v7.11.0

Note

7.11.0 is available on 🐍 PyPI and 🐙 GitHub.

• Breaking: labels.content-rules and labels.file-rules are now tables mapping each label to its patterns, like "📚 docs" = ["docs/**"]. The array-of-tables form and its actions/labeler v5 matcher schema are gone; an un-migrated config is ignored with a warning.
• Breaking: the file-labeller and content-labeller jobs merged into a single apply-labels job. Update any required check or needs: edge naming them.
• Breaking: repomatic init and repomatic workflow lint take --upstream-repo for the upstream toolkit; --repo now means the owner/name slug everywhere, including on sync-labels.
• New pr-sync command replacing peter-evans/create-pull-request in every job: opens, refreshes or retires an automation PR from one --template flag. Its PR closes even when the job's if: gate skips the rest of the step.
• New lock-threads command replacing dessant/lock-threads in the autolock job. It skips threads carrying the 🤖 ci label, so an issue repomatic maintains is no longer locked out of reopening when its condition recurs.
• New apply-labels command replacing actions/labeler and github/issue-labeler in the labeller job. A rule's entry overrides the bundled default for that label, and an empty list disables it.
• The debug job's context dump no longer runs crazy-max/ghaction-dump-context, and no longer installs cgroup-tools and cpuid to read them. It now reports the kernel, disk, CPU and memory of every runner using only what the image already ships.
• A bare content pattern is now a keyword, matched case-insensitively on word boundaries, so "🐛 bug" = ["bug", "error"] works as written; the /…/flags form passes a regex through. Keyword lists used to be AND-joined and never fired.
• repomatic init labels no longer writes .github/labeller-content-based.yaml or .github/labeller-file-based.yaml: the default rules live in the package, and repomatic init now prunes an unmodified committed copy automatically. Move customizations to [tool.repomatic.labels]; a hand-edited copy is left for review instead of deleted.
• The sponsor-label command now applies the 💖 sponsor label the registry defines, instead of a plural variant that exists in no repository and failed every labelling attempt.
• pr-sync now clears a conversation lock standing in the way of retiring a stale automation PR, instead of dying on the refused close comment.
• sync-labels now hands labelmaker the canonical token (REPOMATIC_PAT, then GH_TOKEN, then GITHUB_TOKEN), so an environment carrying only the PAT syncs authenticated.
• Every re-lock (sync-dep-sources, audit --fix) now passes the project's own [tool.uv] exclude-newer explicitly, so CI's ambient UV_EXCLUDE_NEWER can no longer retime the lock.
• lint-repo now runs the branch-ruleset and immutable-releases checks it already defined but never invoked.
• apply-labels no longer applies 💖 sponsor from the words "funding" or "sponsor", or from a pull request touching .github/funding.yml: only sponsor-label sets it, from actual sponsorship.
• Every gh call now runs the registry-pinned, checksum-verified binary, falling back to $PATH with a warning when it cannot be installed.
• Test jobs running an unreleased Python are now titled py3.15-dev, so a continue-on-error cell states why it is allowed to fail.

Full changelog: v7.10.0...v7.11.0