Repository navigation
✨ feat(release): share validation and upkeep - #3
Merged
Merged
Conversation
The 0.2.0 release rendered bare fragment stems instead of pull request links and author credits. Correct its tracked changelog and make the runner rehearsal fail when either credit is missing. Use the unreleased release-creator commit for validation. Switch the lock back to PyPI and rerun the gate before merging.
Seventeen publisher workflows use the same uv wheel and sdist command. Put their locked-tool install, tagged-source prek check, and build in one Action so the publisher and PR rehearsal can run identical steps.
This was referenced Oct 20, 2026
gaborbernat
changed the title
Run the PR rehearsal through the read-only workflow used by tag releases. Keep GitHub Release creation in a separate tag-only job with Contents write.
Use a universal lock and target-specific hashed build constraints across the shared actions. Validate the release patch in a keyless worktree before granting the App key. Upload complete PyPI distributions and verify Simple API files and provenance. Remove obsolete staging actions and single-value inputs.
Use the shared lock for shared-only tools and check staged Towncrier deletions through release-creator. Require release tags to be on main, and use one pinned Nab bootstrap across the Actions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Share the release path across the rollout repositories. A keyless job assembles and validates the Towncrier patch in a fresh worktree; a separate writer verifies the patch before using the repository-scoped App key. The reusable preparation workflow reads paths and categories from the committed Towncrier configuration.
Nab's universal lock supplies only the release groups each job needs and hashed build constraints for selected targets. The weekly updater handles the main lock and an optional target-specific build lock. PyPI publication uploads the complete distribution set, then checks the Simple API files and their trusted-publisher attestations. GitHub Release publication verifies uploaded asset attestations.
The verify-only PyPI Action uses the CLI in release-creator #14. After that package is released, this PR's lock can move from 0.5.1 to the published version.