From 8ff3fe288576f36397a1a07ea9934bd625706944 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= <gaborjbernat@gmail.com>
Date: Sun, 25 Oct 2026 17:17:18 -0700
Subject: [PATCH 1/6] =?UTF-8?q?=F0=9F=90=9B=20fix(lock):=20check=20with=20?=
 =?UTF-8?q?the=20locked=20Nab=20version?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md                                  | 12 ++--
 changelog.d/+check-locked-nab.bugfix.md    |  4 ++
 refresh-release-lock/action.yml            | 14 +++++
 tests/refresh_release_lock/test_refresh.py | 69 +++++++++++++++-------
 4 files changed, 74 insertions(+), 25 deletions(-)
 create mode 100644 changelog.d/+check-locked-nab.bugfix.md

diff --git a/README.md b/README.md
index 0084053..b368388 100644
--- a/README.md
+++ b/README.md
@@ -168,11 +168,13 @@ changes only the secondary lock.
 
 `refresh-release-lock` is the read-only half of the updater. In `refresh` mode, it upgrades the full primary lock and
 writes `$RUNNER_TEMP/lock.patch` if a lock changes. In `check` mode, it regenerates the primary lock without upgrading
-and fails if anything other than Nab's recorded command line differs. Every Nab run unsets `SSL_CERT_FILE` and
-`SSL_CERT_DIR`, so Nab uses its own certificate store. `validate-news` calls this mode when a PR changes release inputs,
-including a workspace member's `pyproject.toml` or a secondary lock. The resulting PR's normal formatting job runs
-`prek`; the writer checks patch paths and modes. Its `changed` output is `true` only when the refresh produces a patch.
-Neither mode pushes a branch or requests a write token.
+and fails if anything other than Nab's recorded command line differs. Check mode installs the Nab version that the
+committed `pylock.toml` records in `[tool.nab] nab-version`, and fails if the lock has none, because a newer Nab would
+rewrite that field in every committed lock. Refresh mode installs the newest Nab under the cutoff. Every Nab run unsets
+`SSL_CERT_FILE` and `SSL_CERT_DIR`, so Nab uses its own certificate store. `validate-news` calls this mode when a PR
+changes release inputs, including a workspace member's `pyproject.toml` or a secondary lock. The resulting PR's normal
+formatting job runs `prek`; the writer checks patch paths and modes. Its `changed` output is `true` only when the
+refresh produces a patch. Neither mode pushes a branch or requests a write token.
 
 Every shared `prek` command runs through `tools/cooled_prek.sh`, which the `cooled-prek` Action wraps for workflows, and
 passes `--config .pre-commit-config.yaml`. Without it, prek prefers a root `prek.toml` and also runs nested
diff --git a/changelog.d/+check-locked-nab.bugfix.md b/changelog.d/+check-locked-nab.bugfix.md
new file mode 100644
index 0000000..0df0457
--- /dev/null
+++ b/changelog.d/+check-locked-nab.bugfix.md
@@ -0,0 +1,4 @@
+Make `refresh-release-lock` in `check` mode install the Nab version that the committed `pylock.toml` records in
+`[tool.nab] nab-version`, and fail if the lock records none. A Nab release newer than that version rewrites the field,
+so every committed lock failed the check until the weekly refresh. `refresh` mode still installs the newest Nab under
+the cutoff, and `nab-git-commit` still installs from that commit in both modes.
diff --git a/refresh-release-lock/action.yml b/refresh-release-lock/action.yml
index bd47065..d5a029a 100644
--- a/refresh-release-lock/action.yml
+++ b/refresh-release-lock/action.yml
@@ -65,6 +65,7 @@ runs:
       env:
         EXCLUDE_NEWER: ${{ inputs.exclude-newer }}
         EXCLUDE_NEWER_PACKAGE: ${{ inputs.exclude-newer-package }}
+        MODE: ${{ inputs.mode }}
         NAB_GIT_COMMIT: ${{ inputs.nab-git-commit }}
       run: |
         set -euo pipefail
@@ -75,6 +76,19 @@ runs:
           for package in nab-index nab-markersets nab-project nab-provider nab-resolver; do
             requirements+=("$package @ $source#subdirectory=$package")
           done
+        elif [[ "$MODE" == check ]]; then
+          version=""
+          if [[ -f pylock.toml ]]; then
+            version=$(python3 -c 'import tomllib
+        with open("pylock.toml", "rb") as lock:
+            print(tomllib.load(lock).get("tool", {}).get("nab", {}).get("nab-version", ""))')
+          fi
+          if [[ -z "$version" ]]; then
+            echo '::error::check mode needs the Nab version in pylock.toml [tool.nab] nab-version' >&2
+            exit 1
+          fi
+          # A newer Nab rewrites nab-version, so checking with it would fail every committed lock.
+          requirements=("nab==$version")
         fi
         "$GITHUB_ACTION_PATH/../tools/install_live_tools.sh" "$RUNNER_TEMP/lock-tools" "${requirements[@]}"
     - name: Resolve all project groups and extras
diff --git a/tests/refresh_release_lock/test_refresh.py b/tests/refresh_release_lock/test_refresh.py
index 436e14c..91de323 100644
--- a/tests/refresh_release_lock/test_refresh.py
+++ b/tests/refresh_release_lock/test_refresh.py
@@ -227,34 +227,41 @@ def test_refresh_rejects_invalid_nab_commit(tmp_path: Path, action_scripts: Path
 
 _NAB_COMMIT: Final = "0123456789abcdef0123456789abcdef01234567"
 _NAB_SOURCE: Final = f"git+https://github.com/notatallshaw/nab@{_NAB_COMMIT}"
+_NAB_WORKSPACE: Final = [
+    f"nab @ {_NAB_SOURCE}",
+    f"nab-index @ {_NAB_SOURCE}#subdirectory=nab-index",
+    f"nab-markersets @ {_NAB_SOURCE}#subdirectory=nab-markersets",
+    f"nab-project @ {_NAB_SOURCE}#subdirectory=nab-project",
+    f"nab-provider @ {_NAB_SOURCE}#subdirectory=nab-provider",
+    f"nab-resolver @ {_NAB_SOURCE}#subdirectory=nab-resolver",
+]
+_VERSIONED_LOCK: Final = f'{_LOCK}nab-version = "0.0.21"\n'
+
+
+@pytest.fixture
+def fake_installer(tmp_path: Path) -> Path:
+    installer = tmp_path / "tools/install_live_tools.sh"
+    installer.parent.mkdir()
+    installer.write_text('#!/bin/sh\nprintf "%s\\n" "$@" >"$RUNNER_TEMP/installed"\n')
+    installer.chmod(0o755)
+    (tmp_path / "action").mkdir()
+    return installer
 
 
 @pytest.mark.parametrize(
-    ("commit", "requirements"),
+    ("mode", "commit", "requirements"),
     [
-        pytest.param("", ["nab>=0.0.22"], id="release"),
-        pytest.param(
-            _NAB_COMMIT,
-            [
-                f"nab @ {_NAB_SOURCE}",
-                f"nab-index @ {_NAB_SOURCE}#subdirectory=nab-index",
-                f"nab-markersets @ {_NAB_SOURCE}#subdirectory=nab-markersets",
-                f"nab-project @ {_NAB_SOURCE}#subdirectory=nab-project",
-                f"nab-provider @ {_NAB_SOURCE}#subdirectory=nab-provider",
-                f"nab-resolver @ {_NAB_SOURCE}#subdirectory=nab-resolver",
-            ],
-            id="git-commit-workspace",
-        ),
+        pytest.param("refresh", "", ["nab>=0.0.22"], id="refresh-release"),
+        pytest.param("check", "", ["nab==0.0.21"], id="check-locked-release"),
+        pytest.param("refresh", _NAB_COMMIT, _NAB_WORKSPACE, id="refresh-git-commit-workspace"),
+        pytest.param("check", _NAB_COMMIT, _NAB_WORKSPACE, id="check-git-commit-workspace"),
     ],
 )
+@pytest.mark.usefixtures("fake_installer")
 def test_refresh_installs_selected_nab(
-    tmp_path: Path, action_scripts: Path, commit: str, requirements: list[str]
+    tmp_path: Path, action_scripts: Path, mode: str, commit: str, requirements: list[str]
 ) -> None:
-    installer = tmp_path / "tools/install_live_tools.sh"
-    installer.parent.mkdir()
-    installer.write_text('#!/bin/sh\nprintf "%s\\n" "$@" >"$RUNNER_TEMP/installed"\n')
-    installer.chmod(0o755)
-    (tmp_path / "action").mkdir()
+    (tmp_path / "pylock.toml").write_text(_VERSIONED_LOCK)
 
     result = _run_step(
         action_scripts,
@@ -262,6 +269,7 @@ def test_refresh_installs_selected_nab(
         tmp_path,
         tmp_path / "bin/uv",
         GITHUB_ACTION_PATH=str(tmp_path / "action"),
+        MODE=mode,
         NAB_GIT_COMMIT=commit,
     )
 
