🐛 fix: check locks with their own Nab, isolate tool installs

.github/workflows/check.yaml

@@ -99,13 +99,6 @@ jobs:
           enable-cache: true
           cache-suffix: ${{ github.job }}
           cache-dependency-glob: pyproject.toml
-      - name: Install release tools
-        env:
-          EXCLUDE_NEWER: 7 days
-          # Temporary: release-creator 3.1.0 is younger than seven days. Delete after 2026-11-02.
-          EXCLUDE_NEWER_PACKAGE: release-creator=2026-10-25T21:03:31Z
-        run: |
-          tools/install_live_tools.sh .release-tools 'release-creator>=3.1.0' 'towncrier>=26.9' 'prek>=0.2' 'yq>=4.4.5'
       - name: Run Action tests
         run: uvx --with tox-uv tox run -e test
   type:

CONTRIBUTING.md

@@ -5,15 +5,12 @@ and test its inputs and outputs before opening a pull request.
 
 ## Set up
 
-Use Python 3.15. Install the release tools under the seven-day cutoff, as CI does, and test tools from the current
-index:
+Use Python 3.15. The `test` group holds the test tools, release-creator, and prek:
 
 ```bash
 uv venv --allow-existing --python 3.15 .venv
-EXCLUDE_NEWER="7 days" tools/install_live_tools.sh .release-tools \
-  'release-creator>=3.1.0' 'towncrier>=26.9' 'prek>=0.2' 'yq>=4.4.5'
 uv pip install --python .venv/bin/python --group test
-export PATH="$PWD/.release-tools/bin:$PWD/.venv/bin:$PATH"
+export PATH="$PWD/.venv/bin:$PATH"
 ```
 
 Run the checks before pushing:

README.md

@@ -168,11 +168,13 @@ changes only the secondary lock.
 
 `refresh-release-lock` is the read-only half of the updater. In `refresh` mode, it upgrades the full primary lock and
 writes `$RUNNER_TEMP/lock.patch` if a lock changes. In `check` mode, it regenerates the primary lock without upgrading
-and fails if anything other than Nab's recorded command line differs. Every Nab run unsets `SSL_CERT_FILE` and
-`SSL_CERT_DIR`, so Nab uses its own certificate store. `validate-news` calls this mode when a PR changes release inputs,
-including a workspace member's `pyproject.toml` or a secondary lock. The resulting PR's normal formatting job runs
-`prek`; the writer checks patch paths and modes. Its `changed` output is `true` only when the refresh produces a patch.
-Neither mode pushes a branch or requests a write token.
+and fails if anything other than Nab's recorded command line differs. Check mode installs the Nab version that the
+committed `pylock.toml` records in `[tool.nab] nab-version`, and fails if the lock has none, because a newer Nab would
+rewrite that field in every committed lock. Refresh mode installs the newest Nab under the cutoff. Every Nab run unsets
+`SSL_CERT_FILE` and `SSL_CERT_DIR`, so Nab uses its own certificate store. `validate-news` calls this mode when a PR
+changes release inputs, including a workspace member's `pyproject.toml` or a secondary lock. The resulting PR's normal
+formatting job runs `prek`; the writer checks patch paths and modes. Its `changed` output is `true` only when the
+refresh produces a patch. Neither mode pushes a branch or requests a write token.
 
 Every shared `prek` command runs through `tools/cooled_prek.sh`, which the `cooled-prek` Action wraps for workflows, and
 passes `--config .pre-commit-config.yaml`. Without it, prek prefers a root `prek.toml` and also runs nested
@@ -182,10 +184,10 @@ anywhere, a `.pre-commit-config.yml`, and a `.pre-commit-config.yaml` below the
 The shared prepare and tagged validator run `refresh-release-lock` in `check` mode before release checks or publishing.
 `check-tagged-source` bundles the tagged checks for a custom tag publisher: on a tag ref it requires the tag to name
 both `GITHUB_SHA` and the checkout, on `main`, and checks the locks. Any other event, such as a `workflow_dispatch` from
-`main` with a `tag` input, must check out the commit that `inputs.tag` names, on `main`. It runs no hooks. It takes the
-secondary lock inputs below and needs a full-history checkout. For a secondary Nab lock, pass its path, selected groups,
-selection type, and matrix inputs to both workflows. A stale primary or secondary lock stops the release before
-artifacts are built.
+`main`, must check out the commit that the `tag` input of the `workflow_dispatch` event (`github.event.inputs.tag`)
+names, on `main`. It runs no hooks. It takes the secondary lock inputs below and needs a full-history checkout. For a
+secondary Nab lock, pass its path, selected groups, selection type, and matrix inputs to both workflows. A stale primary
+or secondary lock stops the release before artifacts are built.
 
