A Copier template that scaffolds a fully-gated Python project — pre-commit hooks, ruff, basedpyright, pytest with branch coverage, optional property/mutation/policy tests, optional scanners and dependency audit, and a just ci gate that is green from the first commit.
copier copy --trust gh:maybebyte/python-kickstarter ./myproj
--trust is required on both copy and update because the template uses Copier's _tasks (and reserves _migrations for future breaking renames) — features Copier classifies as "unsafe".
To update a downstream project after a new template release:
copier update --trust
Hooks are installed on copy unless git's core.hooksPath is set (pre-commit refuses to install under it); the copy then skips that step with a hint instead of failing.
To render the project as a subdirectory of a repository you already have, answer in_existing_repo with yes (or pass it as data):
copier copy --trust --data in_existing_repo=true gh:maybebyte/python-kickstarter ./subdir
This skips git init and the hook install, and does not render the root-only files GitHub and Renovate read only at the repository root: .github/workflows/*.yml, .pre-commit-config.yaml, and renovate.json. Recreate them at the root by hand if you want CI, hooks, or Renovate for the subproject (the workflows need a working-directory). Without the answer, copying into a subdirectory of a repository aborts rather than silently creating a nested one.
All toggles default to true — every guardrail layer ships unless you opt out.
| Toggle | What it enables |
|---|---|
enable_property_tests |
Hypothesis property suite (just fuzz) |
enable_mutation_tests |
mutmut mutation suite (just mutate) |
enable_policy_tests |
stdlib policy assertions (just policy) |
enable_scanners |
Semgrep + gitleaks scan recipe (just scan) |
enable_dependency_audit |
pip-audit recipe (just audit) |
enable_renovate |
Renovate bot config |
enable_sha_pin_policy |
zizmor workflow audit in CI, plus a CI policy test asserting all Action SHAs are pinned — the policy test requires enable_policy_tests (only the zizmor audit ships otherwise) |
enable_changelog |
CHANGELOG.md plus a PR-only changelog.yml check: a PR that touches src/ or pyproject.toml must also add a line to CHANGELOG.md, or carry the skip-changelog label |
Beyond the local recipes, several toggles also emit GitHub Actions workflows: enable_scanners, enable_dependency_audit, and enable_sha_pin_policy each contribute steps to a generated scan.yml (semgrep + gitleaks, pip-audit, and zizmor respectively), enable_mutation_tests emits a scheduled mutation.yml, and enable_changelog emits a PR-only changelog.yml. The always-on ci.yml runs the just ci gate on a Python-version matrix covering every interpreter at or above the project's requires-python floor (a single leg for the 3.13 default).
See AGENTS.md for the template extension contract (adding guardrail layers, releasing, CI pinning rules).
ISC — see LICENSE. Generated projects get their own license, chosen at copy time (MIT, Apache-2.0, ISC, or proprietary).