaDEV/scaffld;visit=swh:1:snp:27f400035a475cd69c842c8af54458ae112cf8d2;anchor=swh:1:rev:61375ed8d0c8a38b4d138faf52f35994ab2ee494

v0.1.1 — the guards, in the version you install

pip install --upgrade scaffld

Upgrade so that what you install carries the guards. 0.1.0 predates the repository-hygiene incident and its fix: the published package was never affected — the tag came before the mistake, and its artefacts are 31 KB and 32 KB — but it ships with no CI and no protection against a repeat.

Added

• A guard against committing a virtualenv. A .v/ directory reached main on 6 Sep: 1,380 files and 467,125 lines, 95% of everything the repository tracked. .gitignore listed .venv/, venv/ and env/ — not that spelling.

  .gitignore could not have stopped it and cannot stop the next one: it does nothing for a path already tracked, and nothing against git add -f. So the guard asks git what it is actually tracking and fails on the markers of an environment — pyvenv.cfg, site-packages/, dist-packages/, and bin|lib|Scripts under a venv-shaped directory — whatever it was named.

  Verified against the failure it exists for before being trusted: it passes on the clean tree and finds 1,379 paths in the broken one. It is now a required check.

• CI across Python 3.9–3.12, plus a job that generates a project from each of the three templates, installs it, runs its tests and builds a wheel. A scaffolder whose output does not build is broken however green its own unit tests are.

• SECURITY.md — with the point specific to a scaffolder: templates are data, not code (there are no post-generation hooks), but a template still writes files that other tools execute later. A hostile template does not need a hook when it can ship a conftest.py.

• A changelog.

Changed

• actions/checkout and actions/setup-python on v7; no deprecated-runtime warnings.

History deliberately not rewritten

It would change every hash after that commit and break clones and links, to fix something that lives in the working tree rather than the object store. main is clean going forward, and this note is here so the decision is visible rather than mysterious.

Provenance

Built from a clean clone of this tag — not a working tree — with python -m build; twine check passed on both artefacts, and both were scanned for vendored environments and repository metadata before upload (126 files, none).

de66a90eb59421cfb970d3e2788b395d48b6f49cccbf00569e1ae528d4a66afd  scaffld-0.1.1-py3-none-any.whl
7ebb77575d98b3db1dff4dd98697dac34aadf319307ed74188c2e28745ad4320  scaffld-0.1.1.tar.gz

Verified against the published package: installed scaffld==0.1.1 from PyPI into a clean venv, scaffld --version reports 0.1.1, and it generated a working python-lib project.

69 tests passing.

scaffld v0.1.0

First tagged release, and the first published to PyPI: pip install scaffld.

It ships the state of main after the verified audit of 2026-09-04 — every fix in it was reproduced before being applied and its verification command recorded in the pull request.

See the repository README for what this does and its limits.