👷 ci: shared workflows and dependency hygiene

.github/workflows/check.yaml

@@ -16,52 +16,29 @@ permissions:
 jobs:
   test:
     name: 🧪 Test
-    runs-on: ubuntu-26.04
-    strategy:
-      fail-fast: false
-      matrix:
-        env:
-          - "3.15"
-          - "3.15t"
-          - "3.14"
-          - "3.13"
-          - "3.12"
-          - "3.11"
-          - type
-          - dev
-          - pkg_meta
-    steps:
-      - name: 📥 Check out code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - name: 🐍 Install uv
-        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
-        with:
-          python-version: "3.15"
-          enable-cache: false
-          cache-dependency-glob: "pyproject.toml"
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-      - name: 📦 Install tox
-        run: uv tool install --python-preference only-managed --python 3.15 tox --with tox-uv
-      - name: 🐍 Install Python
-        if: startsWith(matrix.env, '3.') && matrix.env != '3.15'
-        run: uv python install --python-preference only-managed ${{ matrix.env }}
-      - name: 📦 Set up test suite
-        run: tox run -vv --notest --skip-missing-interpreters false -e ${{ matrix.env }}
-      - name: 🧪 Run test suite
-        run: tox run --skip-pkg-install -e ${{ matrix.env }}
-        env:
-          PYTEST_ADDOPTS: "-vv --durations=20"
-          DIFF_AGAINST: HEAD
+    uses: tox-dev/github-workflows/.github/workflows/check.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+    permissions:
+      contents: read
+    with:
+      include: |
+        [
+          {"env": "3.15"},
+          {"env": "3.15t", "python": "3.15t"},
+          {"env": "3.14", "python": "3.14"},
+          {"env": "3.13", "python": "3.13"},
+          {"env": "3.12", "python": "3.12"},
+          {"env": "3.11", "python": "3.11"},
+          {"env": "type"},
+          {"env": "dev"},
+          {"env": "pkg_meta"}
+        ]
   gate:
     name: 🚦 Required checks pass
     if: ${{ !cancelled() }} # codespell:ignore cancelled
     needs: [test]
     runs-on: ubuntu-26.04
     steps:
       - name: 🚦 Require all needed jobs to pass
-        env:
-          NEEDS_JSON: ${{ toJSON(needs) }}
-        run: jq -e 'all(to_entries[]; .value.result == "success")' <<<"$NEEDS_JSON"
+        uses: tox-dev/github-workflows/required-checks@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+        with:
+          needs: ${{ toJSON(needs) }}

.github/workflows/codeql.yaml

@@ -12,30 +12,11 @@ concurrency:
 permissions: {}
 jobs:
   analyze:
-    name: 🛡️ Analyze ${{ matrix.language }}
-    runs-on: ubuntu-26.04
+    name: 🛡️ Analyze
+    uses: tox-dev/github-workflows/.github/workflows/codeql.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
     permissions:
       contents: read
       security-events: write
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [actions, python]
-    steps:
-      - name: 📥 Check out code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: 🛡️ Initialize CodeQL
-        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: none
-          queries: security-extended
-          config: |
-            paths-ignore:
-              - tests
-      - name: 🛡️ Analyze
-        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
-        with:
-          category: "/language:${{ matrix.language }}"
+    with:
+      languages: '["actions","python"]'
+      paths-ignore: '["tests"]'

.github/workflows/news.yaml

@@ -16,14 +16,14 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: 🐍 Install uv
-        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           python-version: "3.15"
           enable-cache: false
       - name: 📦 Install locked release tools
-        uses: tox-dev/github-workflows/install-locked-tools@99024bcb5749b178c5514f86acfcf1e80c865e75 # 6.3.0
+        uses: tox-dev/github-workflows/install-locked-tools@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
         with:
           groups: release-news
           venv: ${{ runner.temp }}/release-tools
       - name: 🔍 Validate news fragments
-        uses: tox-dev/github-workflows/validate-news@99024bcb5749b178c5514f86acfcf1e80c865e75 # 6.3.0
+        uses: tox-dev/github-workflows/validate-news@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0

