[gaborbernat]

Releasing pre-commit-uv today means typing a version string into a hand-written prepare workflow, and the tag workflow carries its own build, notes and publish scripts that no other tox-dev project shares. This PR moves both onto tox-dev/github-workflows 6.0.1 and release-creator 4.1.0. 🚀 A maintainer now picks auto, major, minor or patch, and auto derives the version from the news fragments: breaking gives a major, feature a minor, anything else a patch.

Release flow

Prepare release calls the shared Towncrier workflow. It builds CHANGELOG.md from changelog.d, adds new contributors from commit authors and co-authors with release-creator contributors, and pushes the release commit and tag through the release App, whose key stays in the release-auth environment. The tag workflow builds the distributions in the shared build workflow while a read-only job renders the GitHub Release notes from the tagged changelog. PyPI gets the files through trusted publishing; a separate job compares PyPI's digests with the built files, and the GitHub Release is created last, from the rendered notes.

flowchart LR
    Prepare[Prepare release] -->|commit + tag| Tag((tag))
    Tag --> Build[🏗️ Build]
    Tag --> Notes[📝 Render notes]
    Build --> PyPI[🚀 Publish to PyPI]
    Notes --> PyPI
    PyPI --> Verify[🔍 Verify PyPI digests]
    Verify --> GHR[🚀 GitHub Release]
    Notes --> GHR
    classDef shared fill:#cfe4ff,stroke:#1f6feb,color:#0b1f3a;
    classDef local fill:#d8f3dc,stroke:#2d6a4f,color:#0b2e1a;
    class Prepare,Build shared;
    class Notes,PyPI,Verify,GHR,Tag local;

Loading

Release writers are trusted, so the tag workflow no longer re-checks the tag's version shape or its changelog section before building. The news check moves to its own workflow on the shared validate-news action, which since 6.0.0 runs each check only when the pull request touches the files it covers; the fragment requirement for human pull requests runs on every pull request.

Changelog and packaging

This PR rewrites the changelog's 15 tagged releases from GitHub's What's Changed lists into user-facing categories with stable anchors, pull request links and linked credits. CONTRIBUTING (new) explains how to write fragments and that credits come from commit authors, never from the fragment. On PyPI the project description now links CHANGELOG.md and CONTRIBUTING.md to GitHub instead of relative paths that break there, and the metadata gains an SPDX license, the hooks, pre-commit and uv keywords in place of format and pyproject, and topic classifiers.

Nab writes pylock.toml from a [tool.nab] table with a seven-day upload cutoff, and a weekly shared workflow opens a pull request with the refreshed lock. The lock carries every dependency group plus a build group with Cython and setuptools, since PyYAML 6.0.3 has no CPython 3.15 wheel. release-creator 4.1.0 enters through a temporary per-package cutoff exception.

Hook updates move to Dependabot's pre-commit ecosystem and pre-commit.ci's quarterly autoupdate, with hook revisions frozen to commit SHAs. Dependabot waits seven days before proposing an action or hook update. Every workflow, job and step now has an emoji-prefixed name.

🛡️ CodeQL

CodeQL moves from default setup to a committed workflow on ubuntu-26.04 that scans actions and python with the security-extended suite and skips tests, so fixtures raise no alerts. It also removes the ubuntu-latest migration notice default setup produces.