Changes

• validate-news reads the pull request's current labels from the API, so re-running an older Changelog run after adding skip news passes instead of failing on the labels the original event carried. Callers grant pull-requests: read to the job (#35) by @gaborbernat.

📜 Full Changelog

Changes

• publish-github-release credits first-time contributors on the GitHub Release, taking the list from GitHub's generated notes for the range since the previous tag and placing it above the package and comparison links. prepare-towncrier no longer adds a New Contributors subsection to the changelog (#34) by @gaborbernat.

📜 Full Changelog

Features

• render-release-notes takes one artifact-url per line, with matching artifact-label lines, so a project that publishes several packages lists them all on one row of the GitHub Release. Release bodies now come from release-creator 4.3.0, which marks each link with its ecosystem emoji (#32) by @gaborbernat.

📜 Full Changelog

Bug fixes

• Match release assets by the name GitHub stores, which replaces characters such as spaces with periods. A file named PyVenv Manage 2-2.4.7-signed.zip uploaded, but its draft stayed unpublished because the check expected the local name (#29) by @gaborbernat.

Full Changelog

Changes

• Admit the [tool.nab] per-package uploaded-prior-to exceptions in cooled-prek hook environments, so a hook dependency pinned past the seven-day cutoff installs the same way as the release lock. Before, prepare failed on such a pin (#28) by @gaborbernat.

Full Changelog

Bug fixes

• Check out the full history in the validate-python-release build job again, so version tools such as hatch-vcs and setuptools-scm see the release tag. 6.0.0 built 0.1.dev1+g<sha> instead of the tagged version (#25) by @gaborbernat.

Full Changelog

Features

• Every Action and reusable workflow now logs the choices it makes and why, and no longer hides tool output (#23) by @gaborbernat.
• Run each validate-news check only when the pull request touches what it validates: fragment validation when the fragment directory changes, the Towncrier configuration check when towncrier.toml or the tool.towncrier table changes, the lock check when a pyproject.toml, pylock.toml, root pylock.*.toml, or nab.toml changes, and the lock-removal guard when pylock.toml is deleted. Workflow changes no longer trigger the lock check, and every root pylock.*.toml does, whether or not it is the configured additional-lock. The fragment requirement for human pull requests still runs on every pull request (#23) by @gaborbernat.

Changes

• Drop the main branch condition from the writer job of upgrade-release-tools.yaml. The deployment branch rule of the release-auth environment still applies (#23) by @gaborbernat.
• Drop the source job of the github-workflows release workflow, which re-checked the tag that started it (#23) by @gaborbernat.
• Give every job and step in the shared workflows and Actions a name that starts with an emoji. Jobs of the reusable workflows show up in callers as <caller job> / <job name>, so required status checks that name them must be updated. publish-jetbrains-marketplace also recognizes a prior upload step named 🚀 Publish signed ZIP, the README's new name for the caller's publishing step (#23) by @gaborbernat.
• Make publish-github-release update an existing draft's title, notes, and prerelease flag on a rerun instead of failing, use the first Release when several share the tag, and create the draft in publish mode when none exists. It no longer compares the title, notes, and prerelease flag of an existing Release; the read-after-write retry and the asset name and digest checks stay (#23) by @gaborbernat.
• Stop commit-and-tag from requiring a clean working tree with only a staged patch; it commits whatever is staged (#23) by @gaborbernat.
• Stop publish-jetbrains-marketplace from inspecting earlier release environment deployments for the tag before an upload; the job no longer needs Deployments read access. Stop publish-post-release-pr from failing when an open pull request's title, body, or base changed, when several pull requests match, or when a merged pull request lost its skip news label; it re-applies the label instead (#23) by @gaborbernat.
• Stop refresh-release-lock from failing in refresh mode when the regenerated lock targets different environments. check mode still compares the whole lock (#23) by @gaborbernat.
• Stop checking the shape of built artifacts that the release jobs produce themselves. validate-python-release.yaml no longer requires an empty dist directory or exactly one wheel and one sdist at the tag's version, and build-python-distribution no longer requires an empty dist directory. reconcile-pypi-artifacts no longer rejects an empty dist, an invalid project name, or local files that are hidden, symbolic links, directories, or belong to another release; it compares every file in dist with PyPI (#23) by @gaborbernat.
• Stop re-checking files the release jobs produce themselves in the JetBrains Actions. sign-jetbrains-plugin no longer runs unzip -t on the unsigned or signed ZIP, checks for Java 17 or an existing signed ZIP, runs the signer's verify, or checks the signed ZIP's type and members. publish-jetbrains-marketplace no longer runs unzip -t, re-hashes the upload copy, or checks the file types of a downloaded receipt and earlier artifacts (#23) by @gaborbernat.
• Stop re-checking the release tag before publishing. publish-github-release no longer requires the remote tag to resolve to commit, which now only sets the target of a new Release. publish-jetbrains-marketplace no longer requires the remote tag to target commit or fails on an earlier upload of the tag from another commit. Drop the step that re-checks the tag before publish-github-release from callers that copied the README example (#23) by @gaborbernat.
• Stop validating caller input in the prepare and tag Actions. prepare-towncrier no longer rejects an unknown phase, a finalize run without version, a changelog-prefix other than empty or v, an explicit version that is not newer than existing tags, other hook configuration files, or an unknown changelog format; any changelog not ending in .rst is formatted with mdformat. read-towncrier-config no longer checks that the paths are normalized and inside the repository, that the changelog ends in .md or .rst, or that fragment categories are configured. select-previous-tag no longer requires the tag to exist locally or limits it to one namespace separator, and commit-and-tag no longer rejects an empty token or app-slug or an annotated value other than true or false; any value other than true creates a lightweight tag (#23) by @gaborbernat.
• Stop validating caller input in the publishing Actions. publish-github-release no longer rejects an empty tag, title, or notes file, a prerelease other than true or false, an unknown mode, or asset directories with hidden, non-regular, or unusually named entries. publish-jetbrains-marketplace no longer checks the archive name and type, the plugin ID, the channel, the tag ref, the notes file type, the artifact IDs, or that publish-token is set. sign-jetbrains-plugin no longer checks the archive name and type, and publish-post-release-pr no longer checks the format of its inputs or the allowed-paths entries (#23) by @gaborbernat.

Breaking changes

• Reduce validate-release-patch to applying the patch and checking its paths and file modes, and remove its version and checks inputs; remove them from callers. It no longer rejects a main branch that moved, a patch that leaves the changelog unchanged, or RST conflict markers, and it no longer runs release-creator validate-fragment-deletions, release-creator notes, the hook configuration check, or prek (#23) by @gaborbernat.
• Remove the app-slug and commit-message inputs from publish-post-release-pr; remove them from callers. The Action no longer compares the candidate's author, committer, and message with the App bot and the expected message, re-reads the branch, pull request head, or base after writing, or checks the files of an already merged pull request against the current base (#23) by @gaborbernat.
• Remove the check-tagged-source Action, and stop checking the tag in validate-python-release.yaml: the workflow no longer requires the tag to resolve to GITHUB_SHA or to sit on main, and checks out the tag with the default fetch depth. Remove check-tagged-source steps from callers (#23) by @gaborbernat.
• Remove the lock job from validate-python-release.yaml and prepare-towncrier-release.yaml, and the lock check from check-tagged-source. validate-news still checks the lock on the pull request that changes it. Both workflows drop the additional-lock, additional-lock-groups, additional-lock-selection, additional-matrix-python, additional-matrix-platforms, and additional-matrix-implementations inputs, and check-tagged-source drops them along with exclude-newer and exclude-newer-package; remove them from callers. Without the lock job, prepare-towncrier-release.yaml no longer skips a dispatch from a branch other than main (#23) by @gaborbernat.
• Remove the validate job from prepare-towncrier-release.yaml, which recalculated the version and ran release-creator and prek on the patch that assemble had just produced; push now depends on assemble alone. The workflow no longer installs the release-validate group (#23) by @gaborbernat.
• Remove the verify-lock and verify-groups inputs from install-locked-tools and verify-groups from export-build-constraints, together with the check_lock_groups.py check behind them; remove them from callers. install-locked-tools no longer checks that the requested groups exist in the lock or ...

Bug fixes

• Make refresh-release-lock in check mode install the Nab version that the committed pylock.toml records in [tool.nab] nab-version, and fail if the lock records none. A Nab release newer than that version rewrites the field, so every committed lock failed the check until the weekly refresh. refresh mode still installs the newest Nab under the cutoff, and nab-git-commit still installs from that commit in both modes (#22) by @gaborbernat.
• Make validate-news reject a pull request that removes pylock.toml when the project has a nab.toml, as it already did for a [tool.nab] table in pyproject.toml (#22) by @gaborbernat.

Documentation

• Say that check-tagged-source reads the tag of a non-tag run from the tag input of the workflow_dispatch event, github.event.inputs.tag, rather than from an input of the Action (#22) by @gaborbernat.

Security

• Make the Actions install their own tools, such as Nab, packaging, certifi, and pypi-attestations, from PyPI even when the caller's repository or environment configures another index. The installer now ignores uv.toml, [tool.uv] in pyproject.toml, and the UV_INDEX, UV_INDEX_URL, UV_DEFAULT_INDEX, UV_EXTRA_INDEX_URL, UV_FIND_LINKS, UV_CONFIG_FILE, UV_INSECURE_HOST, UV_SYSTEM_CERTS, SSL_CERT_FILE, and SSL_CERT_DIR variables, as cooled-prek already does (#22) by @gaborbernat.

Full Changelog

Bug fixes

• Install the whole Nab workspace from the nab-git-commit commit: nab and its nab-index, nab-markersets, nab-project, nab-provider, and nab-resolver sub-packages, which the root pins to an unreleased version (#21) by @gaborbernat.
• Let check-tagged-source accept a workflow_dispatch or other non-tag run, such as one from main with a tag input, when the checkout is the commit that tag names and that commit is on main. Tag runs still require the tag, GITHUB_SHA, and the checkout to match (#21) by @gaborbernat.

Full Changelog