👷 ci(release): move releases onto shared workflows

.github/dependabot.yaml

@@ -15,3 +15,13 @@ updates:
           - "*"
     cooldown:
       default-days: 7
+  - package-ecosystem: "pre-commit"
+    directory: "/"
+    labels:
+      - dependencies
+      - skip news
+    schedule:
+      interval: "weekly"
+      day: "tuesday"
+    cooldown:
+      default-days: 7

.github/workflows/codeql.yaml

@@ -0,0 +1,41 @@
+name: "🛡️ CodeQL"
+on:
+  workflow_dispatch:
+  push:
+    branches: ["main"]
+  pull_request:
+  schedule:
+    - cron: "0 7 * * 2"
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+permissions: {}
+jobs:
+  analyze:
+    name: "🛡️ Analyze ${{ matrix.language }}"
+    runs-on: ubuntu-26.04
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [actions, python]
+    steps:
+      - name: "📥 Check out code"
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: "🛡️ Initialize CodeQL"
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          queries: security-extended
+          config: |
+            paths-ignore:
+              - tests
+      - name: "🛡️ Analyze"
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/news.yaml

@@ -0,0 +1,32 @@
+name: "📝 Changelog"
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, labeled, unlabeled]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+jobs:
+  changelog:
+    name: "📝 News fragment"
+    runs-on: ubuntu-26.04
+    steps:
+      - name: "📥 Check out code"
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: "🐍 Install uv"
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+        with:
+          version: latest-known
+          python-version: "3.15"
+          enable-cache: false
+      - name: "📦 Install locked release tools"
+        uses: tox-dev/github-workflows/install-locked-tools@259a3d3fb578d00517ffb73341fdd463259b0b2f # 6.0.1
+        with:
+          groups: release-news
+          venv: ${{ runner.temp }}/release-tools
+      - name: "🔍 Validate news fragments"
+        uses: tox-dev/github-workflows/validate-news@259a3d3fb578d00517ffb73341fdd463259b0b2f # 6.0.1

.github/workflows/perf.yaml

@@ -1,4 +1,4 @@
-name: "📊 performance matrix"
+name: "⏱️ performance matrix"
 on:
   workflow_dispatch:
 concurrency:
@@ -8,7 +8,7 @@ permissions:
   contents: read
 jobs:
   bench:
-    name: "📊 bench - ${{ matrix.os }}"
+    name: "⏱️ bench - ${{ matrix.os }}"
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -18,17 +18,19 @@ jobs:
           - windows-2025
           - macos-15
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: "📥 Check out code"
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - name: "🔄 Install the latest version of uv"
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - name: "🐍 Install uv"
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
+          version: latest-known
           python-version: "3.15"
           enable-cache: false
-      - name: "🧪 Install tox"
+      - name: "📦 Install tox"
         run: uv tool install --python-preference only-managed --python 3.15 tox --with tox-uv
-      - name: "📊 Measure the performance matrix"
+      - name: "⏱️ Measure the performance matrix"
         run: tox run -e bench
         env:
           UV_PYTHON_PREFERENCE: only-managed

.github/workflows/prepare-release.yaml

@@ -1,133 +1,22 @@
-name: 🛠️ Prepare release
+name: "🏷️ Prepare release"
 on:
   workflow_dispatch:
     inputs:
       bump:
-        description: "Version bump"
+        description: Version bump type
         required: true
-        default: auto
         type: choice
         options: [auto, major, minor, patch]
-permissions:
-  contents: read
+        default: auto
+permissions: {}
 jobs:
-  assemble:
-    name: 📝 build changelog
-    if: github.ref == 'refs/heads/main'
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: read
-    outputs:
-      version: ${{ steps.version.outputs.version }}
-    steps:
-      - name: 📥 Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0 # full history so the version calculation sees the latest tag
-          persist-credentials: false
-      - name: 📦 Setup uv
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
-        with:
-          python-version: "3.15"
-          enable-cache: false
-      - name: 🔢 Compute next version
-        id: version
-        env:
-          BUMP: ${{ inputs.bump }}
-        run: |
-          current=$(git tag --list --sort=-v:refname | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | head -1)
-          current=${current:-0.0.0}
-          IFS='.' read -r major minor patch <<< "$current"
-          bump="$BUMP"
-          if [ "$bump" = "auto" ]; then
-            if ls docs/changelog/*.breaking.rst >/dev/null 2>&1; then
-              bump=major
-            elif ls docs/changelog/*.feature.rst >/dev/null 2>&1; then
-              bump=minor
-            else
-              bump=patch
-            fi
-          fi
-          case "$bump" in
-            major) next="$((major + 1)).0.0" ;;
-            minor) next="$major.$((minor + 1)).0" ;;
-            patch) next="$major.$minor.$((patch + 1))" ;;
-          esac
-          echo "Bumping $current -> $next ($bump)"
-          echo "version=$next" >> "$GITHUB_OUTPUT"
-      - name: 📝 Build release patch
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          set -euo pipefail
-          if git tag --list "$VERSION" | grep -q .; then
-            echo "Tag $VERSION already exists, nothing to do"
-            exit 1
-          fi
-          if ! compgen -G 'docs/changelog/*.*.rst' > /dev/null; then
-            echo "::error::no changelog fragments to release"
-            exit 1
-          fi
-          uvx towncrier build --yes --version "$VERSION"
-          git diff HEAD --binary > "$RUNNER_TEMP/release.patch"
-          test -s "$RUNNER_TEMP/release.patch"
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: release-patch
-          path: ${{ runner.temp }}/release.patch
-          if-no-files-found: error
-  push:
-    name: 🔖 Commit and tag
-    needs: assemble
-    runs-on: ubuntu-24.04
-    environment: release-auth
+  prepare:
+    name: "🏷️ Prepare Towncrier release"
+    uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@259a3d3fb578d00517ffb73341fdd463259b0b2f # 6.0.1
     permissions:
       contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          name: release-patch
-          path: ${{ runner.temp }}/release-patch
-      - name: Validate release patch
-        env:
-          VERSION: ${{ needs.assemble.outputs.version }}
-        run: |
-          set -euo pipefail
-          git fetch origin main
-          git reset --hard origin/main
-          git apply --check "$RUNNER_TEMP/release-patch/release.patch"
-          git apply --index "$RUNNER_TEMP/release-patch/release.patch"
-          while IFS= read -r path; do
-            case "$path" in
-              docs/changelog.rst|docs/changelog/*.rst) ;;
-              *) echo "::error::unexpected release path: $path"; exit 1 ;;
-            esac
-          done < <(git diff --cached --name-only)
-          grep -qE "^ ${VERSION//./\\.} \(" docs/changelog.rst
-          git diff --cached --check
-      - id: token
-        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
-        with:
-          client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
-          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
-          owner: ${{ github.repository_owner }}
-          repositories: ${{ github.event.repository.name }}
-          permission-contents: write
-      - name: Commit and tag the release
-        env:
-          VERSION: ${{ needs.assemble.outputs.version }}
-          GH_TOKEN: ${{ steps.token.outputs.token }}
-          APP_SLUG: ${{ steps.token.outputs.app-slug }}
-        run: |
-          set -euo pipefail
-          app_user_id=$(gh api "/users/${APP_SLUG}[bot]" --jq .id)
-          git config user.name "${APP_SLUG}[bot]"
-          git config user.email "${app_user_id}+${APP_SLUG}[bot]@users.noreply.github.com"
-          git commit -m "Release $VERSION"
-          git tag "$VERSION"
-          gh auth setup-git --hostname github.com --force
-          git push --atomic origin HEAD:main "refs/tags/$VERSION"
+      pull-requests: read
+    with:
+      bump: ${{ inputs.bump }}
+    secrets:
+      RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}