Repository navigation
👷 ci(release): adopt github-workflows 6.0.1 - #43
Merged
Merged
Conversation
gaborbernat
changed the title
gaborbernat
force-pushed
the
fix/release-contract
branch
from
October 25, 2026 22:20
3f48ee3 to
76a1654
Compare
gaborbernat
changed the title
gaborbernat
force-pushed
the
fix/release-contract
branch
from
October 26, 2026 00:00
76a1654 to
5d5acad
Compare
gaborbernat
changed the title
gaborbernat
force-pushed
the
fix/release-contract
branch
from
October 26, 2026 01:00
5d5acad to
9b2d840
Compare
gaborbernat
changed the title
gaborbernat
changed the title
gaborbernat
force-pushed
the
fix/release-contract
branch
4 times, most recently
from
October 26, 2026 20:58
6f16ffa to
46ef72f
Compare
gaborbernat
changed the title
gaborbernat
force-pushed
the
fix/release-contract
branch
3 times, most recently
from
October 26, 2026 23:40
2f1aeaf to
5e35356
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+51
to
+57
| - name: 📥 Check out code | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| ref: ${{ needs.verify-tag.outputs.commit }} | ||
| fetch-depth: 0 | ||
| persist-credentials: false | ||
| - name: 🐍 Install uv |
gaborbernat
force-pushed
the
fix/release-contract
branch
from
October 27, 2026 01:57
5e35356 to
f691c05
Compare
Use the shared release workflows from github-workflows 6.0.1 for news checks, release preparation and the weekly lock refresh. Prepare picks a v-prefixed version from the fragments and runs release-creator contributors to add a New Contributors section from the commit authors and co-authors before the release App pushes the annotated tag. CONTRIBUTING now says credits come from the commit, not from the fragment. Writers are trusted, so the release path no longer re-checks what they did. The check-tagged-source step, the tag format, main ancestry and release-creator tags checks in verify-tag, the re-check that the tag still names the release commit, and the floating-tag job's main ancestry, moved-tag and published-release checks are gone. So are the main-only condition on Prepare release, the redundant pull_request condition on the news job, and test_release_workflow.py with its CI job, which only covered those checks. verify-tag now just resolves the tag to its commit from a shallow checkout, without installing uv or the release tools, and is named for that. The notes job still skips prereleases, and the floating tags still move only when the release is the newest in its series. Nab writes pylock.toml from a [tool.nab] table, with a temporary upload cutoff exception for release-creator 4.1.0. A build group holds Cython and setuptools, since PyYAML has no CPython 3.15 wheel. The release, release-check and release-validate groups are gone. Every workflow, job and step gets an emoji name, including the steps of the action itself, whose two unnamed steps now have names. The required checks become "🚦 Required checks pass" and "📝 News fragment". The hook cooldown check and its scheduled rerun are gone. Dependabot's pre-commit ecosystem and pre-commit.ci's quarterly autoupdate update the hooks, so the release-creator managed hook pins are dropped. setup-uv is pinned to 10.3.2 in CI and in the action. CodeQL moves from default setup to a committed advanced workflow on ubuntu-26.04 with the same languages and query suite.
gaborbernat
force-pushed
the
fix/release-contract
branch
from
October 27, 2026 04:00
f691c05 to
2f2e2de
Compare
gaborbernat
marked this pull request as ready for review
October 27, 2026 05:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cutting a release of the Action meant typing an exact version into Prepare release and relying on a hand-written bash script to stitch news fragments into the changelog. This PR moves the release pipeline onto tox-dev/github-workflows 6.0.1 and release-creator 4.1.0. 🏷️ Maintainers pick
auto,major,minororpatch, and each release gets a categorized changelog with pull request links and credits for the commit authors andCo-authored-byco-authors.Contributors no longer put a PR number or a credit line in their fragment:
+topic.feature.mdworks, and the fragment categories grow from three to ten. CONTRIBUTING.md documents those rules and the release flow. The existing CHANGELOG.md history is rewritten into the same sectioned format, with PR links and authors on each past entry.Architecture
The shared
prepare-towncrier-releaseworkflow owns release preparation. It computes thev-prefixed version from the pending fragments, builds the changelog with Towncrier, runsprek, and has the repository-scoped GitHub App push the release commit and an annotated tag.The tag push starts this repo's own pipeline: one job resolves the tag to its commit, the shared
render-release-notesandpublish-github-releaseactions turn that version's changelog section into the GitHub Release, and a local job movesv1andv1.0with the App token. The notes job skips prereleases, and a floating tag moves only when the release is the newest in its series.The release path trusts people with write access and stops re-checking their work outside a PR. The tag-format check and the
main-only guard on Prepare release are gone. Pull requests remain the validation point: the news check moves to its own workflow on the sharedvalidate-newsaction and reruns when theskip newslabel changes.The release tools (
release-creator,towncrier,prek) install from apylock.tomlthat nab writes from a[tool.nab]table in a new tool-onlypyproject.toml. The lock takes packages uploaded at least seven days ago, targets Python 3.15 onlinux_x86_64, and carries a temporary exception for release-creator 4.1.0 that expires on 2026-11-02. Abuildgroup locks Cython and setuptools because PyYAML 6.0.3 ships no CPython 3.15 wheel. A weekly run of the sharedupgrade-release-toolsworkflow refreshes the lock.Impact
--python 3.15, souv runanduvxpick the interpreter, andUV_PYTHONis unset for thepre-commitprocess. The Action also moves to setup-uv 10.3.2 withversion: latest-known, its steps get emoji names (the two unnamed ones get names), so the step names in users' logs change, and the README examples pin actions by commit SHA. The PR carries no news fragment for this change.Hook revisions are frozen to commit SHAs. Dependabot's
pre-commitecosystem updates them weekly with a seven-day cooldown, next to pre-commit.ci's quarterly autoupdate. New hooks run mdformat, shfmt, shellcheck and yamlfmt. Each workflow, job and step name now starts with one emoji, which renames two required checks.🛡️ CodeQL
CodeQL moves from default setup to a committed workflow on
ubuntu-26.04that scansactionswith thesecurity-extendedsuite, which adds checks such as untrusted checkouts and unpinned action tags that matter for a published Action. Moving off default setup also removes itsubuntu-latestmigration notice.