Merge

Author: DarkaMaul

.github/dependabot.yml

@@ -6,13 +6,14 @@ updates:
 
   # Update GitHub Actions of both the template and the repo
   - package-ecosystem: github-actions
+    cooldown:
+      default-days: 7
     directories:
-        - "/"
-    schedule:
-      interval: daily
-
-  - package-ecosystem: github-actions
-    directories:
-        - "{{cookiecutter.project_slug}}/.github/workflows"
+      - "/"
+      - "{{cookiecutter.project_slug}}/.github/workflows"
+    groups:
+      actions:
+        patterns:
+          - "*"
     schedule:
       interval: daily

.github/workflows/tests.yml

@@ -12,12 +12,12 @@ jobs:
   self-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@e92bafb6253dcd438e0484186d7669ea7a8ca1cc # v6.4.3
+        uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
         with:
           cache-dependency-glob: cookiecutter.json
 
@@ -35,14 +35,13 @@ jobs:
 
           cd /tmp/python-project
           git init . && git add . && git commit -m "Initial commit"
-          make dev
-          make reformat
+          make format
 
-          git diff --exit-code || { >&2 echo "please reformat"; exit 1; }
+          git diff --exit-code || { >&2 echo "please format"; exit 1; }
 
           make lint
           make test
-          make package
+          make build
           make doc
           cd .. && rm -rf /tmp/python-project
 
@@ -54,14 +53,13 @@ jobs:
 
           cd /tmp/python-project
           git init . && git add . && git commit -m "Initial commit"
-          make dev
-          make reformat
+          make format
 
-          git diff --exit-code || { >&2 echo "please reformat"; exit 1; }
+          git diff --exit-code || { >&2 echo "please format"; exit 1; }
 
           make lint
           make test
-          make package
+          make build
           make doc
           cd .. && rm -rf /tmp/python-project
 
@@ -73,14 +71,13 @@ jobs:
 
           cd /tmp/tob-r-and-e-python-project
           git init . && git add . && git commit -m "Initial commit"
-          make dev
-          make reformat
+          make format
 
-          git diff --exit-code || { >&2 echo "please reformat"; exit 1; }
+          git diff --exit-code || { >&2 echo "please format"; exit 1; }
 
           make lint
           make test
-          make package
+          make build
           make doc
           cd .. && rm -rf /tmp/tob-r-and-e-python-project
 
@@ -92,14 +89,13 @@ jobs:
 
           cd /tmp/bit-trails
           git init . && git add . && git commit -m "Initial commit"
-          make dev
-          make reformat
+          make format
 
-          git diff --exit-code || { >&2 echo "please reformat"; exit 1; }
+          git diff --exit-code || { >&2 echo "please format"; exit 1; }
 
           make lint
           make test
-          make package
+          make build
           make doc
           cd .. && rm -rf /tmp/bit-trails
 
@@ -112,13 +108,12 @@ jobs:
 
           cd /tmp/python-project
           git init . && git add . && git commit -m "Initial commit"
-          make dev
-          make reformat
+          make format
 
-          git diff --exit-code || { >&2 echo "please reformat"; exit 1; }
+          git diff --exit-code || { >&2 echo "please format"; exit 1; }
 
           make lint
           make test
-          make package
+          make build
           make doc
           cd .. && rm -rf /tmp/python-project

.github/workflows/zizmor.yml

@@ -10,27 +10,16 @@ permissions: {}
 
 jobs:
   zizmor:
-    name: zizmor latest via PyPI
     runs-on: ubuntu-latest
     permissions:
-      security-events: write # needed by upload-sarif for all repositories
+      security-events: write
+      contents: read # only needed for private repos
+      actions: read # only needed for private repos
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
 
-      - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@e92bafb6253dcd438e0484186d7669ea7a8ca1cc # v6.4.3
-
       - name: Run zizmor 🌈
-        # Run it for both this repo and the templated cookiecutter repo.
-        run: uvx zizmor --format sarif . {{cookiecutter.project_slug}}/.github/workflows > results.sarif
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5
-        with:
-          sarif_file: results.sarif
-          category: zizmor
+        uses: zizmorcore/zizmor-action@e639db99335bc9038abc0e066dfcd72e23d26fb4 # v0.3.0

