v0.18.0

Frequenz Repository Configuration Release Notes

Summary

This release focuses on finishing the automation of dependabot updates, adding more automated upgrade workflows and fixing some problems with the previous release.

Upgrading

Cookiecutter template

All upgrading should be done via the migration script or regenerating the templates.

curl -sSLf https://raw.githubusercontent.com/frequenz-floss/frequenz-repo-config-python/<tag>/cookiecutter/migrate.py | python3 -I

New Features

Cookiecutter template

• The cookiecutter now asks whether a repository is private, defaults that answer from the selected license, and uses it to toggle private-repository workflow behavior, public publishing jobs, and the link to GitHub Discussions in the issue template chooser.
• All dependencies have been updated in the templates.
• API projects now ship a dedicated grpc-migration.yaml workflow that runs after Dependabot bumps grpcio/grpcio-tools/protobuf and rewrites the matching runtime >= floors in pyproject.toml.
• API projects now have a better grpcio/protobuf updates grouping in Dependabot, which should make upgrading easier, and plays nicer with the new grpc-migration.yaml workflow.
• API projects should now use the new API-specific Protect version branches ruleset variant, which includes the required Fix gRPC/protobuf runtime floors check without affecting non-API Python projects.
• Workflows using the gh-action-dependabot-migrate are upgraded to the latest version, which avoids unnecessary version iterations.
• Add an isort-migration.yaml workflow that automatically reorders imports when Dependabot upgrades isort.

Bug Fixes

Cookiecutter template

• The unused cross-arch QEMU-based testing infrastructure has been removed. The .github/containers/nox-cross-arch/ and .github/containers/test-installation/ directories, as well as the "Cross-Arch Testing" section in CONTRIBUTING.md.
• Private repositories now are generated with credentials uncommented and the publishing workflows disabled.
• The issue template chooser (config.yml) no longer includes the contact_links section for private repositories, since GitHub Discussions are typically disabled for them.
• Normalized the GitHub Action hashes for gh-action-setup-git and gh-action-setup-python-with-deps to point to the actual commit object, which is what Dependabot expects.
• API projects now configure black with extend-exclude = '^/submodules/' so the formatting check doesn't descend into external git submodules that don't follow our formatting rules.
• API projects now configure isort with skip_glob = ["submodules/*"] so the import-sorting check doesn't descend into external git submodules that don't follow our rules.
• CONTRIBUTING.md
  • Fixed the nox example commands in to use the correct tests/ directory instead of the non-existent test/ directory.
  • Fixed the wrong mention to PyPI publishing when releasing for private repositories.