@@ -269,6 +277,27 @@ def test_refresh_installs_selected_nab(
     assert (tmp_path / "installed").read_text().splitlines() == [f"{tmp_path}/lock-tools", *requirements]
 
 
+@pytest.mark.parametrize("lock", [None, _LOCK], ids=["no-lock", "no-nab-version"])
+@pytest.mark.usefixtures("fake_installer")
+def test_refresh_check_requires_locked_nab_version(tmp_path: Path, action_scripts: Path, lock: str | None) -> None:
+    if lock is not None:
+        (tmp_path / "pylock.toml").write_text(lock)
+
+    result = _run_step(
+        action_scripts,
+        "Install Nab",
+        tmp_path,
+        tmp_path / "bin/uv",
+        GITHUB_ACTION_PATH=str(tmp_path / "action"),
+        MODE="check",
+        NAB_GIT_COMMIT="",
+    )
+
+    assert result.returncode != 0
+    assert "::error::check mode needs the Nab version in pylock.toml [tool.nab] nab-version" in result.stderr
+    assert not (tmp_path / "installed").exists()
+
+
 @pytest.mark.parametrize(
     ("path", "steps"),
     [

From 829d877a5c25e466684b3daecc6d5f181c45fa42 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= <gaborjbernat@gmail.com>
Date: Sun, 25 Oct 2026 17:19:04 -0700
Subject: [PATCH 2/6] =?UTF-8?q?=F0=9F=94=92=20fix(tools):=20ignore=20the?=
 =?UTF-8?q?=20caller's=20uv=20settings?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 changelog.d/+live-tools-uv-config.security.md |  5 ++
 .../test_install_live_tools.py                | 61 +++++++++++++++++++
 tools/install_live_tools.sh                   |  8 ++-
 3 files changed, 72 insertions(+), 2 deletions(-)
 create mode 100644 changelog.d/+live-tools-uv-config.security.md

diff --git a/changelog.d/+live-tools-uv-config.security.md b/changelog.d/+live-tools-uv-config.security.md
new file mode 100644
index 0000000..09e2c43
--- /dev/null
+++ b/changelog.d/+live-tools-uv-config.security.md
@@ -0,0 +1,5 @@
+Make the Actions install their own tools, such as Nab, `packaging`, `certifi`, and `pypi-attestations`, from PyPI even
+when the caller's repository or environment configures another index. The installer now ignores `uv.toml`, `[tool.uv]`
+in `pyproject.toml`, and the `UV_INDEX`, `UV_INDEX_URL`, `UV_DEFAULT_INDEX`, `UV_EXTRA_INDEX_URL`, `UV_FIND_LINKS`,
+`UV_CONFIG_FILE`, `UV_INSECURE_HOST`, `UV_SYSTEM_CERTS`, `SSL_CERT_FILE`, and `SSL_CERT_DIR` variables, as `cooled-prek`
+already does.
diff --git a/tests/install_live_tools/test_install_live_tools.py b/tests/install_live_tools/test_install_live_tools.py
index adb678a..1daee39 100644
--- a/tests/install_live_tools/test_install_live_tools.py
+++ b/tests/install_live_tools/test_install_live_tools.py
@@ -8,6 +8,7 @@
 from typing import Any, Final
 
 import pytest
+from pytest_httpserver import HTTPServer
 
 _SCRIPT: Final = Path(__file__).resolve().parents[2] / "tools/install_live_tools.sh"
 
@@ -95,3 +96,63 @@ def test_install_live_tools_requires_a_cutoff(tmp_path: Path, fake_uv: Path) ->
 
     assert result.returncode != 0
     assert "EXCLUDE_NEWER: unbound variable" in result.stderr
+
+
+def test_install_live_tools_ignores_inherited_uv_settings(tmp_path: Path, fake_uv: Path) -> None:
+    leaked = dict.fromkeys(
+        (
+            "UV_CONFIG_FILE",
+            "UV_INDEX",
+            "UV_INDEX_URL",
+            "UV_DEFAULT_INDEX",
+            "UV_EXTRA_INDEX_URL",
+            "UV_FIND_LINKS",
+            "UV_INSECURE_HOST",
+            "UV_SYSTEM_CERTS",
+            "SSL_CERT_FILE",
+            "SSL_CERT_DIR",
+        ),
+        "leak",
+    )
+
+    venv, install = _install(tmp_path, fake_uv, EXCLUDE_NEWER="7 days", **leaked)
+
+    assert [venv["env"].get("UV_NO_CONFIG"), install["env"].get("UV_NO_CONFIG")] == ["1", "1"]
+    assert not leaked.keys() & (venv["env"].keys() | install["env"].keys())
+
+
+@pytest.mark.parametrize(
+    ("files", "variables"),
+    [
+        pytest.param({"pyproject.toml": '[tool.uv]\nindex-url = "{index}"\n'}, {}, id="pyproject"),
+        pytest.param({"uv.toml": 'index-url = "{index}"\n'}, {}, id="uv-toml"),
+        pytest.param({}, {"UV_INDEX_URL": "{index}"}, id="environment"),
+    ],
+)
+def test_install_live_tools_ignores_caller_index(
+    tmp_path: Path, httpserver: HTTPServer, files: dict[str, str], variables: dict[str, str]
+) -> None:
+    caller = tmp_path / "caller"
+    caller.mkdir()
+    index = httpserver.url_for("/simple")
+    for name, template in files.items():
+        (caller / name).write_text(template.format(index=index))
+
+    subprocess.run(
+        [str(_SCRIPT), str(tmp_path / "tools"), "nab>=0.0.22"],
+        cwd=caller,
+        env=os.environ
+        | {
+            "EXCLUDE_NEWER": "7 days",
+            # PyPI is unreachable through this proxy, so the install fails fast unless it uses the caller's index.
+            "HTTPS_PROXY": "http://127.0.0.1:9",
+            "NO_PROXY": "localhost,127.0.0.1",
+            "UV_CACHE_DIR": str(tmp_path / "cache"),
+            "UV_HTTP_RETRIES": "0",
+        }
+        | {name: template.format(index=index) for name, template in variables.items()},
+        capture_output=True,
+        check=False,
+    )
+
+    assert httpserver.log == []
diff --git a/tools/install_live_tools.sh b/tools/install_live_tools.sh
index cc809c0..c6597c7 100755
--- a/tools/install_live_tools.sh
+++ b/tools/install_live_tools.sh
@@ -1,9 +1,13 @@
 #!/usr/bin/env bash
-# The Actions' own tools come from PyPI under a cutoff, so they refresh themselves without a shared lock.
+# The Actions' own tools come from PyPI under a cutoff, so they refresh themselves without a shared lock, ignoring the
+# repository's uv settings.
 set -euo pipefail
 venv=$1
 shift
-unset UV_EXCLUDE_NEWER UV_EXCLUDE_NEWER_PACKAGE
+unset UV_CONFIG_FILE UV_INDEX UV_INDEX_URL UV_DEFAULT_INDEX UV_EXTRA_INDEX_URL
+unset UV_FIND_LINKS UV_EXCLUDE_NEWER UV_EXCLUDE_NEWER_PACKAGE
+unset UV_INSECURE_HOST UV_SYSTEM_CERTS SSL_CERT_FILE SSL_CERT_DIR
+export UV_NO_CONFIG=1
 options=(--exclude-newer "$EXCLUDE_NEWER")
 while IFS= read -r line; do
   read -r line <<<"$line"

