From 876e8279e46ff2aeac128c84dce064d1e8f35557 Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Mon, 9 Dec 2024 19:29:52 -0600
Subject: [PATCH 01/30] Add prepare-release action

---
 prepare-release/README.md  | 74 ++++++++++++++++++++++++++++++++++++++
 prepare-release/action.yml | 71 ++++++++++++++++++++++++++++++++++++
 2 files changed, 145 insertions(+)
 create mode 100644 prepare-release/README.md
 create mode 100644 prepare-release/action.yml

diff --git a/prepare-release/README.md b/prepare-release/README.md
new file mode 100644
index 00000000..6eb8d824
--- /dev/null
+++ b/prepare-release/README.md
@@ -0,0 +1,74 @@
+# Prepare Release
+
+This action prepares a release on GitHub:
+1. Running `towncrier` to update the changelog.
+
+## GitHub Action Usage
+
+```yaml
+name: Prepare Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Release version
+        required: true
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Prepare Release
+        uses: conda/actions/prepare-release
+        with:
+          # [required]
+          # the version to be released
+          version: ${{ inputs.version }}
+
+          # [optional]
+          # GitHub token to fork repository and create changelog PR
+          # (`contents: write` & `pull-request: write` for fine-grained PAT; `repo` for classic PAT)
+          # token: ${{ github.token }}
+```
+
+### Sample Workflow Preparing Release using Dynamic Branch
+
+```yaml
+name: Prepare Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Release version
+        required: true
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get Branch
+        shell: python
+        run: |
+          from os import environ
+          from pathlib import Path
+
+          # derive the branch from the version by dropping the `PATCH` and using `.x`
+          branch = "${{ inputs.version }}".rsplit(".", 1)[0]
+          Path(environ["GITHUB_ENV"]).write_text(f"BRANCH={branch}.x")
+
+      - name: Prepare Release
+        uses: conda/actions/prepare-release
+        with:
+          version: ${{ inputs.version }}
+          branch: ${{ env.BRANCH }}
+```
diff --git a/prepare-release/action.yml b/prepare-release/action.yml
new file mode 100644
index 00000000..e97863f8
--- /dev/null
+++ b/prepare-release/action.yml
@@ -0,0 +1,71 @@
+name: Prepare Release
+description: Prepares a release by running towncrier and creating a PR with the changes.
+inputs:
+  version:
+    description: Release version.
+    required: true
+  branch:
+    description: Target branch for the release. Unless specified, uses the default branch.
+  token:
+    description: >-
+      GitHub token to fork repository and create changelog PR
+      (`contents: write` and `pull-request: write` for fine-grained PAT; `repo` for classic PAT).
+    default: ${{ github.token }}
+runs:
+  using: composite
+  steps:
+    - name: Checkout Source
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        fetch-depth: 0
+        ref: ${{ inputs.branch }}
+
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: '3.13'
+        cache: pip
+        cache-dependency-path: news/requirements.txt
+
+    - name: Pip Install
+      shell: bash
+      run: pip install -r news/requirements.txt
+
+    - name: Pip List
+      shell: bash
+      run: pip list
+
+    - name: Run Townscrier
+      shell: bash
+      run: townscrier build --version ${{ inputs.version }}
+
+    # - name: Detect Contributors
+
+    # - name: Detect First-Time Contributors
+
+    - name: Create Fork
+      # no-op if the repository is already forked
+      shell: bash
+      run: echo FORK=$(gh repo fork --clone=false --default-branch-only 2>&1 | awk '{print $1}') >> $GITHUB_ENV
+      env:
+        GH_TOKEN: ${{ inputs.fork_token }}
+
+    - name: Create PR
+      uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
+      with:
+        push-to-fork: ${{ env.FORK }}
+        token: ${{ inputs.pr_token }}
+        branch: changelog-${{ inputs.version }}
+        delete-branch: true
+        commit-message: Changelog ${{ inputs.version }}
+        author: ${{ inputs.changelog_author }}
+        committer: ${{ inputs.changelog_author }}
+        title: Changelog ${{ inputs.version }}
+        body: |
+          [release.yml]: ${{ github.server_url }}/${{ github.repository }}/blob/main/.github/workflows/release.yml
+
+          ✂️ snip snip ✂️ the making of a new release.
+
+          This PR was triggered by @${{ github.triggering_actor }} via ${{ github.event_name }}.
+
+          ###### Auto-generated by the [`release.yml`][release.yml] workflow, see ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}.

From 379990b9b85949b16d1eeb2f9174a0fd768d35a7 Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Tue, 10 Dec 2024 10:59:15 -0600
Subject: [PATCH 02/30] Create release branch if missing

---
 prepare-release/action.yml | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index e97863f8..e1df2cdc 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -18,7 +18,19 @@ runs:
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
-        ref: ${{ inputs.branch }}
+
+    - name: Create Branch
+      shell: bash
+      run: |
+        if git fetch origin "${{ inputs.branch }}"; then
+          # if branch already exists, checkout and pull
+          git checkout "${{ inputs.branch }}"
+          git pull origin "${{ inputs.branch }}"
+        else
+          # if branch doesn't exist, create and push
+          git checkout -b "${{ inputs.branch }}"
+          git push -u origin "${{ inputs.branch }}"
+        fi
 
     - name: Setup Python
       uses: actions/setup-python@v5
@@ -56,6 +68,7 @@ runs:
         push-to-fork: ${{ env.FORK }}
         token: ${{ inputs.pr_token }}
         branch: changelog-${{ inputs.version }}
+        base: ${{ inputs.branch }}
         delete-branch: true
         commit-message: Changelog ${{ inputs.version }}
         author: ${{ inputs.changelog_author }}

From 797229266215a74e86cf03eed476d74606b587cf Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Tue, 10 Dec 2024 11:10:07 -0600
Subject: [PATCH 03/30] Correct inputs

---
 prepare-release/action.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index e1df2cdc..48dc3299 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -6,6 +6,9 @@ inputs:
     required: true
   branch:
     description: Target branch for the release. Unless specified, uses the default branch.
+  changelog_author:
+    description: Git-format author/committer to use for pull request commits
+    default: Conda Bot <18747875+conda-bot@users.noreply.github.com>
   token:
     description: >-
       GitHub token to fork repository and create changelog PR
@@ -60,13 +63,13 @@ runs:
       shell: bash
       run: echo FORK=$(gh repo fork --clone=false --default-branch-only 2>&1 | awk '{print $1}') >> $GITHUB_ENV
       env:
-        GH_TOKEN: ${{ inputs.fork_token }}
+        GH_TOKEN: ${{ inputs.token }}
 
