Skip to content

Commit db15119

Browse files
gaborbernatgaborbernat
authored
👷 ci: shared workflows and dependency hygiene (#290)
Routine CI hygiene for the release and workflow setup, plus adoption of the shared `tox-dev/github-workflows` 6.5.0 check, CodeQL and release workflows. Hygiene: - Pin every `tox-dev/github-workflows` reference, including the untagged scorecard pin, to 6.4.0. Nothing in 6.2.2 through 6.4.0 renames or removes an input these callers pass. - Align `astral-sh/setup-uv` to v10.3.3. - Drop the `[tool.nab]` `release-creator` exception, which was marked for deletion after 2026-11-02. `pylock.toml` regenerated with nab 0.0.23, the version it records. Adoption: - Pin every reference to 6.5.0. - `check.yaml` passes the tox matrix to the reusable workflow as `include`. The caller keeps the `🧪 Test` job and the `🚦 Required checks pass` gate, which now calls the `required-checks` action instead of an inline `jq` expression. Tox installs under the 7-day upload cutoff, as the shared workflow does for every repository. - `codeql.yaml` runs the analysis through the reusable workflow. The caller keeps its triggers and the `tests` path exclusion. - Release: `release-notes.yaml` renders the GitHub Release body, and `github-release.yaml` verifies the PyPI files before it creates the Release. The PyPI publish job stays in the caller for trusted publishing. This replaces the local notes upload, previous-tag, reconcile and Release steps. Required checks are unchanged: `🚦 Required checks pass`, `📝 News fragment` and `pre-commit.ci - pr` keep their names. The test checks now read `🧪 Test / 🧪 <env> on ubuntu-26.04`, and CodeQL reads `🛡️ Analyze / 🛡️ Analyze <language>`. Dependabot already covers `github-actions` and `pre-commit` with the 7-day cooldown, so no config change there.
1 parent 6192233 commit db15119

9 files changed

Lines changed: 57 additions & 158 deletions

File tree

‎.github/workflows/check.yaml‎

Lines changed: 19 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -16,52 +16,29 @@ permissions:
1616
jobs:
1717
test:
1818
name: 🧪 Test
19-
runs-on: ubuntu-26.04
20-
strategy:
21-
fail-fast: false
22-
matrix:
23-
env:
24-
- "3.15"
25-
- "3.15t"
26-
- "3.14"
27-
- "3.13"
28-
- "3.12"
29-
- "3.11"
30-
- type
31-
- dev
32-
- pkg_meta
33-
steps:
34-
- name: 📥 Check out code
35-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
36-
with:
37-
fetch-depth: 0
38-
persist-credentials: false
39-
- name: 🐍 Install uv
40-
uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
41-
with:
42-
python-version: "3.15"
43-
enable-cache: false
44-
cache-dependency-glob: "pyproject.toml"
45-
github-token: ${{ secrets.GITHUB_TOKEN }}
46-
- name: 📦 Install tox
47-
run: uv tool install --python-preference only-managed --python 3.15 tox --with tox-uv
48-
- name: 🐍 Install Python
49-
if: startsWith(matrix.env, '3.') && matrix.env != '3.15'
50-
run: uv python install --python-preference only-managed ${{ matrix.env }}
51-
- name: 📦 Set up test suite
52-
run: tox run -vv --notest --skip-missing-interpreters false -e ${{ matrix.env }}
53-
- name: 🧪 Run test suite
54-
run: tox run --skip-pkg-install -e ${{ matrix.env }}
55-
env:
56-
PYTEST_ADDOPTS: "-vv --durations=20"
57-
DIFF_AGAINST: HEAD
19+
uses: tox-dev/github-workflows/.github/workflows/check.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
20+
permissions:
21+
contents: read
22+
with:
23+
include: |
24+
[
25+
{"env": "3.15"},
26+
{"env": "3.15t", "python": "3.15t"},
27+
{"env": "3.14", "python": "3.14"},
28+
{"env": "3.13", "python": "3.13"},
29+
{"env": "3.12", "python": "3.12"},
30+
{"env": "3.11", "python": "3.11"},
31+
{"env": "type"},
32+
{"env": "dev"},
33+
{"env": "pkg_meta"}
34+
]
5835
gate:
5936
name: 🚦 Required checks pass
6037
if: ${{ !cancelled() }} # codespell:ignore cancelled
6138
needs: [test]
6239
runs-on: ubuntu-26.04
6340
steps:
6441
- name: 🚦 Require all needed jobs to pass
65-
env:
66-
NEEDS_JSON: ${{ toJSON(needs) }}
67-
run: jq -e 'all(to_entries[]; .value.result == "success")' <<<"$NEEDS_JSON"
42+
uses: tox-dev/github-workflows/required-checks@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
43+
with:
44+
needs: ${{ toJSON(needs) }}

