REPOMATIC-LINT-REPO(1) REPOMATIC-LINT-REPO(1)

repomatic lint-repo - Check repository files against repomatic conventions

repomatic lint-repo [OPTIONS]

Run consistency checks on repository metadata.

Reads package_name, is_sphinx, and project_description from pyproject.toml in the current directory.

Checks, in report order. An error fails the command, a warning never does:


  - Package name matches the repository name (warning).


  - A Sphinx project's website field names the documentation URL declared in


    [project.urls] (warning).


  - GitHub Pages publishes from GitHub Actions, when site.deploy targets


    GitHub Pages (warning).


  - CLOUDFLARE_API_TOKEN secret set, when site.deploy targets Cloudflare


    Pages (warning).


  - CLOUDFLARE_R2_ACCESS_KEY_ID and CLOUDFLARE_R2_SECRET_ACCESS_KEY secrets


    set, when site.cloudflare-r2-bucket is declared (warning).


  - Legacy github.io URLs still redirect, for a site moved to Cloudflare


    Pages (warning).


  - Committed _redirects files survive the Cloudflare Pages engine: no


    dropped rules, no silent budget abort (error).


  - wrangler.toml agrees with the declared Cloudflare project name and


    compatibility date (warning).


  - No tracked file over the 25 MiB Cloudflare Pages limit, unless an R2


    bucket is declared to serve it (warning).


  - No leftover gh-pages branch in a Sphinx project (warning).


  - Repository description matches the project description (error).


  - GitHub topics are a subset of the pyproject.toml keywords (warning).


  - Funding file present when the owner has GitHub Sponsors (warning).


  - No stale draft release, whose tag is not a .dev0 (warning).


  - Every repository label is declared by a configured label source


    (warning).


  - Install guide download URLs resolve to real release assets (warning).


  - No active tag ruleset that can block a release tag push (warning).


  - At least one active branch ruleset (warning).


  - No classic branch protection rule beside the rulesets (warning).


  - Immutable releases enabled, for a package (warning).


  - Fork PR workflow approval policy strict enough (warning).


  - Actions required to be pinned to a full-length commit SHA (warning).


  - The latest PyPI release's provenance names this repository's


    release.yaml (warning).


  - Workflows and reusable-workflow callers declare their permissions


    (warning).


  - Every test-matrix exclude entry names a value on some matrix axis


    (warning).


  - Python classifiers, requires-python and the workflow test matrices agree


    (warning).


  - No job runs on a -latest alias or on an image outside the test matrices


    (warning).


  - Each release-only step tests the capability it needs, and runs on a


    release commit (warning).


  - The manpages.script lockfile pins a click-extra able to render man pages


    (warning).


  - Seeded tool configs carry every bundled template entry, or decline it


    with a reason (warning).


  - No bare [tool.lychee] exclude entry the bundled template now anchors


    (warning).


  - Inline upstream pins match the version the uses: refs name (error).


  - Inline upstream pins resolving under a cooldown carry their


    --exclude-newer-package exemption (error).


  - Every astral-sh/setup-uv step pins one uv version (warning).


  - The pinned uv carries a checksum in the pinned astral-sh/setup-uv


    (warning).


  - Workflows only ask repomatic show-metadata for keys it still emits


    (error).


  - Repository-local PR body templates sit in .github/pr-templates/ and


    carry valid frontmatter (warning).


  - VIRUSTOTAL_API_KEY secret set, when Nuitka is active (warning).


  - REPOMATIC_NOTIFICATIONS_PAT secret set, when the unsubscribe workflow is


    enabled (warning).


  - With a PAT, the administration, contents, issues, pull requests,


    Dependabot alerts and workflows permissions of REPOMATIC_PAT (error).


  - With a PAT, a REPOMATIC_PAT limited to this repository (warning).


  - With a PAT, a REPOMATIC_PAT without the Commit statuses permission


    (warning).

Repository name. Defaults to $GITHUB_REPOSITORY name component.
Repository in 'owner/repo' format. Defaults to $GITHUB_REPOSITORY.
Whether CLOUDFLARE_API_TOKEN is configured.
Whether CLOUDFLARE_R2_ACCESS_KEY_ID and CLOUDFLARE_R2_SECRET_ACCESS_KEY are both configured.
Whether REPOMATIC_NOTIFICATIONS_PAT is configured.
Whether REPOMATIC_PAT is configured, enabling the PAT capability checks. Auto-detected from the REPOMATIC_PAT environment variable when omitted.
Whether VIRUSTOTAL_API_KEY is configured.
Show this message and exit.

Repository name. Defaults to $GITHUB_REPOSITORY name component.
Repository in 'owner/repo' format. Defaults to $GITHUB_REPOSITORY.
Repository in 'owner/repo' format. Defaults to $GITHUB_REPOSITORY.
Whether CLOUDFLARE_API_TOKEN is configured.
Whether CLOUDFLARE_API_TOKEN is configured.
Whether CLOUDFLARE_R2_ACCESS_KEY_ID and CLOUDFLARE_R2_SECRET_ACCESS_KEY are both configured.
Whether CLOUDFLARE_R2_ACCESS_KEY_ID and CLOUDFLARE_R2_SECRET_ACCESS_KEY are both configured.
Whether REPOMATIC_NOTIFICATIONS_PAT is configured.
Whether REPOMATIC_NOTIFICATIONS_PAT is configured.
Whether REPOMATIC_PAT is configured, enabling the PAT capability checks. Auto-detected from the REPOMATIC_PAT environment variable when omitted.
Whether VIRUSTOTAL_API_KEY is configured.
Whether VIRUSTOTAL_API_KEY is configured.
Show this message and exit.

0
Success.
1
A runtime error, an aborted prompt (Ctrl-D), or a declined confirmation.
2
A usage error: unknown option, invalid value, missing operand, or an unparsable configuration file.
130
Interrupted with Ctrl-C: the process ends by SIGINT, reported as 130.

In GitHub Actions (reads pyproject.toml automatically)

repomatic lint\-repo \-\-repo\-name my\-package

Local run (derives repo from $GITHUB_REPOSITORY or --repo)

repomatic lint\-repo \-\-repo owner/repo

With PAT capability checks

repomatic lint\-repo \-\-has\-pat

Kevin Deldycke

2026-10-13 7.18.1.dev0