Repository navigation
💥 feat!: delegate locks, hooks and notes upstream - #20
Merged
Merged
Conversation
Remove check-hook-update-cooldown, recheck-hook-update-cooldown, the recheck-hook-cooldown.yaml workflow and check_hook_config.py. Dependabot cooldowns now gate hook revisions, so the PR job and its gate exception go.
Remove verify-frozen-hooks, check_frozen_hooks.py and check_tagged_hook_age.py, and their calls from the prepare workflow and check-tagged-source. The prek.toml and nested configuration rejection moves next to the prek runs in prepare-towncrier and validate-release-patch.
Remove the generate-hooks job of upgrade-release-tools.yaml and the hook patch handling in its writer, which now checks and applies only the lock patch.
Remove refresh-mise-pin and refresh_mise_pin.py with their tests. Callers rely on mise-action's default release age.
check-tagged-source no longer installs release-check or runs the cooled hooks. The release patch is already checked with prek before the tag is pushed.
refresh-release-lock now runs nab lock --all-groups --all-extras --no-cache, with --upgrade on refresh, and compares a regenerated lock in check mode. Every nab step unsets SSL_CERT_FILE and SSL_CERT_DIR. The release-creator locks path, the uv resolver steps and group, the keep-uv-lock plumbing, the reviewed cutoff table with its check, expiry and patch verifier, and lock_groups.py go. check_lock_groups.py keeps the PyPI and cooling checks and honours the caller's own [tool.nab] uploaded-prior-to overrides. The updater writer accepts only pylock.toml and the secondary lock. Tests read a copy of the 4.0.1 shared lock as caller data.
Remove install-local-release-creator and the local-tool-source input of install-locked-tools and the prepare workflow, along with the matching exemption in check_lock_groups.py.
Delete the shared pylock.toml, update-tools.yaml and every lock group. The Actions install nab, certifi, packaging and pypi-attestations, and gw's own CI installs release-creator, Towncrier, prek and yq, with uv pip install --exclude-newer through tools/install_live_tools.sh, without hashes. Each Action and reusable workflow that installs tools gains exclude-newer, 7 days by default, and exclude-newer-package. install-locked-tools loses lock-source and installs only from the caller lock; build constraints no longer merge the shared build pins.
validate-python-release.yaml runs the lock check as its own keyless job in parallel with build. The build job checks the tag inline, including that it resolves to GITHUB_SHA, exports its build constraints and builds; the validate job drops twine check. gw's own release checks the tag inline and re-resolves it before creating the GitHub Release.
A full commit SHA installs nab from notatallshaw/nab at that commit instead of the release, until a nab release carries the fix turbohtml needs. refresh-release-lock validates it, and the reusable workflows that call the Action forward it.
validate-news and check-tagged-source pass nab-git-commit to refresh-release-lock, so every lock step can use nab from git.
refresh-release-lock installs nab>=0.0.22 under the cutoff instead of the exact 0.0.22 pin, so it picks up the newest nab older than seven days, like the other live tools.
Restore the 4.0.1 --only-binary :all: for the lock reader, now installed live under the cutoff.
validate-python-release.yaml no longer runs check-wheel-contents; packages check their distributions with their own tox -e pkg_meta. The unused check-wheel-contents and twine test dependencies go too.
Describe the release job's single publish-github-release call after PyPI and point failed uploads at re-running the failed jobs.
refresh-release-lock runs check_nab_lock.py --environments-only after regenerating the primary lock in both modes, as it does for the secondary lock.
validate-news accepts a pylock.toml removal when the project has no [tool.nab] table and no additional lock is configured.
build_constraints.py loses --shared-policy and the two-lock merge, which only served the removed shared lock.
check_lock_groups.py only checks that the selected groups exist; the PyPI comparison, cooling and per-package exception logic go with their tests and the fake PyPI plumbing. Nab's regenerate-and-compare check now guards the lock on PRs, on tags, and in a new keyless lock job that the prepare workflow's assembly waits for.
The Action wraps tools/cooled_prek.sh so workflows can reach it. The prepare workflow's prek install-hooks uses it instead of repeating the environment inline.