     - name: Create PR
       uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
       with:
         push-to-fork: ${{ env.FORK }}
-        token: ${{ inputs.pr_token }}
+        token: ${{ inputs.token }}
         branch: changelog-${{ inputs.version }}
         base: ${{ inputs.branch }}
         delete-branch: true

From eddae7f074e98ac8430fd1aeff9065000b7c68f1 Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Tue, 10 Dec 2024 16:22:19 -0600
Subject: [PATCH 04/30] Add requirements file

---
 prepare-release/action.yml       | 8 ++++----
 prepare-release/requirements.txt | 1 +
 2 files changed, 5 insertions(+), 4 deletions(-)
 create mode 100644 prepare-release/requirements.txt

diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index 48dc3299..51e4380d 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -40,19 +40,19 @@ runs:
       with:
         python-version: '3.13'
         cache: pip
-        cache-dependency-path: news/requirements.txt
+        cache-dependency-path: ${{ github.action_path }}/requirements.txt
 
     - name: Pip Install
       shell: bash
-      run: pip install -r news/requirements.txt
+      run: pip install -r ${{ github.action_path }}/requirements.txt
 
     - name: Pip List
       shell: bash
       run: pip list
 
-    - name: Run Townscrier
+    - name: Run Towncrier
       shell: bash
-      run: townscrier build --version ${{ inputs.version }}
+      run: towncrier build --version ${{ inputs.version }}
 
     # - name: Detect Contributors
 
diff --git a/prepare-release/requirements.txt b/prepare-release/requirements.txt
new file mode 100644
index 00000000..0d2d2d7d
--- /dev/null
+++ b/prepare-release/requirements.txt
@@ -0,0 +1 @@
+towncrier

From 6421c564c96bcafa017e045d0593a0dc03bfee80 Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Tue, 10 Dec 2024 16:36:38 -0600
Subject: [PATCH 05/30] Use token for cloning

---
 prepare-release/action.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index 51e4380d..eb0cc215 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -21,6 +21,7 @@ runs:
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        token: ${{ input.token }}
 
     - name: Create Branch
       shell: bash

From 35bc53c94d39db210b0388b9b73382d5cee2c5f0 Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Tue, 10 Dec 2024 16:40:22 -0600
Subject: [PATCH 06/30] Fix variable

---
 prepare-release/action.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index eb0cc215..d42c6c23 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -21,7 +21,7 @@ runs:
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
-        token: ${{ input.token }}
+        token: ${{ inputs.token }}
 
     - name: Create Branch
       shell: bash

From 660a02b6561f2528ac733abf74f06005fa7eacb7 Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Wed, 11 Dec 2024 16:51:47 -0600
Subject: [PATCH 07/30] Use specialized tokens

---
 prepare-release/action.yml | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index d42c6c23..041d0669 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -9,10 +9,14 @@ inputs:
   changelog_author:
     description: Git-format author/committer to use for pull request commits
     default: Conda Bot <18747875+conda-bot@users.noreply.github.com>
-  token:
-    description: >-
-      GitHub token to fork repository and create changelog PR
-      (`contents: write` and `pull-request: write` for fine-grained PAT; `repo` for classic PAT).
+  fork-token:
+    description: 'GitHub token to fork repository (`???: write`).'
+    default: ${{ github.token }}
+  branch-token:
+    description: 'GitHub token to checkout and create the release branch (`contents: write`).'
+    default: ${{ github.token }}
+  pr-token:
+    description: 'GitHub token to create the changelog PR (`pull-request: write`).'
     default: ${{ github.token }}
 runs:
   using: composite
@@ -21,7 +25,7 @@ runs:
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
-        token: ${{ inputs.token }}
+        token: ${{ inputs.branch-token }}
 
     - name: Create Branch
       shell: bash
@@ -64,13 +68,14 @@ runs:
       shell: bash
       run: echo FORK=$(gh repo fork --clone=false --default-branch-only 2>&1 | awk '{print $1}') >> $GITHUB_ENV
       env:
-        GH_TOKEN: ${{ inputs.token }}
+        GH_TOKEN: ${{ inputs.fork-token }}
 
     - name: Create PR
       uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
       with:
         push-to-fork: ${{ env.FORK }}
-        token: ${{ inputs.token }}
+        token: ${{ inputs.pr-token }}
+        branch-token: ${{ inputs.fork-token}}
         branch: changelog-${{ inputs.version }}
         base: ${{ inputs.branch }}
         delete-branch: true

From 62f5f50bf8b90d2004076932a45a5f9f7712ff2c Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Wed, 11 Dec 2024 17:23:28 -0600
Subject: [PATCH 08/30] Update README.md

---
 prepare-release/README.md  | 28 +++++++++++++++++-----------
 prepare-release/action.yml | 19 ++++++++++---------
 2 files changed, 27 insertions(+), 20 deletions(-)

diff --git a/prepare-release/README.md b/prepare-release/README.md
index 6eb8d824..7d77a582 100644
--- a/prepare-release/README.md
+++ b/prepare-release/README.md
@@ -3,7 +3,20 @@
 This action prepares a release on GitHub:
 1. Running `towncrier` to update the changelog.
 
