💥 feat!: delegate locks, hooks and notes upstream

.github/dependabot.yml

@@ -10,13 +10,3 @@ updates:
     labels:
       - dependencies
       - skip news
-  - package-ecosystem: github-actions
-    directory: /check-hook-update-cooldown
-    cooldown:
-      default-days: 7
-    schedule:
-      interval: weekly
-      day: tuesday
-    labels:
-      - dependencies
-      - skip news

.github/workflows/check.yaml

@@ -30,13 +30,13 @@ jobs:
           python-version: "3.15"
           enable-cache: true
           cache-suffix: ${{ github.job }}
-          cache-dependency-glob: |
-            pylock.toml
-            pyproject.toml
-      - uses: $/install-locked-tools
-        with:
-          groups: release-check
-          venv: .release-tools
+          cache-dependency-glob: pyproject.toml
+      - name: Install release tools
+        env:
+          EXCLUDE_NEWER: 7 days
+        run: |
+          tools/install_live_tools.sh .release-tools 'prek>=0.2'
+          uv run --no-project --python .release-tools python tools/expose_locked_commands.py .release-tools
       - name: Check repository formatting
         run: tools/cooled_prek.sh run --all-files
   shell:
@@ -58,13 +58,13 @@ jobs:
           python-version: "3.15"
           enable-cache: true
           cache-suffix: ${{ github.job }}
-          cache-dependency-glob: |
-            pylock.toml
-            pyproject.toml
-      - uses: $/install-locked-tools
-        with:
-          groups: release-shell
-          venv: .release-tools
+          cache-dependency-glob: pyproject.toml
+      - name: Install release tools
+        env:
+          EXCLUDE_NEWER: 7 days
+        run: |
+          tools/install_live_tools.sh .release-tools 'prek>=0.2' 'yq>=4.4.5'
+          uv run --no-project --python .release-tools python tools/expose_locked_commands.py .release-tools
       - name: Check inline shell
         run: |
           set -euo pipefail
@@ -98,13 +98,14 @@ jobs:
           python-version: "3.15"
           enable-cache: true
           cache-suffix: ${{ github.job }}
-          cache-dependency-glob: |
-            pylock.toml
-            pyproject.toml
-      - uses: $/install-locked-tools
-        with:
-          groups: release-news release-shell
-          venv: .release-tools
+          cache-dependency-glob: pyproject.toml
+      - name: Install release tools
+        env:
+          EXCLUDE_NEWER: 7 days
+          # Temporary: release-creator 3.1.0 is younger than seven days. Delete after 2026-11-02.
+          EXCLUDE_NEWER_PACKAGE: release-creator=2026-10-25T21:03:31Z
+        run: |
+          tools/install_live_tools.sh .release-tools 'release-creator>=3.1.0' 'towncrier>=26.9' 'prek>=0.2' 'yq>=4.4.5'
       - name: Run Action tests
         run: uvx --with tox-uv tox run -e test
   type:
@@ -121,37 +122,15 @@ jobs:
           python-version: "3.15"
           enable-cache: true
           cache-suffix: ${{ github.job }}
-          cache-dependency-glob: |
-            pylock.toml
-            pyproject.toml
+          cache-dependency-glob: pyproject.toml
       - name: Check Python types
         run: uvx --with tox-uv tox run -e type
-  hook-cooldown:
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-26.04
-    permissions:
-      actions: read
-      contents: read
-      pull-requests: read
-    steps:
-      - uses: $/check-hook-update-cooldown
-        with:
-          release-app-client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
   gate:
     name: ${{ github.event_name == 'pull_request' && 'Required checks pass' || 'Required checks pass (non-PR)' }}
     if: ${{ !cancelled() }}
-    needs: [check, shell, test, type, hook-cooldown]
+    needs: [check, shell, test, type]
     runs-on: ubuntu-26.04
     steps:
       - env:
           NEEDS_JSON: ${{ toJSON(needs) }}
-          EVENT_NAME: ${{ github.event_name }}
-        run: |
-          jq -e '
-            all(
-              to_entries[];
-              .value.result == "success" or
-              ($ENV.EVENT_NAME != "pull_request" and .value.result == "skipped" and
-                .key == "hook-cooldown")
-            )
-          ' <<<"$NEEDS_JSON"
+        run: jq -e 'all(to_entries[]; .value.result == "success")' <<<"$NEEDS_JSON"

.github/workflows/news.yaml

@@ -18,11 +18,16 @@ jobs:
           python-version: "3.15"
           enable-cache: true
           cache-suffix: ${{ github.job }}
-          cache-dependency-glob: |
-            pylock.toml
-            pyproject.toml
-      - uses: $/install-locked-tools
-        with:
-          groups: release-news
-          venv: ${{ runner.temp }}/release-tools
+          cache-dependency-glob: pyproject.toml
+      - name: Install release tools
+        env:
+          EXCLUDE_NEWER: 7 days
+          # Temporary: release-creator 3.1.0 is younger than seven days. Delete after 2026-11-02.
+          EXCLUDE_NEWER_PACKAGE: release-creator=2026-10-25T21:03:31Z
+        run: |
+          tools/install_live_tools.sh "$RUNNER_TEMP/release-tools" 'release-creator>=2.0.0' 'towncrier>=26.9'
+          uv run --no-project --python "$RUNNER_TEMP/release-tools" python tools/expose_locked_commands.py "$RUNNER_TEMP/release-tools"
       - uses: $/validate-news
+        with:
+          # Temporary: release-creator 3.1.0 is younger than seven days. Delete after 2026-11-02.
+          exclude-newer-package: release-creator=2026-10-25T21:03:31Z

