👷 ci: shared workflows and dependency hygiene

.github/workflows/check.yaml

@@ -16,58 +16,30 @@ permissions:
 jobs:
   test:
     name: 🧪 Test
-    runs-on: ubuntu-26.04
-    strategy:
-      fail-fast: false
-      matrix:
-        env:
-          - "3.15t"
-          - "3.15"
-          - "3.14t"
-          - "3.14"
-          - "3.13"
-          - "3.12"
-          - "3.11"
-          - type
-          - dev
-          - pkg_meta
-    steps:
-      - name: 📥 Check out code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - name: 🐍 Install uv
-        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
-        with:
-          version: latest-known
-          python-version: "3.15"
-          enable-cache: false
-          cache-dependency-glob: "pyproject.toml"
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-      - name: 📦 Install tox
-        run: uv tool install --python-preference only-managed --python 3.15 tox --with tox-uv
-      - name: 🐍 Install Python
-        if: startsWith(matrix.env, '3.') && matrix.env != '3.15'
-        env:
-          MATRIX_ENV: ${{ matrix.env }}
-        run: uv python install --python-preference only-managed "$MATRIX_ENV"
-      - name: 📦 Set up test suite
-        env:
-          MATRIX_ENV: ${{ matrix.env }}
-        run: tox run -vv --notest --skip-missing-interpreters false -e "$MATRIX_ENV"
-      - name: 🧪 Run test suite
-        run: tox run --skip-pkg-install -e "$MATRIX_ENV"
-        env:
-          MATRIX_ENV: ${{ matrix.env }}
-          PYTEST_ADDOPTS: "-vv --durations=20"
+    uses: tox-dev/github-workflows/.github/workflows/check.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+    permissions:
+      contents: read
+    with:
+      include: |
+        [
+          {"env": "3.15t", "python": "3.15t"},
+          {"env": "3.15"},
+          {"env": "3.14t", "python": "3.14t"},
+          {"env": "3.14", "python": "3.14"},
+          {"env": "3.13", "python": "3.13"},
+          {"env": "3.12", "python": "3.12"},
+          {"env": "3.11", "python": "3.11"},
+          {"env": "type"},
+          {"env": "dev"},
+          {"env": "pkg_meta"}
+        ]
   gate:
     name: 🚦 Required checks pass
     if: ${{ !cancelled() }} # codespell:ignore cancelled
     needs: [test]
     runs-on: ubuntu-24.04
     steps:
       - name: 🚦 Require all needed jobs to pass
-        env:
-          NEEDS_JSON: ${{ toJSON(needs) }}
-        run: jq -e 'all(to_entries[]; .value.result == "success")' <<<"$NEEDS_JSON"
+        uses: tox-dev/github-workflows/required-checks@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+        with:
+          needs: ${{ toJSON(needs) }}

.github/workflows/codeql.yaml

@@ -12,31 +12,11 @@ concurrency:
 permissions: {}
 jobs:
   analyze:
-    name: 🛡️ Analyze ${{ matrix.language }}
-    runs-on: ubuntu-26.04
+    name: 🛡️ Analyze
+    uses: tox-dev/github-workflows/.github/workflows/codeql.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
     permissions:
       contents: read
       security-events: write
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [actions, python]
-    steps:
-      - name: 📥 Check out code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: 🛡️ Initialize CodeQL
-        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: none
-          queries: security-extended
-          config: |
-            paths-ignore:
-              - roots
-              - tests
-      - name: 🛡️ Analyze
-        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
-        with:
-          category: "/language:${{ matrix.language }}"
+    with:
+      languages: '["actions","python"]'
+      paths-ignore: '["tests"]'

.github/workflows/news.yaml

@@ -16,15 +16,15 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: 🐍 Install uv
-        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           version: latest-known
           python-version: "3.15"
           enable-cache: false
       - name: 📦 Install locked release tools
-        uses: tox-dev/github-workflows/install-locked-tools@99024bcb5749b178c5514f86acfcf1e80c865e75 # 6.3.0
+        uses: tox-dev/github-workflows/install-locked-tools@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
         with:
           groups: release-news
           venv: ${{ runner.temp }}/release-tools
       - name: 🔍 Validate news fragments
-        uses: tox-dev/github-workflows/validate-news@99024bcb5749b178c5514f86acfcf1e80c865e75 # 6.3.0
+        uses: tox-dev/github-workflows/validate-news@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0

.github/workflows/prepare-release.yaml

@@ -16,7 +16,7 @@ permissions: {}
 jobs:
   prepare:
     name: 🏷️ Prepare Towncrier release
-    uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
+    uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
     permissions:
       contents: read
       pull-requests: read