From f664bd518e74436969f4898a87a7044914727108 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= <gaborjbernat@gmail.com>
Date: Sun, 25 Oct 2026 17:19:37 -0700
Subject: [PATCH 3/6] =?UTF-8?q?=F0=9F=90=9B=20fix(news):=20keep=20the=20lo?=
 =?UTF-8?q?ck=20while=20nab.toml=20exists?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 changelog.d/+nab-toml-lock-removal.bugfix.md |  2 ++
 tests/validate_news/test_news.py             | 18 +++++++++++-------
 validate-news/action.yml                     |  2 +-
 3 files changed, 14 insertions(+), 8 deletions(-)
 create mode 100644 changelog.d/+nab-toml-lock-removal.bugfix.md

diff --git a/changelog.d/+nab-toml-lock-removal.bugfix.md b/changelog.d/+nab-toml-lock-removal.bugfix.md
new file mode 100644
index 0000000..4efbdbc
--- /dev/null
+++ b/changelog.d/+nab-toml-lock-removal.bugfix.md
@@ -0,0 +1,2 @@
+Make `validate-news` reject a pull request that removes `pylock.toml` when the project has a `nab.toml`, as it already
+did for a `[tool.nab]` table in `pyproject.toml`.
diff --git a/tests/validate_news/test_news.py b/tests/validate_news/test_news.py
index dc54021..3e324cd 100644
--- a/tests/validate_news/test_news.py
+++ b/tests/validate_news/test_news.py
@@ -197,18 +197,22 @@ def test_validate_news_detects_release_input_change(
 @pytest.mark.parametrize(
     ("nab_config", "additional_lock", "accepted"),
     [
-        pytest.param(True, "", False, id="nab-config"),
-        pytest.param(False, "pylock.zipapp.toml", False, id="secondary-lock"),
-        pytest.param(False, "", True, id="no-lock-producer"),
+        pytest.param("pyproject.toml", "", False, id="pyproject-nab-table"),
+        pytest.param("nab.toml", "", False, id="nab-toml"),
+        pytest.param("", "pylock.zipapp.toml", False, id="secondary-lock"),
+        pytest.param("", "", True, id="no-lock-producer"),
     ],
 )
 def test_validate_news_checks_removed_release_lock(
-    repository: Path, tmp_path: Path, action_scripts: Path, nab_config: bool, additional_lock: str, accepted: bool
+    repository: Path, tmp_path: Path, action_scripts: Path, nab_config: str, additional_lock: str, accepted: bool
 ) -> None:
     (repository / "pylock.toml").write_text("lock-version = '1.0'\n")
-    if nab_config:
-        project = repository / "pyproject.toml"
-        project.write_text(project.read_text() + '\n[tool.nab]\nuploaded-prior-to = "P7D"\n')
+    match nab_config:
+        case "pyproject.toml":
+            project = repository / "pyproject.toml"
+            project.write_text(project.read_text() + '\n[tool.nab]\nuploaded-prior-to = "P7D"\n')
+        case "nab.toml":
+            (repository / "nab.toml").write_text('uploaded-prior-to = "P7D"\n')
     run(repository, "git", "add", ".")
     run(repository, "git", "commit", "-m", "Add release lock")
     run(repository, "git", "push", "origin", "main")
diff --git a/validate-news/action.yml b/validate-news/action.yml
index 2fed661..67bc35c 100644
--- a/validate-news/action.yml
+++ b/validate-news/action.yml
@@ -63,7 +63,7 @@ runs:
         fi
         if [[ ! -f pylock.toml ]]; then
           # Removing the lock is fine only once nothing is left that would produce one.
-          if git cat-file -e "origin/$BASE_REF:pylock.toml" 2>/dev/null && { [[ -n "$ADDITIONAL_LOCK" ]] || {
+          if git cat-file -e "origin/$BASE_REF:pylock.toml" 2>/dev/null && { [[ -n "$ADDITIONAL_LOCK" || -f nab.toml ]] || {
             [[ -f pyproject.toml ]] &&
               python3 -c 'import sys, tomllib; sys.exit("nab" not in tomllib.load(open("pyproject.toml", "rb")).get("tool", {}))'
           }; }; then

From 261ad5121041eab77a82898e8297bc0becd963eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= <gaborjbernat@gmail.com>
Date: Sun, 25 Oct 2026 17:20:11 -0700
Subject: [PATCH 4/6] =?UTF-8?q?=F0=9F=A7=B9=20test:=20drop=20removed=20gro?=
 =?UTF-8?q?ups=20from=20the=20fixtures?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tests/fixtures/caller/pylock.toml          | 457 ++-------------------
 tests/fixtures/caller/pyproject.toml       |   5 -
 tests/install_locked_tools/test_install.py |   2 -
 3 files changed, 39 insertions(+), 425 deletions(-)

diff --git a/tests/fixtures/caller/pylock.toml b/tests/fixtures/caller/pylock.toml
index 7d05603..073607f 100644
--- a/tests/fixtures/caller/pylock.toml
+++ b/tests/fixtures/caller/pylock.toml
@@ -8,16 +8,11 @@ dependency-groups = [
     "lock-tools",
     "lock-reader",
     "release-notes",
-    "release-resolver",
-    "release-mise-editor",
     "release-news",
     "release-prepare",
     "release-validate",
     "release-check",
-    "release-attestations",
     "release-shell",
-    "release-hooks",
-    "release-hook-check",
     "test",
 ]
 default-groups = []
@@ -25,7 +20,7 @@ default-groups = []
 [[packages]]
 name = "annotated-types"
 version = "0.8.0"
-marker = "\"release-attestations\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -47,7 +42,7 @@ sha256 = "f072f4d804ea359e4eaf198b1af7a8b0943881a87f31bb764f8bf219bb9419e0"
 [[packages]]
 name = "argcomplete"
 version = "3.7.2"
-marker = "\"release-hook-check\" in dependency_groups or \"release-shell\" in dependency_groups"
+marker = "\"release-shell\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -135,7 +130,7 @@ sha256 = "85ef9d2703918bedf7f88caa0b06bb3bb7a71360eb0b05c20796b89fede6e30c"
 [[packages]]
 name = "certifi"
 version = "2026.7.22"
-marker = "\"lock-reader\" in dependency_groups or \"release-attestations\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"lock-reader\" in dependency_groups or \"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -157,7 +152,7 @@ sha256 = "62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775"
 [[packages]]
 name = "cffi"
 version = "2.1.1"
-marker = "(\"release-attestations\" in dependency_groups and (platform_python_implementation != 'PyPy')) or (\"test\" in dependency_groups and (platform_python_implementation != 'PyPy'))"
+marker = "(\"test\" in dependency_groups and (platform_python_implementation != 'PyPy'))"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -363,7 +358,7 @@ sha256 = "d18e5ac0f2f03f4f518d3e23db0f0cad7faa1da8620e9c09461d443bbf6e6692"
 [[packages]]
 name = "charset-normalizer"
 version = "3.5.2"
-marker = "\"release-attestations\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -791,7 +786,7 @@ sha256 = "5ae39c8c434b972f0740d04610759168590713175aab584b012b1b84f6771874"
 [[packages]]
 name = "click"
 version = "8.5.0"
-marker = "\"release-hooks\" in dependency_groups or \"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -1097,7 +1092,7 @@ sha256 = "11d28e9123a9156cb405d8d27b44256c9a58fb5decc2073a8f17862057e3aa0f"
 [[packages]]
 name = "cryptography"
 version = "50.0.2"
-marker = "\"release-attestations\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -1568,32 +1563,10 @@ size = 472099
 [packages.wheels.hashes]
 sha256 = "cf09d55b1e85a89576b036aeb71550bfd68320f3f21761ca329eadadad918638"
 