What's Changed

• Add how to re-trigger a migration to the docs by @llucax in #559
• Remove unused cross-arch files and docs by @llucax in #547
• build(deps): bump frequenz-floss/gh-action-setup-python-with-deps from 0d0d77eac3b54799f31f25a1060ef2c6ebdf9299 to e4d0b2ef8f5a1612d7827f3abaef17c931d2b946 by @dependabot[bot] in #561
• build(deps): bump frequenz-floss/gh-action-nox from 1.1.0 to 1.1.1 in the compatible group by @dependabot[bot] in #560
• build(deps): bump frequenz-floss/gh-action-setup-git from 16952aac3ccc01d27412fe0dea3ea946530dcace to f9d86a01228ee1cadaac5224d4d7626f1eb23f90 by @dependabot[bot] in #562
• build(deps-dev): bump setuptools-scm from 10.0.3 to 10.0.5 in the patch group by @dependabot[bot] in #563
• build(deps-dev): bump mypy from 1.19.1 to 1.20.0 in the minor group by @dependabot[bot] in #564
• Make template aware of private repos by @llucax in #555
• template: Update all dependencies by @llucax in #567
• Normalize action hashes to point to commits by @llucax in #565
• build(deps-dev): bump the patch group with 3 updates by @dependabot[bot] in #568
• build(deps-dev): bump types-pyyaml from 6.0.12.20250915 to 6.0.12.20260408 by @dependabot[bot] in #570
• build(deps): bump the minor group with 2 updates by @dependabot[bot] in #569
• build(deps-dev): bump types-colorama from 0.4.15.20250801 to 0.4.15.20260408 by @dependabot[bot] in #571
• build(deps-dev): bump types-markdown from 3.10.2.20260211 to 3.10.2.20260408 by @dependabot[bot] in #572
• build(deps): bump the compatible group with 5 updates by @dependabot[bot] in #574
• Improve AGENTS.md and add hierarchical AGENTS files by @llucax in #575
• Add dependabot grpc migration workflow by @llucax in #573
• build(deps-dev): bump types-colorama from 0.4.15.20260408 to 0.4.15.20260508 by @dependabot[bot] in #581
• build(deps): bump the compatible group with 3 updates by @dependabot[bot] in #577
• build(deps-dev): bump mypy from 1.20.2 to 2.1.0 by @dependabot[bot] in #579
• build(deps-dev): bump pydoclint from 0.8.3 to 0.8.4 by @dependabot[bot] in #583
• build(deps-dev): bump types-pyyaml from 6.0.12.20260408 to 6.0.12.20260518 by @dependabot[bot] in #580
• build(deps-dev): bump types-markdown from 3.10.2.20260408 to 3.10.2.20260518 by @dependabot[bot] in #582
• Upgrade gh-action-dependabot-migrate by @llucax in #576
• Fix typos and mentions to PyPI in CONTRIBUTING.md by @llucax in #584
• black: Exclude template files by @llucax in #586
• build(deps-dev): bump black from 26.3.1 to 26.5.1 in the minor group across 1 directory by @dependabot[bot] in #578
• build(deps): bump frequenz-floss/gh-action-dependabot-migrate from 1.2.0 to 1.2.1 in the compatible group by @dependabot[bot] in #588
• black: Exclude submodules from API projects by @llucax in #587
• Add isort dependabot auto-migration workflow by @llucax in #585
• build(deps): bump the compatible group with 2 updates by @dependabot[bot] in #589
• Update template versions and prepare the v0.18.0 release by @llucax in #590

Full Changelog: v0.17.0...v0.18.0

v0.17.0

Frequenz Repository Configuration Release Notes

Summary

This release improves workflows security, adds a black migration workflow, and fixes failed migrations from version v0.16.0.

Upgrading

Cookiecutter template

All upgrading should be done via the migration script or regenerating the templates.

curl -sSLf https://raw.githubusercontent.com/frequenz-floss/frequenz-repo-config-python/<tag>/cookiecutter/migrate.py | python3 -I

But you might still need to adapt your code:

New Features

Cookiecutter template

• Add a black-migration.yaml workflow that automatically reformats code when Dependabot upgrades black.

Bug Fixes

Cookiecutter template

• Fix migration of CI workflow matrices that used arch/os dimensions with values different from the default template. The v0.16.0 migration relied on exact string matching, so projects with customized matrix items (for example arch: [amd64], os: [ubuntu-24.04]) could be left only partially migrated. The new migration step rebuilds the platform entries from the existing arch/os values and only rewrites runs-on when it still points to the old matrix keys.
• Improve workflows security: tighten permissions, avoid potential shell injection, run Python in isolated mode, pin all dependencies using the SHA hash.

What's Changed

• Fix the cookiecutter migration script template by @llucax in #540
• build(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 by @dependabot[bot] in #542
• build(deps): bump the patch group with 5 updates by @dependabot[bot] in #543
• build(deps-dev): bump the minor group with 2 updates by @dependabot[bot] in #544
• Reset release notes and migration script by @llucax in #539
• Improve workflows security by @llucax in #546
• build(deps-dev): bump mkdocs-material from 9.7.5 to 9.7.6 in the patch group by @dependabot[bot] in #550
• build(deps-dev): bump setuptools-scm from 9.2.2 to 10.0.3 by @dependabot[bot] in #552
• build(deps-dev): update sybil requirement from <10,>=6.1.1 to >=6.1.1,<11 by @dependabot[bot] in #553
• Add black auto-migration workflow by @llucax in #556
• Handle private repos in workflow migration by @llucax in #548
• migrate: Fix missed CI platform matrix migrations by @llucax in #549
• Remove chardet pinning by @llucax in #554
• Prepare for v0.17.0 release by @llucax in #557

Full Changelog: v0.16.0...v0.17.0

v0.16.0

Frequenz Repository Configuration Release Notes

Summary

This is a maintenance, template-only, bugfix release.

