[gaborbernat]

This draft moves pytest-print onto the shared release flow from github-workflows 6.0.0 and release-creator 4.0.0. Releases are prepared from Towncrier fragments: release-creator picks the version, assembles the changelog, adds a New Contributors subsection, and pushes an App-authored commit and tag. The 19 tagged changelog sections get user-facing categories, stable anchors and author credits, and a new CONTRIBUTING.md explains how to write fragments and why they carry no hand-written credits: credits come from commit authors and co-authors.

The tag workflow runs under a per-tag concurrency group. The shared validate-python-release workflow builds the wheel and sdist, while a read-only notes job renders the changelog section in parallel. PyPI publishing goes through OIDC and no longer skips existing files. A single job then reconciles the PyPI digests and attestations and creates the GitHub Release with one publish-github-release call. GitHub's generated notes and the separate draft stage are gone.

Checks that guard only against a writer are removed. The tag workflow no longer re-checks that the tag still names the release commit before the GitHub Release, since only a writer can move a tag. Prepare no longer requires refs/heads/main, because only writers can dispatch it; the fork guard on github.repository stays. news.yaml drops the pull_request condition that repeated its only trigger, and the release-validate group goes with the shared prepare job that installed it. gw 6.0.0 itself drops the lock, tag and patch re-checks it used to run in validate-python-release and prepare-towncrier-release.

Every job and step now has an emoji name, for example 🚦 Required checks pass, 📝 News fragment and 🚀 Publish GitHub Release.

pylock.toml now comes from Nab 0.0.22 and covers every group and extra on CPython 3.15 linux_x86_64, locking release-creator 4.0.0. The [tool.nab] table carries a temporary uploaded-prior-to exception for release-creator, to be deleted after 2026-11-02. A build dependency group locks the hatchling backend together with Cython and setuptools, because PyYAML has no CPython 3.15 wheel. The unused release, release-check and release-validate groups are removed. Tests still resolve fresh.

Hook updates move to Dependabot's pre-commit ecosystem with a seven-day cooldown, and pre-commit.ci autoupdates quarterly. The hook cooldown check and its scheduled rerun are removed, so 🚦 Required checks pass only aggregates the test matrix.

The App key and client ID are staged in the main-only release-auth environment. A pytest-dev administrator still needs to install the repo-only App and configure its ruleset bypass before a release.

Before merging, the main ruleset's required checks must follow the renames: Required checks pass becomes 🚦 Required checks pass, and changelog becomes 📝 News fragment. pre-commit.ci - pr is an external app check and keeps its name. swap_required_checks.py pytest-dev/pytest-print 275 --apply makes the swap right before the merge.