 For example, a tagged source job that also publishes from a PGO lock checks both files before installing build tools:
 

changelog.d/+check-locked-nab.bugfix.md

@@ -0,0 +1,4 @@
+Make `refresh-release-lock` in `check` mode install the Nab version that the committed `pylock.toml` records in
+`[tool.nab] nab-version`, and fail if the lock records none. A Nab release newer than that version rewrites the field,
+so every committed lock failed the check until the weekly refresh. `refresh` mode still installs the newest Nab under
+the cutoff, and `nab-git-commit` still installs from that commit in both modes.

changelog.d/+dispatch-tag-input.doc.md

@@ -0,0 +1,2 @@
+Say that `check-tagged-source` reads the tag of a non-tag run from the `tag` input of the `workflow_dispatch` event,
+`github.event.inputs.tag`, rather than from an input of the Action.

changelog.d/+live-tools-uv-config.security.md

@@ -0,0 +1,5 @@
+Make the Actions install their own tools, such as Nab, `packaging`, `certifi`, and `pypi-attestations`, from PyPI even
+when the caller's repository or environment configures another index. The installer now ignores `uv.toml`, `[tool.uv]`
+in `pyproject.toml`, and the `UV_INDEX`, `UV_INDEX_URL`, `UV_DEFAULT_INDEX`, `UV_EXTRA_INDEX_URL`, `UV_FIND_LINKS`,
+`UV_CONFIG_FILE`, `UV_INSECURE_HOST`, `UV_SYSTEM_CERTS`, `SSL_CERT_FILE`, and `SSL_CERT_DIR` variables, as `cooled-prek`
+already does.

changelog.d/+nab-toml-lock-removal.bugfix.md

@@ -0,0 +1,2 @@
+Make `validate-news` reject a pull request that removes `pylock.toml` when the project has a `nab.toml`, as it already
+did for a `[tool.nab]` table in `pyproject.toml`.

pylock.toml

@@ -92,7 +92,7 @@ sha256 = "aeae0e330c9f6acd681f647d46cefd30c29f93e3392882e792e82080c9691399"
 [[packages]]
 name = "click"
 version = "8.5.0"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.10"
 index = "https://pypi.org/simple/"
 
@@ -334,7 +334,7 @@ sha256 = "cf09d55b1e85a89576b036aeb71550bfd68320f3f21761ca329eadadad918638"
 [[packages]]
 name = "docutils"
 version = "0.23"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.9"
 index = "https://pypi.org/simple/"
 
@@ -491,7 +491,7 @@ sha256 = "9121e2c1fdb355232495be3194c8dfe87ccc2d5dee45947b78e68f499790d7a7"
 [[packages]]
 name = "jinja2"
 version = "3.1.6"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.7"
 dependencies = [
     { name = "markupsafe" },
@@ -519,7 +519,7 @@ sha256 = "85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67"
 [[packages]]
 name = "markdown-it-py"
 version = "4.2.0"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.10"
 dependencies = [
     { name = "mdurl" },
@@ -572,7 +572,7 @@ sha256 = "925f929d6b59a8b3f8b8c6ac363cd0af7eecc81efb3071770b3c6717c450a369"
 [[packages]]
 name = "mdformat"
 version = "1.0.0"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.10"
 dependencies = [
     { name = "markdown-it-py" },
@@ -600,7 +600,7 @@ sha256 = "bca015d65a1d063a02e885a91daee303057bc7829c2cd37b2075a50dbb65944b"
 [[packages]]
 name = "mdformat-gfm"
 version = "1.0.0"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.10"
 dependencies = [
     { name = "markdown-it-py" },
@@ -631,7 +631,7 @@ sha256 = "7305a50efd2a140d7c83505b58e3ac5df2b09e293f9bbe72f6c7bee8c678b005"
 [[packages]]
 name = "mdit-py-plugins"
 version = "0.6.1"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.10"
 dependencies = [
     { name = "markdown-it-py" },
@@ -659,7 +659,7 @@ sha256 = "214c82fb2ac524472ab6a5bcab1de80f73b50443e187f401bfd77efbc7c6481d"
 [[packages]]
 name = "mdurl"
 version = "0.1.2"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.7"
 index = "https://pypi.org/simple/"
 
