6.2.1

Changes

• validate-news reads the pull request's current labels from the API, so re-running an older Changelog run after adding skip news passes instead of failing on the labels the original event carried. Callers grant pull-requests: read to the job (#35) by @gaborbernat.

📜 Full Changelog

6.2.0

Changes

• publish-github-release credits first-time contributors on the GitHub Release, taking the list from GitHub's generated notes for the range since the previous tag and placing it above the package and comparison links. prepare-towncrier no longer adds a New Contributors subsection to the changelog (#34) by @gaborbernat.

📜 Full Changelog

6.1.0

Features

• render-release-notes takes one artifact-url per line, with matching artifact-label lines, so a project that publishes several packages lists them all on one row of the GitHub Release. Release bodies now come from release-creator 4.3.0, which marks each link with its ecosystem emoji (#32) by @gaborbernat.

📜 Full Changelog

6.0.3

Bug fixes

• Match release assets by the name GitHub stores, which replaces characters such as spaces with periods. A file named PyVenv Manage 2-2.4.7-signed.zip uploaded, but its draft stayed unpublished because the check expected the local name (#29) by @gaborbernat.

Full Changelog

6.0.2

Changes

• Admit the [tool.nab] per-package uploaded-prior-to exceptions in cooled-prek hook environments, so a hook dependency pinned past the seven-day cutoff installs the same way as the release lock. Before, prepare failed on such a pin (#28) by @gaborbernat.

Full Changelog

6.0.1

Bug fixes

• Check out the full history in the validate-python-release build job again, so version tools such as hatch-vcs and setuptools-scm see the release tag. 6.0.0 built 0.1.dev1+g<sha> instead of the tagged version (#25) by @gaborbernat.

Full Changelog

6.0.0

Features

• Every Action and reusable workflow now logs the choices it makes and why, and no longer hides tool output (#23) by @gaborbernat.
• Run each validate-news check only when the pull request touches what it validates: fragment validation when the fragment directory changes, the Towncrier configuration check when towncrier.toml or the tool.towncrier table changes, the lock check when a pyproject.toml, pylock.toml, root pylock.*.toml, or nab.toml changes, and the lock-removal guard when pylock.toml is deleted. Workflow changes no longer trigger the lock check, and every root pylock.*.toml does, whether or not it is the configured additional-lock. The fragment requirement for human pull requests still runs on every pull request (#23) by @gaborbernat.

Changes

• Drop the main branch condition from the writer job of upgrade-release-tools.yaml. The deployment branch rule of the release-auth environment still applies (#23) by @gaborbernat.
• Drop the source job of the github-workflows release workflow, which re-checked the tag that started it (#23) by @gaborbernat.
• Give every job and step in the shared workflows and Actions a name that starts with an emoji. Jobs of the reusable workflows show up in callers as <caller job> / <job name>, so required status checks that name them must be updated. publish-jetbrains-marketplace also recognizes a prior upload step named 🚀 Publish signed ZIP, the README's new name for the caller's publishing step (#23) by @gaborbernat.
• Make publish-github-release update an existing draft's title, notes, and prerelease flag on a rerun instead of failing, use the first Release when several share the tag, and create the draft in publish mode when none exists. It no longer compares the title, notes, and prerelease flag of an existing Release; the read-after-write retry and the asset name and digest checks stay (#23) by @gaborbernat.
• Stop commit-and-tag from requiring a clean working tree with only a staged patch; it commits whatever is staged (#23) by @gaborbernat.
• Stop publish-jetbrains-marketplace from inspecting earlier release environment deployments for the tag before an upload; the job no longer needs Deployments read access. Stop publish-post-release-pr from failing when an open pull request's title, body, or base changed, when several pull requests match, or when a merged pull request lost its skip news label; it re-applies the label instead (#23) by @gaborbernat.
• Stop refresh-release-lock from failing in refresh mode when the regenerated lock targets different environments. check mode still compares the whole lock (#23) by @gaborbernat.
• Stop checking the shape of built artifacts that the release jobs produce themselves. validate-python-release.yaml no longer requires an empty dist directory or exactly one wheel and one sdist at the tag's version, and build-python-distribution no longer requires an empty dist directory. reconcile-pypi-artifacts no longer rejects an empty dist, an invalid project name, or local files that are hidden, symbolic links, directories, or belong to another release; it compares every file in dist with PyPI (#23) by @gaborbernat.
• Stop re-checking files the release jobs produce themselves in the JetBrains Actions. sign-jetbrains-plugin no longer runs unzip -t on the unsigned or signed ZIP, checks for Java 17 or an existing signed ZIP, runs the signer's verify, or checks the signed ZIP's type and members. publish-jetbrains-marketplace no longer runs unzip -t, re-hashes the upload copy, or checks the file types of a downloaded receipt and earlier artifacts (#23) by @gaborbernat.
• Stop re-checking the release tag before publishing. publish-github-release no longer requires the remote tag to resolve to commit, which now only sets the target of a new Release. publish-jetbrains-marketplace no longer requires the remote tag to target commit or fails on an earlier upload of the tag from another commit. Drop the step that re-checks the tag before publish-github-release from callers that copied the README example (#23) by @gaborbernat.
• Stop validating caller input in the prepare and tag Actions. prepare-towncrier no longer rejects an unknown phase, a finalize run without version, a changelog-prefix other than empty or v, an explicit version that is not newer than existing tags, other hook configuration files, or an unknown changelog format; any changelog not ending in .rst is formatted with mdformat. read-towncrier-config no longer checks that the paths are normalized and inside the repository, that the changelog ends in .md or .rst, or that fragment categories are configured. select-previous-tag no longer requires the tag to exist locally or limits it to one namespace separator, and commit-and-tag no longer rejects an empty token or app-slug or an annotated value other than true or false; any value other than true creates a lightweight tag (#23) by @gaborbernat.
• Stop validating caller input in the publishing Actions. publish-github-release no longer rejects an empty tag, title, or notes file, a prerelease other than true or false, an unknown mode, or asset directories with hidden, non-regular, or unusually named entries. publish-jetbrains-marketplace no longer checks the archive name and type, the plugin ID, the channel, the tag ref, the notes file type, the artifact IDs, or that publish-token is set. sign-jetbrains-plugin no longer checks the archive name and type, and publish-post-release-pr no longer checks the format of its inputs or the allowed-paths entries (#23) by @gaborbernat.

Breaking changes

• Reduce validate-release-patch to applying the patch and checking its paths and file modes, and remove its version and checks inputs; remove them from callers. It no longer rejects a main branch that moved, a patch that leaves the changelog unchanged, or RST conflict markers, and it no longer runs release-creator validate-fragment-deletions, release-creator notes, the hook configuration check, or prek (#23) by @gaborbernat.
• Remove the app-slug and commit-message inputs from publish-post-release-pr; remove them from callers. The Action no longer compares the candidate's author, committer, and message with the App bot and the expected message, re-reads the branch, pull request head, or base after writing, or checks the files of an already merged pull request against the current base (#23) by @gaborbernat.
• Remove the check-tagged-source Action, and stop checking the tag in validate-python-release.yaml: the workflow no longer requires the tag to resolve to GITHUB_SHA or to sit on main, and checks out the tag with the default fetch depth. Remove check-tagged-source steps from callers (#23) by @gaborbernat.
• Remove the lock job from validate-python-release.yaml and prepare-towncrier-release.yaml, and the lock check from check-tagged-source. validate-news still checks the lock on the pull request that changes it. Both workflows drop the additional-lock, additional-lock-groups, additional-lock-selection, additional-matrix-python, additional-matrix-platforms, and additional-matrix-implementations inputs, and check-tagged-source drops them along with exclude-newer and exclude-newer-package; remove them from callers. Without the lock job, prepare-towncrier-release.yaml no longer skips a dispatch from a branch other than main (#23) by @gaborbernat.
• Remove the validate job from prepare-towncrier-release.yaml, which recalculated the version and ran release-creator and prek on the patch that assemble had just produced; push now depends on assemble alone. The workflow no longer installs the release-validate group (#23) by @gaborbernat.
• Remove the verify-lock and verify-groups inputs from install-locked-tools and verify-groups from export-build-constraints, together with the check_lock_groups.py check behind them; remove them from callers. install-locked-tools no longer checks that the requested groups exist in the lock or ...

5.0.2

Bug fixes

• Make refresh-release-lock in check mode install the Nab version that the committed pylock.toml records in [tool.nab] nab-version, and fail if the lock records none. A Nab release newer than that version rewrites the field, so every committed lock failed the check until the weekly refresh. refresh mode still installs the newest Nab under the cutoff, and nab-git-commit still installs from that commit in both modes (#22) by @gaborbernat.
• Make validate-news reject a pull request that removes pylock.toml when the project has a nab.toml, as it already did for a [tool.nab] table in pyproject.toml (#22) by @gaborbernat.

Documentation

• Say that check-tagged-source reads the tag of a non-tag run from the tag input of the workflow_dispatch event, github.event.inputs.tag, rather than from an input of the Action (#22) by @gaborbernat.

Security

• Make the Actions install their own tools, such as Nab, packaging, certifi, and pypi-attestations, from PyPI even when the caller's repository or environment configures another index. The installer now ignores uv.toml, [tool.uv] in pyproject.toml, and the UV_INDEX, UV_INDEX_URL, UV_DEFAULT_INDEX, UV_EXTRA_INDEX_URL, UV_FIND_LINKS, UV_CONFIG_FILE, UV_INSECURE_HOST, UV_SYSTEM_CERTS, SSL_CERT_FILE, and SSL_CERT_DIR variables, as cooled-prek already does (#22) by @gaborbernat.

Full Changelog

5.0.1

Bug fixes

• Install the whole Nab workspace from the nab-git-commit commit: nab and its nab-index, nab-markersets, nab-project, nab-provider, and nab-resolver sub-packages, which the root pins to an unreleased version (#21) by @gaborbernat.
• Let check-tagged-source accept a workflow_dispatch or other non-tag run, such as one from main with a tag input, when the checkout is the commit that tag names and that commit is on main. Tag runs still require the tag, GITHUB_SHA, and the checkout to match (#21) by @gaborbernat.

Full Changelog

5.0.0

Features

• Add exclude-newer and exclude-newer-package inputs to every Action and reusable workflow that installs its own tools. exclude-newer defaults to 7 days; exclude-newer-package takes newline-separated name=date overrides for an emergency (#20) by @gaborbernat.
• Add a temporary nab-git-commit input to refresh-release-lock and to the Actions and reusable workflows that call it. A full commit SHA installs Nab from notatallshaw/nab at that commit, with no cooldown, until a Nab release carries the fix (#20) by @gaborbernat.
• Add the cooled-prek Action, which runs prek with the root configuration and hook environments built under the seven-day cutoff. The prepare workflow now installs its hooks through it (#20) by @gaborbernat.
• Run release-creator contributors after the Towncrier build in prepare-towncrier, so the changelog section gets a "New Contributors" subsection. It needs release-creator 3.1.0 (#20) by @gaborbernat.

Changes

• Drop the hook pin mention from the default pull-request-body of upgrade-release-tools.yaml, which now reads "Refresh the project lock." (#20) by @gaborbernat.
• Let validate-news accept a pull request that removes pylock.toml when the project has no [tool.nab] table and no additional-lock is configured, so nothing would produce a lock (#20) by @gaborbernat.
• Make check-tagged-source require that the tag resolves to GITHUB_SHA, as the Python release build job does (#20) by @gaborbernat.
• Make the github-workflows release job check that the tag still resolves to the tagged commit before it creates the GitHub Release, and check the tag inline instead of through check-tagged-source (#20) by @gaborbernat.
• Reject a primary lock refresh that changes the lock's target environments, as the secondary lock refresh already does (#20) by @gaborbernat.

Breaking changes

• Accept only pylock.toml and the configured secondary lock in the upgrade-release-tools.yaml patch. pyproject.toml and uv.lock changes are rejected (#20) by @gaborbernat.
• Generate the primary pylock.toml with nab lock --all-groups --all-extras --no-cache, adding --upgrade in refresh mode, and compare a regenerated lock in check mode. The release-creator locks path and the uv resolver steps are gone, so relock a release-creator locks lock with Nab before re-pinning. Nab runs without SSL_CERT_FILE and SSL_CERT_DIR (#20) by @gaborbernat.
• Remove GitHub's generated notes from the release path: the generated-notes input of render-release-notes is gone, and the github-workflows release no longer has a Contents-write job that fetches contributor metadata. The read-only notes job now runs in parallel with the tag check and renders the notes from the full history alone (#20) by @gaborbernat.
• Remove the Actions' shared pylock.toml, its weekly refresh, and the lock-source input of install-locked-tools. The Actions now install the newest release of each of their own tools, above a minimum version, that is older than a seven-day cutoff, and install-locked-tools installs only from the caller's pylock.toml. Build constraints come from the caller lock's build group alone, without the shared Cython and setuptools pins (#20) by @gaborbernat.
• Remove the --shared-policy option and two-lock merging from tools/build_constraints.py; it now exports the build constraints of one lock (#20) by @gaborbernat.
• Remove the check-hook-update-cooldown and recheck-hook-update-cooldown Actions and the recheck-hook-cooldown.yaml workflow. Pull requests that change .pre-commit-config.yaml are no longer checked for hook revision age or dependency closure cooling; drop the hook-cooldown job and its scheduled rerun from callers (#20) by @gaborbernat.
• Remove the install-local-release-creator Action and the local-tool-source input of install-locked-tools and prepare-towncrier-release.yaml. A lock may no longer list release-creator as a local directory package (#20) by @gaborbernat.
• Remove the keep-uv-lock input of refresh-release-lock, validate-news, check-tagged-source, prepare-towncrier-release.yaml, upgrade-release-tools.yaml, and validate-python-release.yaml. A committed uv.lock is no longer refreshed or checked (#20) by @gaborbernat.
• Remove the refresh-mise-pin Action. Callers that pinned a mise binary with it keep jdx/mise-action's default release age instead (#20) by @gaborbernat.
• Remove the verify-frozen-hooks Action with its frozen revision, tagged hook provenance, and hook dependency closure checks. The shared prepare workflow and check-tagged-source no longer run it; drop it from custom tag jobs. prepare-towncrier and validate-release-patch now reject a prek.toml or a nested hook configuration before they run prek (#20) by @gaborbernat.
• Remove the hook refresh from upgrade-release-tools.yaml. The weekly updater no longer runs prek update --freeze --cooldown-days 7 or release-creator hooks, and its writer accepts only the lock patch; let Dependabot's pre-commit ecosystem update hook revisions instead (#20) by @gaborbernat.
• Remove the reviewed cutoff table, the recent cutoff check, the cutoff expiry, and the verify-cutoff-patch Action. Callers own their per-package uploaded-prior-to exceptions in [tool.nab], and gw neither checks nor expires them (#20) by @gaborbernat.
• Restructure validate-python-release.yaml. A keyless lock job checks the locks in parallel with build, which now checks the tag inline, including that it resolves to GITHUB_SHA, and exports its own build constraints; the source-check and constraints jobs and the build-constraints artifact are gone. The validate job, which ran twine check and check-wheel-contents, is removed; packages check their distributions with their own tox -e pkg_meta. The workflow no longer needs actions: read or pull-requests: read (#20) by @gaborbernat.
• Stop checking caller locks against PyPI metadata and upload times in install-locked-tools. check_lock_groups.py now only checks that the selected groups exist, and Nab's regenerate-and-compare check in refresh-release-lock guards the lock on pull requests, on tags, and in a new keyless lock job of prepare-towncrier-release.yaml that runs before assembly (#20) by @gaborbernat.
• Stop running prek on the tagged source. check-tagged-source now checks only the tag and the locks and no longer installs the caller's release-check group; the release patch is still checked with prek before it is pushed (#20) by @gaborbernat.

Packaging

• Lock github-workflows' own release-prepare and release-validate tools, with the build backends PyYAML needs, in a small pylock.toml made by Nab under the seven-day cutoff, so its release preparation installs them hash-checked from its own lock like every caller (#20) by @gaborbernat.

Full Changelog