chore: prepare release v0.31.4

.changes/v0.31.4.md

@@ -0,0 +1,10 @@
+## [0.31.4] - 2026-07-24
+
+### Fixed
+- oauth2provider: use the website base path when building frontend redirect URLs instead of the API base path.
+- webauthn: fix sign in failing for counter-incrementing authenticators (e.g. Windows Hello) — the assertion was verified against the core twice
+### Infrastructure
+- Replace the local lint-pr workflow with a thin caller of the shared supertokens/actions reusable lint-pr workflow (behavior unchanged)
+- Replace the local dev-sync workflow with a thin caller of the shared supertokens/actions reusable dev-sync workflow (behavior unchanged)
+- Mint short-lived GitHub App installation tokens in-job (actions/create-github-app-token) for the release-tag and check-docs workflows, replacing the ALL_REPO_PAT org secret
+- Adopt the shared reusable release-tag workflow from supertokens/actions; keep only the docs and PyPI publish jobs as thin callers consuming its outputs. The git tag is now pushed before the API release mark.

.github/workflows/check-docs.yml

@@ -20,13 +20,21 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - uses: actions/create-github-app-token@v2
+        id: app-token
+        with:
+          app-id: ${{ vars.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+          owner: supertokens
+          repositories: ${{ github.event.repository.name }}
+
       - uses: actions/checkout@v4
         with:
           ref: ${{ github.ref }}
           # Need a complete fetch to make the master merge check work
           fetch-depth: 0
           fetch-tags: true
-          token: ${{ secrets.ALL_REPO_PAT }}
+          token: ${{ steps.app-token.outputs.token }}
 
 
       - name: Setup git

.github/workflows/dev-sync.yml

@@ -1,15 +1,15 @@
 name: "Sync Dev to Version Branch"
 
-# On every push to dev, computes the next version from unreleased changelog
+# Thin caller of the shared reusable dev-sync workflow in supertokens/actions.
+# On every push to dev, it computes the next version from unreleased changie
 # fragments and creates or force-updates a release PR:
 #
-#   release/vX.Y.Z  →  X.Y  (version branch)
+#   release/vX.Y.Z  ->  X.Y  (version branch)
 #
-# The PR title and branch name make the target version explicit — that's the
-# sanity check. Review it, merge it, then trigger the Release Pipeline.
-#
-# Can also be triggered manually to override the bump type (e.g. force a minor
-# release when auto would compute a patch).
+# Can also be triggered manually to override the bump type. The python-specific
+# release prep (install doc deps + rebuild the html/ API docs), the Python
+# version, and the set of files to stage are passed as inputs; the orchestration
+# logic lives once in the reusable workflow.
 
 on:
   push:
@@ -32,146 +32,14 @@ permissions:
 