@@ -784,7 +784,7 @@ sha256 = "7dd7b0d8832ba3cb632c306926ded123429211b83641b35dc5c41ad2d34f9bec"
 [[packages]]
 name = "prek"
 version = "0.5.5"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.8"
 index = "https://pypi.org/simple/"
 
@@ -1047,7 +1047,7 @@ sha256 = "d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f"
 [[packages]]
 name = "release-creator"
 version = "3.1.0"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.15"
 dependencies = [
     { name = "docutils" },
@@ -1156,7 +1156,7 @@ sha256 = "05562412163a3037b94497385fb7f9204c637bc605af7a48199e41cf2272f437"
 [[packages]]
 name = "towncrier"
 version = "26.9.0"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.9"
 dependencies = [
     { name = "click" },
@@ -1406,7 +1406,7 @@ sha256 = "b319f8590a84e5de5f8f2c803ecd2237e9bc0ffa7c1e875e3169c107cecb7454"
 [[packages]]
 name = "wcwidth"
 version = "0.9.2"
-marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups"
+marker = "\"release-prepare\" in dependency_groups or \"release-validate\" in dependency_groups or \"test\" in dependency_groups"
 requires-python = ">=3.9"
 index = "https://pypi.org/simple/"
 
@@ -1474,7 +1474,9 @@ command-line = [
     "--all-groups",
     "--all-extras",
     "--no-cache",
-    "--upgrade",
+    "pyproject.toml",
+    "--output",
+    "pylock.toml",
 ]
 input-path = "pyproject.toml"
 mode = "universal"

pyproject.toml

@@ -15,11 +15,13 @@ test = [
   "certifi",
   "coverage[toml]>=7.10",
   "hatchling>=1.28",
+  "prek>=0.2",
   "pytest>=9",
   "pytest-httpserver",
   "pytest-mock>=3.16",
   "pytest-xdist>=3",
   "pyyaml>=6",
+  "release-creator>=3.1.0",
   "tomlkit>=0.13",
   "tox>=4.64.7",
   "tox-uv>=1.36.1",

refresh-release-lock/action.yml

@@ -65,6 +65,7 @@ runs:
       env:
         EXCLUDE_NEWER: ${{ inputs.exclude-newer }}
         EXCLUDE_NEWER_PACKAGE: ${{ inputs.exclude-newer-package }}
+        MODE: ${{ inputs.mode }}
         NAB_GIT_COMMIT: ${{ inputs.nab-git-commit }}
       run: |
         set -euo pipefail
@@ -75,6 +76,19 @@ runs:
           for package in nab-index nab-markersets nab-project nab-provider nab-resolver; do
             requirements+=("$package @ $source#subdirectory=$package")
           done
+        elif [[ "$MODE" == check ]]; then
+          version=""
+          if [[ -f pylock.toml ]]; then
+            version=$(python3 -c 'import tomllib
+        with open("pylock.toml", "rb") as lock:
+            print(tomllib.load(lock).get("tool", {}).get("nab", {}).get("nab-version", ""))')
+          fi
+          if [[ -z "$version" ]]; then
+            echo '::error::check mode needs the Nab version in pylock.toml [tool.nab] nab-version' >&2
+            exit 1
+          fi
+          # A newer Nab rewrites nab-version, so checking with it would fail every committed lock.
+          requirements=("nab==$version")
         fi
         "$GITHUB_ACTION_PATH/../tools/install_live_tools.sh" "$RUNNER_TEMP/lock-tools" "${requirements[@]}"
     - name: Resolve all project groups and extras