‎.github/workflows/codeql.yaml‎

Lines changed: 5 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -12,30 +12,11 @@ concurrency:
1212
permissions: {}
1313
jobs:
1414
analyze:
15-
name: 🛡️ Analyze ${{ matrix.language }}
16-
runs-on: ubuntu-26.04
15+
name: 🛡️ Analyze
16+
uses: tox-dev/github-workflows/.github/workflows/codeql.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
1717
permissions:
1818
contents: read
1919
security-events: write
20-
strategy:
21-
fail-fast: false
22-
matrix:
23-
language: [actions, python]
24-
steps:
25-
- name: 📥 Check out code
26-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
27-
with:
28-
persist-credentials: false
29-
- name: 🛡️ Initialize CodeQL
30-
uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
31-
with:
32-
languages: ${{ matrix.language }}
33-
build-mode: none
34-
queries: security-extended
35-
config: |
36-
paths-ignore:
37-
- tests
38-
- name: 🛡️ Analyze
39-
uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
40-
with:
41-
category: "/language:${{ matrix.language }}"
20+
with:
21+
languages: '["actions","python"]'
22+
paths-ignore: '["tests"]'

‎.github/workflows/news.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,14 @@ jobs:
1616
fetch-depth: 0
1717
persist-credentials: false
1818
- name: 🐍 Install uv
19-
uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
19+
uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
2020
with:
2121
python-version: "3.15"
2222
enable-cache: false
2323
- name: 📦 Install locked release tools
24-
uses: tox-dev/github-workflows/install-locked-tools@99024bcb5749b178c5514f86acfcf1e80c865e75 # 6.3.0
24+
uses: tox-dev/github-workflows/install-locked-tools@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
2525
with:
2626
groups: release-news
2727
venv: ${{ runner.temp }}/release-tools
2828
- name: 🔍 Validate news fragments
29-
uses: tox-dev/github-workflows/validate-news@99024bcb5749b178c5514f86acfcf1e80c865e75 # 6.3.0
29+
uses: tox-dev/github-workflows/validate-news@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0

‎.github/workflows/prepare-release.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
prepare:
1818
name: 🏷️ Prepare Towncrier release
1919
if: github.repository == 'pytest-dev/pytest-print'
20-
uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
20+
uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
2121
permissions:
2222
contents: read
2323
pull-requests: read

‎.github/workflows/release.yaml‎

Lines changed: 15 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -10,48 +10,20 @@ concurrency:
1010
jobs:
1111
build:
1212
name: 🏗️ Build
13-
uses: tox-dev/github-workflows/.github/workflows/validate-python-release.yaml@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
13+
uses: tox-dev/github-workflows/.github/workflows/validate-python-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
1414
permissions:
1515
contents: read
16-
github-notes:
16+
notes:
1717
name: 📝 Render GitHub Release notes
18-
runs-on: ubuntu-26.04
18+
uses: tox-dev/github-workflows/.github/workflows/release-notes.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
1919
permissions:
2020
contents: read
21-
outputs:
22-
artifact-id: ${{ steps.upload.outputs.artifact-id }}
23-
steps:
24-
- name: 📥 Check out code
25-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
26-
with:
27-
fetch-depth: 0
28-
persist-credentials: false
29-
- name: 🐍 Install uv
30-
uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
31-
with:
32-
python-version: "3.15"
33-
enable-cache: false
34-
- name: 📦 Install locked release tools
35-
uses: tox-dev/github-workflows/install-locked-tools@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
36-
with:
37-
groups: release-notes
38-
venv: ${{ runner.temp }}/release-tools
39-
- name: 📝 Render release notes
40-
uses: tox-dev/github-workflows/render-release-notes@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
41-
with:
42-
tag: ${{ github.ref_name }}
43-
changelog: CHANGELOG.md
44-
artifact-url: https://pypi.org/project/pytest-print/${{ github.ref_name }}/
45-
- name: 📤 Upload release notes
46-
id: upload
47-
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
48-
with:
49-
name: github-release-notes
50-
path: ${{ runner.temp }}/release-notes.md
51-
if-no-files-found: error
21+
with:
22+
tag: ${{ github.ref_name }}
23+
artifact-url: https://pypi.org/project/pytest-print/${{ github.ref_name }}/
5224
release:
5325
name: 🚀 Publish to PyPI
54-
needs: [build, github-notes]
26+
needs: [build, notes]
5527
runs-on: ubuntu-26.04
5628
environment:
5729
name: release
@@ -71,40 +43,13 @@ jobs:
7143
attestations: true
7244
github-release:
7345
name: 🚀 Publish GitHub Release
74-
needs: [build, release, github-notes]
75-
runs-on: ubuntu-26.04
46+
needs: [build, release, notes]
47+
uses: tox-dev/github-workflows/.github/workflows/github-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
7648
permissions:
7749
contents: write
78-
steps:
79-
- name: 🐍 Install uv
80-
uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
81-
with:
82-
version: latest-known
83-
python-version: "3.15"
84-
enable-cache: false
85-
ignore-empty-workdir: true
86-
- name: 📩 Download distributions
87-
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
88-
with:
89-
artifact-ids: ${{ needs.build.outputs.distributions-artifact-id }}
90-
path: dist/
91-
- name: 📩 Download release notes
92-
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
93-
with:
94-
artifact-ids: ${{ needs.github-notes.outputs.artifact-id }}
95-
path: ${{ runner.temp }}
96-
- name: 🔍 Verify PyPI artifacts
97-
uses: tox-dev/github-workflows/reconcile-pypi-artifacts@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
98-
with:
99-
project: pytest-print
100-
version: ${{ github.ref_name }}
101-
dist: dist/
102-
- name: 🚀 Publish GitHub release
103-
uses: tox-dev/github-workflows/publish-github-release@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
104-
env:
105-
GH_TOKEN: ${{ github.token }}
106-
with:
107-
tag: ${{ github.ref_name }}
108-
commit: ${{ github.sha }}
109-
title: ${{ github.ref_name }}
110-
notes-file: ${{ runner.temp }}/release-notes.md
50+
with:
51+
project: pytest-print
52+
version: ${{ github.ref_name }}
53+
tag: ${{ github.ref_name }}
54+
artifact-pattern: python-package-distributions
55+
notes-artifact-id: ${{ needs.notes.outputs.artifact-id }}

‎.github/workflows/scorecard.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,4 @@ jobs:
2323
pull-requests: read # read reviews for the Code-Review check
2424
security-events: write # upload the SARIF results to code scanning
2525
statuses: read # read commit statuses for the CI-Tests check
26-
uses: tox-dev/github-workflows/.github/workflows/scorecard.yaml@cfb6d637a10b70da576575790eb3c806f57cd0b5
26+
uses: tox-dev/github-workflows/.github/workflows/scorecard.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0

‎.github/workflows/upgrade-release-tools.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ concurrency:
1010
jobs:
1111
upgrade:
1212
name: 🔀 Upgrade release tools
13-
uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
13+
uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
1414
permissions:
1515
contents: read
1616
secrets:

‎pylock.toml‎

Lines changed: 12 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1501,7 +1501,7 @@ sha256 = "b531f0f90c4d6ec22f1f8e78996980048bd7d494b7d366b0cf98e39b293565e0"
15011501
[[packages]]
15021502
name = "pyyaml"
15031503
version = "6.0.3"
1504-
marker = "\"dev\" in dependency_groups or \"lint\" in dependency_groups or \"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups"
1504+
marker = "\"dev\" in dependency_groups or \"lint\" in dependency_groups"
15051505
requires-python = ">=3.8"
15061506
index = "https://pypi.org/simple/"
15071507

@@ -1546,7 +1546,7 @@ sha256 = "d0dae1f74bb273b534770cb4cccb6bb78735540afdb03c2146f4e19dcd412560"
15461546

15471547
[[packages]]
15481548
name = "release-creator"
1549-
version = "4.1.0"
1549+
version = "4.2.0"
15501550
marker = "\"release-news\" in dependency_groups or \"release-notes\" in dependency_groups or \"release-prepare\" in dependency_groups"
15511551
requires-python = ">=3.15"
15521552
dependencies = [
@@ -1555,28 +1555,27 @@ dependencies = [
15551555
{ name = "mdformat" },
15561556
{ name = "mdformat-gfm" },
15571557
{ name = "packaging" },
1558-
{ name = "pyyaml" },
15591558
{ name = "towncrier" },
15601559
]
15611560
index = "https://pypi.org/simple/"
15621561

15631562
[packages.sdist]
1564-
name = "release_creator-4.1.0.tar.gz"
1565-
upload-time = 2026-10-26 18:24:45.805437+00:00
1566-
url = "https://files.pythonhosted.org/packages/7f/fd/05d7f3c604476a238d67d5aaa2a4085312e7078c193dbd7ad99ad48d560d/release_creator-4.1.0.tar.gz"
1567-
size = 186016
1563+
name = "release_creator-4.2.0.tar.gz"
1564+
upload-time = 2026-10-26 22:39:33.566239+00:00
1565+
url = "https://files.pythonhosted.org/packages/0c/c2/6ff369a01a8fff3e4845e2a6989164b71b1662cba8e104ae9f0a2925ca43/release_creator-4.2.0.tar.gz"
1566+
size = 163102
15681567

15691568
[packages.sdist.hashes]
1570-
sha256 = "c783037f5ca2efc16fa7cccfb1c2abf0a442f116a63ca82bd7bfb7e2a8343a15"
1569+
sha256 = "5affc1e7a935aa816dfa16c03200b17f93f7d17d201e6a913c50e1e9e32bad2f"
15711570

15721571
[[packages.wheels]]
1573-
name = "release_creator-4.1.0-py3-none-any.whl"
1574-
upload-time = 2026-10-26 18:24:44.353933+00:00
1575-
url = "https://files.pythonhosted.org/packages/30/d0/38480e99025c021d07e0710af02547562dfadbd798bef26dc01869a3f81e/release_creator-4.1.0-py3-none-any.whl"
1576-
size = 52922
1572+
name = "release_creator-4.2.0-py3-none-any.whl"
1573+
upload-time = 2026-10-26 22:39:32.212020+00:00
1574+
url = "https://files.pythonhosted.org/packages/a5/c2/b1be3e0bff91e390890f3bc8e2d9307a1c2841bb3452798d013f2a2b741d/release_creator-4.2.0-py3-none-any.whl"
1575+
size = 53089
15771576

15781577
[packages.wheels.hashes]
1579-
sha256 = "67deae16d11ac261a1512f18a22c0cf13418f43afc3e56cb74e58ad4422062e3"
1578+
sha256 = "fe3048e7bc31ee0d757985bbc256290fc40b1ca4c76be574b6730752cbb5831f"
15801579

15811580
[[packages]]
15821581
name = "requests"
@@ -2145,7 +2144,6 @@ command-line = [
21452144
"--all-groups",
21462145
"--all-extras",
21472146
"--no-cache",
2148-
"--upgrade",
21492147
]
21502148
input-path = "pyproject.toml"
21512149
mode = "universal"

‎pyproject.toml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -214,5 +214,3 @@ uploaded-prior-to = "P7D"
214214
decision-order = "stable"
215215
matrix.python = ">=3.15,<3.16"
216216
matrix.platforms = [ "linux_x86_64" ]
217-
# temporary, delete after 2026-11-02
218-
packages.release-creator.uploaded-prior-to = 2026-10-26T18:24:46Z

0 commit comments

Comments
 (0)