Upgrading

Cookiecutter template

All upgrading should be done via the migration script or regenerating the templates.

curl -sSL https://raw.githubusercontent.com/frequenz-floss/frequenz-repo-config-python/v0.16.0/cookiecutter/migrate.py | python3

Bug Fixes

Cookiecutter template

• Added a migration step for api repositories to fix mkdocs.yml when the previous mkdocstrings-python v2 migration moved only paths: ["src"] under handlers.python.options but not paths: ["py"].
• Fixed runners for jobs that require Docker and where wrongly converted to ubuntu-slim in v0.15.0, changing them back to ubuntu-24.04 to avoid Docker-related failures. The template and the migration script were both updated to reflect this change.
• Updated the repo-config migration workflow template and migration script so existing repositories also add the merge_group trigger and skip the job unless the event is pull_request_target, allowing the workflow to be used as a required merge-queue check.
• Added a migration step to remove the copilot review request from the Protect version branch protection rules. This was also done by v0.15.0 in theory, but the migration step was wrong and didn't update it properly.

What's Changed

• Fix mkdocs python path for API repos by @llucax in #534
• migrate: Update runners for Docker jobs by @llucax in #536
• ci: Trigger repo-config migration in merge queue by @llucax in #537
• migrate: Fix version ruleset copilot removal by @llucax in #535
• Prepare for the v0.16.0 release by @llucax in #538

Full Changelog: v0.15.1...v0.16.0

v0.15.1

Frequenz Repository Configuration Release Notes

Note

This is a bugfix release for v0.15.0. This release was never published to PyPI, so we keep the entire release notes for v0.15.0 here (updated to the new changes) to make it easier for users to upgrade from v0.14.0 to v0.15.x.

The only change with respect to v0.15.0 is using the appropriate job runner for the publish-to-pypi job in ci.yaml. v0.15.0 updated it to ubuntu-slim but that didn't work because it requires Docker, and it is not installed on the ubuntu-slim runner.

Summary

This release reduces CI cost by moving lightweight GitHub Actions jobs to the new ubuntu-slim runner, fixes Dependabot auto-merge/merge-queue issues by switching to a GitHub App installation token, and introduces an automated repo-config migration workflow (including updating existing repos' version-branch protection defaults).

Upgrading

Cookiecutter template

All upgrading should be done via the migration script or regenerating the templates.

curl -sSL https://raw.githubusercontent.com/frequenz-floss/frequenz-repo-config-python/v0.15.0/cookiecutter/migrate.py | python3

But you might still need to adapt your code:

New Features

Cookiecutter template

• Migrated lightweight workflow jobs to use the new ubuntu-slim runner for cost savings.
  The following jobs now use ubuntu-slim:

  • ci.yaml: protolint, nox-all, test-installation-all, create-github-release
  • ci-pr.yaml: protolint
  • auto-dependabot.yaml: auto-merge
  • release-notes-check.yml: check-release-notes
  • dco-merge-queue.yml: DCO
  • labeler.yml: Label

• Migrated the publish-to-pypi job in ci.yaml from ubuntu-latest to ubuntu-24.04 to get reproducible builds.

• Added the flake8-datetimez plugin to the flake8 session. This plugin prevents accidental use of naive datetime objects by flagging calls that create or return datetimes without timezone information.

• The CI workflow now uses a simpler matrix.

• Added repo-config-migration.yaml workflow that automatically runs the migration script, commits changes, posts results, and auto-approves/merges only when no migration commit is created.

  The workflow handles multi-version jumps by running each intermediate migration in sequence. The migration script output is posted as a PR comment and in the job summary. PRs with migration commits stay open for manual approval and merge. PRs that need manual intervention fail the job until a human completes the steps and signals resolution by removing the tool:repo-config:migration:intervention-pending label or adding the tool:repo-config:migration:intervention-done label.

• The auto-dependabot.yaml workflow now skips repo-config group PRs, which are handled by the new migration workflow instead.

• Updated the default "Protect version branches" ruleset to require the new Migrate Repo Config status check, which is added by the migration workflow to PRs that need manual intervention. This prevents merging PRs that require manual migration steps until those steps are completed and the check passes. Also removed the required code-owner approval and automatic Copilot review request.

