NEW_LIBRARY_CHECKLIST.md.jinja

# New library checklist: {{ project_name }}

Delete this file after completing setup.

## Step 1 — Local setup

```bash
uv sync --group dev
uv run pre-commit install --hook-type commit-msg
make check      # should pass on a fresh repo
```

Then fill in `docs/agents.md`. It ships as a skeleton with `TODO` markers, and it is the
page people hand to a coding assistant instead of the whole site — write it from the API
you actually wrote, verify every name it tells a caller to import, and delete the
guidance comment at the top. `https://bedrock-python.github.io/pg-partsmith/agents/` is
the worked example. `CONTRIBUTING.md` keeps it current from there.

```bash
make docs-build   # the page is in the nav, so the build fails without it
```

## Step 2 — Create GitHub repo and push

```bash
gh repo create {{ github_org }}/{{ project_slug }} --public \
  --description "{{ project_description }}"
git init
git add .
git commit -m "feat: initial release of {{ project_name }}"
git remote add origin https://github.com/{{ github_org }}/{{ project_slug }}.git
git push -u origin master
```

## Step 3 — Run setup script (after first CI pass)

Wait for the first CI run to complete (creates the "All checks passed" status),
then run from the template repo:

```bash
python /path/to/python-library-template/scripts/setup_repo.py {{ github_org }}/{{ project_slug }}
```

This configures (idempotent, re-run any time):
- GitHub environments (`pypi`, `github-pages`) and Pages (source: GitHub Actions)
- Actions: read-only workflow token by default, Release Please may open PRs
- Merge settings: squash or merge commit, branches deleted on merge, no wiki/projects,
  docs site as the homepage, topics from `pyproject` keywords
- Security: secret scanning, push protection, Dependabot alerts + security updates,
  private vulnerability reporting
- A `master` ruleset: pull requests only, no force-push or deletion, `All checks passed`
  required (left out with a warning if CI has not reported yet — re-run after it has)

## Step 4 — PyPI Trusted Publisher (manual)

Go to https://pypi.org/manage/account/publishing/ → Add pending publisher:

| Field | Value |
|---|---|
| PyPI project name | `{{ project_slug }}` |
| Owner | `{{ github_org }}` |
| Repository | `{{ project_slug }}` |
| Workflow | `publish.yml` |
| Environment | `pypi` |

## Step 5 — Codecov (manual)

1. Go to https://app.codecov.io → add repo `{{ github_org }}/{{ project_slug }}`
2. Copy the `CODECOV_TOKEN`
3. Add it: GitHub repo → Settings → Secrets → Actions → `CODECOV_TOKEN`

## Step 6 — First release

The project starts at `{{ initial_version }}`; Release Please cuts the first real
release (`0.1.0` from a `feat:` commit, `0.0.1` from a `fix:`).

After merging code, Release Please creates a release PR automatically. Check that
it bumps all three: `CHANGELOG.md`, `.release-please-manifest.json` **and**
`{{ package_name }}/__version__.py` — the last one only works thanks to the
`# x-release-please-version` anchor in that file, so never drop it.

Merge the PR → tag `{{ project_slug }}-v0.1.0` is created → PyPI publish triggers.

Or to publish manually:
```bash
git tag {{ project_slug }}-v0.1.0
git push origin {{ project_slug }}-v0.1.0
# Then create a GitHub Release from that tag
```

## Done ✓

- [ ] `make check` passes
- [ ] CI green on first push
- [ ] `setup_repo.py` ran successfully
- [ ] PyPI Trusted Publisher configured
- [ ] `CODECOV_TOKEN` secret added
- [ ] First release published to PyPI