 jobs:
   sync:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: dev
-          fetch-depth: 0
-          token: ${{ secrets.ALL_REPO_PAT }}
-
-      - name: Setup git
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git fetch --all --tags
-
-      - uses: miniscruff/changie-action@v2
-        with:
-          version: latest
-
-      - name: Compute next version
-        id: next
-        run: |
-          bump="${{ inputs.bump || 'auto' }}"
-
-          if ! raw_version=$(changie next $bump 2>&1); then
-            echo "changie next returned: $raw_version"
-            echo "No bumpable fragments found (all changes may be Infrastructure/none). Skipping sync."
-            echo "skip=true" >> $GITHUB_OUTPUT
-            exit 0
-          fi
-
-          version="${raw_version#v}"  # strip leading 'v' if present (changie next returns e.g. v0.31.2)
-          version_branch=$(echo "$version" | grep -oE '^[0-9]+\.[0-9]+')
-
-          echo "version=$version"               >> $GITHUB_OUTPUT
-          echo "version_branch=$version_branch" >> $GITHUB_OUTPUT
-          echo "pr_branch=release/v$version"    >> $GITHUB_OUTPUT
-
-      - name: Create version branch if it doesn't exist
-        if: steps.next.outputs.skip != 'true'
-        run: |
-          version_branch="${{ steps.next.outputs.version_branch }}"
-
-          if ! git show-ref --verify --quiet "refs/remotes/origin/$version_branch"; then
-            git checkout -b "$version_branch"
-            git push origin "$version_branch"
-            echo "Created new version branch: $version_branch"
-          else
-            echo "Version branch $version_branch already exists."
-          fi
-
-      - uses: actions/setup-python@v5
-        if: steps.next.outputs.skip != 'true'
-        with:
-          python-version: '3.13'
-
-      - name: Install doc dependencies
-        if: steps.next.outputs.skip != 'true'
-        run: pip install pdoc3==0.11.0 -e ".[fastapi,flask,django,drf]"
-
-      - name: Build release branch
-        if: steps.next.outputs.skip != 'true'
-        run: |
-          pr_branch="${{ steps.next.outputs.pr_branch }}"
-          version_branch="${{ steps.next.outputs.version_branch }}"
-          version="${{ steps.next.outputs.version }}"
-
-          # Start from the version branch (clean base), merge dev on top.
-          # -X theirs ensures dev wins on any conflict — dev is the source of truth.
-          if git show-ref --verify --quiet "refs/remotes/origin/$pr_branch"; then
-            git checkout "$pr_branch"
-            git reset --hard "origin/$version_branch"
-          else
-            git checkout -b "$pr_branch" "origin/$version_branch"
-          fi
-
-          git merge origin/dev --no-edit -X theirs
-
-          # changie batch:
-          #  - collects unreleased fragments into .changes/v{version}.md
-          #  - updates setup.py and constants.py via replacements
-          changie batch "v$version"
-          changie merge
-
-          # Regenerate API docs (publish-docs job in release pipeline reads from html/)
-          make build-docs
-
-          git add .changes/ CHANGELOG.md setup.py supertokens_python/constants.py html/
-          git diff --staged --quiet \
-            || git commit -m "chore: prepare release v$version"
-
-          git push origin "$pr_branch" --force
-
-      - name: Create or update pull request
-        if: steps.next.outputs.skip != 'true'
-        env:
-          GH_TOKEN: ${{ secrets.ALL_REPO_PAT }}
-        run: |
-          version="${{ steps.next.outputs.version }}"
-          pr_branch="${{ steps.next.outputs.pr_branch }}"
-          target_branch="${{ steps.next.outputs.version_branch }}"
-
-          pr_number=$(gh pr list \
-            --base "$target_branch" \
-            --head "$pr_branch" \
-            --json number \
-            --jq '.[0].number')
-
-          # Strip the version header line for the PR body
-          notes=$(sed '1d' ".changes/v${version}.md" | sed '/./,$!d')
-
-          body=$(cat <<EOF
-          ## Release v${version}
-
-          This PR is automatically kept in sync with \`dev\`. It will be force-updated on every push to \`dev\`.
-
-          **Review checklist:**
-          - [ ] Version \`${version}\` is correct (check \`setup.py\` and \`constants.py\`)
-          - [ ] Changelog entries below are accurate and complete
-
-          **After merging:** trigger the [Release Pipeline](../actions/workflows/pipeline-release-tag.yml) with branch \`${target_branch}\`.
-
-          ---
-
-          ${notes}
-          EOF
-          )
-
-          if [[ -n "$pr_number" ]]; then
-            gh pr edit "$pr_number" \
-              --title "chore: prepare release v${version}" \
-              --body "$body" \
-              --add-label "run-tests"
-            echo "Updated PR #$pr_number"
-          else
-            gh pr create \
-              --base "$target_branch" \
-              --head "$pr_branch" \
-              --title "chore: prepare release v${version}" \
-              --body "$body" \
-              --label "run-tests,Skip-Changelog"
-            echo "Created new release PR"
-          fi
+    uses: supertokens/actions/.github/workflows/dev-sync.yml@main
+    secrets: inherit
+    with:
+      bump: ${{ inputs.bump || 'auto' }}
+      python_version: "3.13"
+      prepare: |
+        pip install pdoc3==0.11.0 -e ".[fastapi,flask,django,drf]"
+        make build-docs
+      add_paths: ".changes/ CHANGELOG.md setup.py supertokens_python/constants.py html/"
+      version_check_hint: '\`setup.py\` and \`constants.py\`'
+      post_merge_note: 'trigger the [Release Pipeline](../actions/workflows/pipeline-release-tag.yml) with branch \`${target_branch}\`.'

.github/workflows/lint-pr.yml

@@ -10,51 +10,12 @@ on:
       - labeled
       - unlabeled
 
-permissions:
-  contents: read
-
 # Only one instance of this workflow will run on the same ref (PR/Branch/Tag)
 # Previous runs will be cancelled.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  lint-pr-title:
-    name: Lint PR Title
-    runs-on: ubuntu-latest
-    steps:
-      - uses: amannn/action-semantic-pull-request@v6
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          validateSingleCommit: true
-
-  lint-changelog:
-    name: Require Changelog Fragment
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Check for changelog fragment
-        if: "!contains(github.event.pull_request.labels.*.name, 'Skip-Changelog')"
-        run: |
-          git fetch origin ${{ github.base_ref }}
-
-          new_fragments=$(git diff --name-only --diff-filter=A \
-            "origin/${{ github.base_ref }}...HEAD" -- .changes/unreleased/)
-
-          if [[ -z "$new_fragments" ]]; then
-            echo "::error::No changelog fragment found in .changes/unreleased/"
-            echo ""
-            echo "Please add a fragment before merging:"
-            echo "  changie new"
-            echo ""
-            echo "Or add the 'Skip-Changelog' label to skip this check."
-            exit 1
-          fi
-
-          echo "Found changelog fragment(s):"
-          echo "$new_fragments"
+  lint:
+    uses: supertokens/actions/.github/workflows/lint-pr.yml@main