v7.5.0

Note

7.5.0 is available on 🐍 PyPI and 🐙 GitHub.

• Breaking: bundled skills drop model and disable-model-invocation, so every skill is now model-invocable and runs on the session model. The recommended model moved to the spec's compatibility field.
• Breaking: manage_issue_lifecycle() takes the rendered body string instead of a body_file path, and writes the temporary file gh needs itself.
• Breaking: format_file_size moves from images to a new humanize module, joined there by format_age. Frontmatter parsing moves to a new frontmatter module.
• Breaking: workflows now run the CLI from uv.lock with uv run --frozen instead of uvx --from ., so installs are hash-verified. The release freeze still pins downstream to uvx 'repomatic==X.Y.Z'.
• minimum-release-age now defaults to 1 week (was 8 days) and [tool.uv] exclude-newer tracks it, closing the band where uv.lock could pin a version CI then refused to install.
• Reject a dependency floor naming a release still inside the cooldown window, which would ship a package that downstream repos and uvx users cannot resolve.
• Fix the sync-* updaters adopting a release published on the cutoff day itself, which uv then refused to resolve because it applies the window to the hour rather than the day.
• sync-workflow-pins now warns when a pin already in the tree sits inside the cooldown, instead of only judging the version it is about to write.
• A lint-repo check that cannot read its GitHub API response now reports one "could not query API" outcome instead of separate unreachable-API and unparsable-JSON messages.
• Fix prepare-release and sync-github-releases reading ./changelog.md instead of the configured changelog.location.
• Fix a PR body template's footer: false being ignored, appending the attribution footer to a template that opted out of it.
• Fix template and skill frontmatter truncating at a value that embeds ---, dropping every field below it.
• Fix the parallel test run aborting before any test executed, and add a conformance test asserting no parametrization iterates an unordered collection.
• Trim the hand-maintained example dumps from metadata's module and nuitka_matrix docstrings, which had drifted from the values they claimed to show.
• Fix docstrings where a brace placeholder against a closing backtick rendered as a spurious role, swallowing the prose after it, and add a conformance test.
• Every workflow now gates package installs behind the minimum-release-age cooldown, so no uvx, uv pip install, npm install or npx resolves a release published inside the window.
• A thin caller carrying extra downstream jobs now gets a top-level permissions: {}, and on its managed job the union of the scopes the reusable workflow's jobs declare. Callers with no extra jobs are untouched.
• astral-sh/setup-uv steps now pin the uv version, bumped by sync-workflow-pins once a release clears the cooldown, instead of installing the newest build satisfying required-version.
• repomatic run mdformat provisions its own shfmt at the registry-pinned version, so formatting shell blocks in Markdown no longer needs a system shfmt.
• New path_tools field on a tool spec, naming registry tools whose binary must be on PATH while it runs.
• Fix repomatic run mdformat aborting on Windows ARM64, where shfmt publishes no binary: a companion missing for the platform is now skipped with a warning.
• Fix the macOS binary builds, which crashed in code signing once skills joined the bundled data: an --include-data-dir source holding symlinks is now staged symlink-free.
• The format-markdown job drops back to the lean ubuntu-slim runner, and its awesome-list fixup uses sed instead of gawk.
• apt-get replaces apt in every workflow step, with --no-install-recommends throughout.
• Add gh to the repomatic run registry. The release engine's attestation check now uses it instead of adding GitHub's RPM repository to the build container and installing an unpinned gh.
• A tool's strip_components accepts a per-platform mapping, like archive_format already did.
• Add oxipng to the repomatic run registry, bumped to 10.1.1. format-images now uses the pinned, checksum-verified build instead of a hand-fetched .deb installed with dpkg.
• New ensure_binary() helper returning a registry tool's verified executable, for repomatic code that shells out to a binary without going through repomatic run.
• Dependency-updater reports now close on the Held back by cooldown section, below Cooldown bypasses, so a PR opens on what the run changed instead of what it left alone.
• sync-tool-versions leaves autofix.yaml for a new upstream-only self-maintenance.yaml, and polls daily instead of weekly. Downstream autofix.yaml loses the four steps it could never run.
• sync-tool-versions now also bumps the packages pinned alongside a tool in its uvx environment, like mdformat's plugin set, reporting them like every other row.
• Fix get_source_url returning a bug-tracker or changelog sub-path instead of the repository root, and matching project_urls keys case-sensitively.
• The bundled ruff config sets output-prefer-rule-codes, so diagnostics report ISC004 instead of implicit-string-concatenation-in-collection-literal. Requires ruff 0.16.1.
• repomatic init holds the derived upstream workflow pin back to the newest release past the minimum-release-age cooldown; --no-cooldown pins the running version immediately.
• Commands honoring --output now log their destination uniformly, always naming what is written instead of mixing Save updated results to and a subject-less Write to.
• Align bundled skills with the Agent Skills specification: babysit-ci gains its required name field, and allowed-tools moves to the spec's space-separated form.
• Skills are now installed as whole folders, so one can ship the spec's optional scripts/, references/ and assets/ directories alongside its SKILL.md.
• Add [tool.repomatic.flavor] with agent and ci keys, declaring the ecosystems a repository targets. Values are extra-platforms trait IDs.
• [tool.repomatic.labels.extra] entries now carry labelmaker's full per-label specification, adding rename-from in-place renames, multi-color lists, and the create, update, enforce-case and on-rename-clash knobs. An unknown field now warns instead of being dropped silently.
• New release-assets filename list in [tool.repomatic]: each named asset is built by a caller-side job, attested like the compiled binaries, and attached to the release draft before publication locks it.
• The man-page tarball is now attested like the compiled binaries, with its sigstore bundle attached as a manpages.attestation.json release asset.
• skills.location and agents.location now default to the layout of the configured flavor.agent, and still win when set explicitly.
• repomatic run mdformat drops the mdformat-ruff plugin and its separate ruff pin, and the bundled ruff config drops extend-include: ruff formats fenced Python blocks in Markdown on its own.
• Teach the repomatic-ship and babysit-ci skills to act on the first failing CI job instead of waiting out full matrices, pay down pre-existing and ⁉️-probe test debt before the first push, and hold prose-only pushes while binary matrices drain.
• Chart the /repomatic-ship convergence loop (first-failing-job fixes, push timing, debt paydown) on the skills docs page.
• Re-base the release PR onto the current main HEAD after every build by also running prepare-release on workflow_run, so a reconciliation commit that misses changelog.yaml's paths: filter no longer leaves the PR stale.
• /repomatic-topics pre-approves the Agent tool instead of the retired Task name.
• Add a history documentation page retracing the project from its 2021 reusable-workflow origins through the gha-utils CLI to the repomatic rename.
• Recenter the readme and the workflows page on the CLI-first design: workflows only trigger CLI commands, with local-run examples and links to the standalone binaries and history pages.
• Document Agent Skills spec conformance, and argument-hint as the single accepted deviation, on the skills documentation page.
• Correct the readme and benchmark page: both carried stale reusable-workflow counts, and listed jpegoptim among the tools repomatic run manages when it never was.

Full changelog: v7.4.1...v7.5.0