Sourced from frequenz-repo-config's releases.

v0.17.0

Frequenz Repository Configuration Release Notes

Summary

This release improves workflows security, adds a black migration workflow, and fixes failed migrations from version v0.16.0.

Upgrading

Cookiecutter template

All upgrading should be done via the migration script or regenerating the templates.

curl -sSLf https://raw.githubusercontent.com/frequenz-floss/frequenz-repo-config-python/<tag>/cookiecutter/migrate.py | python3 -I

But you might still need to adapt your code:

New Features

Cookiecutter template

• Add a black-migration.yaml workflow that automatically reformats code when Dependabot upgrades black.

Bug Fixes

Cookiecutter template

• Fix migration of CI workflow matrices that used arch/os dimensions with values different from the default template. The v0.16.0 migration relied on exact string matching, so projects with customized matrix items (for example arch: [amd64], os: [ubuntu-24.04]) could be left only partially migrated. The new migration step rebuilds the platform entries from the existing arch/os values and only rewrites runs-on when it still points to the old matrix keys.
• Improve workflows security: tighten permissions, avoid potential shell injection, run Python in isolated mode, pin all dependencies using the SHA hash.

What's Changed

• Fix the cookiecutter migration script template by @​llucax in frequenz-floss/frequenz-repo-config-python#540
• build(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 by @​dependabot[bot] in frequenz-floss/frequenz-repo-config-python#542
• build(deps): bump the patch group with 5 updates by @​dependabot[bot] in frequenz-floss/frequenz-repo-config-python#543
• build(deps-dev): bump the minor group with 2 updates by @​dependabot[bot] in frequenz-floss/frequenz-repo-config-python#544
• Reset release notes and migration script by @​llucax in frequenz-floss/frequenz-repo-config-python#539
• Improve workflows security by @​llucax in frequenz-floss/frequenz-repo-config-python#546
• build(deps-dev): bump mkdocs-material from 9.7.5 to 9.7.6 in the patch group by @​dependabot[bot] in frequenz-floss/frequenz-repo-config-python#550
• build(deps-dev): bump setuptools-scm from 9.2.2 to 10.0.3 by @​dependabot[bot] in frequenz-floss/frequenz-repo-config-python#552
• build(deps-dev): update sybil requirement from <10,>=6.1.1 to >=6.1.1,<11 by @​dependabot[bot] in frequenz-floss/frequenz-repo-config-python#553
• Add black auto-migration workflow by @​llucax in frequenz-floss/frequenz-repo-config-python#556
• Handle private repos in workflow migration by @​llucax in frequenz-floss/frequenz-repo-config-python#548
• migrate: Fix missed CI platform matrix migrations by @​llucax in frequenz-floss/frequenz-repo-config-python#549
• Remove chardet pinning by @​llucax in frequenz-floss/frequenz-repo-config-python#554
• Prepare for v0.17.0 release by @​llucax in frequenz-floss/frequenz-repo-config-python#557

... (truncated)

• 5814b77 Prepare for v0.17.0 release (#557)
• 3d3a0de template: Bump version to the upcoming v0.17.0
• b8165c5 Prepare release notes for the v0.17.0 release
• 9bc1d61 Fix wrong trailing quote in migration script
• f125700 Normalize tag comment
• 488c80c Remove chardet pinning (#554)
• 2ad88e7 migrate: Fix missed CI platform matrix migrations (#549)
• eec17e3 Handle private repos in workflow migration (#548)
• ce994a3 Add black auto-migration workflow (#556)
• 5800adf Add release notes
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions