5.0.2

Bug fixes

• Make refresh-release-lock in check mode install the Nab version that the committed pylock.toml records in [tool.nab] nab-version, and fail if the lock records none. A Nab release newer than that version rewrites the field, so every committed lock failed the check until the weekly refresh. refresh mode still installs the newest Nab under the cutoff, and nab-git-commit still installs from that commit in both modes (#22) by @gaborbernat.
• Make validate-news reject a pull request that removes pylock.toml when the project has a nab.toml, as it already did for a [tool.nab] table in pyproject.toml (#22) by @gaborbernat.

Documentation

• Say that check-tagged-source reads the tag of a non-tag run from the tag input of the workflow_dispatch event, github.event.inputs.tag, rather than from an input of the Action (#22) by @gaborbernat.

Security

• Make the Actions install their own tools, such as Nab, packaging, certifi, and pypi-attestations, from PyPI even when the caller's repository or environment configures another index. The installer now ignores uv.toml, [tool.uv] in pyproject.toml, and the UV_INDEX, UV_INDEX_URL, UV_DEFAULT_INDEX, UV_EXTRA_INDEX_URL, UV_FIND_LINKS, UV_CONFIG_FILE, UV_INSECURE_HOST, UV_SYSTEM_CERTS, SSL_CERT_FILE, and SSL_CERT_DIR variables, as cooled-prek already does (#22) by @gaborbernat.

Full Changelog