[gaborbernat]

python-discovery cut releases through its own copy of the release logic: a shell version calculator in the prepare workflow, an awk and regex converter from the RST changelog to GitHub notes, and a local tasks/release.py behind a tox environment. 🚀 This PR hands that work to the shared release path in tox-dev/github-workflows 6.0.1 and release-creator 4.1.0, so a fix to how tox-dev projects release lands here with a pin bump instead of a hand edit.

Architecture

This repo keeps thin caller workflows and the project-specific inputs: the changelog path, the PyPI project name and the annotated-tag choice. github-workflows owns the steps: preparing the release commit and tag, building the distributions, rendering notes, checking PyPI digests and creating the GitHub Release. release-creator owns the changelog rules those steps call, from linking fragments to their pull request to crediting authors and converting a tagged RST section to Markdown.

On a tag push, the build and the notes run in parallel, PyPI publishing waits for both, and the GitHub Release comes last, after the PyPI files match the built ones.

flowchart LR
    Tag[Tag push] --> Build[🏗️ Build]
    Tag --> Notes[📝 Render notes]
    Build --> PyPI[🚀 PyPI via OIDC]
    Notes --> PyPI
    PyPI --> GHR[🚀 GitHub Release]
    classDef local fill:#cfe4ff,stroke:#1f6feb,color:#0b1f3a;
    classDef shared fill:#d8f3dc,stroke:#2d6a4f,color:#0b2e1a;
    class Tag,PyPI local;
    class Build,Notes,GHR shared;

Loading

What changes for contributors and maintainers

docs/changelog.rst is rebuilt from the 25 release tags with categorized sections (Added, Fixed, Documentation and others) and stable anchors per release and per category. Fragments name no pull request number: release preparation links each one to its merged PR and credits that PR's commit author and co-authors, then runs release-creator contributors to add a New Contributors subsection. A new docs/contributing.rst page documents this, and a separate news workflow checks fragments on pull requests.

The owner's rule is that people with write access are trusted and the pull request merge is where their work gets validated. So this PR drops checks that only re-validated a writer's action outside a pull request: the tag-format and changelog-section check on tag push, and the prepare workflow's patch path checks before pushing to main. Every job and step now carries a name with one emoji.

Dependencies

pylock.toml comes from nab, configured in [tool.nab]: universal mode, a seven-day P7D upload window, CPython 3.15 on linux_x86_64, covering every dependency group. A weekly workflow relocks it. A new build group adds cython and setuptools next to the hatchling backend because PyYAML 6.0.3 ships no cp315 wheel. release-creator has a temporary cutoff of 2026-10-26T18:24:46Z, marked for deletion after 2026-11-02, which lets the lock resolve 4.1.0 before it is seven days old.

Hook updates move to Dependabot's pre-commit ecosystem with a seven-day cooldown, hook revisions are frozen to commit SHAs, and pre-commit.ci autoupdates quarterly. The package metadata switches to an SPDX license, and the PyPI Changelog link points at docs/changelog.rst.

🛡️ CodeQL

CodeQL moves from default setup to a committed workflow on ubuntu-26.04 that scans actions and python with the security-extended suite and skips tests, which removes the ubuntu-latest migration notice default setup produces. GitHub rejects advanced-setup results while default setup is on, so the 🛡️ Analyze jobs fail until default setup is turned off for this repository.