-## GitHub Action Usage
+## Action Inputs
+
+| Name | Description | Default |
+| ---- | ----------- | ------- |
+| `version` | Version to release. | **Required** |
+| `branch` | Target branch to use for the release. | `${{ github.even.repository.default_branch` |
+| `changelog-author` | Git-format author to use for the changelog commits. | @conda-bot |
+| `fork-token` | GitHub token to create and push to the fork. If not provided, no fork will be used.<br>Fine-grained PAT: `administration: write` | `${{ github.token }}` |
+| `branch-token` | GitHub token to create and push to the branch.<br>Fine-grained PAT: `contents: write` | `${{ github.token }}` |
+| `pr-token` | GitHub token to create the pull request.<br>Fine-grained PAT: `pull-request: write` | `${{ github.token }}` |
+
+## Sample Workflows
+
+### Basic Workflow
 
 ```yaml
 name: Prepare Release
@@ -12,7 +25,7 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: Release version
+        description: The version to release.
         required: true
 
 permissions:
@@ -26,17 +39,10 @@ jobs:
       - name: Prepare Release
         uses: conda/actions/prepare-release
         with:
-          # [required]
-          # the version to be released
           version: ${{ inputs.version }}
-
-          # [optional]
-          # GitHub token to fork repository and create changelog PR
-          # (`contents: write` & `pull-request: write` for fine-grained PAT; `repo` for classic PAT)
-          # token: ${{ github.token }}
 ```
 
