v0.12.0

Upgrade steps:

• Breaking: in a library, research or data-pipeline project, run just citation after the update and commit what it writes. Until you do, the new citation hook fails, in CI too. Add email: to the authors in CITATION.cff first, or codemeta.json loses the email it has.
• With openssf_badge=silver: from this update on, sign off your own commits too (git commit -s, or git rebase --signoff origin/main for a branch you already have). Run prek install again so the new commit-msg hook is active.
• If your README.md has the three-dot fair-software.eu badge and fair.yml scores under five of five, delete the badge line by hand. copier update never changes README.md.

Changed

• New citable public projects no longer get a fair-software.eu badge at three of five dots. Add it once fair.yml scores five of five: set FAIR_MIN: 5 and paste the snippet howfairis prints in the job summary.
• Breaking for openssf_badge=silver: the dco check runs on every pull request, the maintainers' branches included, as the silver badge's DCO criterion asks of every developer. A commit-msg hook refuses an unsigned commit before the push. Commits Dependabot or Renovate write in their own pull requests are exempt; a human commit on a bot's branch is still checked. The commit-msg hook accepts only a full Signed-off-by: Name <email> line, as the check does. just repo-settings also turns on GitHub's "require contributors to sign off on web-based commits", so a commit made in the web UI, such as "Commit suggestion", passes the check. Below silver, only pull requests from forks are checked, as before.
• The copier-update workflow signs off its commit.
• Pull requests restore the CI caches main saved and save none of their own, in every workflow that caches: uv, Rust, the pnpm store, Go, the git hook environments and trivy's database. GitHub lets only the pull request read a cache it saves, and a repo holds 10 GB of caches before it evicts the oldest, so those caches pushed out main's and new pull requests built cold. The pr title workflow, which runs on pull requests only, no longer caches uv.
• codemeta.json declares CodeMeta 3.0 instead of 4.0, because Software Heritage's indexer reads only 2.0 and 3.0 and skipped the file. The fields are the same in both.
• JSON files are checked by jsonvet 3.2.0, the new name of check-json5, in every project, not only TypeScript ones: .vscode/ and .github/rulesets/ JSON ship with every stack. It reads .json files as JSON5, so comments and trailing commas still pass, and fails on syntax errors and duplicate keys.

Fixed

• The generated README had two blank lines before "Before the first release" (or before "License" in a project that publishes nothing), so the Markdown linter rewrote it on the first commit.
• fair.yml called GitHub's API anonymously, so on a runner whose IP had used up its 60 requests an hour, howfairis scored checks as missing without an error. It now passes the job's token as APIKEY_GITHUB.
• fair.yml scored the checklist as missing on every repo with an OpenSSF Best Practices badge, because the howfairis on PyPI (0.14.2) predates the www.bestpractices.dev badge URL. It now runs howfairis 0.15.0 from its GitHub tag, which reads that URL; PyPI has no 0.15.0 yet.
• biome check failed on every new TypeScript project with biome 2.6, which formats Markdown and YAML too. biome.json now leaves those files to rumdl and yamlfmt.
• just repo-settings in a public Renovate repo stopped with a bare "Validation Failed" when the Renovate app was not installed yet, because GitHub refuses an app it can't see as a bypass actor. It now shows GitHub's reason and says to install the app first.

Added

• just citation writes .zenodo.json and codemeta.json from CITATION.cff, so you edit one file instead of three: title, description, authors with their ORCID iD, email and affiliation, licence and repository into both, and version, release date and DOI into codemeta.json only. Zenodo takes the version and date from the release, and would take a DOI for the release's own and mint none. Other top-level fields you add to the JSON files stay; the author lists are rewritten whole. A name particle such as van is kept in front of the family name. A git hook, which CI also runs, fails while the files disagree, and just citation --check runs the same check by hand.
• docs/usage.md has a checklist for making a private repo public: a secret scan over the full history, the name on PyPI, crates.io and npm, a clean issue list and the README status sentence.
• A Rust or Go binary and a Python data-pipeline get docs/accessibility.md: how the program prints (colour is never the only signal, NO_COLOR and --color never are honoured, plain output off a terminal, errors as file:line:col on standard error) and the author's email for problems. Check each claim holds for your program before you publish it. An existing project gets the file on copier update and keeps its own edits after that.
• A public repo's CONTRIBUTING.md has a "Scope and response" section: one maintainer, a reply within about two weeks, an issue before a large pull request, and out-of-scope pull requests closed with a link to it.
• A new status question (experimental, the default, stable, maintenance or archived, under customise) puts one status sentence under the README's badges. A public repo's README also says where questions and bugs go. An existing project's README is its own, so copier update adds neither: copy them from a fresh render.
• A public repo gets issue forms in .github/ISSUE_TEMPLATE/: one for bugs and one for feature requests. Blank issues are turned off, and a link sends questions to CONTRIBUTING.md. Vulnerabilities go to private reporting, as before. A private repo gets none.
• The template itself has a Zenodo DOI, 10.5281/zenodo.23701980, which always points to the newest release. CITATION.cff and the README carry it.