Drop GitHub's generate-notes call, its Contents-write job, and the generated-notes input of render-release-notes. gw's notes job is read-only, uses the full history and runs in parallel with the tag check; the release job downloads the notes, re-checks the tag and publishes once.
prepare-towncrier calls release-creator's New Contributors step after the Towncrier build. The command name is a placeholder until release-creator 3.1.0 ships it; the tests stand in for it with a shim.
Add a release-prepare group and a universal [tool.nab] config with a 3.15 matrix and the seven-day cutoff, and lock it with nab lock --all-groups --all-extras --no-cache. A temporary release-creator cutoff of 2026-10-25T07:08:32Z admits 2.0.0 until 2026-11-01.
gw's own workflows pass exclude-newer-package release-creator=2026-10-25T07:08:32Z, one second after 2.0.0's last upload, to their live installs and the Actions and workflows they call. Delete the override after 2026-11-01.
Add the 4.0.1 build and release-validate groups to gw's own lock. PyYAML 6.0.3 has no cp315 wheel and builds with setuptools and Cython, and the prepare workflow's validate job installs release-validate.
Restore update-tools.yaml, now calling upgrade-release-tools.yaml for gw's small release lock the same way consumers do.
Replace the New Contributors placeholder with the release-creator 3.1.0 command and its --changelog, --version and --repository options. The test shim accepts only that interface until 3.1.0 is on PyPI.
Move the temporary release-creator cutoff to 2026-10-25T21:03:31Z, one second after 3.1.0's last upload, in gw's [tool.nab] table and workflows. Delete it after 2026-11-02.
Raise the release-prepare, release-validate and test-tool floors to release-creator>=3.1.0, which adds the contributors command, and relock gw's pylock.toml with nab lock --all-groups --all-extras --upgrade.
Use the changelog heading's version, with changelog-prefix and without the tag's v, so a v-prefixed tag finds its section.
Drop the release-creator shim now that 3.1.0 is on PyPI. The fake GitHub GraphQL endpoint now answers 3.1.0's merge commit author, pull request and first-contribution search queries.
Remove conftest input defaults no Action reads, the stale release-creator lock table in the caller fixture, and the shared-lock wording in the export-build-constraints lock input.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github-workflows 5.0.0 hands lock generation, hook updates and release-note credits to tools that already do these jobs, and keeps the behaviour consumers depend on. Tools shrink from 1,891 to 429 lines and actions from 2,692 to 2,157.
Locks come from nab, and uv only installs them.
refresh-release-lockrunsnab lock --all-groups --all-extras. Lock integrity is checked by nab's own regenerate-and-compare check in three places: on PRs, beside the tag build, and in a new keyless job before prepare assembles the release patch. That replaces our cooling and PyPI re-verification. The reviewed exception table, its expiry tooling, the uv resolver pin,keep-uv-lockand the release-creatorlockspath are gone. Each caller owns its exceptions in its own[tool.nab]table. github-workflows' own tools install live with--exclude-newer "7 days"from version floors, so they pick up new releases once they are a week old. Callers can override that withexclude-newerandexclude-newer-package. turbohtml gets a temporarynab-git-commitinput until nab releases the fixes it needs.Hooks are left to Dependabot and pre-commit.ci. The PR cooldown check, its daily recheck, the frozen-revision and tag-time hook-age checks, the weekly hook refresh and
refresh-mise-pinare removed. Our own prepare-time hook runs stay cooled through the newcooled-prekaction.The tag release no longer repeats PR CI.
tox -e pkg_meta.Release notes now equal the changelog. GitHub's generate-notes call and the contributor-metadata job are removed. Prepare runs
release-creator contributorsaftertowncrier buildto add a New Contributors subsection, so the GitHub release body is the rendered changelog section.This needs release-creator 3.1.0. Until 2026-11-02, github-workflows' own workflows carry a temporary override that admits it inside the 7-day window.
toxpasses with 100% coverage. Each breaking change has a fragment underchangelog.d/that lists what callers must update.