Fix release lock and hook age checks

.github/workflows/check.yaml

@@ -24,7 +24,7 @@ jobs:
         with:
           path: ~/.cache/prek
           key: prek-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('.pre-commit-config.yaml') }}
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: latest-known
           python-version: "3.15"
@@ -60,7 +60,7 @@ jobs:
         with:
           path: ~/.cache/prek
           key: prek-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('.pre-commit-config.yaml') }}
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: latest-known
           python-version: "3.15"
@@ -107,7 +107,7 @@ jobs:
         with:
           fetch-depth: 1
           persist-credentials: false
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: latest-known
           python-version: "3.15"
@@ -130,7 +130,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: latest-known
           python-version: "3.15"

.github/workflows/news.yaml

@@ -12,7 +12,7 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: latest-known
           python-version: "3.15"

.github/workflows/prepare-towncrier-release.yaml

@@ -18,6 +18,34 @@ on:
         description: Install release-creator from the tagged checkout for its own release
         type: boolean
         default: false
+      keep-uv-lock:
+        description: Check a committed native uv.lock alongside pylock.toml
+        type: boolean
+        default: false
+      additional-lock:
+        description: Secondary Nab lock to check before release preparation
+        type: string
+        default: ""
+      additional-lock-groups:
+        description: Groups selected by the secondary lock
+        type: string
+        default: ""
+      additional-lock-selection:
+        description: Project or build-or-groups selection for the secondary lock
+        type: string
+        default: build-or-groups
+      additional-matrix-python:
+        description: Python range for the secondary lock
+        type: string
+        default: ""
+      additional-matrix-platforms:
+        description: Space-separated Nab platform IDs for the secondary lock
+        type: string
+        default: ""
+      additional-matrix-implementations:
+        description: Space-separated implementations for the secondary lock
+        type: string
+        default: ""
       annotated:
         description: Create an annotated tag
         type: boolean
@@ -50,11 +78,21 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
           ref: ${{ github.sha }}
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: latest-known
           python-version: "3.15"
           enable-cache: false
+      - uses: $/refresh-release-lock
+        with:
+          mode: check
+          keep-uv-lock: ${{ inputs.keep-uv-lock }}
+          additional-lock: ${{ inputs.additional-lock }}
+          additional-lock-groups: ${{ inputs.additional-lock-groups }}
+          additional-lock-selection: ${{ inputs.additional-lock-selection }}
+          additional-matrix-python: ${{ inputs.additional-matrix-python }}
+          additional-matrix-platforms: ${{ inputs.additional-matrix-platforms }}
+          additional-matrix-implementations: ${{ inputs.additional-matrix-implementations }}
       - id: tools
         uses: $/install-locked-tools
         with:
@@ -121,7 +159,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
           ref: ${{ github.sha }}
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: latest-known
           python-version: "3.15"

.github/workflows/release.yaml

@@ -11,16 +11,22 @@ jobs:
   check:
     runs-on: ubuntu-26.04
     permissions:
+      actions: read
       contents: read
+      pull-requests: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          fetch-depth: 0
           persist-credentials: false
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: latest-known
           python-version: "3.15"
           enable-cache: false
+      - uses: $/refresh-release-lock
+        with:
+          mode: check
       - uses: $/install-locked-tools
         with:
           groups: release-check
@@ -48,7 +54,7 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: latest-known
           python-version: "3.15"
@@ -105,7 +111,7 @@ jobs:
         with:
           fetch-depth: 1
           persist-credentials: false
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: latest-known
           python-version: "3.15"

.github/workflows/update-tools.yaml

@@ -12,8 +12,9 @@ jobs:
     secrets:
       RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
     with:
+      upgrade-resolver: true
       lock-groups: >-
-        build lock-tools lock-reader release-notes release-news release-prepare release-validate release-check release-attestations release-shell release-hooks release-hook-check
+        build lock-tools lock-reader release-notes release-resolver release-news release-prepare release-validate release-check release-attestations release-shell release-hooks release-hook-check
       commit-message: "🔧 build: refresh release tool lock"
       pull-request-title: "🔧 build: refresh release tool lock"
       pull-request-body: "Refresh the locked tools used by release preparation and CI."

