chore(CI): Remove upstream workflows

.github/workflows/_test.yml

@@ -16,7 +16,7 @@ on:
       python-version:
         description: "Python version to test against"
         required: true
-        default: "3.10"
+        default: "3.12"
         type: string
       upgrade-deps:
         description: "Whether to install all extras"

.github/workflows/create-tag.yml

@@ -7,7 +7,9 @@ on:
 
 jobs:
   create-tag:
-    if: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'chore/release-')
+    if: |
+      github.event.pull_request.merged == true &&
+      startsWith(github.event.pull_request.head.ref, 'chore/release-')
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -16,15 +18,23 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
         with:
-          ref: develop
+          ref: ${{ github.event.pull_request.merge_commit_sha }}
           fetch-depth: 0
 
-      - name: Extract version from pyproject.toml
+      - name: Verify commit author is not a bot
+        run: |
+          AUTHOR=$(git log -1 --format='%ae' ${{ github.event.pull_request.merge_commit_sha }})
+          echo "Merge commit author: ${AUTHOR}"
+          if echo "${AUTHOR}" | grep -qiE '(dependabot|bot@)'; then
+            echo "::error::Commit authored by a bot (${AUTHOR}), aborting tag creation."
+            exit 1
+          fi
+
+      - name: Derive tag from commit SHA
         id: version
         run: |
-          VERSION=$(grep '^version = ' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
-          echo "version=${VERSION}" >> $GITHUB_OUTPUT
-          echo "tag=v${VERSION}" >> $GITHUB_OUTPUT
+          SHORT_SHA=$(git rev-parse --short ${{ github.event.pull_request.merge_commit_sha }})
+          echo "tag=sha-${SHORT_SHA}" >> $GITHUB_OUTPUT
 
       - name: Check if tag already exists
         id: check-tag
@@ -42,7 +52,7 @@ jobs:
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          git tag -a ${{ steps.version.outputs.tag }} -m "Release ${{ steps.version.outputs.tag }}"
+          git tag -a ${{ steps.version.outputs.tag }} ${{ github.event.pull_request.merge_commit_sha }} -m "Release ${{ steps.version.outputs.tag }}"
           git push origin ${{ steps.version.outputs.tag }}
 
       - name: Tag already exists

.github/workflows/full-tests.yml

@@ -19,7 +19,7 @@ jobs:
     strategy:
       matrix:
         os: [Windows, macOS] # exclude Ubuntu as it is available in pr-tests
-        python-version: ["3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.12"]
         include:
           - os: Windows
             image: windows-2022

.github/workflows/latest-deps-tests.yml

@@ -10,7 +10,7 @@ jobs:
     strategy:
       matrix:
         os: [Ubuntu, macOS, Windows]
-        python-version: ["3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.12"]
         include:
           - os: Ubuntu
             image: ubuntu-latest

.github/workflows/lint.yml

@@ -10,7 +10,7 @@ on:
 
 env:
   POETRY_VERSION: 1.8.2
-  PYTHON_VERSION: "3.11"
+  PYTHON_VERSION: "3.12"
 
 jobs:
   lint:

.github/workflows/pr-tests.yml

@@ -11,11 +11,11 @@ jobs:
     strategy:
       matrix:
         os: [Ubuntu]
-        python-version: ["3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.12"]
         include:
           - os: Ubuntu
             image: ubuntu-latest
-          - python-version: "3.11"
+          - python-version: "3.12"
             with-coverage: true
       fail-fast: false
     uses: ./.github/workflows/_test.yml