feat(release): lock project selections and guard uploads

.github/workflows/check.yaml

@@ -40,7 +40,13 @@ jobs:
       - name: Check repository formatting
         env:
           UV_EXCLUDE_NEWER: 7 days
-        run: prek run --all-files
+          UV_NO_CONFIG: "1"
+          UV_NO_SOURCES: "1"
+        run: |
+          unset UV_CONFIG_FILE UV_INDEX UV_INDEX_URL UV_DEFAULT_INDEX UV_EXTRA_INDEX_URL
+          unset UV_FIND_LINKS UV_EXCLUDE_NEWER_PACKAGE
+          unset UV_INSECURE_HOST UV_SYSTEM_CERTS SSL_CERT_FILE SSL_CERT_DIR
+          prek run --all-files
   shell:
     runs-on: ubuntu-26.04
     permissions:
@@ -68,7 +74,14 @@ jobs:
           groups: release-shell
           venv: .release-tools
       - name: Check inline shell
+        env:
+          UV_EXCLUDE_NEWER: 7 days
+          UV_NO_CONFIG: "1"
+          UV_NO_SOURCES: "1"
         run: |
+          unset UV_CONFIG_FILE UV_INDEX UV_INDEX_URL UV_DEFAULT_INDEX UV_EXTRA_INDEX_URL
+          unset UV_FIND_LINKS UV_EXCLUDE_NEWER_PACKAGE
+          unset UV_INSECURE_HOST UV_SYSTEM_CERTS SSL_CERT_FILE SSL_CERT_DIR
           set -euo pipefail
           script_dir=./inline-shell-check
           mkdir "$script_dir"
@@ -139,33 +152,10 @@ jobs:
       - uses: $/check-hook-update-cooldown
         with:
           release-app-client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
-  release-tools-preview:
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-26.04
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
-        with:
-          version: latest-known
-          python-version: "3.15"
-          enable-cache: true
-          cache-suffix: ${{ github.job }}
-          cache-dependency-glob: |
-            pylock.toml
-            pyproject.toml
-      - uses: $/refresh-release-lock
-        with:
-          lock-groups: >-
-            build lock-tools lock-reader release-notes release-news release-prepare release-validate release-check release-attestations release-shell release-hooks release-hook-check
-          mode: check
   gate:
     name: ${{ github.event_name == 'pull_request' && 'Required checks pass' || 'Required checks pass (non-PR)' }}
     if: ${{ !cancelled() }}
-    needs: [check, shell, test, type, hook-cooldown, release-tools-preview]
+    needs: [check, shell, test, type, hook-cooldown]
     runs-on: ubuntu-26.04
     steps:
       - env:
@@ -177,6 +167,6 @@ jobs:
               to_entries[];
               .value.result == "success" or
               ($ENV.EVENT_NAME != "pull_request" and .value.result == "skipped" and
-                (.key == "hook-cooldown" or .key == "release-tools-preview"))
+                .key == "hook-cooldown")
             )
           ' <<<"$NEEDS_JSON"

.github/workflows/prepare-towncrier-release.yaml

@@ -61,11 +61,18 @@ jobs:
           groups: release-prepare${{ inputs.local-tool-source && ' project-runtime' || '' }}
           venv: .venv
           local-tool-source: ${{ inputs.local-tool-source }}
+      - uses: $/verify-frozen-hooks
       - name: Install prek hooks
         id: hooks
         env:
           UV_EXCLUDE_NEWER: 7 days
-        run: prek install-hooks
+          UV_NO_CONFIG: "1"
+          UV_NO_SOURCES: "1"
+        run: |
+          unset UV_CONFIG_FILE UV_INDEX UV_INDEX_URL UV_DEFAULT_INDEX UV_EXTRA_INDEX_URL
+          unset UV_FIND_LINKS UV_EXCLUDE_NEWER_PACKAGE
+          unset UV_INSECURE_HOST UV_SYSTEM_CERTS SSL_CERT_FILE SSL_CERT_DIR
+          prek install-hooks
         background: true
       - name: Build local release tool wheel
         if: inputs.local-tool-source
@@ -188,13 +195,18 @@ jobs:
           version: ${{ needs.assemble.outputs.version }}
           patch: ${{ runner.temp }}/release-patch/release.patch
           checks: "false"
+      - id: repository
+        name: Select the current repository
+        env:
+          REPOSITORY: ${{ github.repository }}
+        run: echo "name=${REPOSITORY#*/}" >>"$GITHUB_OUTPUT"
       - id: token
         uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
-          repositories: ${{ github.event.repository.name }}
+          repositories: ${{ steps.repository.outputs.name }}
           permission-contents: write
       - uses: $/commit-and-tag
         with:

