Repository navigation
👷 ci: adopt shared workflows and dependency hygiene - #242
Merged
Merged
Conversation
Move the tox matrix and the CodeQL analysis onto the shared check and CodeQL workflows so every tox library runs the same test and analysis steps. The old-target job stays local because it builds the wheel and checks interpreter discovery, which only this project needs. The caller keeps its triggers, its schedule, and the gate job name that branch protection requires.
The shared release notes and GitHub Release workflows replace the local notes and release jobs, which repeated the same reconciliation steps. The PyPI upload stays in the caller because trusted publishing cannot run inside a reusable workflow.
gaborbernat
changed the title
gaborbernat
marked this pull request as ready for review
November 4, 2026 04:35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every tox-dev library runs its test, CodeQL, and release steps from the shared github-workflows repository at 6.5.0, so a fix there reaches this project without a local copy to update. This PR moves the repository onto those shared workflows and removes the local copies they replace.
The repository keeps its triggers, schedules, concurrency, and the
releaseenvironment. The shared check workflow owns the tox matrix, the shared CodeQL workflow owns analysis, and the shared required-checks Action owns the gate, which keeps its job name so the branch ruleset still finds the required check. The shared release notes and GitHub Release workflows render and publish the release. The PyPI upload stays in this repository because PyPI trusted publishing cannot run inside a reusable workflow.The old-target job stays in this repository. It builds the wheel and checks interpreter discovery with this project's own script, which the shared workflows do not cover. It joins the gate, so a failure there still blocks merges.
Check run names change to
🧪 Test / …and🛡️ Analyze / …. None of them is a required check: the gate and the News fragment check keep their names. The GitHub Release job now runs in thereleaseenvironment, which the shared workflow sets.Every shared-workflow reference is pinned to 6.5.0 by commit SHA, and
setup-uvmoves to v10.3.3, the version other tox-dev repositories already use. No runtime or packaging code changes.