Repository navigation
♻️ refactor(release)!: simplify shared actions - #6
Merged
Merged
Conversation
gaborbernat
added
bug
gaborbernat
force-pushed
the
fix/round5-release-audit
branch
from
October 23, 2026 17:29
5de4bdf to
728add1
Compare
Keep lock cooling and artifact verification at trust boundaries while removing repeated checks and unused action layers. Split news checks from the test matrix and isolate package builds from release tools.
gaborbernat
force-pushed
the
fix/round5-release-audit
branch
from
October 23, 2026 17:35
728add1 to
e295d30
Compare
The shared trim removed actions and inputs still used by draft callers. Restore those contracts until callers migrate, including secondary lock refresh and keyless PR builds.
A repository setting does not make older releases immutable. Check the release record before omitting the second fetch; retain draft and mutable release checks. Share asset matching across the remaining checks.
gaborbernat
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release jobs install only their selected locked tools. The build job receives hashed backend constraints without installing release tools. Committed locks and alternate constraint locks are checked against the seven-day upload cutoff and PyPI artifact identity. PyPI verification compares the complete file set and digests, checks trusted-publisher attestations, and retries transient listing failures.
Changelog checks run separately, so label changes do not restart the test matrix. Constraint export uses the same renderer as locked-tool installation while retaining the public Action for secondary locks and target selections. Published immutable GitHub Releases skip redundant reads; drafts and older mutable releases retain their checks. The patch writer keeps its path and mode checks because it applies output from a job that ran third-party hooks.
This removes the public
install-nab,label-bot-news,refresh-hook-pins,resolve-pr-from-run, andvalidate-python-distributionActions and retires the inputs and output named in the Breaking changes fragment. The adoption drafts use the remaining shared Actions. Automatic version selection chooses 1.0.0.