.github/workflows/release.yaml

@@ -25,10 +25,17 @@ jobs:
         with:
           groups: release-check
           venv: .venv
+      - uses: $/verify-frozen-hooks
       - name: Check tagged source
         env:
           UV_EXCLUDE_NEWER: 7 days
-        run: .venv/bin/prek run --all-files
+          UV_NO_CONFIG: "1"
+          UV_NO_SOURCES: "1"
+        run: |
+          unset UV_CONFIG_FILE UV_INDEX UV_INDEX_URL UV_DEFAULT_INDEX UV_EXTRA_INDEX_URL
+          unset UV_FIND_LINKS UV_EXCLUDE_NEWER_PACKAGE
+          unset UV_INSECURE_HOST UV_SYSTEM_CERTS SSL_CERT_FILE SSL_CERT_DIR
+          .venv/bin/prek run --all-files
   source:
     runs-on: ubuntu-26.04
     permissions:

.github/workflows/upgrade-release-tools.yaml

@@ -3,8 +3,8 @@ on:
   workflow_call:
     inputs:
       lock-groups:
-        description: Release dependency groups selected by the universal lock
-        required: true
+        description: Legacy Nab dependency groups; ignored for full project locks
+        default: ""
         type: string
       additional-lock:
         description: Optional secondary pylock basename for a separate build matrix

.github/workflows/validate-python-release.yaml

@@ -35,10 +35,16 @@ jobs:
         with:
           groups: release-check
           venv: ${{ runner.temp }}/release-tools
+      - uses: $/verify-frozen-hooks
       - name: Run tagged source checks
         env:
           UV_EXCLUDE_NEWER: 7 days
-        run: >-
+          UV_NO_CONFIG: "1"
+          UV_NO_SOURCES: "1"
+        run: |
+          unset UV_CONFIG_FILE UV_INDEX UV_INDEX_URL UV_DEFAULT_INDEX UV_EXTRA_INDEX_URL
+          unset UV_FIND_LINKS UV_EXCLUDE_NEWER_PACKAGE
+          unset UV_INSECURE_HOST UV_SYSTEM_CERTS SSL_CERT_FILE SSL_CERT_DIR
           "$RUNNER_TEMP/release-tools/bin/prek" run --all-files
   constraints:
     runs-on: ubuntu-26.04

.pre-commit-config.yaml

@@ -5,22 +5,36 @@ repos:
     rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # v6.0.0
     hooks:
       - id: end-of-file-fixer
+        additional_dependencies:
+          - "ruamel-yaml==0.19.1" # release-creator managed
       - id: trailing-whitespace
+        additional_dependencies:
+          - "ruamel-yaml==0.19.1" # release-creator managed
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: 38bfb07c0c64c304f47eb52090f8288150c77730 # v0.17.1
     hooks:
       - id: ruff-check
         args: ["--fix", "--unsafe-fixes", "--exit-non-zero-on-fix"]
+        additional_dependencies:
+          - "ruff==0.17.1" # release-creator managed
       - id: ruff-format
         types_or: [python, pyi]
+        additional_dependencies:
+          - "ruff==0.17.1" # release-creator managed
   - repo: local
     hooks:
       - id: mdformat
         name: mdformat
         entry: mdformat --wrap 120
         language: python
         types: [markdown]
-        additional_dependencies: [mdformat-gfm==1.0.0]
+        additional_dependencies:
+          - mdformat-gfm==1.0.0
+          - "markdown-it-py==4.2.0" # release-creator managed
+          - "mdformat==1.0.0" # release-creator managed
+          - "mdit-py-plugins==0.6.1" # release-creator managed
+          - "mdurl==0.1.2" # release-creator managed
+          - "wcwidth==0.9.2" # release-creator managed
   - repo: https://github.com/scop/pre-commit-shfmt
     rev: 479be5958357ba5ab65ce47172117348516860e9 # v3.14.1-1
     hooks:
@@ -38,3 +52,5 @@ repos:
     rev: c92afdf2c6ca336aaa8f39e2bd8d48f62dbd8e1f # v1.31.1
     hooks:
       - id: zizmor
+        additional_dependencies:
+          - "zizmor==1.31.1" # release-creator managed