👷 ci(release): share the RST release path

.github/dependabot.yaml

@@ -15,3 +15,23 @@ updates:
           - "*"
     cooldown:
       default-days: 7
+  - package-ecosystem: "pre-commit"
+    directory: "/"
+    allow:
+      - dependency-name: "mdformat-gfm"
+      - dependency-name: "mdformat-ruff"
+      - dependency-name: "sphinx"
+    labels:
+      - dependencies
+      - skip news
+    schedule:
+      interval: "weekly"
+      day: "tuesday"
+    groups:
+      formatting-plugins:
+        patterns:
+          - "mdformat-gfm"
+          - "mdformat-ruff"
+          - "sphinx"
+    cooldown:
+      default-days: 7

.github/release.yaml

@@ -2,4 +2,5 @@ changelog:
   exclude:
     authors:
       - dependabot[bot]
+      - github-actions[bot]
       - pre-commit-ci[bot]

.github/workflows/check.yaml

@@ -5,7 +5,7 @@ on:
     branches: ["main"]
     tags-ignore: ["**"]
   pull_request:
-    types: [opened, synchronize, reopened, labeled, unlabeled]
+    types: [opened, synchronize, reopened]
   schedule:
     - cron: "0 8 * * *"
 concurrency:
@@ -37,9 +37,10 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - name: Install the latest version of uv
+      - name: Set up uv
         uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
+          version: latest-known
           python-version: "3.15"
           enable-cache: false
           cache-dependency-glob: "pyproject.toml"
@@ -63,9 +64,10 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - name: Install the latest version of uv
+      - name: Set up uv
         uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
+          version: latest-known
           python-version: "3.15"
           enable-cache: false
           cache-dependency-glob: "pyproject.toml"
@@ -81,32 +83,34 @@ jobs:
             run: tasks/old_target_check.sh 3.5 rejected
           - name: Reject Python 2.7
             run: tasks/old_target_check.sh 2.7 rejected
-  changelog:
-    if: github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'skip news')
-    runs-on: ubuntu-24.04
+  hook-cooldown:
+    name: Hook update cooldown
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-26.04
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: read
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: tox-dev/github-workflows/check-hook-update-cooldown@55f51f9b5cc0b40f280155a95de2d4f0ecbf7be1 # v3.0.0
         with:
-          python-version: "3.15"
-          enable-cache: false
-      - run: uvx towncrier check --compare-with "origin/${GITHUB_BASE_REF}"
+          release-app-client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
+        env:
+          GH_TOKEN: ${{ github.token }}
   gate:
-    name: Required checks pass
-    if: always()
-    needs: [test, old-target, changelog]
-    runs-on: ubuntu-24.04
+    name: ${{ github.event_name == 'pull_request' && 'Required checks pass' || 'Non-PR checks pass' }}
+    if: ${{ !cancelled() }} # codespell:ignore cancelled
+    needs: [test, old-target, hook-cooldown]
+    runs-on: ubuntu-26.04
     steps:
       - env:
           NEEDS_JSON: ${{ toJSON(needs) }}
+          EVENT_NAME: ${{ github.event_name }}
         run: |
-          jq -e '
+          jq -e --arg event "$EVENT_NAME" '
             all(
               to_entries[];
               .value.result == "success" or
-              (.key == "changelog" and .value.result == "skipped")
+              ((.key == "hook-cooldown") and .value.result == "skipped" and $event != "pull_request")
             )
-          ' <<< "$NEEDS_JSON"
+          ' <<<"$NEEDS_JSON"

.github/workflows/news.yaml

@@ -0,0 +1,29 @@
+name: Changelog
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, labeled, unlabeled]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+jobs:
+  changelog:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-26.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          version: latest-known
+          python-version: "3.15"
+          enable-cache: false
+      - name: Install locked release tools
+        uses: tox-dev/github-workflows/install-locked-tools@55f51f9b5cc0b40f280155a95de2d4f0ecbf7be1 # v3.0.0
+        with:
+          groups: release-news
+          venv: ${{ runner.temp }}/release-tools
+      - uses: tox-dev/github-workflows/validate-news@55f51f9b5cc0b40f280155a95de2d4f0ecbf7be1 # v3.0.0