.github/workflows/prepare-release.yaml

@@ -17,7 +17,7 @@ jobs:
   prepare:
     name: 🏷️ Prepare Towncrier release
     if: github.repository == 'pytest-dev/pytest-print'
-    uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
+    uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
     permissions:
       contents: read
       pull-requests: read

.github/workflows/release.yaml

@@ -10,48 +10,20 @@ concurrency:
 jobs:
   build:
     name: 🏗️ Build
-    uses: tox-dev/github-workflows/.github/workflows/validate-python-release.yaml@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
+    uses: tox-dev/github-workflows/.github/workflows/validate-python-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
     permissions:
       contents: read
-  github-notes:
+  notes:
     name: 📝 Render GitHub Release notes
-    runs-on: ubuntu-26.04
+    uses: tox-dev/github-workflows/.github/workflows/release-notes.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
     permissions:
       contents: read
-    outputs:
-      artifact-id: ${{ steps.upload.outputs.artifact-id }}
-    steps:
-      - name: 📥 Check out code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - name: 🐍 Install uv
-        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
-        with:
-          python-version: "3.15"
-          enable-cache: false
-      - name: 📦 Install locked release tools
-        uses: tox-dev/github-workflows/install-locked-tools@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
-        with:
-          groups: release-notes
-          venv: ${{ runner.temp }}/release-tools
-      - name: 📝 Render release notes
-        uses: tox-dev/github-workflows/render-release-notes@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
-        with:
-          tag: ${{ github.ref_name }}
-          changelog: CHANGELOG.md
-          artifact-url: https://pypi.org/project/pytest-print/${{ github.ref_name }}/
-      - name: 📤 Upload release notes
-        id: upload
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: github-release-notes
-          path: ${{ runner.temp }}/release-notes.md
-          if-no-files-found: error
+    with:
+      tag: ${{ github.ref_name }}
+      artifact-url: https://pypi.org/project/pytest-print/${{ github.ref_name }}/
   release:
     name: 🚀 Publish to PyPI
-    needs: [build, github-notes]
+    needs: [build, notes]
     runs-on: ubuntu-26.04
     environment:
       name: release
@@ -71,40 +43,13 @@ jobs:
           attestations: true
   github-release:
     name: 🚀 Publish GitHub Release
-    needs: [build, release, github-notes]
-    runs-on: ubuntu-26.04
+    needs: [build, release, notes]
+    uses: tox-dev/github-workflows/.github/workflows/github-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
     permissions:
       contents: write
-    steps:
-      - name: 🐍 Install uv
-        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
-        with:
-          version: latest-known
-          python-version: "3.15"
-          enable-cache: false
-          ignore-empty-workdir: true
-      - name: 📩 Download distributions
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          artifact-ids: ${{ needs.build.outputs.distributions-artifact-id }}
-          path: dist/
-      - name: 📩 Download release notes
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          artifact-ids: ${{ needs.github-notes.outputs.artifact-id }}
-          path: ${{ runner.temp }}
-      - name: 🔍 Verify PyPI artifacts
-        uses: tox-dev/github-workflows/reconcile-pypi-artifacts@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
-        with:
-          project: pytest-print
-          version: ${{ github.ref_name }}
-          dist: dist/
-      - name: 🚀 Publish GitHub release
-        uses: tox-dev/github-workflows/publish-github-release@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
-        env:
-          GH_TOKEN: ${{ github.token }}
-        with:
-          tag: ${{ github.ref_name }}
-          commit: ${{ github.sha }}
-          title: ${{ github.ref_name }}
-          notes-file: ${{ runner.temp }}/release-notes.md
+    with:
+      project: pytest-print
+      version: ${{ github.ref_name }}
+      tag: ${{ github.ref_name }}
+      artifact-pattern: python-package-distributions
+      notes-artifact-id: ${{ needs.notes.outputs.artifact-id }}

.github/workflows/scorecard.yaml

@@ -23,4 +23,4 @@ jobs:
       pull-requests: read # read reviews for the Code-Review check
       security-events: write # upload the SARIF results to code scanning
       statuses: read # read commit statuses for the CI-Tests check
-    uses: tox-dev/github-workflows/.github/workflows/scorecard.yaml@cfb6d637a10b70da576575790eb3c806f57cd0b5
+    uses: tox-dev/github-workflows/.github/workflows/scorecard.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0