.github/workflows/upgrade-release-tools.yaml

@@ -30,6 +30,14 @@ on:
         description: Space-separated implementations for the secondary lock
         type: string
         default: ""
+      upgrade-resolver:
+        description: Upgrade this repository's exact shared uv resolver pin with its lock
+        type: boolean
+        default: false
+      keep-uv-lock:
+        description: Refresh and check uv.lock alongside pylock.toml
+        type: boolean
+        default: false
       commit-message:
         description: Commit message for the refreshed dependency files
         type: string
@@ -61,7 +69,7 @@ jobs:
         with:
           fetch-depth: 1
           persist-credentials: false
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: latest-known
           python-version: "3.15"
@@ -76,6 +84,8 @@ jobs:
           additional-matrix-python: ${{ inputs.additional-matrix-python }}
           additional-matrix-platforms: ${{ inputs.additional-matrix-platforms }}
           additional-matrix-implementations: ${{ inputs.additional-matrix-implementations }}
+          upgrade-resolver: ${{ inputs.upgrade-resolver }}
+          keep-uv-lock: ${{ inputs.keep-uv-lock }}
       - id: upload
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: steps.lock.outputs.changed == 'true'
@@ -99,7 +109,7 @@ jobs:
         with:
           fetch-depth: 1
           persist-credentials: false
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: latest-known
           python-version: "3.15"
@@ -161,6 +171,7 @@ jobs:
       - name: Check artifact patch paths
         env:
           ADDITIONAL_LOCK: ${{ inputs.additional-lock }}
+          KEEP_UV_LOCK: ${{ inputs.keep-uv-lock }}
           LOCK_CHANGED: ${{ needs.generate-lock.outputs.changed }}
           HOOKS_CHANGED: ${{ needs.generate-hooks.outputs.changed }}
         run: |
@@ -184,7 +195,7 @@ jobs:
               git diff --cached --name-only --no-renames -z >"$RUNNER_TEMP/$artifact-paths"
             while IFS= read -r -d '' path; do
               if [[ "$artifact" == lock && "$path" != pylock.toml && "$path" != pyproject.toml &&
-                "$path" != "$ADDITIONAL_LOCK" ]] ||
+                "$path" != "$ADDITIONAL_LOCK" && ("$path" != uv.lock || "$KEEP_UV_LOCK" != true) ]] ||
                 [[ "$artifact" == hooks && "$path" != .pre-commit-config.yaml ]]; then
                 echo "::error::unexpected $artifact patch path: $path" >&2
                 exit 1

.github/workflows/validate-python-release.yaml

@@ -14,23 +14,64 @@ on:
         description: Prefix for distribution artifacts in a multi-package release
         default: ""
         type: string
+      keep-uv-lock:
+        description: Check a committed native uv.lock alongside pylock.toml
+        default: false
+        type: boolean
+      additional-lock:
+        description: Secondary Nab lock to check against the tagged project
+        default: ""
+        type: string
+      additional-lock-groups:
+        description: Groups selected by the secondary lock
+        default: ""
+        type: string
+      additional-lock-selection:
+        description: Project or build-or-groups selection for the secondary lock
+        default: build-or-groups
+        type: string
+      additional-matrix-python:
+        description: Python range for the secondary lock
+        default: ""
+        type: string
+      additional-matrix-platforms:
+        description: Space-separated Nab platform IDs for the secondary lock
+        default: ""
+        type: string
+      additional-matrix-implementations:
+        description: Space-separated implementations for the secondary lock
+        default: ""
+        type: string
 permissions:
   contents: read
 jobs:
   source-check:
     runs-on: ubuntu-26.04
     permissions:
+      actions: read
       contents: read
+      pull-requests: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          fetch-depth: 0
           persist-credentials: false
           ref: ${{ github.sha }}
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: latest-known
           python-version: "3.15"
           enable-cache: false
+      - uses: $/refresh-release-lock
+        with:
+          mode: check
+          keep-uv-lock: ${{ inputs.keep-uv-lock }}
+          additional-lock: ${{ inputs.additional-lock }}
+          additional-lock-groups: ${{ inputs.additional-lock-groups }}
+          additional-lock-selection: ${{ inputs.additional-lock-selection }}
+          additional-matrix-python: ${{ inputs.additional-matrix-python }}
+          additional-matrix-platforms: ${{ inputs.additional-matrix-platforms }}
+          additional-matrix-implementations: ${{ inputs.additional-matrix-implementations }}
       - uses: $/install-locked-tools
         with:
           groups: release-check
@@ -57,7 +98,7 @@ jobs:
         with:
           persist-credentials: false
           ref: ${{ github.sha }}
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: latest-known
           python-version: "3.15"
@@ -75,7 +116,7 @@ jobs:
           path: ${{ runner.temp }}/build-constraints.txt
           if-no-files-found: error
   build:
-    needs: constraints
+    needs: [source-check, constraints]
     runs-on: ubuntu-26.04
     outputs:
       artifact-id: ${{ steps.upload.outputs.artifact-id }}
@@ -96,7 +137,7 @@ jobs:
           git check-ref-format "refs/tags/$TAG"
           test "$(git rev-parse "refs/tags/$TAG^{commit}")" = "$(git rev-parse HEAD)"
           git merge-base --is-ancestor HEAD origin/main
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: latest-known
           python-version: "3.15"
@@ -149,7 +190,7 @@ jobs:
         with:
           persist-credentials: false
           ref: ${{ github.sha }}
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: latest-known
           python-version: "3.15"