Bug Fixes

Cookiecutter template

• Switched project.license to SPDX expressions and added project.license-files. This removes deprecated setuptools license metadata and avoids build warnings.

• Fixed auto-dependabot workflow failing to trigger merge queue CI or complete auto-merge. The workflow now uses a GitHub App installation token (via actions/create-github-app-token) instead of GITHUB_TOKEN, which was suppressing subsequent workflow runs by design. Workflow permissions have been reduced to the minimum needed for the workflow (contents: read and pull-requests: write).

• Fix dependabot group patterns for repo-config and mkdocstrings.

What's Changed

• ci: Fix runner for publish-to-pypi by @llucax in #532

Full Changelog: v0.15.0...v0.15.1

v0.15.0

Frequenz Repository Configuration Release Notes

Summary

This release reduces CI cost by moving lightweight GitHub Actions jobs to the new ubuntu-slim runner, fixes Dependabot auto-merge/merge-queue issues by switching to a GitHub App installation token, and introduces an automated repo-config migration workflow (including updating existing repos' version-branch protection defaults).

Upgrading

Cookiecutter template

All upgrading should be done via the migration script or regenerating the templates.

curl -sSL https://raw.githubusercontent.com/frequenz-floss/frequenz-repo-config-python/v0.15.0/cookiecutter/migrate.py | python3

But you might still need to adapt your code:

New Features

Cookiecutter template

• Migrated lightweight workflow jobs to use the new ubuntu-slim runner for cost savings.
  The following jobs now use ubuntu-slim:

  • ci.yaml: protolint, nox-all, test-installation-all, create-github-release, publish-to-pypi
  • ci-pr.yaml: protolint
  • auto-dependabot.yaml: auto-merge
  • release-notes-check.yml: check-release-notes
  • dco-merge-queue.yml: DCO
  • labeler.yml: Label

• Added the flake8-datetimez plugin to the flake8 session. This plugin prevents accidental use of naive datetime objects by flagging calls that create or return datetimes without timezone information.

• The CI workflow now uses a simpler matrix.

• Added repo-config-migration.yaml workflow that automatically runs the migration script, commits changes, posts results, and auto-approves/merges only when no migration commit is created.

  The workflow handles multi-version jumps by running each intermediate migration in sequence. The migration script output is posted as a PR comment and in the job summary. PRs with migration commits stay open for manual approval and merge. PRs that need manual intervention fail the job until a human completes the steps and signals resolution by removing the tool:repo-config:migration:intervention-pending label or adding the tool:repo-config:migration:intervention-done label.

• The auto-dependabot.yaml workflow now skips repo-config group PRs, which are handled by the new migration workflow instead.

• Updated the default "Protect version branches" ruleset to require the new Migrate Repo Config status check, which is added by the migration workflow to PRs that need manual intervention. This prevents merging PRs that require manual migration steps until those steps are completed and the check passes. Also removed the required code-owner approval and automatic Copilot review request.

Bug Fixes

Cookiecutter template

• Switched project.license to SPDX expressions and added project.license-files. This removes deprecated setuptools license metadata and avoids build warnings.

• Fixed auto-dependabot workflow failing to trigger merge queue CI or complete auto-merge. The workflow now uses a GitHub App installation token (via actions/create-github-app-token) instead of GITHUB_TOKEN, which was suppressing subsequent workflow runs by design. Workflow permissions have been reduced to the minimum needed for the workflow (contents: read and pull-requests: write).

• Fix dependabot group patterns for repo-config and mkdocstrings.