.github/workflows/release.yaml

@@ -10,52 +10,17 @@ concurrency:
 jobs:
   build:
     name: 🏗️ Build
-    uses: tox-dev/github-workflows/.github/workflows/validate-python-release.yaml@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
+    uses: tox-dev/github-workflows/.github/workflows/validate-python-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
     permissions:
       contents: read
   notes:
     name: 📝 Render GitHub Release notes
-    runs-on: ubuntu-26.04
+    uses: tox-dev/github-workflows/.github/workflows/release-notes.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
     permissions:
       contents: read
-    outputs:
-      artifact-id: ${{ steps.upload.outputs.artifact-id }}
-    steps:
-      - name: 📥 Check out code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - name: 🐍 Install uv
-        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
-        with:
-          version: latest-known
-          python-version: "3.15"
-          enable-cache: false
-      - name: 📦 Install locked release tools
-        uses: tox-dev/github-workflows/install-locked-tools@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
-        with:
-          groups: release-notes
-          venv: ${{ runner.temp }}/release-tools
-      - name: 🏷️ Select previous tag
-        id: previous
-        uses: tox-dev/github-workflows/select-previous-tag@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
-        with:
-          tag: ${{ github.ref_name }}
-      - name: 📝 Render release notes
-        uses: tox-dev/github-workflows/render-release-notes@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
-        with:
-          tag: ${{ github.ref_name }}
-          previous: ${{ steps.previous.outputs.previous }}
-          changelog: CHANGELOG.md
-          artifact-url: https://pypi.org/project/sphinx-argparse-cli/${{ github.ref_name }}/
-      - name: 📤 Upload release notes
-        id: upload
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: github-release-notes
-          path: ${{ runner.temp }}/release-notes.md
-          if-no-files-found: error
+    with:
+      tag: ${{ github.ref_name }}
+      artifact-url: https://pypi.org/project/sphinx-argparse-cli/${{ github.ref_name }}/
   publish:
     name: 🚀 Publish to PyPI
     needs: [build, notes]
@@ -79,39 +44,12 @@ jobs:
   release:
     name: 🚀 Publish GitHub Release
     needs: [build, publish, notes]
-    runs-on: ubuntu-26.04
+    uses: tox-dev/github-workflows/.github/workflows/github-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
     permissions:
       contents: write
-    steps:
-      - name: 🐍 Install uv
-        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
-        with:
-          version: latest-known
-          python-version: "3.15"
-          enable-cache: false
-          ignore-empty-workdir: true
-      - name: 📩 Download distributions
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          artifact-ids: ${{ needs.build.outputs.distributions-artifact-id }}
-          path: dist/
-      - name: 📩 Download release notes
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          artifact-ids: ${{ needs.notes.outputs.artifact-id }}
-          path: ${{ runner.temp }}
-      - name: 🔍 Verify PyPI artifacts
-        uses: tox-dev/github-workflows/reconcile-pypi-artifacts@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
-        with:
-          project: sphinx-argparse-cli
-          version: ${{ github.ref_name }}
-          dist: dist
-      - name: 🚀 Publish GitHub Release
-        uses: tox-dev/github-workflows/publish-github-release@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
-        env:
-          GH_TOKEN: ${{ github.token }}
-        with:
-          tag: ${{ github.ref_name }}
-          commit: ${{ github.sha }}
-          title: ${{ github.ref_name }}
-          notes-file: ${{ runner.temp }}/release-notes.md
+    with:
+      project: sphinx-argparse-cli
+      version: ${{ github.ref_name }}
+      tag: ${{ github.ref_name }}
+      artifact-pattern: python-package-distributions
+      notes-artifact-id: ${{ needs.notes.outputs.artifact-id }}

.github/workflows/scorecard.yaml

@@ -23,4 +23,4 @@ jobs:
       pull-requests: read # read reviews for the Code-Review check
       security-events: write # upload the SARIF results to code scanning
       statuses: read # read commit statuses for the CI-Tests check
-    uses: tox-dev/github-workflows/.github/workflows/scorecard.yaml@cfb6d637a10b70da576575790eb3c806f57cd0b5
+    uses: tox-dev/github-workflows/.github/workflows/scorecard.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0

.github/workflows/upgrade-release-tools.yaml

@@ -10,7 +10,7 @@ concurrency:
 jobs:
   upgrade:
     name: 🔀 Upgrade release tools
-    uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
+    uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
     permissions:
       contents: read
     secrets:

pyproject.toml

@@ -210,5 +210,6 @@ uploaded-prior-to = "P7D"
 decision-order = "stable"
 matrix.python = ">=3.15,<3.16"
 matrix.platforms = [ "linux_x86_64" ]
-# release-creator 4.4.0 needs a seven-day cutoff exception through 2026-11-09.
+# release-creator 4.4.0 needs a seven-day cutoff exception.
+# expires 2026-11-09
 packages.release-creator.uploaded-prior-to = 2026-11-02T21:45:00Z