.github/workflows/prepare-release.yaml

@@ -1,156 +1,22 @@
-name: Prepare Release
+name: Prepare release
 on:
   workflow_dispatch:
     inputs:
       bump:
-        description: "Version bump type"
+        description: Version bump type
         required: true
         type: choice
-        options:
-          - auto
-          - major
-          - minor
-          - patch
+        options: [auto, major, minor, patch]
         default: auto
-permissions:
-  contents: read
-env:
-  FORCE_COLOR: 1
+permissions: {}
 jobs:
-  assemble:
-    if: github.ref == 'refs/heads/main'
-    runs-on: ubuntu-24.04
+  prepare:
+    uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@55f51f9b5cc0b40f280155a95de2d4f0ecbf7be1 # v3.0.0
     permissions:
       contents: read
-    outputs:
-      version: ${{ steps.version.outputs.version }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0 # The next version comes from the tags.
-          persist-credentials: false
-      - name: Install uv
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
-        with:
-          python-version: "3.15"
-          enable-cache: false
-      - name: Require a news fragment
-        run: |
-          if ! compgen -G 'docs/changelog/*.*.rst' > /dev/null; then
-            echo '::error::add a docs/changelog/*.rst fragment before preparing a release'
-            exit 1
-          fi
-      - name: Set up remote tracking
-        run: |
-          git remote -v
-          git fetch origin
-          git branch -a
-      - name: Calculate next version
-        id: version
-        env:
-          BUMP: ${{ inputs.bump }}
-        run: |
-          current=$(git describe --tags --abbrev=0 2>/dev/null || echo "0.0.0")
-          echo "Current version: $current"
-
-          IFS='.' read -r major minor patch <<< "$current"
-
-          bump_type="$BUMP"
-          if [ "$bump_type" = "auto" ]; then
-            feature_count=$(find docs/changelog -name "*.feature.rst" 2>/dev/null | wc -l)
-            breaking_count=$(find docs/changelog -name "*.breaking.rst" 2>/dev/null | wc -l)
-            if [ "$breaking_count" -gt 0 ]; then
-              bump_type="major"
-              echo "Auto-detected: major bump (found $breaking_count breaking changelog(s))"
-            elif [ "$feature_count" -gt 0 ]; then
-              bump_type="minor"
-              echo "Auto-detected: minor bump (found $feature_count feature changelog(s))"
-            else
-              bump_type="patch"
-              echo "Auto-detected: patch bump (no feature changelogs)"
-            fi
-          fi
-
-          case "$bump_type" in
-            major)
-              next="$((major + 1)).0.0"
-              ;;
-            minor)
-              next="$major.$((minor + 1)).0"
-              ;;
-            patch)
-              next="$major.$minor.$((patch + 1))"
-              ;;
-          esac
-
-          echo "Next version: $next"
-          echo "version=$next" >> "$GITHUB_OUTPUT"
-      - name: Build release patch
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          set -euo pipefail
-          uvx towncrier build --yes --version "$VERSION"
-          uvx --with pre-commit-uv pre-commit run --files docs/changelog.rst ||
-            uvx --with pre-commit-uv pre-commit run --files docs/changelog.rst
-          git diff HEAD --binary > "$RUNNER_TEMP/release.patch"
-          test -s "$RUNNER_TEMP/release.patch"
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: release-patch
-          path: ${{ runner.temp }}/release.patch
-          if-no-files-found: error
-  push:
-    needs: assemble
-    runs-on: ubuntu-24.04
-    environment: release-auth
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          name: release-patch
-          path: ${{ runner.temp }}/release-patch
-      - name: Validate release patch
-        env:
-          VERSION: ${{ needs.assemble.outputs.version }}
-        run: |
-          set -euo pipefail
-          git fetch origin main
-          git reset --hard origin/main
-          git apply --check "$RUNNER_TEMP/release-patch/release.patch"
-          git apply --index "$RUNNER_TEMP/release-patch/release.patch"
-          while IFS= read -r path; do
-            case "$path" in
-              docs/changelog.rst|docs/changelog/*.rst) ;;
-              *) echo "::error::unexpected release path: $path"; exit 1 ;;
-            esac
-          done < <(git diff --cached --name-only)
-          grep -qE "^ v${VERSION//./\\.} \(" docs/changelog.rst
-          git diff --cached --check
-      - id: token
-        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
-        with:
-          client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
-          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
-          owner: ${{ github.repository_owner }}
-          repositories: ${{ github.event.repository.name }}
-          permission-contents: write
-      - name: Commit and tag the release
-        env:
-          VERSION: ${{ needs.assemble.outputs.version }}
-          GH_TOKEN: ${{ steps.token.outputs.token }}
-          APP_SLUG: ${{ steps.token.outputs.app-slug }}
-        run: |
-          set -euo pipefail
-          app_user_id=$(gh api "/users/${APP_SLUG}[bot]" --jq .id)
-          git config user.name "${APP_SLUG}[bot]"
-          git config user.email "${app_user_id}+${APP_SLUG}[bot]@users.noreply.github.com"
-          git commit -m "release $VERSION"
-          git tag -a "$VERSION" -m "release $VERSION"
-          gh auth setup-git --hostname github.com --force
-          git push --atomic origin HEAD:main "refs/tags/$VERSION"
+      pull-requests: read
+    with:
+      bump: ${{ inputs.bump }}
+      annotated: true
+    secrets:
+      RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

.github/workflows/recheck-hook-cooldown.yaml

@@ -0,0 +1,18 @@
+name: Recheck hook cooldown
+on:
+  schedule:
+    - cron: "17 7 * * *"
+  workflow_dispatch:
+permissions: {}
+jobs:
+  recheck:
+    runs-on: ubuntu-26.04
+    permissions:
+      actions: write
+      contents: read
+      pull-requests: read
+    steps:
+      - uses: tox-dev/github-workflows/recheck-hook-update-cooldown@55f51f9b5cc0b40f280155a95de2d4f0ecbf7be1 # v3.0.0
+        with:
+          workflow: check.yaml
+          job-name: Hook update cooldown