From 39cc0b5032f2b2aea97019312949d8a50a06b9a2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= Date: Tue, 3 Nov 2026 18:57:50 -0800 Subject: [PATCH 1/7] =?UTF-8?q?=F0=9F=91=B7=20ci(workflows):=20pin=20githu?= =?UTF-8?q?b-workflows=206.4.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/news.yaml | 4 ++-- .github/workflows/prepare-release.yml | 2 +- .github/workflows/release.yml | 6 +++--- .github/workflows/scorecard.yaml | 2 +- .github/workflows/upgrade-release-tools.yml | 2 +- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/news.yaml b/.github/workflows/news.yaml index 7b48de2..f7c0b3e 100644 --- a/.github/workflows/news.yaml +++ b/.github/workflows/news.yaml @@ -24,9 +24,9 @@ jobs: python-version: "3.15" enable-cache: false - name: 📦 Install locked release tools - uses: tox-dev/github-workflows/install-locked-tools@99024bcb5749b178c5514f86acfcf1e80c865e75 # 6.3.0 + uses: tox-dev/github-workflows/install-locked-tools@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 with: groups: release-news venv: ${{ runner.temp }}/release-tools - name: 🔍 Validate news fragments - uses: tox-dev/github-workflows/validate-news@99024bcb5749b178c5514f86acfcf1e80c865e75 # 6.3.0 + uses: tox-dev/github-workflows/validate-news@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index df0e410..2c16f9e 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -16,7 +16,7 @@ permissions: {} jobs: prepare: name: 🏷️ Prepare Towncrier release - uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1 + uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 permissions: contents: read pull-requests: read diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7be0a97..cd1a24a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -60,12 +60,12 @@ jobs: python-version: "3.15" enable-cache: false - name: 📦 Install locked release tools - uses: tox-dev/github-workflows/install-locked-tools@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1 + uses: tox-dev/github-workflows/install-locked-tools@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 with: groups: release-notes venv: ${{ runner.temp }}/release-tools - name: 📝 Render release notes - uses: tox-dev/github-workflows/render-release-notes@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1 + uses: tox-dev/github-workflows/render-release-notes@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 with: tag: ${{ needs.verify-tag.outputs.tag }} changelog: CHANGELOG.md @@ -91,7 +91,7 @@ jobs: artifact-ids: ${{ needs.notes.outputs.artifact-id }} path: ${{ runner.temp }} - name: 🚀 Publish GitHub release - uses: tox-dev/github-workflows/publish-github-release@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1 + uses: tox-dev/github-workflows/publish-github-release@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 env: GH_TOKEN: ${{ github.token }} with: diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml index 40a15ab..81912d8 100644 --- a/.github/workflows/scorecard.yaml +++ b/.github/workflows/scorecard.yaml @@ -23,4 +23,4 @@ jobs: pull-requests: read # read reviews for the Code-Review check security-events: write # upload the SARIF results to code scanning statuses: read # read commit statuses for the CI-Tests check - uses: tox-dev/github-workflows/.github/workflows/scorecard.yaml@cfb6d637a10b70da576575790eb3c806f57cd0b5 + uses: tox-dev/github-workflows/.github/workflows/scorecard.yaml@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 diff --git a/.github/workflows/upgrade-release-tools.yml b/.github/workflows/upgrade-release-tools.yml index 90bb14a..9b1b0ca 100644 --- a/.github/workflows/upgrade-release-tools.yml +++ b/.github/workflows/upgrade-release-tools.yml @@ -7,7 +7,7 @@ permissions: {} jobs: upgrade: name: 🔀 Upgrade release tools - uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1 + uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 permissions: contents: read secrets: From d71a11f8a90c3d7fff8e6f2177a2c8b081e9c730 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= Date: Tue, 3 Nov 2026 18:57:50 -0800 Subject: [PATCH 2/7] =?UTF-8?q?=F0=9F=91=B7=20ci(workflows):=20bump=20setu?