🐛 fix(release): close audit gaps and trim inputs

.github/workflows/check.yaml

@@ -38,15 +38,7 @@ jobs:
           groups: release-check
           venv: .release-tools
       - name: Check repository formatting
-        env:
-          UV_EXCLUDE_NEWER: 7 days
-          UV_NO_CONFIG: "1"
-          UV_NO_SOURCES: "1"
-        run: |
-          unset UV_CONFIG_FILE UV_INDEX UV_INDEX_URL UV_DEFAULT_INDEX UV_EXTRA_INDEX_URL
-          unset UV_FIND_LINKS UV_EXCLUDE_NEWER_PACKAGE
-          unset UV_INSECURE_HOST UV_SYSTEM_CERTS SSL_CERT_FILE SSL_CERT_DIR
-          prek run --all-files
+        run: tools/cooled_prek.sh run --all-files
   shell:
     runs-on: ubuntu-26.04
     permissions:
@@ -74,14 +66,7 @@ jobs:
           groups: release-shell
           venv: .release-tools
       - name: Check inline shell
-        env:
-          UV_EXCLUDE_NEWER: 7 days
-          UV_NO_CONFIG: "1"
-          UV_NO_SOURCES: "1"
         run: |
-          unset UV_CONFIG_FILE UV_INDEX UV_INDEX_URL UV_DEFAULT_INDEX UV_EXTRA_INDEX_URL
-          unset UV_FIND_LINKS UV_EXCLUDE_NEWER_PACKAGE
-          unset UV_INSECURE_HOST UV_SYSTEM_CERTS SSL_CERT_FILE SSL_CERT_DIR
           set -euo pipefail
           script_dir=./inline-shell-check
           mkdir "$script_dir"
@@ -96,8 +81,8 @@ jobs:
               index=$((index + 1))
             done <"$RUNNER_TEMP/run-blocks"
           done
-          prek run shellcheck --files "$script_dir"/*.sh
-          prek run shfmt --files "$script_dir"/*.sh
+          tools/cooled_prek.sh run shellcheck --files "$script_dir"/*.sh
+          tools/cooled_prek.sh run shfmt --files "$script_dir"/*.sh
   test:
     runs-on: ubuntu-26.04
     permissions:

.github/workflows/prepare-towncrier-release.yaml

@@ -110,24 +110,12 @@ jobs:
           unset UV_CONFIG_FILE UV_INDEX UV_INDEX_URL UV_DEFAULT_INDEX UV_EXTRA_INDEX_URL
           unset UV_FIND_LINKS UV_EXCLUDE_NEWER_PACKAGE
           unset UV_INSECURE_HOST UV_SYSTEM_CERTS SSL_CERT_FILE SSL_CERT_DIR
-          prek install-hooks
+          prek install-hooks --config .pre-commit-config.yaml
         background: true
-      - name: Build local release tool wheel
+      - uses: $/install-local-release-creator
         if: inputs.local-tool-source
-        env:
-          BUILD_CONSTRAINTS: ${{ steps.tools.outputs.build-constraints }}
-        run: |
-          uv build --wheel --build-constraints "$BUILD_CONSTRAINTS" \
-            --require-build-hashes --out-dir "$RUNNER_TEMP/local-tool-dist" .
-      - name: Install local release tool wheel
-        if: inputs.local-tool-source
-        run: uv pip install --python .venv/bin/python --no-deps "$RUNNER_TEMP/local-tool-dist/"*.whl
-      - name: Expose local release command
-        if: inputs.local-tool-source
-        run: |
-          mkdir -p "$RUNNER_TEMP/local-release-cli"
-          ln -s "$GITHUB_WORKSPACE/.venv/bin/release-creator" "$RUNNER_TEMP/local-release-cli/release-creator"
-          echo "$RUNNER_TEMP/local-release-cli" >>"$GITHUB_PATH"
+        with:
+          build-constraints: ${{ steps.tools.outputs.build-constraints }}
       - id: prepare
         name: Build changelog
         uses: $/prepare-towncrier
@@ -170,22 +158,10 @@ jobs:
           groups: release-validate${{ inputs.local-tool-source && ' project-runtime' || '' }}
           venv: .venv
           local-tool-source: ${{ inputs.local-tool-source }}
-      - name: Build local release tool wheel
+      - uses: $/install-local-release-creator
         if: inputs.local-tool-source
-        env:
-          BUILD_CONSTRAINTS: ${{ steps.tools.outputs.build-constraints }}
-        run: |
-          uv build --wheel --build-constraints "$BUILD_CONSTRAINTS" \
-            --require-build-hashes --out-dir "$RUNNER_TEMP/local-tool-dist" .
-      - name: Install local release tool wheel
-        if: inputs.local-tool-source
-        run: uv pip install --python .venv/bin/python --no-deps "$RUNNER_TEMP/local-tool-dist/"*.whl
-      - name: Expose local release command
-        if: inputs.local-tool-source
-        run: |
-          mkdir -p "$RUNNER_TEMP/local-release-cli"
-          ln -s "$GITHUB_WORKSPACE/.venv/bin/release-creator" "$RUNNER_TEMP/local-release-cli/release-creator"
-          echo "$RUNNER_TEMP/local-release-cli" >>"$GITHUB_PATH"
+        with:
+          build-constraints: ${{ steps.tools.outputs.build-constraints }}
       - id: config
         uses: $/read-towncrier-config
       - name: Verify selected release version
@@ -210,7 +186,6 @@ jobs:
       - uses: $/validate-release-patch
         with:
           version: ${{ needs.assemble.outputs.version }}
-          patch: ${{ runner.temp }}/release-patch/release.patch
   push:
     needs: [assemble, validate]
     runs-on: ubuntu-26.04
@@ -231,7 +206,6 @@ jobs:
       - uses: $/validate-release-patch
         with:
           version: ${{ needs.assemble.outputs.version }}
-          patch: ${{ runner.temp }}/release-patch/release.patch
           checks: "false"
       - id: repository
         name: Select the current repository

.github/workflows/release.yaml

@@ -24,24 +24,7 @@ jobs:
           version: latest-known
           python-version: "3.15"
           enable-cache: false
-      - uses: $/refresh-release-lock
-        with:
-          mode: check
-      - uses: $/install-locked-tools
-        with:
-          groups: release-check
-          venv: .venv
-      - uses: $/verify-frozen-hooks
-      - name: Check tagged source
-        env:
-          UV_EXCLUDE_NEWER: 7 days
-          UV_NO_CONFIG: "1"
-          UV_NO_SOURCES: "1"
-        run: |
-          unset UV_CONFIG_FILE UV_INDEX UV_INDEX_URL UV_DEFAULT_INDEX UV_EXTRA_INDEX_URL
-          unset UV_FIND_LINKS UV_EXCLUDE_NEWER_PACKAGE
-          unset UV_INSECURE_HOST UV_SYSTEM_CERTS SSL_CERT_FILE SSL_CERT_DIR
-          .venv/bin/prek run --all-files
+      - uses: $/check-tagged-source
   source:
     runs-on: ubuntu-26.04
     permissions:
@@ -130,7 +113,6 @@ jobs:
           previous: ${{ needs.source.outputs.previous }}
           changelog: CHANGELOG.md
           generated-notes: ${{ runner.temp }}/generated-notes.md
-          output: ${{ runner.temp }}/release-notes.md
       - id: artifact
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:

.github/workflows/update-tools.yaml

@@ -12,9 +12,6 @@ jobs:
     secrets:
       RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
     with:
-      upgrade-resolver: true
-      lock-groups: >-
-        build lock-tools lock-reader release-notes release-resolver release-news release-prepare release-validate release-check release-attestations release-shell release-hooks release-hook-check
       commit-message: "🔧 build: refresh release tool lock"
       pull-request-title: "🔧 build: refresh release tool lock"
       pull-request-body: "Refresh the locked tools used by release preparation and CI."

