[ali92hm]

Fixes for a batch of issues found while reviewing the project after #37/#38.

Real bugs

• Generated project wheels no longer ship a top-level tests package. [tool.setuptools.packages.find] had include = ["*"]/exclude = [], which picked up tests/ (it has __init__.py). Anyone pip installing a generated package got a tests module dumped into site-packages. Fixed to include = ["<snake_case>*"]/exclude = ["tests*"]. Verified by building a real wheel: tests/ is gone from top_level.txt.
• Project-name validation accepted Python keywords and rejected single-character names. The hand-rolled regex ^[_a-zA-Z][_a-zA-Z0-9]+$ required 2+ characters and didn't check keywords, so a project named class would generate an unimportable package (import class is a SyntaxError), while x or _ were wrongly rejected. Replaced with str.isidentifier() and not keyword.iskeyword(...). Added test cases for both.
• Three broken links in the root README — ./docs/development-instructions, ./docs/tool-choices, ./docs/project-structure were all missing .md.

CI deprecation warnings (confirmed from an actual Windows job log)

• PEP 639 license migration: project.license as a TOML table is deprecated / License classifiers are deprecated, four times per build, in both pyproject.tomls. Switched to license = "<SPDX id>" / license-files = ["LICENSE"] and dropped the License :: classifiers. cookiecutter.json's _pypi_license_map is renamed _spdx_license_map and now holds SPDX identifiers. Verified: rebuilt wheel now has zero warnings and License-Expression: MIT in its metadata.
• Node 20 deprecation: bumped actions/checkout/actions/setup-python to v7 (checked live via gh api, not guessed) in all four workflow files.
• Black interpreter-version warning: set target-version = ["py311"] in both pyproject.tomls.

Cleanup

• pytest-cov was installed and configured but never actually invoked — wired --cov into make test-unit in both trees.
• Dropped the unused wheel dev dependency from the template (the build backend supplies it via the isolated build env).
• .vscode/settings.json/extensions.json referenced settings and an extension (python.linting.*, python.formatting.provider, bungcip.better-toml) that no longer exist/are unmaintained; replaced with current equivalents, in both the repo and the template.
• Added .github/dependabot.yml for pip (both trees) and github-actions.
• tests/e2e/test_e2e.py's make init was installing the generated project's dependencies into whatever environment ran the test suite. It now creates a throwaway venv per baked project.
• Declared all Makefile targets .PHONY, documented the ARGS passthrough on test-* targets.
• Wrote real content for docs/tool-choices.md and CONTRIBUTING.md (root and template) — both were stubs linked from the README as if complete.
• Bumped the minimum supported Python version to 3.11 and added 3.14 to the CI matrix (3.10 reaches EOL 2026-10-31 — checked live, not assumed).

Testing

All run locally with real dependencies (Python 3.11), not simulated:

• make check-style / make check-types — pass
• make test-unit (now with coverage) — 24/24 pass
• make test-integration — 18/18 pass, across all license variants (exercises the new SPDX license logic through the real cookiecutter renderer)
• make test-e2e (with the new per-project venv isolation) — 2/2 pass
• Manually baked a project with the real cookiecutter CLI and confirmed: rendered pyproject.toml/workflows are correct, the built wheel has no tests/ package and correct License-Expression metadata with zero build warnings, check-version.sh/release-tag.sh still behave correctly, and make test-unit/check-style/check-types all pass inside the generated project

Known caveat

.github/dependabot.yml's directory: "/{{cookiecutter.__project_name_kebab_case}}" entry parses as valid YAML but wasn't validated against GitHub's actual Dependabot config parser (that needs a live push). Worth checking the Dependabot "Insights" tab after this merges.

🤖 Generated with Claude Code