v7.12.0

Note

7.12.0 is available on 🐍 PyPI and 🐙 GitHub.

• New ci-status command reporting each workflow's latest run and which of its failing jobs gate a merge, read from jobs rather than run conclusions.
• New repomatic run <tool> --verify reporting which files a formatter would rewrite, without touching the working tree.
• repomatic run now resolves a tool's targets itself when given no arguments, and skips a tool with no matching file instead of invoking it pathless.
• New repeatable pr-sync --add-path option limiting what the pull request commits to a git pathspec list.
• lint-deps now warns about declarations departing from version policy: upper bounds, missing floors, unsorted lists, misplaced type stubs, uncommented floors. Disabled with --no-policy.
• lint-deps now names the lint-deps.allow exemption in the remedy it prints for a git source.
• sync-workflow-pins now backfills a missing --exclude-newer-package exemption on a run that moves no version, instead of computing the splice and discarding it.
• lint-repo now fails when an inline upstream pin resolving under a cooldown carries no --exclude-newer-package exemption, which takes every needs: metadata job down with it.
• lint-repo now warns when an astral-sh/setup-uv step declares no version: input, or when steps across the repository pin more than one uv version.
• lint-repo now fails, and repomatic init now warns, when a workflow asks repomatic metadata for a key that no longer exists.
• lint-repo now warns when a Sphinx project's GitHub website field differs from the documentation URL declared in [project.urls].
• lint-changelog now warns about a released section holding no entry.
• runner-images now watches every image the workflows name literally, not just the curated test axes.
• A bare repomatic init now re-syncs a tool config the repository already carries, so [tool.typos], [tool.uv] and [tool.bumpversion] follow the bundled template once adopted.
• Every job now caps its runtime with timeout-minutes, so a hung job frees its runner in minutes instead of the platform's 6-hour ceiling. Downstream callers inherit the caps.
• The Docs workflow now triggers on readme.*.md, so a push touching only a translated readme no longer skips link checking.
• repomatic run actionlint now ships a bundled config declaring the ubuntu-26.04 runner labels actionlint 1.7.12 predates.
• The bundled lychee.toml now excludes bitdefender.com, npmjs.com, star-history.com and githubstatus.com, which answer bots with 403, 405 or JavaScript rather than a link.
• cancel-runs now spares a run whose head commit carries [changelog] Release, so a sweep of the default branch cannot kill a release matrix.
• Fix gh re-downloading on every command instead of once per version: a binary nested in an archive subdirectory was stored under one cache key and looked up under another.
• Fix repomatic init realigning a workflow's inline repomatic==X.Y.Z pin without the cooldown exemption beside it, leaving a command that cannot resolve the version just written.
• Fix audit --fix dirtying uv.lock with a cooldown-override record when no upgrade was reachable, which opened a fix-vulnerable-deps pull request carrying no fix.
• Fix repomatic init restyling a locally added array item when it re-syncs a tool config, which had sync-repomatic and format-pyproject endlessly opening pull requests undoing each other.
• A formatter exiting with its rewrite status while leaving every target unchanged is now reported as a crash, instead of passing for a successful reformat that never happened.
• Fix stale guidance across the bundled skills: wrong [tool.repomatic.workflow] key names, wrong workflow and job names for lint-deps and lint-changelog, which tools a bundled default actually covers, and downstream audits comparing against main rather than the adopted release.
• Fix the bundled babysit-ci skill classifying a CI job by a leading ✅, which dropped every required job whose name carries no stability glyph from the failures it collects.

Full changelog: v7.11.0...v7.12.0