-### Sample Workflow Preparing Release using Dynamic Branch
+### Dynamic Branch Workflow
 
 ```yaml
 name: Prepare Release
@@ -45,7 +51,7 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: Release version
+        description: The version to release.
         required: true
 
 permissions:
diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index 041d0669..c2d94895 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -2,21 +2,22 @@ name: Prepare Release
 description: Prepares a release by running towncrier and creating a PR with the changes.
 inputs:
   version:
-    description: Release version.
+    description: The version to release.
     required: true
   branch:
-    description: Target branch for the release. Unless specified, uses the default branch.
-  changelog_author:
-    description: Git-format author/committer to use for pull request commits
+    description: The target branch to use for the release.
+    default: ${{ github.evebt.repository.default_branch }}
+  changelog-author:
+    description: Git-format author to use for the changelog commits.
     default: Conda Bot <18747875+conda-bot@users.noreply.github.com>
   fork-token:
-    description: 'GitHub token to fork repository (`???: write`).'
+    description: 'GitHub token to create and push to the fork. Fine-grained PAT: `administration: write`'
     default: ${{ github.token }}
   branch-token:
-    description: 'GitHub token to checkout and create the release branch (`contents: write`).'
+    description: 'GitHub token to create and push to the branch. Fine-grained PAT: `contents: write`'
     default: ${{ github.token }}
   pr-token:
-    description: 'GitHub token to create the changelog PR (`pull-request: write`).'
+    description: 'GitHub token to create the pull request. Fine-grained PAT: `pull-request: write`'
     default: ${{ github.token }}
 runs:
   using: composite
@@ -80,8 +81,8 @@ runs:
         base: ${{ inputs.branch }}
         delete-branch: true
         commit-message: Changelog ${{ inputs.version }}
-        author: ${{ inputs.changelog_author }}
-        committer: ${{ inputs.changelog_author }}
+        author: ${{ inputs.changelog-author }}
+        committer: ${{ inputs.changelog-author }}
         title: Changelog ${{ inputs.version }}
         body: |
           [release.yml]: ${{ github.server_url }}/${{ github.repository }}/blob/main/.github/workflows/release.yml

From efec99df3df97d63229caabfa2ea3edd6ba1dc04 Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Thu, 12 Dec 2024 09:29:57 -0600
Subject: [PATCH 09/30] Remove branch-token

---
 prepare-release/README.md  | 1 -
 prepare-release/action.yml | 6 +-----
 2 files changed, 1 insertion(+), 6 deletions(-)

diff --git a/prepare-release/README.md b/prepare-release/README.md
index 7d77a582..7c6955fa 100644
--- a/prepare-release/README.md
+++ b/prepare-release/README.md
@@ -11,7 +11,6 @@ This action prepares a release on GitHub:
 | `branch` | Target branch to use for the release. | `${{ github.even.repository.default_branch` |
 | `changelog-author` | Git-format author to use for the changelog commits. | @conda-bot |
 | `fork-token` | GitHub token to create and push to the fork. If not provided, no fork will be used.<br>Fine-grained PAT: `administration: write` | `${{ github.token }}` |
-| `branch-token` | GitHub token to create and push to the branch.<br>Fine-grained PAT: `contents: write` | `${{ github.token }}` |
 | `pr-token` | GitHub token to create the pull request.<br>Fine-grained PAT: `pull-request: write` | `${{ github.token }}` |
 
 ## Sample Workflows
diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index c2d94895..c293f618 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -11,10 +11,7 @@ inputs:
     description: Git-format author to use for the changelog commits.
     default: Conda Bot <18747875+conda-bot@users.noreply.github.com>
   fork-token:
-    description: 'GitHub token to create and push to the fork. Fine-grained PAT: `administration: write`'
-    default: ${{ github.token }}
-  branch-token:
-    description: 'GitHub token to create and push to the branch. Fine-grained PAT: `contents: write`'
+    description: 'GitHub token to create and push to the fork. Fine-grained PAT: `administration: write; contents: write`'
     default: ${{ github.token }}
   pr-token:
     description: 'GitHub token to create the pull request. Fine-grained PAT: `pull-request: write`'
@@ -26,7 +23,6 @@ runs:
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
-        token: ${{ inputs.branch-token }}
 
     - name: Create Branch
       shell: bash

From 66f5954a39dff9ff809c81a90ed15b30ee4c2312 Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Thu, 12 Dec 2024 14:37:23 -0600
Subject: [PATCH 10/30] Add back fork-token to cloning

---
 prepare-release/action.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index c293f618..9235e92a 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -23,6 +23,7 @@ runs:
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        token: ${{ inputs.fork-token }}
 
     - name: Create Branch
       shell: bash

From 2edc990fe2504441cfb65f5977dd5a35cf461cbd Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Thu, 12 Dec 2024 16:41:40 -0600
Subject: [PATCH 11/30] Rename tokens

---
 prepare-release/README.md  |  4 ++--
 prepare-release/action.yml | 16 ++++++++--------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/prepare-release/README.md b/prepare-release/README.md
index 7c6955fa..9cc26ba1 100644
--- a/prepare-release/README.md
+++ b/prepare-release/README.md
@@ -10,8 +10,8 @@ This action prepares a release on GitHub:
 | `version` | Version to release. | **Required** |
 | `branch` | Target branch to use for the release. | `${{ github.even.repository.default_branch` |
 | `changelog-author` | Git-format author to use for the changelog commits. | @conda-bot |
-| `fork-token` | GitHub token to create and push to the fork. If not provided, no fork will be used.<br>Fine-grained PAT: `administration: write` | `${{ github.token }}` |
-| `pr-token` | GitHub token to create the pull request.<br>Fine-grained PAT: `pull-request: write` | `${{ github.token }}` |
+| `token` | GitHub token to create the pull request.<br>Fine-grained PAT: `pull-request: write` | `${{ github.token }}` |
+| `branch-token` | GitHub token to create and push to the fork/branch.<br>Fine-grained PAT: `administration: write; contents: write` | `${{ github.token }}` |
 
 ## Sample Workflows
 
diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index 9235e92a..d5a2c0b0 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -10,12 +10,12 @@ inputs:
   changelog-author:
     description: Git-format author to use for the changelog commits.
     default: Conda Bot <18747875+conda-bot@users.noreply.github.com>
-  fork-token:
-    description: 'GitHub token to create and push to the fork. Fine-grained PAT: `administration: write; contents: write`'
-    default: ${{ github.token }}
-  pr-token:
+  token:
     description: 'GitHub token to create the pull request. Fine-grained PAT: `pull-request: write`'
     default: ${{ github.token }}
+  branch-token:
+    description: 'GitHub token to create and push to the fork. Fine-grained PAT: `administration: write; contents: write`'
+    default: ${{ github.token }}
 runs:
   using: composite
   steps:
@@ -23,7 +23,7 @@ runs:
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
-        token: ${{ inputs.fork-token }}
+        token: ${{ inputs.branch-token }}
 
     - name: Create Branch
       shell: bash
@@ -66,14 +66,14 @@ runs:
       shell: bash
       run: echo FORK=$(gh repo fork --clone=false --default-branch-only 2>&1 | awk '{print $1}') >> $GITHUB_ENV
       env:
-        GH_TOKEN: ${{ inputs.fork-token }}
+        GH_TOKEN: ${{ inputs.branch-token }}
 
     - name: Create PR
       uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
       with:
         push-to-fork: ${{ env.FORK }}
-        token: ${{ inputs.pr-token }}
-        branch-token: ${{ inputs.fork-token}}
+        token: ${{ inputs.token }}
+        branch-token: ${{ inputs.branch-token}}
         branch: changelog-${{ inputs.version }}
         base: ${{ inputs.branch }}
         delete-branch: true

From 598af2a2b0432e95f449d57805ee85acf3a8416a Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Thu, 12 Dec 2024 17:11:02 -0600
Subject: [PATCH 12/30] Use GH API to create branch remotely

---
 prepare-release/action.yml | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index d5a2c0b0..25552ceb 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -6,7 +6,7 @@ inputs:
     required: true
   branch:
     description: The target branch to use for the release.
-    default: ${{ github.evebt.repository.default_branch }}
+    default: ${{ github.event.repository.default_branch }}
   changelog-author:
     description: Git-format author to use for the changelog commits.
     default: Conda Bot <18747875+conda-bot@users.noreply.github.com>
@@ -23,20 +23,24 @@ runs:
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
-        token: ${{ inputs.branch-token }}
 
     - name: Create Branch
       shell: bash
       run: |
-        if git fetch origin "${{ inputs.branch }}"; then
-          # if branch already exists, checkout and pull
-          git checkout "${{ inputs.branch }}"
-          git pull origin "${{ inputs.branch }}"
-        else
-          # if branch doesn't exist, create and push
-          git checkout -b "${{ inputs.branch }}"
-          git push -u origin "${{ inputs.branch }}"
+        if ! git fetch origin "${{ inputs.branch }}"; then
+          # if branch doesn't exist, create it from the default branch
+          gh api \
+            -X POST \
+            -H "Accept: application/vnd.github+json" \
+            "/repos/${{ github.repository }}/git/refs" \
+            -f ref="refs/heads/${{ inputs.branch }}" \
+            -f sha="$(git rev-parse ${{ github.event.repository.default_branch }})"
         fi
+        git fetch origin
+        git checkout "${{ inputs.branch }}"
+        git pull origin "${{ inputs.branch }}"
+      env:
+        GH_TOKEN: ${{ inputs.branch-token }}
 
     - name: Setup Python
       uses: actions/setup-python@v5

From 030bc7ddebbc49a3fd2560c5df7711c26606c79b Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Thu, 12 Dec 2024 17:16:48 -0600
Subject: [PATCH 13/30] Correct tokens

---
 prepare-release/README.md  |  4 ++--
 prepare-release/action.yml | 10 +++++-----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/prepare-release/README.md b/prepare-release/README.md
index 9cc26ba1..d3e5ee91 100644
--- a/prepare-release/README.md
+++ b/prepare-release/README.md
@@ -10,8 +10,8 @@ This action prepares a release on GitHub:
 | `version` | Version to release. | **Required** |
 | `branch` | Target branch to use for the release. | `${{ github.even.repository.default_branch` |
 | `changelog-author` | Git-format author to use for the changelog commits. | @conda-bot |
-| `token` | GitHub token to create the pull request.<br>Fine-grained PAT: `pull-request: write` | `${{ github.token }}` |
-| `branch-token` | GitHub token to create and push to the fork/branch.<br>Fine-grained PAT: `administration: write; contents: write` | `${{ github.token }}` |
+| `token` | GitHub token to create release branch if missing and the pull request.<br>Fine-grained PAT: `pull-request: write; contents: write` | `${{ github.token }}` |
+| `fork-token` | GitHub token to create and push to the fork/branch.<br>Fine-grained PAT: `administration: write; contents: write` | `${{ github.token }}` |
 
 ## Sample Workflows
 
diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index 25552ceb..a2eed5a7 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -11,9 +11,9 @@ inputs:
     description: Git-format author to use for the changelog commits.
     default: Conda Bot <18747875+conda-bot@users.noreply.github.com>
   token:
-    description: 'GitHub token to create the pull request. Fine-grained PAT: `pull-request: write`'
+    description: 'GitHub token to create release branch if missing and the pull request. Fine-grained PAT: `pull-request: write; contents: write`'
     default: ${{ github.token }}
-  branch-token:
+  fork-token:
     description: 'GitHub token to create and push to the fork. Fine-grained PAT: `administration: write; contents: write`'
     default: ${{ github.token }}
 runs:
@@ -40,7 +40,7 @@ runs:
         git checkout "${{ inputs.branch }}"
         git pull origin "${{ inputs.branch }}"
       env:
-        GH_TOKEN: ${{ inputs.branch-token }}
+        GH_TOKEN: ${{ inputs.token }}
 
     - name: Setup Python
       uses: actions/setup-python@v5
@@ -70,14 +70,14 @@ runs:
       shell: bash
       run: echo FORK=$(gh repo fork --clone=false --default-branch-only 2>&1 | awk '{print $1}') >> $GITHUB_ENV
       env:
-        GH_TOKEN: ${{ inputs.branch-token }}
+        GH_TOKEN: ${{ inputs.fork-token }}
 
     - name: Create PR
       uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
       with:
         push-to-fork: ${{ env.FORK }}
         token: ${{ inputs.token }}
-        branch-token: ${{ inputs.branch-token}}
+        branch-token: ${{ inputs.fork-token}}
         branch: changelog-${{ inputs.version }}
         base: ${{ inputs.branch }}
         delete-branch: true

From 42bf1038ffcbe2b813149d55a0df3187882b6195 Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Thu, 12 Dec 2024 19:43:57 -0600
Subject: [PATCH 14/30] Remove pip caching

---
 prepare-release/action.yml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index a2eed5a7..cf5fbd08 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -46,12 +46,10 @@ runs:
       uses: actions/setup-python@v5
       with:
         python-version: '3.13'
-        cache: pip
-        cache-dependency-path: ${{ github.action_path }}/requirements.txt
 
     - name: Pip Install
       shell: bash
-      run: pip install -r ${{ github.action_path }}/requirements.txt
+      run: pip install --quiet -r ${{ github.action_path }}/requirements.txt
 
     - name: Pip List
       shell: bash

From 2ac25e4afc48353942d076663894752dcba93ed3 Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Thu, 12 Dec 2024 19:56:05 -0600
Subject: [PATCH 15/30] Use =

---
 prepare-release/action.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index cf5fbd08..919d92ef 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -57,7 +57,7 @@ runs:
 
     - name: Run Towncrier
       shell: bash
-      run: towncrier build --version ${{ inputs.version }}
+      run: towncrier build --version=${{ inputs.version }}
 
     # - name: Detect Contributors
 

From 9690c5e2969e86d9b6b3a1b427e2bd75ce86a5de Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Thu, 12 Dec 2024 20:25:59 -0600
Subject: [PATCH 16/30] Correct forking

---
 prepare-release/action.yml | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index 919d92ef..9af638a2 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -66,22 +66,24 @@ runs:
     - name: Create Fork
       # no-op if the repository is already forked
       shell: bash
-      run: echo FORK=$(gh repo fork --clone=false --default-branch-only 2>&1 | awk '{print $1}') >> $GITHUB_ENV
+      run: echo FORK=$(gh repo fork --clone=false --remote=false --default-branch-only 2>&1 | awk '{print $1}') >> $GITHUB_ENV