AGENTS.md

@@ -0,0 +1,59 @@
+# AGENTS.md
+
+## Project Overview
+
+A Cookiecutter template for Python packages, supporting both CLI and library project types. Generates projects with uv, ruff, pyright, and pytest pre-configured. It also comes with GitHub Actions workflows configured for the project.
+
+This template is opinionated and enforces recommended practices when creating new Python projects.
+
+## Repository Structure
+
+- `{{cookiecutter.project_slug}}/` - Template directory (rendered by Cookiecutter)
+- `cookiecutter.json` - Template variables and prompts
+- `hooks/` - Pre/post generation scripts
+  - `pre_gen_project.py` - Validates inputs (namespace, slug, entry point)
+  - `post_gen_project.py` - Cleans up unused files based on options
+
+## Key Template Variables
+
+| Variable | Purpose |
+|----------|---------|
+| `project_name` | Human-readable name |
+| `project_slug` | Pip/repo name (auto-derived) |
+| `project_namespace_import` | Optional namespace (e.g., `company.tools`) |
+| `repo_type` | `CLI` or `library` |
+| `entry_point` | CLI command name (CLI only) |
+
+## Testing Changes
+
+Generate a test project to verify template changes:
+
+```bash
+# Generate in temp directory
+uvx cookiecutter -o /tmp .
+
+# Or with specific options (no prompts)
+uvx cookiecutter --no-input -o /tmp . project_name="Test Project" repo_type="CLI"
+```
+
+Then verify the generated project:
+
+```bash
+cd /tmp/test-project
+make lint && make test
+```
+
+## Verification
+
+When modifying the template:
+
+1. Ensure Jinja2 syntax is valid in template files
+2. Test both `CLI` and `library` repo types
+3. Test with and without `project_namespace_import`
+4. Verify generated project passes `make lint && make test`
+
+## Commit Messages
+
+- Summary line: max 50 chars (hard limit 72)
+- Body lines: max 72 chars
+- Use Markdown formatting in description

CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

{{cookiecutter.project_slug}}/.github/dependabot.yml

@@ -1,7 +1,9 @@
 version: 2
 
 updates:
-  - package-ecosystem: pip
+  - package-ecosystem: uv
+    cooldown:
+      default-days: 7
     directory: /
     groups:
       python:
@@ -11,6 +13,8 @@ updates:
       interval: daily
 
   - package-ecosystem: github-actions
+    cooldown:
+      default-days: 7
     directory: /
     groups:
       actions:

{{cookiecutter.project_slug}}/.github/workflows/docs.yml

@@ -10,24 +10,22 @@ permissions: {}
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # needed for private repos
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@e92bafb6253dcd438e0484186d7669ea7a8ca1cc # v6.4.3
-
-      - name: setup
-        run: |
-          make dev INSTALL_EXTRA=doc
+        uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
 
       - name: build docs
         run: |
           make doc
 
       - name: upload docs artifact
-        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
         with:
           path: ./html/
 

{{cookiecutter.project_slug}}/.github/workflows/lint.yml

@@ -11,13 +11,15 @@ permissions: {}
 jobs:
   lint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # needed for private repos
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@e92bafb6253dcd438e0484186d7669ea7a8ca1cc # v6.4.3
+        uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
 
       - name: lint
-        run: make lint INSTALL_EXTRA=lint
+        run: make lint

{{cookiecutter.project_slug}}/.github/workflows/release.yml

@@ -11,19 +11,21 @@ jobs:
   build:
     name: Build distributions
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # needed for private repos
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       with:
         persist-credentials: false
 
     - name: Install uv
-      uses: astral-sh/setup-uv@e92bafb6253dcd438e0484186d7669ea7a8ca1cc # v6.4.3
+      uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
 
     - name: Build distributions
-      run: uv build
+      run: make build
 
     - name: Upload distributions
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
       with:
         name: distributions
         path: dist/
@@ -37,12 +39,12 @@ jobs:
       attestations: write # To persist the attestation files.
     steps:
       - name: Download distributions
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           name: distributions
           path: dist/
       - name: Generate build provenance
-        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
+        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
         with:
           subject-path: 'dist/*'
 
@@ -59,12 +61,12 @@ jobs:
       id-token: write
     steps:
       - name: Download distributions
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           name: distributions
           path: dist/
 
       - name: Publish distributions
-        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
         with:
           attestations: true

{{cookiecutter.project_slug}}/.github/workflows/tests.yml

@@ -19,16 +19,17 @@ jobs:
           - "3.13"
           - "3.14"
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # needed for private repos
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@e92bafb6253dcd438e0484186d7669ea7a8ca1cc # v6.4.3
-
-      - name: Install Python ${{ matrix.python }}
-        run: uv python install ${{ matrix.python }}
+        uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
+        with:
+          python-version: ${{ matrix.python }}
 
       - name: test
-        run: make test INSTALL_EXTRA=test
+        run: make test