-[[packages]]
-name = "dnspython"
-version = "2.9.0"
-marker = "\"release-attestations\" in dependency_groups"
-index = "https://pypi.org/simple/"
-
-[packages.sdist]
-url = "https://files.pythonhosted.org/packages/ef/4a/50822184bd67cc6493f0fb6a880749158fcd31ab3fa07409acfd91f9fc85/dnspython-2.9.0.tar.gz"
-upload-time = 2026-10-09 00:07:24+00:00
-size = 423560
-
-[packages.sdist.hashes]
-sha256 = "b44dc6b18f07a8b1c56676a19fbfdb5209415b046a9cece286baafa87ff3f7f1"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/10/02/cdcc9b7c051786a103c3b09e1003a82fa0c66bcb91ffbdabcfbf7b4163b9/dnspython-2.9.0-py3-none-any.whl"
-upload-time = 2026-10-09 00:07:22+00:00
-size = 354822
-
-[packages.wheels.hashes]
-sha256 = "9a4aedb833c3c1b49214d04d44d3032ab7a9135f7c1d29a549b4ff78fd82fda9"
-
 [[packages]]
 name = "docutils"
 version = "0.23"
-marker = "\"release-hooks\" in dependency_groups or \"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -1612,28 +1585,6 @@ size = 634701
 [packages.wheels.hashes]
 sha256 = "25d013af9bf23bc1c7b2b093dff4208166c53a94786c9e447808335ef1185fea"
 
-[[packages]]
-name = "email-validator"
-version = "2.3.0"
-marker = "\"release-attestations\" in dependency_groups"
-index = "https://pypi.org/simple/"
-
-[packages.sdist]
-url = "https://files.pythonhosted.org/packages/f5/22/900cb125c76b7aaa450ce02fd727f452243f2e91a61af068b40adba60ea9/email_validator-2.3.0.tar.gz"
-upload-time = 2025-08-26 13:09:06+00:00
-size = 51238
-
-[packages.sdist.hashes]
-sha256 = "9fc05c37f2f6cf439ff414f8fc46d917929974a82244c20eb10231ba60c54426"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/de/15/545e2b6cf2e3be84bc1ed85613edd75b8aea69807a71c26f4ca6a9258e82/email_validator-2.3.0-py3-none-any.whl"
-upload-time = 2025-08-26 13:09:05+00:00
-size = 35604
-
-[packages.wheels.hashes]
-sha256 = "80f13f623413e6b197ae73bb10bf4eb0908faf509ad8362c5edeb0be7fd450b4"
-
 [[packages]]
 name = "execnet"
 version = "2.1.2"
@@ -1703,7 +1654,7 @@ sha256 = "08ecf7548fb48205e7f213d70c71e67b8271b7242093dc3f1da578b42c734a2c"
 [[packages]]
 name = "id"
 version = "1.6.1"
-marker = "\"release-attestations\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -1725,7 +1676,7 @@ sha256 = "f5ec41ed2629a508f5d0988eda142e190c9c6da971100612c4de9ad9f9b237ca"
 [[packages]]
 name = "idna"
 version = "3.20"
-marker = "\"release-attestations\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -1879,7 +1830,7 @@ sha256 = "97e5714520c16fc0a45695e5365a2e11b81ea79bba796e26f9f1d178cb182683"
 [[packages]]
 name = "jinja2"
 version = "3.1.6"
-marker = "\"release-hooks\" in dependency_groups or \"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -1923,7 +1874,7 @@ sha256 = "be4a0b195f149690c166e850609a477c532ddbfbaed96a404d4e43f8d5e2689f"
 [[packages]]
 name = "markdown-it-py"
 version = "4.2.0"
-marker = "\"release-attestations\" in dependency_groups or \"release-hooks\" in dependency_groups or \"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -1945,7 +1896,7 @@ sha256 = "9f7ebbcd14fe59494226453aed97c1070d83f8d24b6fc3a3bcf9a38092641c4a"
 [[packages]]
 name = "markupsafe"
 version = "3.0.4"
-marker = "\"release-hooks\" in dependency_groups or \"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -2239,7 +2190,7 @@ sha256 = "39dbacefc411633db5b4378b066a9aca70a3d7e2922c9e578d825f844026eeba"
 [[packages]]
 name = "mdformat"
 version = "1.0.0"
-marker = "\"release-hooks\" in dependency_groups or \"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -2261,7 +2212,7 @@ sha256 = "bca015d65a1d063a02e885a91daee303057bc7829c2cd37b2075a50dbb65944b"
 [[packages]]
 name = "mdformat-gfm"
 version = "1.0.0"
-marker = "\"release-hooks\" in dependency_groups or \"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -2283,7 +2234,7 @@ sha256 = "7305a50efd2a140d7c83505b58e3ac5df2b09e293f9bbe72f6c7bee8c678b005"
 [[packages]]
 name = "mdit-py-plugins"
 version = "0.6.1"
-marker = "\"release-hooks\" in dependency_groups or \"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -2305,7 +2256,7 @@ sha256 = "214c82fb2ac524472ab6a5bcab1de80f73b50443e187f401bfd77efbc7c6481d"
 [[packages]]
 name = "mdurl"
 version = "0.1.2"
-marker = "\"release-attestations\" in dependency_groups or \"release-hooks\" in dependency_groups or \"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -2623,7 +2574,7 @@ sha256 = "f04b7d333b27f13ca439da3cf1c75c2fba34f104969f6ce4ac8e7079699c2f4a"
 [[packages]]
 name = "packaging"
 version = "26.3"
-marker = "\"lock-reader\" in dependency_groups or \"lock-tools\" in dependency_groups or \"release-attestations\" in dependency_groups or \"release-hooks\" in dependency_groups or \"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"lock-reader\" in dependency_groups or \"lock-tools\" in dependency_groups or \"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -2667,7 +2618,7 @@ sha256 = "a00ce642f577bf7f473932318056212bc4f8bfdf53128c78bbd5af0b9b20b189"
 [[packages]]
 name = "platformdirs"
 version = "4.13.4"
-marker = "\"release-attestations\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -2711,7 +2662,7 @@ sha256 = "7dd7b0d8832ba3cb632c306926ded123429211b83641b35dc5c41ad2d34f9bec"
 [[packages]]
 name = "prek"
 version = "0.5.5"
-marker = "\"release-check\" in dependency_groups or \"release-hook-check\" in dependency_groups or \"release-hooks\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-shell\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-check\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-shell\" in dependency_groups or \"release-validate\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -2794,32 +2745,10 @@ size = 5517355
 [packages.wheels.hashes]
 sha256 = "3db3191d2509830c75438e20956a47c2259867d18a4106064ed75088b968a0c6"
 
-[[packages]]
-name = "pyasn1"
-version = "0.6.4"
-marker = "\"release-attestations\" in dependency_groups"
-index = "https://pypi.org/simple/"
-
-[packages.sdist]
-url = "https://files.pythonhosted.org/packages/a4/9a/23310166d960def5897e91fe20e5b724601b02a22e84ba1f94232c0b7f67/pyasn1-0.6.4.tar.gz"
-upload-time = 2026-07-09 01:12:33+00:00
-size = 151262
-
-[packages.sdist.hashes]
-sha256 = "9c447d8431c947fe4c8febc4ed9e760bc29011a5b01e5c74b67025bd9fb8ce81"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/9a/3b/6163796d69c3977d1e4287bea4a6979161cbbdd170ebb430511e8e1999ce/pyasn1-0.6.4-py3-none-any.whl"
-upload-time = 2026-07-09 01:12:32+00:00
-size = 84410
-
-[packages.wheels.hashes]
-sha256 = "deda9277cfd454080ec40b207fb6df82206a3a2688735233cdcd8d3d565f088b"
-
 [[packages]]
 name = "pycparser"
 version = "3.11"
-marker = "(\"release-attestations\" in dependency_groups and (implementation_name != 'PyPy' and platform_python_implementation != 'PyPy')) or (\"test\" in dependency_groups and (implementation_name != 'PyPy' and platform_python_implementation != 'PyPy'))"
+marker = "(\"test\" in dependency_groups and (implementation_name != 'PyPy' and platform_python_implementation != 'PyPy'))"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -2841,7 +2770,7 @@ sha256 = "51d5a8ba2be0bbe440b99d2112604c95bbbc3c2748a64260186c541e1729cd80"
 [[packages]]
 name = "pydantic"
 version = "2.14.1"
-marker = "\"release-attestations\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -2863,7 +2792,7 @@ sha256 = "9195d967ec791692a04438115466764fb8b9a27b31f14a760437694f40d6b454"
 [[packages]]
 name = "pydantic-core"
 version = "2.50.1"
-marker = "\"release-attestations\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -3117,7 +3046,7 @@ sha256 = "c3ede305158e75510be50869b319550ab072008c13d64d4ab1e094fb286b6f44"
 [[packages]]
 name = "pygments"
 version = "2.21.0"
-marker = "\"release-attestations\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -3136,72 +3065,6 @@ size = 1250147
 [packages.wheels.hashes]
 sha256 = "2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9"
 
-[[packages]]
-name = "pyjwt"
-version = "2.15.1"
-marker = "\"release-attestations\" in dependency_groups"
-index = "https://pypi.org/simple/"
-
-[packages.sdist]
-url = "https://files.pythonhosted.org/packages/43/ea/5194e52748b0da83d71e082d75496eaec6e58f419f5e184786ded517e6a9/pyjwt-2.15.1.tar.gz"
-upload-time = 2026-09-28 18:40:42+00:00
-size = 121252
-
-[packages.sdist.hashes]
-sha256 = "4f259e80cdfb6b3fc18a7de51fd1ef9ec79652f25019bae68975ca2468a34df8"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/50/ca/44de4e75f8aadc457f0634be3b542815078ded46dca30efb960edeecad6e/pyjwt-2.15.1-py3-none-any.whl"
-upload-time = 2026-09-28 18:40:41+00:00
-size = 33860
-
-[packages.wheels.hashes]
-sha256 = "42d59d631f7768a1028a64c7ff581a9bf7519804daf91fc5b6c56e30eec5e193"
-
-[[packages]]
-name = "pyopenssl"
-version = "26.4.0"
-marker = "\"release-attestations\" in dependency_groups"
-index = "https://pypi.org/simple/"
-
-[packages.sdist]
-url = "https://files.pythonhosted.org/packages/3f/e8/7325d258199b159eb2c03fe32107533e2832e70e63f4fb88a6aa00023201/pyopenssl-26.4.0.tar.gz"
-upload-time = 2026-08-01 19:50:50+00:00
-size = 182046
-
-[packages.sdist.hashes]
-sha256 = "28dfcce0162b9211413e26dfbfdf1d24317fbeba18fc93c12400a1856b2a0bc7"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/51/ad/2cf6d3fa2fae5c79e1ed9960c0d42badd0f94d81dd12b50604cdc839e648/pyopenssl-26.4.0-py3-none-any.whl"
-upload-time = 2026-08-01 19:50:48+00:00
-size = 56026
-
-[packages.wheels.hashes]
-sha256 = "f0eb0cb2d581d3ad2b9c489468485e7f2ab6727d08401bcf9d824c3caddf3c1c"
-
-[[packages]]
-name = "pypi-attestations"
-version = "0.0.30"
-marker = "\"release-attestations\" in dependency_groups"
-index = "https://pypi.org/simple/"
-
-[packages.sdist]
-url = "https://files.pythonhosted.org/packages/97/1e/eb8a0233cdcaf01acb18076ac8b8a057714177b3717baf26b78a11b8d929/pypi_attestations-0.0.30.tar.gz"
-upload-time = 2026-07-28 14:08:35+00:00
-size = 139108
-
-[packages.sdist.hashes]
-sha256 = "14ff13c76bbef02a483c2b77532da02bfd746b5141b881f355e06b9807434423"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/5f/24/e59078318b5e2bca59be5a21957d70e082e6eb4f478adffe373f3b74daf4/pypi_attestations-0.0.30-py3-none-any.whl"
-upload-time = 2026-07-28 14:08:33+00:00
-size = 23015
-
-[packages.wheels.hashes]
-sha256 = "b3a9c53f6cb89e5e7b5b70e6cfca97cfc66008c1ed54087355e06e40071cef21"
-
 [[packages]]
 name = "pyproject-api"
 version = "1.12.0"
@@ -3381,7 +3244,7 @@ sha256 = "8a1513379d709975552d202d942d9837758905c8d01eb82b8bcc30918929e7b8"
 [[packages]]
 name = "pyyaml"
 version = "6.0.3"
-marker = "\"release-hook-check\" in dependency_groups or \"release-hooks\" in dependency_groups or \"release-mise-editor\" in dependency_groups or \"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-shell\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-shell\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -3417,7 +3280,7 @@ sha256 = "d0dae1f74bb273b534770cb4cccb6bb78735540afdb03c2146f4e19dcd412560"
 [[packages]]
 name = "release-creator"
 version = "2.0.0"
-marker = "\"release-hooks\" in dependency_groups or \"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -3439,7 +3302,7 @@ sha256 = "cf93c2395f4a9ba80bd503792c16189fc238c5d82bb90535250de2968d8d2e92"
 [[packages]]
 name = "requests"
 version = "2.34.2"
-marker = "\"release-attestations\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -3480,120 +3343,10 @@ size = 54481
 [packages.wheels.hashes]
 sha256 = "cccfdd665f0a24fcf4726e690f65639d272bb0637b9b92dfd91a5568ccf6bd06"
 
-[[packages]]
-name = "rfc3161-client"
-version = "1.0.9"
-marker = "\"release-attestations\" in dependency_groups"
-index = "https://pypi.org/simple/"
-
-[packages.sdist]
-url = "https://files.pythonhosted.org/packages/56/53/e2f526fb6957023180c928448e2dd71b03b35038c315aed2d12d9a77c3af/rfc3161_client-1.0.9.tar.gz"
-upload-time = 2026-09-14 19:32:29+00:00
-size = 112825
-
-[packages.sdist.hashes]
-sha256 = "66997415086d2c6e5d57a2d315157b32a9c3f4f1312877ca8eb55e2e0ddf8ce4"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/92/2c/b81b822bc067647aa291dc4ea71f052f994344934fc84d499759aec64cf8/rfc3161_client-1.0.9-cp39-abi3-macosx_10_12_x86_64.whl"
-upload-time = 2026-09-14 19:32:08+00:00
-size = 2109721
-
-[packages.wheels.hashes]
-sha256 = "5e619d7e28ffa3a46685923e6d6ba4ce2e74cb09a41c77995a0702cc1a533bc4"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/88/cf/bcfb66eaeccdc076457451a6213360c840bcacd0e938e8507951be29373f/rfc3161_client-1.0.9-cp39-abi3-macosx_11_0_arm64.whl"
-upload-time = 2026-09-14 19:32:10+00:00
-size = 2439706
-
-[packages.wheels.hashes]
-sha256 = "a7004edfbf1bb7ec7801978a39fa7a7fe385ca59673df90d7578079b6eba3b24"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/8e/f3/4b69d47fd7f79238bf8db20902a30d28c908efc0d906fb57abcc89ac75e3/rfc3161_client-1.0.9-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
-upload-time = 2026-09-14 19:32:12+00:00
-size = 2651455
-
-[packages.wheels.hashes]
-sha256 = "7b703b233dbee7228d117d5f1c118363c61d523fa6f018c9217c79e3c6684f86"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/33/49/154c3e80ac94e51b9d1097dab15b95f44aa593c395bd41775e4486a7d0a0/rfc3161_client-1.0.9-cp39-abi3-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
-upload-time = 2026-09-14 19:32:13+00:00
-size = 2051342
-
-[packages.wheels.hashes]
-sha256 = "d3cbf1991b6f3457efcb25e1d31179cac556112e6d3e65ec9e0fd70c6e9af90d"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/c8/57/79bf6a67cd4ca729b0b74e6fa79ebef84e6bc8657b85772df01a7d3b7b89/rfc3161_client-1.0.9-cp39-abi3-manylinux_2_17_i686.manylinux2014_i686.whl"
-upload-time = 2026-09-14 19:32:15+00:00
-size = 2418228
-
-[packages.wheels.hashes]
-sha256 = "614da494c6f8850c5d6d98c23bc291a4e4dbf2c3c9082d9907fa156f9e4a75c6"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/11/ae/19139fee184916065705d660bad203b676dc40b449afff36f79818c59c4f/rfc3161_client-1.0.9-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
-upload-time = 2026-09-14 19:32:17+00:00
-size = 2415566
-
-[packages.wheels.hashes]
-sha256 = "fac3f440a507555e684dc5daba75e33dc08f0f45fdefa48448f19001233a6b21"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/6e/54/43f89c8e004baade51943261b29f9dd866df3383f4554d5797a2568c2855/rfc3161_client-1.0.9-cp39-abi3-musllinux_1_2_aarch64.whl"
-upload-time = 2026-09-14 19:32:19+00:00
-size = 2995975
-
-[packages.wheels.hashes]
-sha256 = "0ac247d5aa22f3514d1e284bdc547d2ad5f101e1e5d7f6db25db2ab3a0c59f06"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/2b/b2/938e4df767a2ea6fae2bc8e8e0df52e1d70a32a082a13bdfdd6fac59dc32/rfc3161_client-1.0.9-cp39-abi3-musllinux_1_2_armv7l.whl"
-upload-time = 2026-09-14 19:32:20+00:00
-size = 2358728
-
-[packages.wheels.hashes]
-sha256 = "03be7ac7919c7f4c566076b07773b81b1f1b28d447fa91c6960fb5f82fac5bc1"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/ff/54/f0193b27f1a635aa336d19b48c296f133719cafb87e950de6eae4638a046/rfc3161_client-1.0.9-cp39-abi3-musllinux_1_2_i686.whl"
-upload-time = 2026-09-14 19:32:22+00:00
-size = 2565766
-
-[packages.wheels.hashes]
-sha256 = "8208999e94e1252e3f5f748f5efe59d3b9c308d04c7626be1becfbf3236c9de4"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/15/41/6c48b05fc41a424ab3b0cb0515e77046707b498837411633fe7ce77812ee/rfc3161_client-1.0.9-cp39-abi3-musllinux_1_2_x86_64.whl"
-upload-time = 2026-09-14 19:32:24+00:00
-size = 2643597
-
-[packages.wheels.hashes]
-sha256 = "d4cf92f0e784ff02ff5ea1c574f8521f30953dc178092424126dbd8348034f93"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/d2/18/fcb2f311b0b1754b0476165a4eae2929606007fc0ff0a575a65dbff2c0f6/rfc3161_client-1.0.9-cp39-abi3-win32.whl"
-upload-time = 2026-09-14 19:32:25+00:00
-size = 1996018
-
-[packages.wheels.hashes]
-sha256 = "4d33f5aaec2974239e1c62a79a6fcf32506b09095482377a8b5be3a00fa67dfb"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/d2/a1/b71d9f2071660a914e039061d3cdcad77b1cbccf7276bff073f95e8b4d1a/rfc3161_client-1.0.9-cp39-abi3-win_amd64.whl"
-upload-time = 2026-09-14 19:32:27+00:00
-size = 2431351
-
-[packages.wheels.hashes]
-sha256 = "908f6a775da4bdce1d39f825a4431f389542696078ef3e4ed911a068bcaf1792"
-
 [[packages]]
 name = "rfc3986"
 version = "2.0.0"
-marker = "\"release-attestations\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -3612,32 +3365,10 @@ size = 31326
 [packages.wheels.hashes]
 sha256 = "50b1502b60e289cb37883f3dfd34532b8873c7de9f49bb546641ce9cbd256ebd"
 
