feat: prepare focused v0.4.0 template refresh

[jlevy]

Summary

• update the frozen, 14-day-eligible uv, Copier, pytest, Ruff, and basedpyright versions
• pin GitHub Actions to reviewed full commit SHAs, disable persisted checkout credentials, and verify the uv download with its official SHA-256
• exact-pin build backends, include them in the locked build group, and build non-isolated from that environment
• enforce the 14-day resolver policy in generated project configuration, Makefiles, CI, and executable documentation paths
• add a timestamped supply-chain manifest and reproducible maintenance workflow for future releases

Why

This prepares the focused v0.4.0 minor release so newly rendered projects start with current eligible tooling without adopting releases younger than two weeks. It also closes gaps where direct uv commands, mutable action tags, unpinned runners, or isolated build resolution could bypass the documented policy.

Validation

• fresh default, proprietary/no-publish, and no-license renders
• clean Copier update from v0.3.0 with convergence to a fresh render and explicit answer override coverage
• Python 3.11, 3.12, 3.13, and 3.14 tests
• codespell, Ruff check/format, and basedpyright
• locked, non-isolated sdist and wheel build
• uv audit: no known vulnerabilities across 24 third-party packages
• 136 locked PyPI artifacts verified non-yanked, at or before the frozen cutoff, and matching recorded SHA-256 hashes
• Markdown formatting, workflow YAML parsing, and agent-skill validation

The eligible get-tbd 0.3.0 repository bootstrap migration is intentionally deferred: its 142-file f05/f06 and forkable-docs delta is unrelated to generated-project currency and is tracked separately.

---

Note

Medium Risk
Touches CI/publish workflows, dependency resolution defaults, and the release build path for all future renders; supply-chain controls are intentional but behavior changes (cool-off, non-isolated builds) need downstream validation.

Overview
Prepares the v0.4.0 minor release by freezing 14-day-eligible tool versions and tightening how generated projects resolve, install, and build dependencies.

Supply chain and tooling: Bumps pinned uv (0.11.25), Copier (9.16.0), and dev-tool floors (pytest, Ruff, basedpyright). Adds a frozen v0.4.0 supply-chain manifest and expands updating.md with a reproducible audit script and release checklist. Pins npm skill installer usage and hardens skill-validate CI with script ignore and a frozen before cutoff.

Generated projects: Sets [tool.uv] exclude-newer = "14 days" and exports UV_EXCLUDE_NEWER from Makefiles (template repo and rendered project). Documents uvx/uv add --exclude-newer and make install instead of raw uv sync across README, skill, and copier post-copy messages.

CI and Actions: Pins actions/checkout and setup-uv to full commit SHAs, disables persist-credentials, verifies uv with the official Linux checksum, and syncs with --all-groups. Release builds use uv build --no-build-isolation.

Build graph: Exact-pins hatchling and uv-dynamic-versioning in [build-system] and a new locked build dependency group so wheels/sdists come from uv.lock, not an isolated build resolver.

^{Reviewed by Cursor Bugbot for commit 69266fb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 69266fb. Configure here.}

[cursor]

Inventory script empty eligible crash

Low Severity

The new Step 1 inventory script uses max(...) on the eligible-release generator with no fallback. If every stable release for a package is newer than the 14-day cutoff (or none qualify), the generator is empty and the script raises ValueError instead of reporting that no eligible version exists.

Additional Locations (1)

• updating.md#L96-L98

 

^{Reviewed by Cursor Bugbot for commit 69266fb. Configure here.}