.github/workflows/upgrade-release-tools.yaml

@@ -2,10 +2,6 @@ name: Upgrade release tools
 on:
   workflow_call:
     inputs:
-      lock-groups:
-        description: Legacy Nab dependency groups; ignored for full project locks
-        default: ""
-        type: string
       additional-lock:
         description: Optional secondary pylock basename for a separate build matrix
         type: string
@@ -30,10 +26,6 @@ on:
         description: Space-separated implementations for the secondary lock
         type: string
         default: ""
-      upgrade-resolver:
-        description: Upgrade this repository's exact shared uv resolver pin with its lock
-        type: boolean
-        default: false
       keep-uv-lock:
         description: Refresh and check uv.lock alongside pylock.toml
         type: boolean
@@ -77,14 +69,12 @@ jobs:
       - id: lock
         uses: $/refresh-release-lock
         with:
-          lock-groups: ${{ inputs.lock-groups }}
           additional-lock: ${{ inputs.additional-lock }}
           additional-lock-groups: ${{ inputs.additional-lock-groups }}
           additional-lock-selection: ${{ inputs.additional-lock-selection }}
           additional-matrix-python: ${{ inputs.additional-matrix-python }}
           additional-matrix-platforms: ${{ inputs.additional-matrix-platforms }}
           additional-matrix-implementations: ${{ inputs.additional-matrix-implementations }}
-          upgrade-resolver: ${{ inputs.upgrade-resolver }}
           keep-uv-lock: ${{ inputs.keep-uv-lock }}
       - id: upload
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
@@ -219,7 +209,7 @@ jobs:
               exit 1
             fi
           done <"$RUNNER_TEMP/dependency-modes"
-      - uses: $/verify-nab-cutoff-patch
+      - uses: $/verify-cutoff-patch
       - name: Commit refreshed tools
         env:
           COMMIT_MESSAGE: ${{ inputs.commit-message }}

.github/workflows/validate-python-release.yaml

@@ -62,31 +62,15 @@ jobs:
           version: latest-known
           python-version: "3.15"
           enable-cache: false
-      - uses: $/refresh-release-lock
+      - uses: $/check-tagged-source
         with:
-          mode: check
           keep-uv-lock: ${{ inputs.keep-uv-lock }}
           additional-lock: ${{ inputs.additional-lock }}
           additional-lock-groups: ${{ inputs.additional-lock-groups }}
           additional-lock-selection: ${{ inputs.additional-lock-selection }}
           additional-matrix-python: ${{ inputs.additional-matrix-python }}
           additional-matrix-platforms: ${{ inputs.additional-matrix-platforms }}
           additional-matrix-implementations: ${{ inputs.additional-matrix-implementations }}
-      - uses: $/install-locked-tools
-        with:
-          groups: release-check
-          venv: ${{ runner.temp }}/release-tools
-      - uses: $/verify-frozen-hooks
-      - name: Run tagged source checks
-        env:
-          UV_EXCLUDE_NEWER: 7 days
-          UV_NO_CONFIG: "1"
-          UV_NO_SOURCES: "1"
-        run: |
-          unset UV_CONFIG_FILE UV_INDEX UV_INDEX_URL UV_DEFAULT_INDEX UV_EXTRA_INDEX_URL
-          unset UV_FIND_LINKS UV_EXCLUDE_NEWER_PACKAGE
-          unset UV_INSECURE_HOST UV_SYSTEM_CERTS SSL_CERT_FILE SSL_CERT_DIR
-          "$RUNNER_TEMP/release-tools/bin/prek" run --all-files
   constraints:
     runs-on: ubuntu-26.04
     outputs:

CHANGELOG.md

@@ -36,6 +36,14 @@
   match the fork repository, branch, commit, and workflow, and occur after the PR opened
   ([#15](https://github.com/tox-dev/github-workflows/pull/15)) by [@gaborbernat](https://github.com/gaborbernat).
 
+<a name="release-3-0-1-breaking-changes"></a>
+
+### Breaking changes
+
+- The tagged `source-check` job of `validate-python-release` requests `actions: read` and `pull-requests: read` and
+  checks out full history for the hook age check. A caller whose `build` job grants only `contents: read` fails at
+  startup; grant all three. This entry was added after the release, which shipped without it.
+
 <a name="release-3-0-1-security"></a>
 
 ### Security