[coldsofttech]

Summary

First version of Sweepito (0.1.0): a CLI that finds the technologies in a repository and removes only the caches and build output that are safe to remove.

It only ever deletes paths that Git already ignores and does not track, inside the project root. A folder such as build/ is a candidate only when the project's own marker file is present (CMakeLists.txt, pom.xml, ...), never because of its name.

What's included

• Commands: scan, clean, check, report, rules, profiles, config, init, hook, doctor. Output uses Rich; --json stays plain for scripts.
• 17 built-in profiles, 97 rules (Python, Node.js and package managers, Rust, JVM, .NET, Go, C/C++, PHP, Ruby, Dart, Swift, Elixir, R, Jupyter, Terraform, common), kept as TOML data.
• Risk levels: safe runs by default, configurable and high-impact are opt-in via --enable / --risk. Rules a user writes themselves are custom, always on, and --risk custom runs only those.
• Configuration: sweepito.toml or [tool.sweepito], with custom path rules and profiles.
• Git hooks: native hook installer and .pre-commit-hooks.yaml.
• Project setup: docs, changelog, community files, Dependabot, and workflows for tests, lint and release.

Safety

• Only git-ignored, untracked paths inside the project root; .git is never touched.
• Symlinks and Windows junctions are never followed (a recursive delete could previously be steered out of a candidate through a junction; fixed and covered by regression tests).
• Tracked files are protected, and tracked state is re-read right before deleting.
• Custom rules use the same gates; exec rules are rejected.

Testing

• Unit and CLI tests, one integration module per profile, and integration tests for custom rules and links.
• Targeted runs pass locally (Python 3.11, Windows). The full matrix runs in CI on this PR: Ubuntu 3.11 to 3.15, Windows 3.11, macOS 3.11.
• Symlink tests are skipped locally for lack of privileges and will run on the Linux and macOS jobs.

Before releasing

• Enable private vulnerability reporting (used by SECURITY.md)
• Register the PyPI trusted publisher and pypi environment
• Tag v0.1.0 after merge (the README's pre-commit example pins it)