[gaborbernat]

Releasing devpi-process meant typing an exact version into a hand-written prepare workflow, and the tag run built, uploaded and published through inline shell that only this repository maintained. 🚀 This PR moves both workflows onto the reusable ones in tox-dev/github-workflows 6.0.1, with release-creator 4.1.0 writing the changelog and release notes, so this repository keeps only thin callers.

Release flow

A maintainer now starts a release by picking a bump (auto, major, minor or patch) instead of typing a version. The shared prepare workflow asks release-creator tags for the next version from the pending fragments and existing tags (source), builds the changelog, adds a New Contributors subsection with release-creator contributors (source), runs the prek hooks, and pushes the commit and tag with the release App from the release-auth environment.

On the tag, the distribution build and the notes rendering from CHANGELOG.md run side by side. The PyPI upload waits for both; a verification job then compares every built file with PyPI and checks its trusted-publisher attestation (action), and only after that does the GitHub Release get created. Jobs pass distributions and notes to each other by artifact ID, and runs for one tag queue rather than cancel each other. Every workflow, job and step name now starts with an emoji.

flowchart LR
    Tag[Tag push] --> Build[Build distributions]
    Tag --> Prev[Select previous tag] --> Notes[Render notes from CHANGELOG.md]
    Build --> PyPI[Publish to PyPI]
    Notes --> PyPI
    PyPI --> Verify[Verify PyPI files and attestations]
    Verify --> GHR[Publish GitHub Release]
    Notes --> GHR
    classDef step fill:#cfe4ff,stroke:#1f6feb,color:#0b1f3a;
    classDef publish fill:#ffe3a3,stroke:#d29200,color:#3a2c00;
    class Tag,Build,Prev,Notes,Verify step;
    class PyPI,GHR publish;

Loading

The tag run no longer checks that the tag has a matching changelog section: only writers push tags, and the PR checks already validate the fragments. That news check moves to its own 📝 Changelog workflow, which reruns when a label changes, so adding skip news no longer reruns the test matrix.

Changelog and contributors

CHANGELOG.md now uses release-creator's template, with entries grouped under Added, Fixed, Packaging and the other sections, each linked to its PR and credited to its author. Older releases gain entries they lacked, such as Python 3.11 support from #31 and Python 3.15 from #262. A new CONTRIBUTING.md lists the ten fragment types and asks contributors not to write credits, because those come from commit authors and Co-authored-by trailers.

📦 On PyPI, the README's links to the changelog and the contributing guide pointed at relative paths; hatch-fancy-pypi-readme now rewrites them to GitHub URLs. The metadata adds a Changelog URL, drops the Framework :: tox and MIT license classifiers, and replaces the keywords with devpi, process and testing.

Dependencies

nab 0.0.22 writes pylock.toml for CPython 3.15 on linux_x86_64, the only target where CI installs from the lock, with a seven-day upload cutoff. A temporary exception lets release-creator 4.1.0 in until 2026-11-02. Each release job installs only its own group (release-news, release-notes or release-prepare), and a build group locks the hatchling backends with Cython and setuptools because PyYAML has no CPython 3.15 wheel. A weekly 🔒 Upgrade release tools workflow relocks pylock.toml and opens a PR.

The pre-commit config pins each hook to a frozen commit SHA. Dependabot's pre-commit ecosystem updates them weekly with a seven-day cooldown, alongside a quarterly pre-commit.ci autoupdate.

🛡️ CodeQL

CodeQL moves from default setup to a committed workflow on ubuntu-26.04 that scans Python and Actions with the security-extended suite and skips tests, whose alerts nobody would fix. This also removes the ubuntu-latest migration notice default setup produces.