       env:
         GH_TOKEN: ${{ inputs.fork-token }}
 
     - name: Create PR
       uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
       with:
+        # push to the fork
+        branch-token: ${{ inputs.fork-token }}
         push-to-fork: ${{ env.FORK }}
-        token: ${{ inputs.token }}
-        branch-token: ${{ inputs.fork-token}}
         branch: changelog-${{ inputs.version }}
-        base: ${{ inputs.branch }}
-        delete-branch: true
         commit-message: Changelog ${{ inputs.version }}
         author: ${{ inputs.changelog-author }}
         committer: ${{ inputs.changelog-author }}
+        # create PR
+        token: ${{ inputs.token }}
+        base: ${{ inputs.branch }}
+        delete-branch: true
         title: Changelog ${{ inputs.version }}
         body: |
           [release.yml]: ${{ github.server_url }}/${{ github.repository }}/blob/main/.github/workflows/release.yml

From 863735445d6f7ea6d12ec8b8e1d0b9630e03f936 Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Fri, 13 Dec 2024 10:30:08 -0600
Subject: [PATCH 17/30] Add branch-sha input

---
 prepare-release/action.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index 9af638a2..fe78544f 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -7,6 +7,8 @@ inputs:
   branch:
     description: The target branch to use for the release.
     default: ${{ github.event.repository.default_branch }}
+  branch-sha:
+    description: The SHA from which to create the target branch if missing.
   changelog-author:
     description: Git-format author to use for the changelog commits.
     default: Conda Bot <18747875+conda-bot@users.noreply.github.com>
@@ -15,7 +17,7 @@ inputs:
     default: ${{ github.token }}
   fork-token:
     description: 'GitHub token to create and push to the fork. Fine-grained PAT: `administration: write; contents: write`'
-    default: ${{ github.token }}
+    default: ${{ inputs.token }}
 runs:
   using: composite
   steps:
@@ -34,7 +36,7 @@ runs:
             -H "Accept: application/vnd.github+json" \
             "/repos/${{ github.repository }}/git/refs" \
             -f ref="refs/heads/${{ inputs.branch }}" \
-            -f sha="$(git rev-parse ${{ github.event.repository.default_branch }})"
+            -f sha="$(git rev-parse ${{ inputs.branch-sha || github.event.repository.default_branch }})"
         fi
         git fetch origin
         git checkout "${{ inputs.branch }}"

From df5bad029d77ee7399e2c2bd8cfe1fb10e6dbfae Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Thu, 12 Dec 2024 20:29:02 -0600
Subject: [PATCH 18/30] Workaround for `gh repo fork`

---
 prepare-release/action.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index fe78544f..30b13b70 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -68,7 +68,15 @@ runs:
     - name: Create Fork
       # no-op if the repository is already forked
       shell: bash
-      run: echo FORK=$(gh repo fork --clone=false --remote=false --default-branch-only 2>&1 | awk '{print $1}') >> $GITHUB_ENV
+      # don't use `gh repo fork` since it doesn't provide consistent output
+      # see: https://github.com/cli/cli/issues/10079
+      run: |
+        echo FORK=$(gh api \
+          -X POST \
+          -H "Accept: application/vnd.github+json" \
+          "/repos/${{ github.repository }}/forks" \
+          -f default_branch_only=true \
+          --jq ".full_name") >> $GITHUB_ENV
       env:
         GH_TOKEN: ${{ inputs.fork-token }}
 

From 231956984b3afdaddc76bae516e8458bb0a27f87 Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Fri, 13 Dec 2024 11:56:49 -0600
Subject: [PATCH 19/30] Remove fork-token default

---
 prepare-release/action.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index 30b13b70..7bf7a0b4 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -17,7 +17,6 @@ inputs:
     default: ${{ github.token }}
   fork-token:
     description: 'GitHub token to create and push to the fork. Fine-grained PAT: `administration: write; contents: write`'
-    default: ${{ inputs.token }}
 runs:
   using: composite
   steps:
@@ -78,13 +77,13 @@ runs:
           -f default_branch_only=true \
           --jq ".full_name") >> $GITHUB_ENV
       env:
-        GH_TOKEN: ${{ inputs.fork-token }}
+        GH_TOKEN: ${{ inputs.fork-token || inputs.token }}
 
     - name: Create PR
       uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
       with:
         # push to the fork
-        branch-token: ${{ inputs.fork-token }}
+        branch-token: ${{ inputs.fork-token || inputs.token }}
         push-to-fork: ${{ env.FORK }}
         branch: changelog-${{ inputs.version }}
         commit-message: Changelog ${{ inputs.version }}

From 65d3a145278c2189562ddcceb8eee689f3cd8b6b Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Fri, 13 Dec 2024 12:00:35 -0600
Subject: [PATCH 20/30] Debugging

---
 prepare-release/action.yml | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index 7bf7a0b4..edd37197 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -70,12 +70,23 @@ runs:
       # don't use `gh repo fork` since it doesn't provide consistent output
       # see: https://github.com/cli/cli/issues/10079
       run: |
-        echo FORK=$(gh api \
+        RESPONSE=$(gh api \
           -X POST \
           -H "Accept: application/vnd.github+json" \
           "/repos/${{ github.repository }}/forks" \
-          -f default_branch_only=true \
-          --jq ".full_name") >> $GITHUB_ENV
+          -f default_branch_only=true)
+
+        # extract values with jq
+        FULL_NAME="$(echo "${RESPONSE}" | jq -r '.full_name')"
+        CREATED_AT="$(echo "${RESPONSE}" | jq -r '.created_at')"
+
+        # wait a minute to ensure the fork is ready
+        TIMESTAMP="$(date -d "${CREATED_AT}" +%s)"
+        CURRENT="$(date +%s)"
+        [ $((CURRENT - TIMESTAMP)) -gt 60 ] || sleep 60
+
+        # store values for subsequent usage
+        echo FORK="${FULL_NAME}" >> $GITHUB_ENV
       env:
         GH_TOKEN: ${{ inputs.fork-token || inputs.token }}
 

From 3d3c2245c848be44e2fadf77d58c0aaa3bddbc1f Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Tue, 17 Dec 2024 09:21:13 -0600
Subject: [PATCH 21/30] Add cache for pip packages

---
 prepare-release/action.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index edd37197..bd76161c 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -43,6 +43,13 @@ runs:
       env:
         GH_TOKEN: ${{ inputs.token }}
 
+    - name: Load Pip Cache
+      uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+      with:
+        path: ~/.cache/pip
+        # invalidate the cache anytime a workflow changes
+        key: ${{ github.workflow }}-${{ hashFiles('.github/workflows/*') }}
+
     - name: Setup Python
       uses: actions/setup-python@v5
       with:

From 315b336aaffc3158b7200aeb675ed53b6e9598d4 Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Wed, 18 Dec 2024 08:48:06 -0600
Subject: [PATCH 22/30] Use create-fork action

---
 prepare-release/action.yml | 30 +++++-------------------------
 1 file changed, 5 insertions(+), 25 deletions(-)

diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index bd76161c..72308405 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -72,37 +72,17 @@ runs:
     # - name: Detect First-Time Contributors
 
     - name: Create Fork
-      # no-op if the repository is already forked
-      shell: bash
-      # don't use `gh repo fork` since it doesn't provide consistent output
-      # see: https://github.com/cli/cli/issues/10079
-      run: |
-        RESPONSE=$(gh api \
-          -X POST \
-          -H "Accept: application/vnd.github+json" \