What's Changed

• CONTRIBUTING.md: Document cookiecutter workflow by @llucax in #493
• Clear release notes by @llucax in #491
• Add AGENTS.md by @llucax in #494
• Use ubuntu-slim for lightweight jobs by @llucax in #496
• Bump actions/download-artifact from 6 to 7 by @dependabot[bot] in #498
• Replace deprecated setuptools options by @llucax in #503
• Bump setuptools from 80.9.0 to 80.10.2 in the minor group by @dependabot[bot] in #500
• Improve migration script results reporting by @llucax in #507
• template: Add flake8-datetimez by @llucax in #506
• Use GitHub app credentials for auto-dependabot by @llucax in #508
• Fix dependabot-auto-approve version by @llucax in #510
• Bump actions/upload-artifact from 5 to 6 by @dependabot[bot] in #497
• Bump the patch group across 1 directory with 4 updates by @dependabot[bot] in #509
• Fix dependabot repo-config and mkdocstrings groups by @llucax in #512
• Bump frequenz-floss/gh-action-setup-python-with-deps from 1.0.1 to 1.0.2 in the compatible group by @dependabot[bot] in #513
• Bump mkdocs-material from 9.7.1 to 9.7.2 in the patch group by @dependabot[bot] in #514
• Bump nox from 2025.11.12 to 2026.2.9 by @dependabot[bot] in #515
• Update types-setuptools requirement from <81,>=67.6.0 to >=67.6.0,<83 by @dependabot[bot] in #516
• Bump black from 25.12.0 to 26.1.0 by @dependabot[bot] in #501
• Simplify CI job matrix by @llucax in #511
• Bump setuptools from 80.10.2 to 82.0.0 by @dependabot[bot] in #517
• Fix tests by adding dependency constraint by @llucax in #528
• Bump actions/download-artifact from 7 to 8 by @dependabot[bot] in #522
• Only apply ubuntu-slim to publish-to-pypy for public repos by @llucax in #525
• Bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #521
• Bump the patch group with 3 updates by @dependabot[bot] in #523
• Bump frequenz-floss/dependabot-auto-approve from 1.4.0 to 1.5.0 in the compatible group by @dependabot[bot] in #520
• Bump isort from 7.0.0 to 8.0.1 by @dependabot[bot] in #524
• Add repo-config auto-migration workflow by @llucax in #519
• Improve "Protect version branches" ruleset by @llucax in #529
• Prepare for the v0.15.0 release by @llucax in #530

Full Changelog: v0.14.0...v0.15.0

v0.14.0

Frequenz Repository Configuration Release Notes

Summary

This release adds a new workflow for Dependabot auto-merge and updates mkdocstrings to v2.

Upgrading

Cookiecutter template

All upgrading should be done via the migration script or regenerating the templates.

curl -sSL https://raw.githubusercontent.com/frequenz-floss/frequenz-repo-config-python/v0.14.0/cookiecutter/migrate.py | python3

But you might still need to adapt your code, just have a look at the script output for further instructions.

New Features

• mkdocsstrings-python v2 is now supported.

Cookiecutter template

• Dependencies have been updated.
• New warning ignores for protobuf gencode versions in pytest.
• Added Dependabot auto-merge workflow using frequenz-floss/dependabot-auto-approve action.

Bug Fixes

Cookiecutter template

• mkdocstrings: Move paths key to the right section in mkdocs.yml.
• Fix invalid YAML syntax in Dependabot workflow template.