-[[packages]]
-name = "rfc8785"
-version = "0.1.4"
-marker = "\"release-attestations\" in dependency_groups"
-index = "https://pypi.org/simple/"
-
-[packages.sdist]
-url = "https://files.pythonhosted.org/packages/ef/2f/fa1d2e740c490191b572d33dbca5daa180cb423c24396b856f5886371d8b/rfc8785-0.1.4.tar.gz"
-upload-time = 2024-09-27 16:33:31+00:00
-size = 14321
-
-[packages.sdist.hashes]
-sha256 = "e545841329fe0eee4f6a3b44e7034343100c12b4ec566dc06ca9735681deb4da"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/4d/78/119878110660b2ad709888c8a1614fce7e2fab39080ab960656dc8605bf6/rfc8785-0.1.4-py3-none-any.whl"
-upload-time = 2024-09-27 16:33:29+00:00
-size = 9240
-
-[packages.wheels.hashes]
-sha256 = "520d690b448ecf0703691c76e1a34a24ddcd4fc5bc41d589cb7c58ec651bcd48"
-
 [[packages]]
 name = "rich"
 version = "15.0.0"
-marker = "\"release-attestations\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -3678,28 +3409,6 @@ size = 15554
 [packages.wheels.hashes]
 sha256 = "0ce65888c0725fcb2c5bc0fdb8e5438eece02c523557ea40ce0703c266248137"
 
-[[packages]]
-name = "securesystemslib"
-version = "1.5.1"
-marker = "\"release-attestations\" in dependency_groups"
-index = "https://pypi.org/simple/"
-
-[packages.sdist]
-url = "https://files.pythonhosted.org/packages/81/d4/f9323507144693d869f30f13694035438ab6642153b94e3057945cf0584f/securesystemslib-1.5.1.tar.gz"
-upload-time = 2026-09-04 06:55:32+00:00
-size = 947087
-
-[packages.sdist.hashes]
-sha256 = "4b8d00abd93707ead10b69eb2b8582376a1364de3b0a71077de534c2ef4985e0"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/38/fc/c71335a5046d46bf3b761a8c7fa092b40a7721429a5613538f0a28ae80a6/securesystemslib-1.5.1-py3-none-any.whl"
-upload-time = 2026-09-04 06:55:30+00:00
-size = 876390
-
-[packages.wheels.hashes]
-sha256 = "ada8bdf817da29ece4ba91654f6a162ce7cfbadbc3ae3f840f7313f9d22675de"
-
 [[packages]]
 name = "setuptools"
 version = "84.0.0"
@@ -3722,72 +3431,6 @@ size = 818216
 [packages.wheels.hashes]
 sha256 = "51a52592b3b99e102b609654876bd65f19f999935166d1352678931132b0c670"
 
-[[packages]]
-name = "sigstore"
-version = "4.5.0"
-marker = "\"release-attestations\" in dependency_groups"
-index = "https://pypi.org/simple/"
-
-[packages.sdist]
-url = "https://files.pythonhosted.org/packages/18/e0/279419065e2d7102413605b3456122adbbccbc42e010b499c7b882fc01f8/sigstore-4.5.0.tar.gz"
-upload-time = 2026-07-28 07:34:01+00:00
-size = 90969
-
-[packages.sdist.hashes]
-sha256 = "020d3e07f622b2916bf453e66ff6ff0711e1fdc5ab69e8bd8902f71d9fcb316f"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/bf/7f/51dc313c06dd3ec6c5b308e334492cfdea0b02c9184a0da7b2db8c2a30a1/sigstore-4.5.0-py3-none-any.whl"
-upload-time = 2026-07-28 07:34:00+00:00
-size = 111724
-
-[packages.wheels.hashes]
-sha256 = "f045b207f2e12605cf775ec38e89c5eda625d71ffa7830477db65e47ec2bc8b2"
-
-[[packages]]
-name = "sigstore-models"
-version = "0.0.6"
-marker = "\"release-attestations\" in dependency_groups"
-index = "https://pypi.org/simple/"
-
-[packages.sdist]
-url = "https://files.pythonhosted.org/packages/c6/ed/5c0ff809f90b19f4e971e17c1ed11f4df60082c6010b32a82054087e91e0/sigstore_models-0.0.6.tar.gz"
-upload-time = 2025-11-26 19:18:12+00:00
-size = 7037
-
-[packages.sdist.hashes]
-sha256 = "c766c09470c2a7e8a4a333c893f07e2001c56a3ff1757b1a246119f53169a849"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/12/dc/7a19864a7bc9f43121ab459e12768ab0080590e3e1b60a29b2f2eb01fb85/sigstore_models-0.0.6-py3-none-any.whl"
-upload-time = 2025-11-26 19:18:11+00:00
-size = 13213
-
-[packages.wheels.hashes]
-sha256 = "5201a68f4d7d0f8bec1e2f4378eb646b084c52609a4e31db8c385095fff68b2e"
-
-[[packages]]
-name = "sigstore-rekor-types"
-version = "0.0.18"
-marker = "\"release-attestations\" in dependency_groups"
-index = "https://pypi.org/simple/"
-
-[packages.sdist]
-url = "https://files.pythonhosted.org/packages/b4/54/102e772445c5e849b826fbdcd44eb9ad7b3d10fda17b08964658ec7027dc/sigstore_rekor_types-0.0.18.tar.gz"
-upload-time = 2024-11-22 13:59:54+00:00
-size = 15687
-
-[packages.sdist.hashes]
-sha256 = "19aef25433218ebf9975a1e8b523cc84aaf3cd395ad39a30523b083ea7917ec5"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/45/7c/f0b4e19fd424df4cc964f5d454e1d814fd2dc3b386342e6040441024318f/sigstore_rekor_types-0.0.18-py3-none-any.whl"
-upload-time = 2024-11-22 13:59:52+00:00
-size = 20610
-
-[packages.wheels.hashes]
-sha256 = "b62bf38c5b1a62bc0d7fe0ee51a0709e49311d137c7880c329882a8f4b2d1d78"
-
 [[packages]]
 name = "tomli"
 version = "2.5.0"
@@ -3957,7 +3600,7 @@ sha256 = "32a7b79ac57a2e83670ce329ccf675798bc5a2094783a63676866b70503f2e2b"
 [[packages]]
 name = "tomli-w"
 version = "1.2.0"
-marker = "\"lock-tools\" in dependency_groups or \"release-hooks\" in dependency_groups or \"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"lock-tools\" in dependency_groups or \"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -3979,7 +3622,7 @@ sha256 = "188306098d013b691fcadc011abd66727d3c414c571bb01b1a174ba8c983cf90"
 [[packages]]
 name = "tomlkit"
 version = "0.15.2"
-marker = "\"lock-tools\" in dependency_groups or \"release-hook-check\" in dependency_groups or \"release-shell\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"lock-tools\" in dependency_groups or \"release-shell\" in dependency_groups or \"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -4001,7 +3644,7 @@ sha256 = "05562412163a3037b94497385fb7f9204c637bc605af7a48199e41cf2272f437"
 [[packages]]
 name = "towncrier"
 version = "26.9.0"
-marker = "\"release-hooks\" in dependency_groups or \"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -4144,28 +3787,6 @@ size = 19017
 [packages.wheels.hashes]
 sha256 = "9aaaedaefaf06d8b206278cf8b5012bc897f485a874503501e12d776df78951c"
 