-          "/repos/${{ github.repository }}/forks" \
-          -f default_branch_only=true)
-
-        # extract values with jq
-        FULL_NAME="$(echo "${RESPONSE}" | jq -r '.full_name')"
-        CREATED_AT="$(echo "${RESPONSE}" | jq -r '.created_at')"
-
-        # wait a minute to ensure the fork is ready
-        TIMESTAMP="$(date -d "${CREATED_AT}" +%s)"
-        CURRENT="$(date +%s)"
-        [ $((CURRENT - TIMESTAMP)) -gt 60 ] || sleep 60
-
-        # store values for subsequent usage
-        echo FORK="${FULL_NAME}" >> $GITHUB_ENV
-      env:
-        GH_TOKEN: ${{ inputs.fork-token || inputs.token }}
+      id: create-fork
+      uses: conda/actions/create-fork@create-fork
+      with:
+        token: ${{ inputs.fork-token || inputs.token }}
 
     - name: Create PR
       uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
       with:
         # push to the fork
         branch-token: ${{ inputs.fork-token || inputs.token }}
-        push-to-fork: ${{ env.FORK }}
+        push-to-fork: ${{ steps.create-fork.outputs.fork }}
         branch: changelog-${{ inputs.version }}
         commit-message: Changelog ${{ inputs.version }}
         author: ${{ inputs.changelog-author }}

From 40a3d03b5f54b0c97447488e93b3c4ef4d1e4144 Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Wed, 18 Dec 2024 15:35:21 -0600
Subject: [PATCH 23/30] Improve descriptions

---
 prepare-release/action.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index 72308405..a4964d92 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -13,10 +13,14 @@ inputs:
     description: Git-format author to use for the changelog commits.
     default: Conda Bot <18747875+conda-bot@users.noreply.github.com>
   token:
-    description: 'GitHub token to create release branch if missing and the pull request. Fine-grained PAT: `pull-request: write; contents: write`'
+    description: |
+      GitHub token to create release branch if missing and the pull request.
+      Fine-grained PAT: `pull-request: write; contents: write`
     default: ${{ github.token }}
   fork-token:
-    description: 'GitHub token to create and push to the fork. Fine-grained PAT: `administration: write; contents: write`'
+    description: |
+      GitHub token to create and push to the fork.
+      Fine-grained PAT: `administration: write; contents: write`
 runs:
   using: composite
   steps:

From 8ac59012498fd64ee074686819d63e8abe01220e Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Wed, 18 Dec 2024 15:40:44 -0600
Subject: [PATCH 24/30] Fix token

---
 prepare-release/action.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index a4964d92..67e1767b 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -21,6 +21,7 @@ inputs:
     description: |
       GitHub token to create and push to the fork.
       Fine-grained PAT: `administration: write; contents: write`
+    # default: ${{ inputs.token }}
 runs:
   using: composite
   steps:

From f3e6fbe1820d52dc1b451c7532266728bb5ee35c Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Fri, 24 Jan 2025 15:41:22 -0600
Subject: [PATCH 25/30] Add prepare-release to tests.yml

---
 .github/workflows/tests.yml | 24 ++++++++++++++++++++++++
 prepare-release/action.yml  | 37 ++++++++++++++++++++++++++-----------
 2 files changed, 50 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index ab4b4b87..f250a22a 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -115,6 +115,7 @@ jobs:
           filters: |
             code:
               - 'template-files/**'
+
       - name: Comment on PR
         if: github.event_name == 'pull_request' && steps.filter.outputs.code == 'true'
         uses: marocchino/sticky-pull-request-comment@331f8f5b4215f0445d3c07b4967662a32a2d3e31  # v2.9.0
@@ -130,6 +131,29 @@ jobs:
             ${{ steps.templates-error.outputs.summary }}
           GITHUB_TOKEN: ${{ secrets.SANDBOX_TEMPLATE_TOKEN }}
 
+  prepare-release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Prepare Major Release
+        uses: ./prepare-release
+        with:
+          repository: conda-sandbox/releases
+          version: ${{ github.event.pull_request.number }}.0.0
+          branch: ${{ github.event.pull_request.number }}.0.x
+          branch-sha: main
+          token: ${{ secrets.SANDBOX_RELEASES_TOKEN }}
+          fork-token: ${{ secrets.FORK_TOKEN }}
+
+      - name: Prepare Patch Release
+        uses: ./prepare-release
+        with:
+          repository: conda-sandbox/releases
+          version: 0.0.${{ github.event.pull_request.number }}
+          branch: 0.0.x
+          branch-sha: main
+          token: ${{ secrets.SANDBOX_RELEASES_TOKEN }}
+          fork-token: ${{ secrets.FORK_TOKEN }}
+
   # required check
   analyze:
     needs: [pytest, read-file, template-files]
diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index 67e1767b..9e00cbca 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -9,6 +9,7 @@ inputs:
     default: ${{ github.event.repository.default_branch }}
   branch-sha:
     description: The SHA from which to create the target branch if missing.
+    default: ${{ github.event.repository.default_branch }}
   changelog-author:
     description: Git-format author to use for the changelog commits.
     default: Conda Bot <18747875+conda-bot@users.noreply.github.com>
@@ -22,6 +23,13 @@ inputs:
       GitHub token to create and push to the fork.
       Fine-grained PAT: `administration: write; contents: write`
     # default: ${{ inputs.token }}
+  comment-blurb:
+    description: Comment to add to the PR.
+    default: ✂️ snip snip ✂️ the making of a new release.
+  repository:
+    description: The repository to use for the release.
+    default: ${{ github.repository }}
+
 runs:
   using: composite
   steps:
@@ -29,6 +37,9 @@ runs:
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        path: .github_cache/actions/prepare-release
+        repository: ${{ inputs.repository }}
+        token: ${{ inputs.token }}
 
     - name: Create Branch
       shell: bash
@@ -38,9 +49,9 @@ runs:
           gh api \
             -X POST \
             -H "Accept: application/vnd.github+json" \
-            "/repos/${{ github.repository }}/git/refs" \
+            "/repos/${{ inputs.repository }}/git/refs" \
             -f ref="refs/heads/${{ inputs.branch }}" \
-            -f sha="$(git rev-parse ${{ inputs.branch-sha || github.event.repository.default_branch }})"
+            -f sha="$(git rev-parse ${{ inputs.branch-sha }})"
         fi
         git fetch origin
         git checkout "${{ inputs.branch }}"
@@ -48,17 +59,23 @@ runs:
       env:
         GH_TOKEN: ${{ inputs.token }}
 
-    - name: Load Pip Cache
+    # `hashFiles` only works on files within the working directory, since `requirements.txt`
+    # is not in the working directory we need to manually compute the SHA256 hash
+    - name: Compute Hash
+      id: hash
+      shell: bash
+      run: echo hash=$(sha256sum ${{ github.action_path }}/requirements.txt | awk '{print $1}') >> $GITHUB_OUTPUT
+
+    - name: Pip Cache
       uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
       with:
         path: ~/.cache/pip
-        # invalidate the cache anytime a workflow changes
-        key: ${{ github.workflow }}-${{ hashFiles('.github/workflows/*') }}
+        key: ${{ github.workflow }}-prepare-release-${{ steps.hash.outputs.hash }}
 
     - name: Setup Python
       uses: actions/setup-python@v5
       with:
-        python-version: '3.13'
+        python-version: '>=3.9'
 
     - name: Pip Install
       shell: bash
@@ -78,7 +95,7 @@ runs:
 
     - name: Create Fork
       id: create-fork
-      uses: conda/actions/create-fork@create-fork