= =?UTF-8?q?p-uv=20to=20v10.3.3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/main.yml | 4 ++-- .github/workflows/news.yaml | 2 +- .github/workflows/release.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 6a600e1..b3356a2 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -26,7 +26,7 @@ jobs: with: persist-credentials: false - name: 🐍 Install uv - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: version: latest-known python-version: "3.13" @@ -45,7 +45,7 @@ jobs: with: persist-credentials: false - name: 🐍 Install uv - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: version: latest-known python-version: "3.15" diff --git a/.github/workflows/news.yaml b/.github/workflows/news.yaml index f7c0b3e..53e2b27 100644 --- a/.github/workflows/news.yaml +++ b/.github/workflows/news.yaml @@ -18,7 +18,7 @@ jobs: fetch-depth: 0 persist-credentials: false - name: 🐍 Install uv - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: version: latest-known python-version: "3.15" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cd1a24a..c8a31a8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -54,7 +54,7 @@ jobs: fetch-depth: 0 persist-credentials: false - name: 🐍 Install uv - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: version: latest-known python-version: "3.15" From c0bf8a519cad923cadf2e95857c646c889c0c5c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= Date: Tue, 3 Nov 2026 18:57:50 -0800 Subject: [PATCH 3/7] =?UTF-8?q?=F0=9F=91=B7=20ci(workflows):=20cancel=20su?= =?UTF-8?q?perseded=20runs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/main.yml | 3 +++ .github/workflows/upgrade-release-tools.yml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index b3356a2..bbb3ed7 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -4,6 +4,9 @@ on: types: [opened, synchronize, reopened] push: branches: [main, test-me-*] +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true permissions: contents: read jobs: diff --git a/.github/workflows/upgrade-release-tools.yml b/.github/workflows/upgrade-release-tools.yml index 9b1b0ca..4753ae5 100644 --- a/.github/workflows/upgrade-release-tools.yml +++ b/.github/workflows/upgrade-release-tools.yml @@ -3,6 +3,9 @@ on: workflow_dispatch: schedule: - cron: 0 8 * * 2 +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true permissions: {} jobs: upgrade: From bc053d0b904886c7a63f7308a3a4976f148a3c9e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= Date: Tue, 3 Nov 2026 18:57:50 -0800 Subject: [PATCH 4/7] =?UTF-8?q?=F0=9F=94=92=20build(deps):=20drop=20expire?= =?UTF-8?q?d=20release-creator=20pin?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pylock.toml | 40 +++++++++++----------------------------- pyproject.toml | 2 -- 2 files changed, 11 insertions(+), 31 deletions(-) diff --git a/pylock.toml b/pylock.toml index 39e8711..09847f5 100644 --- a/pylock.toml +++ b/pylock.toml @@ -342,25 +342,9 @@ size = 6140221 [packages.wheels.hashes] sha256 = "c139c494fb1d9826688f8107d1514fa2a58f8f4a0f0527b68e7970fa50a8b723" -[[packages]] -name = "pyyaml" -version = "6.0.3" -marker = "\"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups" -requires-python = ">=3.8" -index = "https://pypi.org/simple/" - -[packages.sdist] -name = "pyyaml-6.0.3.tar.gz" -upload-time = 2025-09-25 21:33:16.546886+00:00 -url = "https://files.pythonhosted.org/packages/05/8e/961c0007c59b8dd7729d542c61a4d537767a59645b82a0b521206e1e25c2/pyyaml-6.0.3.tar.gz" -size = 130960 - -[packages.sdist.hashes] -sha256 = "d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f" - [[packages]] name = "release-creator" -version = "4.1.0" +version = "4.2.0" marker = "\"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups" requires-python = ">=3.15" dependencies = [ @@ -369,28 +353,27 @@ dependencies = [ { name = "mdformat" }, { name = "mdformat-gfm" }, { name = "packaging" }, - { name = "pyyaml" }, { name = "towncrier" }, ] index = "https://pypi.org/simple/" [packages.sdist] -name = "release_creator-4.1.0.tar.gz" -upload-time = 2026-10-26 18:24:45.805437+00:00 -url = "https://files.pythonhosted.org/packages/7f/fd/05d7f3c604476a238d67d5aaa2a4085312e7078c193dbd7ad99ad48d560d/release_creator-4.1.0.tar.gz" -size = 186016 +name = "release_creator-4.2.0.tar.gz" +upload-time = 2026-10-26 22:39:33.566239+00:00 +url = "https://files.pythonhosted.org/packages/0c/c2/6ff369a01a8fff3e4845e2a6989164b71b1662cba8e104ae9f0a2925ca43/release_creator-4.2.0.tar.gz" +size = 163102 [packages.sdist.hashes] -sha256 = "c783037f5ca2efc16fa7cccfb1c2abf0a442f116a63ca82bd7bfb7e2a8343a15" +sha256 = "5affc1e7a935aa816dfa16c03200b17f93f7d17d201e6a913c50e1e9e32bad2f" [[packages.wheels]] -name = "release_creator-4.1.0-py3-none-any.whl" -upload-time = 2026-10-26 18:24:44.353933+00:00 -url = "https://files.pythonhosted.org/packages/30/d0/38480e99025c021d07e0710af02547562dfadbd798bef26dc01869a3f81e/release_creator-4.1.0-py3-none-any.whl" -size = 52922 +name = "release_creator-4.2.0-py3-none-any.whl" +upload-time = 2026-10-26 22:39:32.212020+00:00 +url = "https://files.pythonhosted.org/packages/a5/c2/b1be3e0bff91e390890f3bc8e2d9307a1c2841bb3452798d013f2a2b741d/release_creator-4.2.0-py3-none-any.whl" +size = 53089 [packages.wheels.hashes] -sha256 = "67deae16d11ac261a1512f18a22c0cf13418f43afc3e56cb74e58ad4422062e3" +sha256 = "fe3048e7bc31ee0d757985bbc256290fc40b1ca4c76be574b6730752cbb5831f" [[packages]] name = "setuptools" @@ -489,7 +472,6 @@ command-line = [ "--all-groups", "--all-extras", "--no-cache", - "--upgrade", ] input-path = "pyproject.toml" mode = "universal" diff --git a/pyproject.toml b/pyproject.toml index 1d954d2..9810619 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -36,8 +36,6 @@ uploaded-prior-to = "P7D" decision-order = "stable" matrix.python = ">=3.15,<3.16" matrix.platforms = [ "linux_x86_64" ] -# temporary, delete after 2026-11-02 -packages.release-creator.uploaded-prior-to = 2026-10-26T18:24:46Z [tool.towncrier] name = "action-pre-commit-uv" From 6d282a851467dc9e9c967b2f5d74cec0edf0648e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= Date: Tue, 3 Nov 2026 20:08:15 -0800 Subject: [PATCH 5/7] =?UTF-8?q?=F0=9F=91=B7=20ci:=20run=20CodeQL=20through?= =?UTF-8?q?=20gw=206.5.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/codeql.yaml | 25 ++++--------------------- 1 file changed, 4 insertions(+), 21 deletions(-) diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml index 0b3925a..cd3c7e2 100644 --- a/.github/workflows/codeql.yaml +++ b/.github/workflows/codeql.yaml @@ -12,27 +12,10 @@ concurrency: permissions: {} jobs: analyze: - name: 🛡️ Analyze ${{ matrix.language }} - runs-on: ubuntu-26.04 + name: 🛡️ Analyze + uses: tox-dev/github-workflows/.github/workflows/codeql.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0 permissions: contents: read security-events: write - strategy: - fail-fast: false - matrix: - language: [actions] - steps: - - name: 📥 Check out code - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - - name: 🛡️ Initialize CodeQL - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 - with: - languages: ${{ matrix.language }} - build-mode: none - queries: security-extended - - name: 🛡️ Analyze - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 - with: - category: "/language:${{ matrix.language }}" + with: + languages: '["actions"]' From 8a1918b7aa8d76700fe8aba690a898cf14eb0611 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= Date: Tue, 3 Nov 2026 20:08:15 -0800 Subject: [PATCH 6/7] =?UTF-8?q?=F0=9F=91=B7=20ci:=20gate=20CI=20on=20the?= =?UTF-8?q?=20shared=20required-checks=20action?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The shared required-checks action checks the same needs context as the inline jq filter, and it is the one gate implementation every tox-dev repository uses. The gate job keeps its name so the branch ruleset still finds the required check. --- .github/workflows/main.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index bbb3ed7..07aff9f 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -62,8 +62,9 @@ jobs: if: always() needs: [self-test-uvx, self-test-uv-run, self-test-external-uv] runs-on: ubuntu-26.04 + permissions: {} steps: - name: 🚦 Require all needed jobs to pass - env: - NEEDS_JSON: ${{ toJSON(needs) }} - run: jq -e 'all(to_entries[]; .value.result == "success")' <<<"$NEEDS_JSON" + uses: tox-dev/github-workflows/required-checks@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0 + with: + needs: ${{ toJSON(needs) }} From bf10a41792888331d715793e4446a25fe41c2e3b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= Date: Tue, 3 Nov 2026 20:08:15 -0800 Subject: [PATCH 7/7] =?UTF-8?q?