v7.9.0

Note

7.9.0 is available on 🐍 PyPI and 🐙 GitHub.

• Breaking: REPOMATIC_PAT now requires Administration: Read-only, and lint-repo fails without it. Regenerate the token with the setup guide's pre-filled link; steps that cannot be verified now say so instead of vanishing.
• New [tool.repomatic] nuitka.dev-targets option: an ordinary push now compiles binaries only for a canary subset, ["linux-arm64"] by default. Release commits, a new weekly schedule and manual dispatches build the full 6-target fleet.
• lint-repo now also verifies versionless releases/latest/download URLs in docs/install.md, catching a renamed asset that leaves the guide pointing at a 404.
• sync-workflow-pins now walks npx pkg@1.2.3 version literals forward, not just npm install and uvx pins.
• repomatic init now realigns a workflow's inline repomatic==X.Y.Z literal onto the pin it writes into the uses: refs, in either direction.
• Nuitka compile caches now persist across runs, so a warm build skips most of the C compilation. Release commits and macOS builds opt out, so no published binary is influenced by cached objects.
• Compile, binary-test and VirusTotal-scan jobs now carry execution timeouts, so a hung job frees its runner slot instead of squatting it for 6 hours.
• Scheduled and manually dispatched release runs get their own concurrency group, so a later push no longer cancels them mid-build.
• Binary self-tests on non-release pushes now run inside the compile job; the standalone per-target test jobs run on release commits only.
• sync-gitignore no longer discards rules added by hand to the committed .gitignore: it refuses to write when the rebuild would lose one, naming the rules. New --drop-orphans flag confirms an intended loss.
• The setup guide no longer asks a uv virtual project to register a PyPI Trusted Publisher, and lint-repo no longer checks one: both now gate on whether the project builds a distributable.
• Fix the broken-links issue never being filed: docs.yaml ran lychee through xargs, which reported its "broken links found" exit status as a crash.
• A Bad credentials 401 now fails immediately instead of retrying a token that cannot recover, so a revoked REPOMATIC_PAT reports itself plainly rather than as a chain of unrelated check failures.
• New Nuitka compilation guide covering build targets, fleet cadence, compile caching, the LTO stance, and upstream workarounds.
• New Build backends section in the packaging guide, covering the [tool.setuptools] package-discovery shim a distribution needs when it builds a uv-build project with setuptools.
• The documentation sidebar logo now follows Furo's light and dark toggle, so the wordmark no longer renders near-black against the dark theme.

Full changelog: v7.8.0...v7.9.0