From cb2018ca5b8c58cb6e10b18f0b2ab16d89eeca51 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= <gaborjbernat@gmail.com>
Date: Fri, 6 Nov 2026 19:21:49 -0800
Subject: [PATCH] =?UTF-8?q?=F0=9F=A7=B9=20ci:=20pin=20shared=20workflows?=
 =?UTF-8?q?=20to=206.7.2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The cooled hook run held back a hook bumped to a release younger than seven
days, so a deliberate bump failed the pull request. github-workflows 6.7.2
admits each exact hook pin up to its upload time while it is inside the
cooldown window.

The Nab cutoff exceptions gain the expiry comment the shared changelog
check requires.
---
 .github/workflows/check.yaml           | 2 +-
 .github/workflows/prepare-release.yaml | 2 +-
 pyproject.toml                         | 3 ++-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml
index 569f7e0..aeffe26 100644
--- a/.github/workflows/check.yaml
+++ b/.github/workflows/check.yaml
@@ -43,7 +43,7 @@ jobs:
       dry-run: true
   hooks:
     name: 🧹 Hooks under the cooldown
-    uses: tox-dev/github-workflows/.github/workflows/cooled-hooks.yaml@e1361e2efa1e9dd9705bb9be719d923cd9154707 # 6.7.1
+    uses: tox-dev/github-workflows/.github/workflows/cooled-hooks.yaml@0c4cffd63033d38196319524d101caae1eef925b # 6.7.2
     permissions:
       contents: read
   gate:
diff --git a/.github/workflows/prepare-release.yaml b/.github/workflows/prepare-release.yaml
index 3b65506..6355081 100644
--- a/.github/workflows/prepare-release.yaml
+++ b/.github/workflows/prepare-release.yaml
@@ -24,7 +24,7 @@ permissions:
 jobs:
   prepare:
     name: 🏷️ Prepare Towncrier release
-    uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@e1361e2efa1e9dd9705bb9be719d923cd9154707 # 6.7.1
+    uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@0c4cffd63033d38196319524d101caae1eef925b # 6.7.2
     with:
       bump: ${{ inputs.bump || 'auto' }}
       dry-run: ${{ inputs.dry-run == true }}
diff --git a/pyproject.toml b/pyproject.toml
index 2c21a20..242950a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -208,5 +208,6 @@ uploaded-prior-to = "P7D"
 decision-order = "stable"
 matrix.python = ">=3.15,<3.16"
 matrix.platforms = [ "linux_x86_64" ]
-# release-creator 4.4.0 needs a seven-day cutoff exception through 2026-11-09.
+# release-creator 4.4.0 needs a seven-day cutoff exception.
+# expires 2026-11-09
 packages.release-creator.uploaded-prior-to = 2026-11-02T21:45:00Z