chore: restore workflow files to avoid token scope restriction

Author: I766515

.github/dependabot.yml

@@ -1,29 +1,22 @@
 version: 2
 updates:
-  # Python pip dependencies
-  # Non-major (minor + patch) version updates are batched into one grouped PR;
-  # majors are left ungrouped so each breaking bump lands in its own PR for
-  # review. Security updates (enabled in repo settings) come as a separate
-  # grouped PR of their own
+  # Python pip dependencies - security updates only
+  # Regular version updates are disabled because we use compatible release
+  # constraints (~=) in pyproject.toml to pin patch versions.
+  # Dependabot Security Updates (enabled in repo settings) bypass these rules.
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
       interval: "weekly"
       day: "monday"
       time: "09:00"
-    groups:
-      version-minor-patch:
-        patterns:
-          - "*"
+    # Ignore all regular version updates - security updates still come through
+    ignore:
+      - dependency-name: "*"
         update-types:
-          - "minor"
-          - "patch"
-      security:
-        applies-to: security-updates
-        patterns:
-          - "*"
-    labels:
-      - "dependencies"
+          - "version-update:semver-major"
+          - "version-update:semver-minor"
+          - "version-update:semver-patch"
     # Commit message configuration
     commit-message:
       prefix: "chore"
@@ -46,11 +39,6 @@ updates:
     labels:
       - "dependencies"
       - "github-actions"
-    # Batch all Actions bumps (including majors) into one PR
-    groups:
-      github-actions:
-        patterns:
-          - "*"
     commit-message:
       prefix: "chore"
       include: "scope"

.github/workflows/check-version-bump.yaml

@@ -18,30 +18,29 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.11"
-
-      - name: Install version comparison dependency
-        run: python -m pip install packaging
-
       - name: Check that version was bumped if src/ was modified
         run: |
           BASE_SHA="${{ github.event.pull_request.base.sha }}"
           HEAD_SHA="${{ github.event.pull_request.head.sha }}"
-          MERGE_BASE=$(git merge-base "$BASE_SHA" "$HEAD_SHA")
 
-          CHANGED_FILES=$(git diff --name-only "$MERGE_BASE" "$HEAD_SHA")
+          CHANGED_FILES=$(git diff --name-only "$BASE_SHA" "$HEAD_SHA")
 
           if echo "$CHANGED_FILES" | grep -qE "^src/.*\.(py|pyi|proto)$"; then
-            BASE_VERSION=$(git show "$MERGE_BASE:pyproject.toml" | grep "^version = " | cut -d'"' -f2)
+            BASE_VERSION=$(git show "$BASE_SHA:pyproject.toml" | grep "^version = " | cut -d'"' -f2)
             HEAD_VERSION=$(git show "$HEAD_SHA:pyproject.toml" | grep "^version = " | cut -d'"' -f2)
 
-            # Use PEP 440 ordering because sort -V ranks RCs above final releases
-            python .github/scripts/check_version_bump.py \
-              "$BASE_VERSION" "$HEAD_VERSION"
+            if [ "$BASE_VERSION" = "$HEAD_VERSION" ]; then
+              echo "ERROR: Source files under src/ were modified but the version in pyproject.toml was not bumped (still $HEAD_VERSION)."
+              exit 1
+            fi
+
+            HIGHER=$(printf '%s\n' "$BASE_VERSION" "$HEAD_VERSION" | sort -V | tail -1)
+            if [ "$HIGHER" != "$HEAD_VERSION" ]; then
+              echo "ERROR: Version regression detected. Base is $BASE_VERSION but PR has $HEAD_VERSION."
+              exit 1
+            fi
 
+            echo "Version bump OK: $BASE_VERSION → $HEAD_VERSION"
           else
             echo "No source file changes under src/. Version bump not required."
           fi

.github/workflows/release.yml

@@ -29,21 +29,13 @@ jobs:
       - name: Read package name and version from pyproject.toml
         id: metadata
         run: |
-          python -m pip install toml packaging
+          pip install toml
           PKG_NAME=$(python -c "import toml; print(toml.load('pyproject.toml')['project']['name'])")
           VERSION=$(python -c "import toml; print(toml.load('pyproject.toml')['project']['version'])")
           echo "Publishing $PKG_NAME version $VERSION to PyPI"
           echo "name=$PKG_NAME" >> $GITHUB_OUTPUT
           echo "version=$VERSION" >> $GITHUB_OUTPUT
 
-      - name: Validate pre-release status
-        env:
-          PACKAGE_VERSION: ${{ steps.metadata.outputs.version }}
-          RELEASE_IS_PRERELEASE: ${{ github.event.release.prerelease }}
-        run: |
-          python .github/scripts/validate_prerelease.py \
-            "$PACKAGE_VERSION" "$RELEASE_IS_PRERELEASE"
-
       - name: Check if version already exists on PyPI
         run: |
           PKG_NAME="${{ steps.metadata.outputs.name }}"
@@ -65,4 +57,4 @@ jobs:
         run: uv build
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@v1.14.2
+        uses: pypa/gh-action-pypi-publish@v1.14.0