.github/workflows/upgrade-release-tools.yaml

@@ -10,7 +10,7 @@ concurrency:
 jobs:
   upgrade:
     name: 🔀 Upgrade release tools
-    uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
+    uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
     permissions:
       contents: read
     secrets:

pylock.toml

@@ -1501,7 +1501,7 @@ sha256 = "b531f0f90c4d6ec22f1f8e78996980048bd7d494b7d366b0cf98e39b293565e0"
 [[packages]]
 name = "pyyaml"
 version = "6.0.3"
-marker = "\"dev\" in dependency_groups or \"lint\" in dependency_groups or \"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups"
+marker = "\"dev\" in dependency_groups or \"lint\" in dependency_groups"
 requires-python = ">=3.8"
 index = "https://pypi.org/simple/"
 
@@ -1546,7 +1546,7 @@ sha256 = "d0dae1f74bb273b534770cb4cccb6bb78735540afdb03c2146f4e19dcd412560"
 
 [[packages]]
 name = "release-creator"
-version = "4.1.0"
+version = "4.2.0"
 marker = "\"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups"
 requires-python = ">=3.15"
 dependencies = [
@@ -1555,28 +1555,27 @@ dependencies = [
     { name = "mdformat" },
     { name = "mdformat-gfm" },
     { name = "packaging" },
-    { name = "pyyaml" },
     { name = "towncrier" },
 ]
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
-name = "release_creator-4.1.0.tar.gz"
-upload-time = 2026-10-26 18:24:45.805437+00:00
-url = "https://files.pythonhosted.org/packages/7f/fd/05d7f3c604476a238d67d5aaa2a4085312e7078c193dbd7ad99ad48d560d/release_creator-4.1.0.tar.gz"
-size = 186016
+name = "release_creator-4.2.0.tar.gz"
+upload-time = 2026-10-26 22:39:33.566239+00:00
+url = "https://files.pythonhosted.org/packages/0c/c2/6ff369a01a8fff3e4845e2a6989164b71b1662cba8e104ae9f0a2925ca43/release_creator-4.2.0.tar.gz"
+size = 163102
 
 [packages.sdist.hashes]
-sha256 = "c783037f5ca2efc16fa7cccfb1c2abf0a442f116a63ca82bd7bfb7e2a8343a15"
+sha256 = "5affc1e7a935aa816dfa16c03200b17f93f7d17d201e6a913c50e1e9e32bad2f"
 
 [[packages.wheels]]
-name = "release_creator-4.1.0-py3-none-any.whl"
-upload-time = 2026-10-26 18:24:44.353933+00:00
-url = "https://files.pythonhosted.org/packages/30/d0/38480e99025c021d07e0710af02547562dfadbd798bef26dc01869a3f81e/release_creator-4.1.0-py3-none-any.whl"
-size = 52922
+name = "release_creator-4.2.0-py3-none-any.whl"
+upload-time = 2026-10-26 22:39:32.212020+00:00
+url = "https://files.pythonhosted.org/packages/a5/c2/b1be3e0bff91e390890f3bc8e2d9307a1c2841bb3452798d013f2a2b741d/release_creator-4.2.0-py3-none-any.whl"
+size = 53089
 
 [packages.wheels.hashes]
-sha256 = "67deae16d11ac261a1512f18a22c0cf13418f43afc3e56cb74e58ad4422062e3"
+sha256 = "fe3048e7bc31ee0d757985bbc256290fc40b1ca4c76be574b6730752cbb5831f"
 
 [[packages]]
 name = "requests"
@@ -2145,7 +2144,6 @@ command-line = [
     "--all-groups",
     "--all-extras",
     "--no-cache",
-    "--upgrade",
 ]
 input-path = "pyproject.toml"
 mode = "universal"

pyproject.toml

@@ -214,5 +214,3 @@ uploaded-prior-to = "P7D"
 decision-order = "stable"
 matrix.python = ">=3.15,<3.16"
 matrix.platforms = [ "linux_x86_64" ]
-# temporary, delete after 2026-11-02
-packages.release-creator.uploaded-prior-to = 2026-10-26T18:24:46Z