=F0=9F=91=B7=20ci:=20pin=20github-workflows?= =?UTF-8?q?=20to=206.5.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/news.yaml | 4 ++-- .github/workflows/prepare-release.yml | 2 +- .github/workflows/release.yml | 6 +++--- .github/workflows/scorecard.yaml | 2 +- .github/workflows/upgrade-release-tools.yml | 2 +- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/news.yaml b/.github/workflows/news.yaml index 53e2b27..178f876 100644 --- a/.github/workflows/news.yaml +++ b/.github/workflows/news.yaml @@ -24,9 +24,9 @@ jobs: python-version: "3.15" enable-cache: false - name: 📦 Install locked release tools - uses: tox-dev/github-workflows/install-locked-tools@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 + uses: tox-dev/github-workflows/install-locked-tools@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0 with: groups: release-news venv: ${{ runner.temp }}/release-tools - name: 🔍 Validate news fragments - uses: tox-dev/github-workflows/validate-news@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 + uses: tox-dev/github-workflows/validate-news@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0 diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index 2c16f9e..f8b74e4 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -16,7 +16,7 @@ permissions: {} jobs: prepare: name: 🏷️ Prepare Towncrier release - uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 + uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0 permissions: contents: read pull-requests: read diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c8a31a8..a216664 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -60,12 +60,12 @@ jobs: python-version: "3.15" enable-cache: false - name: 📦 Install locked release tools - uses: tox-dev/github-workflows/install-locked-tools@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 + uses: tox-dev/github-workflows/install-locked-tools@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0 with: groups: release-notes venv: ${{ runner.temp }}/release-tools - name: 📝 Render release notes - uses: tox-dev/github-workflows/render-release-notes@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 + uses: tox-dev/github-workflows/render-release-notes@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0 with: tag: ${{ needs.verify-tag.outputs.tag }} changelog: CHANGELOG.md @@ -91,7 +91,7 @@ jobs: artifact-ids: ${{ needs.notes.outputs.artifact-id }} path: ${{ runner.temp }} - name: 🚀 Publish GitHub release - uses: tox-dev/github-workflows/publish-github-release@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 + uses: tox-dev/github-workflows/publish-github-release@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0 env: GH_TOKEN: ${{ github.token }} with: diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml index 81912d8..659e643 100644 --- a/.github/workflows/scorecard.yaml +++ b/.github/workflows/scorecard.yaml @@ -23,4 +23,4 @@ jobs: pull-requests: read # read reviews for the Code-Review check security-events: write # upload the SARIF results to code scanning statuses: read # read commit statuses for the CI-Tests check - uses: tox-dev/github-workflows/.github/workflows/scorecard.yaml@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 + uses: tox-dev/github-workflows/.github/workflows/scorecard.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0 diff --git a/.github/workflows/upgrade-release-tools.yml b/.github/workflows/upgrade-release-tools.yml index 4753ae5..b360f2e 100644 --- a/.github/workflows/upgrade-release-tools.yml +++ b/.github/workflows/upgrade-release-tools.yml @@ -10,7 +10,7 @@ permissions: {} jobs: upgrade: name: 🔀 Upgrade release tools - uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 + uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0 permissions: contents: read secrets: