♻️ refactor(release)!: simplify shared actions

.github/workflows/check.yaml

@@ -3,7 +3,7 @@ on:
   push:
     branches: [main]
   pull_request:
-    types: [opened, reopened, synchronize, labeled, unlabeled]
+    types: [opened, reopened, synchronize]
   workflow_dispatch:
 permissions:
   contents: read
@@ -37,8 +37,6 @@ jobs:
         with:
           groups: release-check
           venv: .release-tools
-      - name: Add locked tools to PATH
-        run: echo "$PWD/.release-tools/bin" >>"$GITHUB_PATH"
       - name: Check repository formatting
         run: prek run --all-files
   shell:
@@ -67,8 +65,6 @@ jobs:
         with:
           groups: release-shell
           venv: .release-tools
-      - name: Add locked tools to PATH
-        run: echo "$PWD/.release-tools/bin" >>"$GITHUB_PATH"
       - name: Check inline shell
         run: |
           set -euo pipefail
@@ -109,8 +105,6 @@ jobs:
         with:
           groups: release-news release-shell
           venv: .release-tools
-      - name: Add locked tools to PATH
-        run: echo "$PWD/.release-tools/bin" >>"$GITHUB_PATH"
       - name: Install current test tools
         run: |
           uv venv --python 3.15 .venv
@@ -136,30 +130,6 @@ jobs:
             pyproject.toml
       - name: Check Python types
         run: uvx --with tox-uv tox run -e type
-  changelog:
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-26.04
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
-        with:
-          version: latest-known
-          python-version: "3.15"
-          enable-cache: true
-          cache-suffix: ${{ github.job }}
-          cache-dependency-glob: |
-            pylock.toml
-            pyproject.toml
-      - uses: $/install-locked-tools
-        with:
-          groups: release-news
-          venv: ${{ runner.temp }}/release-tools
-      - name: Add locked tools to PATH
-        run: echo "$RUNNER_TEMP/release-tools/bin" >>"$GITHUB_PATH"
-      - uses: $/validate-news
   hook-cooldown:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-26.04
@@ -195,7 +165,7 @@ jobs:
   gate:
     name: ${{ github.event_name == 'pull_request' && 'Required checks pass' || 'Required checks pass (non-PR)' }}
     if: ${{ !cancelled() }}
-    needs: [check, shell, test, type, changelog, hook-cooldown, release-tools-preview]
+    needs: [check, shell, test, type, hook-cooldown, release-tools-preview]
     runs-on: ubuntu-26.04
     steps:
       - env:
@@ -207,6 +177,6 @@ jobs:
               to_entries[];
               .value.result == "success" or
               ($ENV.EVENT_NAME != "pull_request" and .value.result == "skipped" and
-                (.key == "changelog" or .key == "hook-cooldown" or .key == "release-tools-preview"))
+                (.key == "hook-cooldown" or .key == "release-tools-preview"))
             )
           ' <<<"$NEEDS_JSON"

.github/workflows/news.yaml

@@ -0,0 +1,28 @@
+name: Changelog
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, labeled, unlabeled]
+permissions:
+  contents: read
+jobs:
+  changelog:
+    runs-on: ubuntu-26.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          version: latest-known
+          python-version: "3.15"
+          enable-cache: true
+          cache-suffix: ${{ github.job }}
+          cache-dependency-glob: |
+            pylock.toml
+            pyproject.toml
+      - uses: $/install-locked-tools
+        with:
+          groups: release-news
+          venv: ${{ runner.temp }}/release-tools
+      - uses: $/validate-news

.github/workflows/prepare-towncrier-release.yaml

@@ -44,7 +44,6 @@ jobs:
     outputs:
       version: ${{ steps.prepare.outputs.version }}
       artifact-id: ${{ steps.patch.outputs.artifact-id }}
-      patch-sha: ${{ steps.digest.outputs.sha }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -56,27 +55,22 @@ jobs:
           version: latest-known
           python-version: "3.15"
           enable-cache: false
-      - uses: $/install-locked-tools
+      - id: tools
+        uses: $/install-locked-tools
         with:
           groups: release-prepare${{ inputs.local-tool-source && ' project-runtime' || '' }}
           venv: .venv
           local-tool-source: ${{ inputs.local-tool-source }}
-      - name: Add locked tools to PATH
-        run: echo "$PWD/.venv/bin" >>"$GITHUB_PATH"
       - name: Install prek hooks
         id: hooks
         run: prek install-hooks
         background: true
       - name: Create a fresh validation worktree
         run: git worktree add --detach "$RUNNER_TEMP/release-validation" "$GITHUB_SHA"
-      - name: Export local build constraints
-        if: inputs.local-tool-source
-        id: constraints
-        uses: $/export-build-constraints
       - name: Build local release tool wheel
         if: inputs.local-tool-source
         env:
-          BUILD_CONSTRAINTS: ${{ steps.constraints.outputs.path }}
+          BUILD_CONSTRAINTS: ${{ steps.tools.outputs.build-constraints }}
         run: |
           uv build --wheel --build-constraints "$BUILD_CONSTRAINTS" \
             --require-build-hashes --out-dir "$RUNNER_TEMP/local-tool-dist" .
@@ -102,11 +96,6 @@ jobs:
           version: ${{ steps.prepare.outputs.version }}
           patch: ${{ runner.temp }}/release.patch
           working-directory: ${{ runner.temp }}/release-validation
-      - name: Record validated patch digest
-        id: digest
-        run: |
-          patch_sha=$(sha256sum "$RUNNER_TEMP/release.patch")
-          printf 'sha=%s\n' "${patch_sha%% *}" >>"$GITHUB_OUTPUT"
       - id: patch
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
@@ -134,16 +123,7 @@ jobs:
         with:
           version: ${{ needs.assemble.outputs.version }}
           patch: ${{ runner.temp }}/release-patch/release.patch
-          expected-patch-sha: ${{ needs.assemble.outputs.patch-sha }}
           checks: "false"
-      - name: Require release App key
-        env:
-          RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
-        run: |
-          if [[ -z "$RELEASE_APP_PRIVATE_KEY" ]]; then
-            echo '::error::RELEASE_APP_PRIVATE_KEY is missing from release-auth' >&2
-            exit 1
-          fi
       - id: token
         uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:

.github/workflows/release.yaml

@@ -27,15 +27,13 @@ jobs:
           venv: .venv
       - name: Check tagged source
         run: .venv/bin/prek run --all-files
-      - name: Check source remains clean
-        run: test -z "$(git status --porcelain)"
   source:
     runs-on: ubuntu-26.04
     permissions:
       contents: read
     outputs:
       previous: ${{ steps.previous.outputs.previous }}
-      commit: ${{ steps.tag.outputs.commit }}
+      commit: ${{ github.sha }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -51,19 +49,16 @@ jobs:
           groups: release-notes
           venv: .venv
       - name: Verify tagged source
-        id: tag
         env:
           TAG: ${{ github.ref_name }}
         run: |
           set -euo pipefail
           test "$(git rev-parse "refs/tags/$TAG^{commit}")" = "$(git rev-parse HEAD)"
           git merge-base --is-ancestor HEAD origin/main
-          echo "commit=$(git rev-parse HEAD)" >>"$GITHUB_OUTPUT"
       - id: previous
         uses: $/select-previous-tag
         with:
           tag: ${{ github.ref_name }}
-          executable: .venv/bin/release-creator
   contributors:
     needs: source
     runs-on: ubuntu-26.04
@@ -99,7 +94,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          fetch-depth: 0
+          fetch-depth: 1
           persist-credentials: false
       - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
@@ -110,8 +105,6 @@ jobs:
         with:
           groups: release-notes
           venv: .venv
-      - name: Add locked tools to PATH
-        run: echo "$PWD/.venv/bin" >>"$GITHUB_PATH"
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.contributors.outputs.artifact-id }}

.github/workflows/upgrade-release-tools.yaml

@@ -101,8 +101,27 @@ jobs:
           version: latest-known
           python-version: "3.15"
           enable-cache: false
+      - uses: $/install-locked-tools
+        with:
+          groups: release-hooks
+          lock-source: shared
+          venv: ${{ runner.temp }}/hook-tools
+      - name: Refresh frozen hook revisions
+        run: >-
+          uv run --no-project --python "$RUNNER_TEMP/hook-tools" prek update --config .pre-commit-config.yaml --freeze --cooldown-days 7 --no-progress
+      - name: Refresh exact hook dependencies
+        run: >-
+          uv run --no-project --python "$RUNNER_TEMP/hook-tools" release-creator hooks --exclude-newer '7 days' --python-version 3.15
       - id: hooks
-        uses: $/refresh-hook-pins
+        name: Write hook patch
+        run: |
+          set -euo pipefail
+          if git diff --quiet -- .pre-commit-config.yaml; then
+            echo 'changed=false' >>"$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo 'changed=true' >>"$GITHUB_OUTPUT"
+          git diff --binary -- .pre-commit-config.yaml >"$RUNNER_TEMP/hooks.patch"
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: steps.hooks.outputs.changed == 'true'
         with:
@@ -137,21 +156,18 @@ jobs:
           path: ${{ runner.temp }}/release-tools-hooks
       - name: Apply lock patch
         if: needs.generate-lock.outputs.changed == 'true'
-        run: |
-          git apply --check "$RUNNER_TEMP/release-tools-lock/lock.patch"
-          git apply --index "$RUNNER_TEMP/release-tools-lock/lock.patch"
+        run: git apply --index "$RUNNER_TEMP/release-tools-lock/lock.patch"
       - name: Apply hook patch
         if: needs.generate-hooks.outputs.changed == 'true'
-        run: |
-          git apply --check "$RUNNER_TEMP/release-tools-hooks/hooks.patch"
-          git apply --index "$RUNNER_TEMP/release-tools-hooks/hooks.patch"
+        run: git apply --index "$RUNNER_TEMP/release-tools-hooks/hooks.patch"
       - name: Check dependency patch paths
         env:
           ADDITIONAL_LOCK: ${{ inputs.additional-lock }}
         run: |
           set -euo pipefail
-          if [[ -n "$ADDITIONAL_LOCK" && ("$ADDITIONAL_LOCK" != pylock.*.toml || "$ADDITIONAL_LOCK" == */*) ]]; then
-            echo '::error::invalid additional lock basename' >&2
+          if [[ -n "$ADDITIONAL_LOCK" &&
+            ("$ADDITIONAL_LOCK" != pylock.*.toml || "$ADDITIONAL_LOCK" == */*) ]]; then
+            echo "::error::invalid additional lock: $ADDITIONAL_LOCK" >&2
             exit 1
           fi
           git diff --cached --name-only --no-renames -z >"$RUNNER_TEMP/dependency-paths"
@@ -162,7 +178,6 @@ jobs:
               exit 1
             fi
           done <"$RUNNER_TEMP/dependency-paths"
-          git diff --cached --check
       - name: Check dependency patch file mode
         run: |
           set -euo pipefail
@@ -182,13 +197,6 @@ jobs:
           git config user.name 'github-actions[bot]'
           git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
           git commit -m "$COMMIT_MESSAGE"
-      - name: Check release App credentials
-        env:
-          RELEASE_APP_CLIENT_ID: ${{ vars.RELEASE_APP_CLIENT_ID }}
-          RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
-        run: |
-          test -n "$RELEASE_APP_CLIENT_ID"
-          test -n "$RELEASE_APP_PRIVATE_KEY"
       - id: repository
         name: Select the current repository
         env: