[gaborbernat]

virtualenv kept its own copy of the release steps that the other tox-dev projects share, with a hand-compiled tasks/release-requirements.txt and tag-time checks that re-validated what maintainers had already merged. 🚀 This PR moves release preparation, news fragment validation and the weekly release-tool relock onto tox-dev/github-workflows 6.0.1, so a fix to those steps reaches virtualenv through one pin bump. The tag pipeline stays virtualenv's own: it still builds the wheel, sdist and zipapp, attaches the SBOMs, attests every artifact and makes the signed get-virtualenv commit.

Release managers see three changes. The changelog uses the shared categories (Added, Fixed, Security, Packaging and so on) with stable anchors per release and section. Credits come from the human commit authors and co-authors of each fragment's pull request, never from the fragment text or a bot account. Fragments are named +short-description.<type>.rst, and the squash merge supplies the PR number.

Architecture

github-workflows owns the generic parts: the prepare workflow that builds the changelog, commits and tags, the relock workflow, and actions for news validation, notes rendering, PyPI reconciliation and GitHub Release publishing. virtualenv's tag workflow calls those actions as steps and keeps the zipapp, SBOM and get-virtualenv jobs. Each job downloads artifacts by the ID its upstream job returned. The local tox r -e release path calls the release-creator 4.1.0 library for the version bump, PR links and New Contributors section, so a local run produces the same changelog as the shared prepare.

flowchart LR
    Tag[Tag push] --> Build[Build wheel, sdist, zipapp]
    Tag --> Notes[Render notes]
    Build --> Attest[Attest]
    Attest --> PyPI[Publish to PyPI]
    Notes --> PyPI
    PyPI --> Reconcile[Verify PyPI files]
    Reconcile --> GHR[GitHub Release]
    Notes --> GHR
    GHR --> Boot[Update get-virtualenv]
    Boot --> Verify[Verify installs and bootstrap.pypa.io]
    classDef shared fill:#cfe4ff,stroke:#1f6feb,color:#0b1f3a;
    classDef own fill:#ffe3a3,stroke:#d29200,color:#3a2c00;
    class Notes,Reconcile,GHR shared;
    class Tag,Build,Attest,PyPI,Boot,Verify own;

Loading

The release path now trusts people with write access: the PR merge is where their changes get checked. The tag run drops the source check, the changelog-section and tag-format checks, the lock re-verification and the post-publish SPDX run, and tasks/release.py no longer refuses a dirty checkout. The supply-chain guards stay: sealed artifact hashes, attestations, PyPI reconciliation, the byte comparison of published files and the get-virtualenv mismatch errors.

nab locks every dependency group into pylock.toml for CPython 3.15 on linux x86_64, where the release jobs run, and on windows amd64, where CI builds the zipapp. A build group holds the build backend plus cython and setuptools, since PyYAML has no cp315 wheel. pylock.zipapp.toml stays the zipapp lock, and the shared news check and weekly relock cover it too.

The embedded wheel upgrade now validates its patch in a read-only job. The write job checks that patch's SHA-256 and applies it with git apply, without running project Python code.

Hook revisions are frozen to commit SHAs. Dependabot's pre-commit ecosystem bumps them weekly after a seven-day cooldown, and pre-commit.ci autoupdates quarterly.