+      uses: conda/actions/create-fork@7873f9d7c90877290866eb893b8f6eff2e88429a # v25.1.2
       with:
         token: ${{ inputs.fork-token || inputs.token }}
 
@@ -98,10 +115,8 @@ runs:
         delete-branch: true
         title: Changelog ${{ inputs.version }}
         body: |
-          [release.yml]: ${{ github.server_url }}/${{ github.repository }}/blob/main/.github/workflows/release.yml
-
-          ✂️ snip snip ✂️ the making of a new release.
+          ${{ inputs.comment-blurb }}
 
           This PR was triggered by @${{ github.triggering_actor }} via ${{ github.event_name }}.
 
-          ###### Auto-generated by the [`release.yml`][release.yml] workflow, see ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}.
+          ###### Workflow: ${{ github.html_url }}/actions/runs/${{ github.run_id }}

From 2e15e0c5cec1c43450f5a9e92d9e452a88de1e0d Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Fri, 24 Jan 2025 15:55:09 -0600
Subject: [PATCH 26/30] Update PR body

---
 prepare-release/action.yml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index 9e00cbca..26249d36 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -114,9 +114,12 @@ runs:
         base: ${{ inputs.branch }}
         delete-branch: true
         title: Changelog ${{ inputs.version }}
-        body: |
+        # GitHub flavored markdown reinvents how paragraphs work, adjoined lines of text are not
+        # concatenated so instead we rely on YAML multi-line + extra newlines
+        body: >-
           ${{ inputs.comment-blurb }}
 
-          This PR was triggered by @${{ github.triggering_actor }} via ${{ github.event_name }}.
 
-          ###### Workflow: ${{ github.html_url }}/actions/runs/${{ github.run_id }}
+          <sub>PR generated by ${{ github.html_url }}/actions/runs/${{ github.run_id }},
+          triggered by ${{ github.event_name == 'schedule' && 'cron' || format('@{0}', github.triggering_actor) }}
+          via ${{ github.event_name }}.</sub>

From 57aecd75b53a9bff71cf552dfa16b51579f4a1b2 Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Fri, 24 Jan 2025 15:58:23 -0600
Subject: [PATCH 27/30] Checkout conda/actions before testing prepare-release

---
 .github/workflows/tests.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index f250a22a..890b5268 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -134,6 +134,9 @@ jobs:
   prepare-release:
     runs-on: ubuntu-latest
     steps:
+      - name: Checkout Source
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
       - name: Prepare Major Release
         uses: ./prepare-release
         with:

From 8871c9b9541827cd14a1ba5a7999b9f41b7db267 Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Fri, 24 Jan 2025 16:01:21 -0600
Subject: [PATCH 28/30] Limit tests to only when there are prepare-release
 changes

---
 .github/workflows/tests.yml | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 890b5268..3b9d2ecb 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -134,27 +134,38 @@ jobs:
   prepare-release:
     runs-on: ubuntu-latest
     steps:
+      - name: Filter Changes
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        id: filter
+        with:
+          filters: |
+            code:
+              - 'prepare-release/**'
+
       - name: Checkout Source
+        if: steps.filter.outputs.code == 'true'
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Prepare Major Release
+        if: steps.filter.outputs.code == 'true'
         uses: ./prepare-release
         with:
           repository: conda-sandbox/releases
           version: ${{ github.event.pull_request.number }}.0.0
           branch: ${{ github.event.pull_request.number }}.0.x
           branch-sha: main
-          token: ${{ secrets.SANDBOX_RELEASES_TOKEN }}
+          token: ${{ secrets.SANDBOX_RELEASES_PR_TOKEN }}
           fork-token: ${{ secrets.FORK_TOKEN }}
 
       - name: Prepare Patch Release
+        if: steps.filter.outputs.code == 'true'
         uses: ./prepare-release
         with:
           repository: conda-sandbox/releases
           version: 0.0.${{ github.event.pull_request.number }}
           branch: 0.0.x
           branch-sha: main
-          token: ${{ secrets.SANDBOX_RELEASES_TOKEN }}
+          token: ${{ secrets.SANDBOX_RELEASES_PR_TOKEN }}
           fork-token: ${{ secrets.FORK_TOKEN }}
 
   # required check

From 5f954cba3400ab9fff197a263aff38fe4c60f8a4 Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Fri, 24 Jan 2025 16:11:49 -0600
Subject: [PATCH 29/30] Use correct path

---
 prepare-release/action.yml | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/prepare-release/action.yml b/prepare-release/action.yml
index 26249d36..1bcabf2d 100644
--- a/prepare-release/action.yml
+++ b/prepare-release/action.yml
@@ -37,27 +37,28 @@ runs:
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
-        path: .github_cache/actions/prepare-release
+        path: .github_cache/actions/prepare-release/${{ inputs.repository }}
         repository: ${{ inputs.repository }}
         token: ${{ inputs.token }}
 
     - name: Create Branch
       shell: bash
       run: |
-        if ! git fetch origin "${{ inputs.branch }}"; then
+        if ! git -C ${SOURCE} fetch origin "${{ inputs.branch }}"; then
           # if branch doesn't exist, create it from the default branch
           gh api \
             -X POST \
             -H "Accept: application/vnd.github+json" \
             "/repos/${{ inputs.repository }}/git/refs" \
             -f ref="refs/heads/${{ inputs.branch }}" \
-            -f sha="$(git rev-parse ${{ inputs.branch-sha }})"
+            -f sha="$(git -C ${SOURCE} rev-parse ${{ inputs.branch-sha }})"
         fi
-        git fetch origin
-        git checkout "${{ inputs.branch }}"
-        git pull origin "${{ inputs.branch }}"
+        git -C ${SOURCE} fetch origin
+        git -C ${SOURCE} checkout "${{ inputs.branch }}"
+        git -C ${SOURCE} pull origin "${{ inputs.branch }}"
       env:
         GH_TOKEN: ${{ inputs.token }}
+        SOURCE: .github_cache/actions/prepare-release/${{ inputs.repository }}
 
     # `hashFiles` only works on files within the working directory, since `requirements.txt`
     # is not in the working directory we need to manually compute the SHA256 hash
@@ -87,7 +88,10 @@ runs:
 
     - name: Run Towncrier
       shell: bash
-      run: towncrier build --version=${{ inputs.version }}
+      run: >-
+        towncrier build
+        --version=${{ inputs.version }}
+        --dir=.github_cache/actions/prepare-release/${{ inputs.repository }}
 
     # - name: Detect Contributors
 

From 9a868f6ba80569e9ff562bacf4a523991d558447 Mon Sep 17 00:00:00 2001
From: Ken Odegard <kodegard@anaconda.com>
Date: Fri, 24 Jan 2025 16:15:19 -0600
Subject: [PATCH 30/30] Update token

---
 .github/workflows/tests.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 3b9d2ecb..d8e6c303 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -154,7 +154,7 @@ jobs:
           version: ${{ github.event.pull_request.number }}.0.0
           branch: ${{ github.event.pull_request.number }}.0.x
           branch-sha: main
-          token: ${{ secrets.SANDBOX_RELEASES_PR_TOKEN }}
+          token: ${{ secrets.SANDBOX_RELEASES_TOKEN }}
           fork-token: ${{ secrets.FORK_TOKEN }}
 
       - name: Prepare Patch Release
@@ -165,7 +165,7 @@ jobs:
           version: 0.0.${{ github.event.pull_request.number }}
           branch: 0.0.x
           branch-sha: main
-          token: ${{ secrets.SANDBOX_RELEASES_PR_TOKEN }}
+          token: ${{ secrets.SANDBOX_RELEASES_TOKEN }}
           fork-token: ${{ secrets.FORK_TOKEN }}
 
   # required check