.github/workflows/prepare-release.yaml

@@ -17,5 +17,7 @@ jobs:
       pull-requests: read
     with:
       bump: ${{ inputs.bump }}
+      # Temporary: release-creator 3.1.0 is younger than seven days. Delete after 2026-11-02.
+      exclude-newer-package: release-creator=2026-10-25T21:03:31Z
     secrets:
       RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

.github/workflows/prepare-towncrier-release.yaml

@@ -14,14 +14,6 @@ on:
         description: Optional v prefix for the Towncrier changelog heading
         type: string
         default: ""
-      local-tool-source:
-        description: Install release-creator from the tagged checkout for its own release
-        type: boolean
-        default: false
-      keep-uv-lock:
-        description: Check a committed native uv.lock alongside pylock.toml
-        type: boolean
-        default: false
       additional-lock:
         description: Secondary Nab lock to check before release preparation
         type: string
@@ -54,6 +46,18 @@ on:
         description: Create a GitHub Deployment for the App-key job
         type: boolean
         default: true
+      nab-git-commit:
+        description: Temporary full commit SHA of notatallshaw/nab to install instead of the Nab release
+        type: string
+        default: ""
+      exclude-newer:
+        description: Upload cutoff for the tools the shared Actions install from PyPI
+        type: string
+        default: 7 days
+      exclude-newer-package:
+        description: Newline-separated name=date cutoffs that override exclude-newer for single packages
+        type: string
+        default: ""
     secrets:
       RELEASE_APP_PRIVATE_KEY:
         description: Key held by the caller's release-auth environment
@@ -63,19 +67,14 @@ concurrency:
   group: prepare-release-${{ github.repository }}
   cancel-in-progress: false
 jobs:
-  assemble:
+  lock:
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-26.04
     permissions:
       contents: read
-      pull-requests: read
-    outputs:
-      version: ${{ steps.prepare.outputs.version }}
-      artifact-id: ${{ steps.patch.outputs.artifact-id }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          fetch-depth: 0
           persist-credentials: false
           ref: ${{ github.sha }}
       - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
@@ -86,36 +85,47 @@ jobs:
       - uses: $/refresh-release-lock
         with:
           mode: check
-          keep-uv-lock: ${{ inputs.keep-uv-lock }}
           additional-lock: ${{ inputs.additional-lock }}
           additional-lock-groups: ${{ inputs.additional-lock-groups }}
           additional-lock-selection: ${{ inputs.additional-lock-selection }}
           additional-matrix-python: ${{ inputs.additional-matrix-python }}
           additional-matrix-platforms: ${{ inputs.additional-matrix-platforms }}
           additional-matrix-implementations: ${{ inputs.additional-matrix-implementations }}
-      - id: tools
-        uses: $/install-locked-tools
+          nab-git-commit: ${{ inputs.nab-git-commit }}
+          exclude-newer: ${{ inputs.exclude-newer }}
+          exclude-newer-package: ${{ inputs.exclude-newer-package }}
+  assemble:
+    needs: lock
+    runs-on: ubuntu-26.04
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      version: ${{ steps.prepare.outputs.version }}
+      artifact-id: ${{ steps.patch.outputs.artifact-id }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: ${{ github.sha }}
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
-          groups: release-prepare${{ inputs.local-tool-source && ' project-runtime' || '' }}
+          version: latest-known
+          python-version: "3.15"
+          enable-cache: false
+      - uses: $/install-locked-tools
+        with:
+          groups: release-prepare
           venv: .venv
-          local-tool-source: ${{ inputs.local-tool-source }}
-      - uses: $/verify-frozen-hooks
+          exclude-newer: ${{ inputs.exclude-newer }}
+          exclude-newer-package: ${{ inputs.exclude-newer-package }}
       - name: Install prek hooks
         id: hooks
-        env:
-          UV_EXCLUDE_NEWER: 7 days
-          UV_NO_CONFIG: "1"
-          UV_NO_SOURCES: "1"
-        run: |
-          unset UV_CONFIG_FILE UV_INDEX UV_INDEX_URL UV_DEFAULT_INDEX UV_EXTRA_INDEX_URL
-          unset UV_FIND_LINKS UV_EXCLUDE_NEWER_PACKAGE
-          unset UV_INSECURE_HOST UV_SYSTEM_CERTS SSL_CERT_FILE SSL_CERT_DIR
-          prek install-hooks --config .pre-commit-config.yaml
-        background: true
-      - uses: $/install-local-release-creator
-        if: inputs.local-tool-source
+        uses: $/cooled-prek
         with:
-          build-constraints: ${{ steps.tools.outputs.build-constraints }}
+          args: install-hooks
+        background: true
       - id: prepare
         name: Build changelog
         uses: $/prepare-towncrier
@@ -152,16 +162,12 @@ jobs:
           version: latest-known
           python-version: "3.15"
           enable-cache: false
-      - id: tools
-        uses: $/install-locked-tools
+      - uses: $/install-locked-tools
         with:
-          groups: release-validate${{ inputs.local-tool-source && ' project-runtime' || '' }}
+          groups: release-validate
           venv: .venv
-          local-tool-source: ${{ inputs.local-tool-source }}
-      - uses: $/install-local-release-creator
-        if: inputs.local-tool-source
-        with:
-          build-constraints: ${{ steps.tools.outputs.build-constraints }}
+          exclude-newer: ${{ inputs.exclude-newer }}
+          exclude-newer-package: ${{ inputs.exclude-newer-package }}
       - id: config
         uses: $/read-towncrier-config
       - name: Verify selected release version