[gaborbernat]

sphinx-argparse-cli cut releases with shell scripts of its own: the maintainer typed the version into the prepare dispatch, and the tag workflow cut the GitHub Release notes out of CHANGELOG.md with awk. This PR moves both onto the shared pipeline of github-workflows 6.0.1 and release-creator 4.1.0. 🚀 A release is now a dispatch with a bump choice that defaults to auto.

The changelog covers all 40 releases with version anchors, the release-creator categories, pull request links and author credits. Contributors stop writing credits: they come from commit authors and Co-authored-by trailers, and a new CONTRIBUTING.md lists the fragment types and when skip news applies. The PyPI project page also gets working links to the changelog and contribution guide, which the README links by relative path.

Architecture

The prepare workflow is a thin caller of prepare-towncrier-release, which picks the version from the towncrier fragments, assembles CHANGELOG.md, and pushes the release commit and tag with the release App. The tag workflow runs one build and one read-only notes job in parallel. PyPI publishing waits for both and uploads the build's own artifact over OIDC with attestations. A final job compares the PyPI digests with that artifact before it publishes the GitHub Release. Runs for the same tag queue behind each other instead of cancelling.

flowchart LR
    Tag[Tag push] --> Build[🏗️ Build]
    Tag --> Notes[📝 Render notes]
    Build --> PyPI[🚀 Publish to PyPI]
    Notes --> PyPI
    PyPI --> Release[🚀 Reconcile digests and publish GitHub Release]
    Build --> Release
    Notes --> Release
    classDef src fill:#cfe4ff,stroke:#1f6feb,color:#0b1f3a;
    classDef job fill:#d8f0d8,stroke:#2e8b57,color:#0f2e1a;
    classDef pub fill:#ffe3a3,stroke:#d29200,color:#3a2c00;
    class Tag src;
    class Build,Notes job;
    class PyPI,Release pub;

Loading

The tag workflow no longer checks the tag's shape or that CHANGELOG.md has a section for it. People with write access are trusted with tags, in line with github-workflows 6.0.0, which stopped re-checking the release tag and the patch that prepare had just produced. Pull requests stay the validation point: the news fragment check moves to its own workflow, which reacts to label changes, so adding or removing a label no longer reruns the test matrix. Since github-workflows 6.0.0 that check runs each validation only when the pull request touches the files it covers.

Release tools and hooks

The release tools install from a pylock.toml that Nab generates over every dependency group, for CPython 3.15 on linux_x86_64 with a seven-day upload window. release-creator has a temporary exception to that window at 2026-10-26T18:24:46Z, marked for removal after 2026-11-02. A new build group lists the build backends plus cython and setuptools, because the lock has only the PyYAML 6.0.3 sdist for that target. A weekly workflow refreshes the lock through the shared upgrade-release-tools. 🔒

pre-commit hooks are pinned to frozen commit SHAs. Dependabot updates them weekly with a seven-day cooldown and the skip news label, while pre-commit.ci autoupdate drops to quarterly.

🛡️ CodeQL

CodeQL moves from default setup to a committed workflow on ubuntu-26.04 that scans actions and Python with the security-extended suite and ignores tests and the roots Sphinx fixtures, which removes the ubuntu-latest migration notice default setup produces.