-[[packages]]
-name = "tuf"
-version = "7.0.1"
-marker = "\"release-attestations\" in dependency_groups"
-index = "https://pypi.org/simple/"
-
-[packages.sdist]
-url = "https://files.pythonhosted.org/packages/9c/dd/52e7390cbac308e6b1cfe6be9bc3a96fe26326d5893cc297a52bb72792a9/tuf-7.0.1.tar.gz"
-upload-time = 2026-09-02 06:19:52+00:00
-size = 274148
-
-[packages.sdist.hashes]
-sha256 = "5ada1db78da3518fa851e28588f4b2249b8662a28ae528f54afa2a1de541fb31"
-
-[[packages.wheels]]
-url = "https://files.pythonhosted.org/packages/a2/10/171e306e4a19ff980b9029ce5a523881e34bc6a2a52750fb1853f49f0fb9/tuf-7.0.1-py3-none-any.whl"
-upload-time = 2026-09-02 06:19:50+00:00
-size = 56253
-
-[packages.wheels.hashes]
-sha256 = "d30434bda6e079ab303fb30d1b3006d939a10ca34783b1573d61cd9b802fa45c"
-
 [[packages]]
 name = "twine"
 version = "7.0.0"
@@ -4341,7 +3962,7 @@ sha256 = "1d4967c8f7bfd67c9708115b41d7049197c5d20c76fb2e136fe78b0437ada05b"
 [[packages]]
 name = "typing-extensions"
 version = "4.16.0"
-marker = "\"lock-tools\" in dependency_groups or \"release-attestations\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"lock-tools\" in dependency_groups or \"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -4363,7 +3984,7 @@ sha256 = "481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8"
 [[packages]]
 name = "typing-inspection"
 version = "0.4.4"
-marker = "\"release-attestations\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -4385,7 +4006,7 @@ sha256 = "65b8397ba37ccbce054456aaccddfc91e6e3083c92824df348d96ca832f3f147"
 [[packages]]
 name = "urllib3"
 version = "2.8.0"
-marker = "\"lock-tools\" in dependency_groups or \"release-attestations\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"lock-tools\" in dependency_groups or \"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -4407,7 +4028,7 @@ sha256 = "0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3"
 [[packages]]
 name = "uv"
 version = "0.13.5"
-marker = "\"release-resolver\" in dependency_groups or \"test\" in dependency_groups"
+marker = "\"test\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -4587,7 +4208,7 @@ sha256 = "b319f8590a84e5de5f8f2c803ecd2237e9bc0ffa7c1e875e3169c107cecb7454"
 [[packages]]
 name = "wcwidth"
 version = "0.9.2"
-marker = "\"release-hooks\" in dependency_groups or \"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -4805,7 +4426,7 @@ sha256 = "3fa599046443d4ca830d06e3d180cd0a675d5871af0a68daa5623318bb4d17e3"
 [[packages]]
 name = "xmltodict"
 version = "1.0.4"
-marker = "\"release-hook-check\" in dependency_groups or \"release-shell\" in dependency_groups"
+marker = "\"release-shell\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
@@ -4827,7 +4448,7 @@ sha256 = "a4a00d300b0e1c59fc2bfccb53d7b2e88c32f200df138a0dd2229f842497026a"
 [[packages]]
 name = "yq"
 version = "4.4.5"
-marker = "\"release-hook-check\" in dependency_groups or \"release-shell\" in dependency_groups"
+marker = "\"release-shell\" in dependency_groups"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
diff --git a/tests/fixtures/caller/pyproject.toml b/tests/fixtures/caller/pyproject.toml
index 68b57a3..abab5b5 100644
--- a/tests/fixtures/caller/pyproject.toml
+++ b/tests/fixtures/caller/pyproject.toml
@@ -12,16 +12,11 @@ build = [ "Cython>=3.0", "setuptools>=80" ]
 lock-tools = [ "nab==0.0.22", "tomlkit>=0.13" ]
 lock-reader = [ "certifi>=2026.7.22", "packaging>=26.3" ]
 release-notes = [ "release-creator>=2.0.0" ]
-release-resolver = [ "uv==0.13.5" ]
-release-mise-editor = [ "pyyaml>=6" ]
 release-news = [ "release-creator>=2.0.0", "towncrier>=26.9" ]
 release-prepare = [ "release-creator>=2.0.0", "towncrier>=26.9", "prek>=0.2" ]
 release-validate = [ "release-creator>=2.0.0", "prek>=0.2" ]
 release-check = [ "prek>=0.2" ]
-release-attestations = [ "certifi>=2026.7.22", "pypi-attestations>=0.0.30" ]
 release-shell = [ "prek>=0.2", "yq>=4.4.5" ]
-release-hooks = [ "release-creator>=2.0.0", "prek>=0.2" ]
-release-hook-check = [ "prek>=0.2", "yq>=4.4.5" ]
 test = [
   "certifi",
   "check-wheel-contents>=0.6.3",
diff --git a/tests/install_locked_tools/test_install.py b/tests/install_locked_tools/test_install.py
index e0c3306..2154cd7 100644
--- a/tests/install_locked_tools/test_install.py
+++ b/tests/install_locked_tools/test_install.py
@@ -49,8 +49,6 @@ def test_install_locked_tools_installs_groups(
         pytest.param("release-news", "towncrier", "prek", id="pr-news"),
         pytest.param("release-validate", "release-creator", "yq", id="patch-validation"),
         pytest.param("release-shell", "yq", "release-creator", id="inline-shell"),
-        pytest.param("release-hooks", "release-creator", "yq", id="action-tests"),
-        pytest.param("release-hook-check", "yq", "towncrier", id="hook-cooldown"),
     ],
 )
 def test_install_locked_tools_selects_job_tools(

From 6425fbc90949e6f8d8980e0b3e44b11d71503cb8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= <gaborjbernat@gmail.com>
Date: Sun, 25 Oct 2026 17:21:43 -0700
Subject: [PATCH 5/6] =?UTF-8?q?=F0=9F=94=A7=20build(test):=20make=20a=20pl?=
 =?UTF-8?q?ain=20tox=20run=20self-contained?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/check.yaml |  7 -------
 CONTRIBUTING.md              |  7 ++-----
 pylock.toml                  | 28 +++++++++++++++-------------
 pyproject.toml               |  2 ++
 4 files changed, 19 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml
index 7052637..6680a40 100644
--- a/.github/workflows/check.yaml
+++ b/.github/workflows/check.yaml
@@ -99,13 +99,6 @@ jobs:
           enable-cache: true
           cache-suffix: ${{ github.job }}
           cache-dependency-glob: pyproject.toml
-      - name: Install release tools
-        env:
-          EXCLUDE_NEWER: 7 days
-          # Temporary: release-creator 3.1.0 is younger than seven days. Delete after 2026-11-02.
-          EXCLUDE_NEWER_PACKAGE: release-creator=2026-10-25T21:03:31Z
-        run: |
-          tools/install_live_tools.sh .release-tools 'release-creator>=3.1.0' 'towncrier>=26.9' 'prek>=0.2' 'yq>=4.4.5'
       - name: Run Action tests
         run: uvx --with tox-uv tox run -e test
   type:
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 6a8b5a6..f1b50ec 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -5,15 +5,12 @@ and test its inputs and outputs before opening a pull request.
 
