chore: isolate and update the locked semantic release tools

.github/dependabot.yml

@@ -2,7 +2,9 @@
 version: 2
 updates:
   - package-ecosystem: "pip"
-    directory: "/"
+    directories:
+      - "/"
+      - "/scripts/release"
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -36,8 +36,13 @@ jobs:
       - name: Ruff lint
         run: uv run ruff check .
 
-      - name: Build distributions
-        run: uv build
+      - name: Verify the locked release tools
+        run: |
+          uv sync --locked --project scripts/release --python 3.12
+          uv run --locked --project scripts/release python scripts/check_release_runtime.py
+
+      - name: Build distributions with the locked release backend
+        run: uv run --locked --project scripts/release uv build --no-build-isolation
 
       - name: Verify the public distribution boundary
         run: python scripts/check_source_boundary.py --require-dist

.github/workflows/release.yml

@@ -34,14 +34,14 @@ jobs:
           version: "0.12.5"
 
       - name: Install the locked release runtime
-        run: uv sync --locked --extra release
+        run: uv sync --locked --project scripts/release --python 3.12
 
       - name: Run the locked Python Semantic Release CLI
         id: release
         env:
           GH_TOKEN: ${{ secrets.ADMIN_TOKEN }}
         run: >-
-          uv run --locked --extra release
+          uv run --locked --project scripts/release
           python scripts/run_semantic_release.py
 
       - name: Verify release workspace

pyproject.toml

@@ -50,19 +50,6 @@ dev = [
     # with the findings fixed in the same change.
     "ruff>=0.16,<0.17",
 ]
-release = [
-    "uv==0.12.5",
-    # Build inside this reviewed environment. An isolated `uv build` would
-    # resolve the backend again and bypass uv.lock.
-    "hatchling==1.31.0",
-    # Keep the release CLI outside its Docker action. That action resolves
-    # transitive packages during each run, so the fixed action SHA did not
-    # prevent GitPython 3.1.60 from breaking PSR 10.6.1 on 2026-08-25.
-    "python-semantic-release==10.6.1",
-    # Remove this cap only with the reviewed PSR release that contains
-    # https://github.com/python-semantic-release/python-semantic-release/pull/1477.
-    "GitPython==3.1.59",
-]
 all = [
     "openadapt-tray[macos-native]",
 ]

scripts/check_release_runtime.py

@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+"""Exercise the installed release CLI against disposable local Git history."""
+
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+from run_semantic_release import release_command, verify_runtime
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def main() -> None:
+    verify_runtime()
+    cli = release_command()[0]
+    with tempfile.TemporaryDirectory(prefix="tray-release-smoke-") as directory:
+        root = Path(directory)
+        (root / "src/openadapt_tray").mkdir(parents=True)
+        for relative in ("pyproject.toml", "src/openadapt_tray/__init__.py"):
+            shutil.copyfile(ROOT / relative, root / relative)
+        environment = {
+            name: value for name, value in os.environ.items()
+            if name in {"PATH", "HOME", "SYSTEMROOT", "TEMP", "TMP"}
+        }
+        environment.update({
+            "GH_TOKEN": "local-smoke-token",
+            "GITHUB_ACTIONS": "true",
+            "GITHUB_OUTPUT": str(root / "github-output"),
+            "GIT_CONFIG_NOSYSTEM": "1",
+            "GIT_CONFIG_GLOBAL": os.devnull,
+            # Refuse Git transports even if the fixture unexpectedly releases.
+            "GIT_CONFIG_COUNT": "1",
+            "GIT_CONFIG_KEY_0": "protocol.allow",
+            "GIT_CONFIG_VALUE_0": "never",
+        })
+
+        def run(*command: str) -> str:
+            result = subprocess.run(
+                command, cwd=root, env=environment, check=True,
+                capture_output=True, text=True,
+            )
+            return result.stdout
+
+        run("git", "init", "-b", "main")
+        run("git", "config", "user.name", "Release smoke")
+        run("git", "config", "user.email", "release-smoke@example.invalid")
+        run("git", "remote", "add", "origin", "https://github.com/fixture/tray.git")
+        run("git", "add", ".")
+        run("git", "commit", "-m", "chore: baseline")
+        # The fixture uses the exact checked-in release configuration and version.
+        from check_release_consistency import release_versions
+
+        version = release_versions(ROOT)["pyproject.toml"]
+        run("git", "tag", f"v{version}")
+        run("git", "commit", "--allow-empty", "-m", "chore: dependency maintenance")
+        before = run("git", "rev-parse", "HEAD")
+        run(sys.executable, str(ROOT / "scripts/run_semantic_release.py"))
+        output = (root / "github-output").read_text(encoding="utf-8")
+        assert "released=false" in output, output
+        assert run("git", "rev-parse", "HEAD") == before
+        assert run("git", "tag").strip() == f"v{version}"
+
+        run("git", "commit", "--allow-empty", "-m", "feat: synthetic change")
+        before = run("git", "rev-parse", "HEAD")
+        next_version = run(cli, "--noop", "version", "--print").strip()
+        major, minor, _patch = (int(part) for part in version.split("."))
+        assert next_version == f"{major}.{minor + 1}.0", next_version
+        assert run("git", "rev-parse", "HEAD") == before
+        assert run("git", "tag").strip() == f"v{version}"
+    print("Locked PSR accepts the configuration, preserves no-release outputs, and calculates the next version.")
+
+
+if __name__ == "__main__":
+    main()

scripts/release/.python-version

@@ -0,0 +1 @@
+3.12

scripts/release/pyproject.toml

@@ -0,0 +1,13 @@
+# Separate from the application: PSR 10.6.2 requires Click below 8.2,
+# while Tray requires Click 8.3.3 or later. This is a virtual tool project.
+[dependency-groups]
+release = [
+    "uv==0.12.5",
+    "hatchling==1.31.0",
+    "python-semantic-release==10.6.2",
+    "GitPython==3.1.59",
+    "click==8.1.8",
+]
+
+[tool.uv]
+default-groups = ["release"]