What's Changed

• Bump types-pyyaml from 6.0.12.20250402 to 6.0.12.20250516 by @dependabot[bot] in #410
• Bump the patch group with 2 updates by @dependabot[bot] in #408
• Bump the minor group with 2 updates by @dependabot[bot] in #409
• Improve filtering of warnings in pytest by @llucax in #411
• Fix mkdocsstrings config by @llucax in #412
• Merge v0.13.x into v0.x.x by @llucax in #420
• Bump the patch group with 3 updates by @dependabot[bot] in #424
• Bump the minor group with 2 updates by @dependabot[bot] in #423
• Update templates dependencies by @llucax in #431
• Bump types-markdown from 3.8.0.20250415 to 3.8.0.20250708 by @dependabot[bot] in #430
• Bump mypy from 1.16.1 to 1.17.1 in the minor group by @dependabot[bot] in #428
• Bump the mkdocstrings group across 1 directory with 2 updates by @dependabot[bot] in #432
• Bump the patch group across 1 directory with 3 updates by @dependabot[bot] in #433
• Bump the compatible group with 2 updates by @dependabot[bot] in #426
• Bump mkdocstrings-python from 1.17.0 to 1.18.2 in the mkdocstrings group by @dependabot[bot] in #440
• Bump types-pyyaml from 6.0.12.20250516 to 6.0.12.20250822 by @dependabot[bot] in #439
• Bump actions/download-artifact from 4 to 5 in the artifacts group by @dependabot[bot] in #438
• Bump types-colorama from 0.4.15.20240311 to 0.4.15.20250801 by @dependabot[bot] in #436
• Bump actions/checkout from 4 to 5 by @dependabot[bot] in #437
• Bump pydoclint from 0.6.6 to 0.6.11 by @dependabot[bot] in #434
• Bump setuptools-scm[toml] from 8.3.1 to 9.2.0 by @dependabot[bot] in #435
• Bump the minor group with 5 updates by @dependabot[bot] in #452
• Bump types-pyyaml from 6.0.12.20250822 to 6.0.12.20250915 by @dependabot[bot] in #454
• Bump the patch group across 1 directory with 4 updates by @dependabot[bot] in #455
• Bump actions/labeler from 5.0.0 to 6.0.1 by @dependabot[bot] in #450
• Bump pydoclint from 0.6.11 to 0.7.3 by @dependabot[bot] in #453
• Support pylint 4 by @Marenz in #457
• Bump actions/upload-artifact from 4 to 5 by @dependabot[bot] in #459
• Bump isort from 6.0.1 to 7.0.0 by @dependabot[bot] in #464
• Bump nox from 2025.5.1 to 2025.10.16 in the minor group by @dependabot[bot] in #462
• Add Dependabot auto-merge workflow and migration script by @Marenz in #466
• Fix invalid YAML formatting in Dependabot workflow template by @Marenz in #469
• Bump actions/checkout from 5 to 6 by @dependabot[bot] in #476
• Bump the patch group across 1 directory with 3 updates by @dependabot[bot] in #478
• Add support for mkdocstrings-python v2 by @llucax in #481
• Merge v0.13.8 into v0.x.x by @llucax in #480
• Bump the minor group with 7 updates by @dependabot[bot] in #488
• Bump pytest from 9.0.1 to 9.0.2 in the patch group by @dependabot[bot] in #487
• Bump frequenz-floss/gh-action-nox from 1.0.1 to 1.1.0 in the compatible group by @dependabot[bot] in #475
• Bump pydoclint from 0.7.3 to 0.8.3 by @dependabot[bot] in #477
• Bump actions/download-artifact from 5 to 6 by @dependabot[bot] in #460
• Prepare for release v0.14.0 by @llucax in #490
• Update mypy-protobuf requirement from <4,>=3.0.0 to >=3.0.0,<5 by @dependabot[bot] in #489

Full Changelog: v0.13.8...v0.14.0

v0.13.8

Frequenz Repository Configuration Release Notes

New Features

• mkdocs-gen-files v0.6 is now supported.

What's Changed

• Add support for mkdocs-gen-files v0.6 by @llucax in #479

Full Changelog: v0.13.7...v0.13.8

v0.13.7

Frequenz Repository Configuration Release Notes

New Features

• Pytest v9.x is now supported.

What's Changed

• Widen pytest version upper bound to accept v9.x by @llucax in #473

Full Changelog: v0.13.6...v0.13.7

v0.13.6

Frequenz Repository Configuration Release Notes

New Features

• Pylint4 is now supported.

Cookiecutter template

• Dependencies have been updated.

What's Changed

• Clear release notes by @llucax in #419
• Support pylint 4 by @Marenz in #458

Full Changelog: v0.13.5...v0.13.6

v0.13.5

Frequenz Repository Configuration Release Notes

Bug Fixes

• Fixed some typos in the docs.

• Fixed wrong comparison for mike versions when versions were equal.

• Fixed version regex escaping of .. This means that a version like v0x1e1 were accepted as valid semver versions. Now this version is not considered a semver version anymore.

• setuptools.grpc_tools: Fix wrong passing of include paths when passed via:

  • Command-line: Now extra white-spaces and empty strings are removed, before they were passed to protoc -I.
  • pyproject.toml: Now an empty array/list can be passed to override the default paths, before this resulted in an empty string being passed to protoc -I.

What's Changed

• Clear release notes by @llucax in #405
• Fix typos in documentation by @llucax in #416
• setuptools: Fix passing empty include paths by @llucax in #418
• Fix missing comparison for equal versions by @llucax in #415

Full Changelog: v0.13.4...v0.13.5