 ## Set up
 
-Use Python 3.15. Install the release tools under the seven-day cutoff, as CI does, and test tools from the current
-index:
+Use Python 3.15. The `test` group holds the test tools, release-creator, and prek:
 
 ```bash
 uv venv --allow-existing --python 3.15 .venv
-EXCLUDE_NEWER="7 days" tools/install_live_tools.sh .release-tools \
-  'release-creator>=3.1.0' 'towncrier>=26.9' 'prek>=0.2' 'yq>=4.4.5'
 uv pip install --python .venv/bin/python --group test
-export PATH="$PWD/.release-tools/bin:$PWD/.venv/bin:$PATH"
+export PATH="$PWD/.venv/bin:$PATH"
 ```
 
 Run the checks before pushing:
diff --git a/pylock.toml b/pylock.toml
index e8db8ca..21d33b4 100644
--- a/pylock.toml
+++ b/pylock.toml
@@ -92,7 +92,7 @@ sha256 = "aeae0e330c9f6acd681f647d46cefd30c29f93e3392882e792e82080c9691399"
 [[packages]]
 name = "click"
 version = "8.5.0"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.10"
 index = "https://pypi.org/simple/"
 
@@ -334,7 +334,7 @@ sha256 = "cf09d55b1e85a89576b036aeb71550bfd68320f3f21761ca329eadadad918638"
 [[packages]]
 name = "docutils"
 version = "0.23"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.9"
 index = "https://pypi.org/simple/"
 
@@ -491,7 +491,7 @@ sha256 = "9121e2c1fdb355232495be3194c8dfe87ccc2d5dee45947b78e68f499790d7a7"
 [[packages]]
 name = "jinja2"
 version = "3.1.6"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.7"
 dependencies = [
     { name = "markupsafe" },
@@ -519,7 +519,7 @@ sha256 = "85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67"
 [[packages]]
 name = "markdown-it-py"
 version = "4.2.0"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.10"
 dependencies = [
     { name = "mdurl" },
@@ -572,7 +572,7 @@ sha256 = "925f929d6b59a8b3f8b8c6ac363cd0af7eecc81efb3071770b3c6717c450a369"
 [[packages]]
 name = "mdformat"
 version = "1.0.0"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.10"
 dependencies = [
     { name = "markdown-it-py" },
@@ -600,7 +600,7 @@ sha256 = "bca015d65a1d063a02e885a91daee303057bc7829c2cd37b2075a50dbb65944b"
 [[packages]]
 name = "mdformat-gfm"
 version = "1.0.0"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.10"
 dependencies = [
     { name = "markdown-it-py" },
@@ -631,7 +631,7 @@ sha256 = "7305a50efd2a140d7c83505b58e3ac5df2b09e293f9bbe72f6c7bee8c678b005"
 [[packages]]
 name = "mdit-py-plugins"
 version = "0.6.1"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.10"
 dependencies = [
     { name = "markdown-it-py" },
@@ -659,7 +659,7 @@ sha256 = "214c82fb2ac524472ab6a5bcab1de80f73b50443e187f401bfd77efbc7c6481d"
 [[packages]]
 name = "mdurl"
 version = "0.1.2"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.7"
 index = "https://pypi.org/simple/"
 
@@ -784,7 +784,7 @@ sha256 = "7dd7b0d8832ba3cb632c306926ded123429211b83641b35dc5c41ad2d34f9bec"
 [[packages]]
 name = "prek"
 version = "0.5.5"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.8"
 index = "https://pypi.org/simple/"
 
@@ -1047,7 +1047,7 @@ sha256 = "d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f"
 [[packages]]
 name = "release-creator"
 version = "3.1.0"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.15"
 dependencies = [
     { name = "docutils" },
@@ -1156,7 +1156,7 @@ sha256 = "05562412163a3037b94497385fb7f9204c637bc605af7a48199e41cf2272f437"
 [[packages]]
 name = "towncrier"
 version = "26.9.0"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.9"
 dependencies = [
     { name = "click" },
@@ -1406,7 +1406,7 @@ sha256 = "b319f8590a84e5de5f8f2c803ecd2237e9bc0ffa7c1e875e3169c107cecb7454"
 [[packages]]
 name = "wcwidth"
 version = "0.9.2"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.9"
 index = "https://pypi.org/simple/"
 
@@ -1474,7 +1474,9 @@ command-line = [
     "--all-groups",
     "--all-extras",
     "--no-cache",
-    "--upgrade",
+    "pyproject.toml",
+    "--output",
+    "pylock.toml",
 ]
 input-path = "pyproject.toml"
 mode = "universal"
diff --git a/pyproject.toml b/pyproject.toml
index 00dd120..1107a17 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -15,11 +15,13 @@ test = [
   "certifi",
   "coverage[toml]>=7.10",
   "hatchling>=1.28",
+  "prek>=0.2",
   "pytest>=9",
   "pytest-httpserver",
   "pytest-mock>=3.16",
   "pytest-xdist>=3",
   "pyyaml>=6",
+  "release-creator>=3.1.0",
   "tomlkit>=0.13",
   "tox>=4.64.7",
   "tox-uv>=1.36.1",

From a438ebc6c595c992d9320edfde3b9a80bfd672cc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= <gaborjbernat@gmail.com>
Date: Sun, 25 Oct 2026 17:21:59 -0700
Subject: [PATCH 6/6] =?UTF-8?q?=F0=9F=93=9D=20docs:=20name=20the=20dispatc?=
 =?UTF-8?q?h=20tag=20input?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md                              | 8 ++++----
 changelog.d/+dispatch-tag-input.doc.md | 2 ++
 2 files changed, 6 insertions(+), 4 deletions(-)
 create mode 100644 changelog.d/+dispatch-tag-input.doc.md

diff --git a/README.md b/README.md
index b368388..5bc6a7d 100644
--- a/README.md
+++ b/README.md
@@ -184,10 +184,10 @@ anywhere, a `.pre-commit-config.yml`, and a `.pre-commit-config.yaml` below the
 The shared prepare and tagged validator run `refresh-release-lock` in `check` mode before release checks or publishing.
 `check-tagged-source` bundles the tagged checks for a custom tag publisher: on a tag ref it requires the tag to name
 both `GITHUB_SHA` and the checkout, on `main`, and checks the locks. Any other event, such as a `workflow_dispatch` from
-`main` with a `tag` input, must check out the commit that `inputs.tag` names, on `main`. It runs no hooks. It takes the
-secondary lock inputs below and needs a full-history checkout. For a secondary Nab lock, pass its path, selected groups,
-selection type, and matrix inputs to both workflows. A stale primary or secondary lock stops the release before
-artifacts are built.
+`main`, must check out the commit that the `tag` input of the `workflow_dispatch` event (`github.event.inputs.tag`)
+names, on `main`. It runs no hooks. It takes the secondary lock inputs below and needs a full-history checkout. For a
+secondary Nab lock, pass its path, selected groups, selection type, and matrix inputs to both workflows. A stale primary
+or secondary lock stops the release before artifacts are built.
 
 For example, a tagged source job that also publishes from a PGO lock checks both files before installing build tools:
 
diff --git a/changelog.d/+dispatch-tag-input.doc.md b/changelog.d/+dispatch-tag-input.doc.md
new file mode 100644
index 0000000..70e3aac
--- /dev/null
+++ b/changelog.d/+dispatch-tag-input.doc.md
@@ -0,0 +1,2 @@
+Say that `check-tagged-source` reads the tag of a non-tag run from the `tag` input of the `workflow_dispatch` event,
+`github.event.inputs.tag`, rather than from an input of the Action.