Merge branch 'master' into whats-new-template

Author: hugovk

.coveragerc

@@ -6,3 +6,4 @@ exclude_also =
     # Don't complain if non-runnable code isn't run:
     if __name__ == .__main__.
     def main
+    def get_arg_parser

.github/dependabot.yml

@@ -8,3 +8,14 @@ updates:
       actions:
         patterns:
           - "*"
+
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: monthly
+    assignees:
+      - "ezio-melotti"
+    groups:
+      pip:
+        patterns:
+          - "*"

.github/workflows/lint.yml

@@ -14,6 +14,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: "3.x"

.github/workflows/source-and-docs-release.yml

@@ -37,15 +37,17 @@ on:
 
 name: "Build Python source and docs artifacts"
 
+permissions: {}
+
 # Set from inputs for workflow_dispatch, or set defaults to test push/PR events
 env:
   GIT_REMOTE: ${{ github.event.inputs.git_remote || 'python' }}
-  GIT_COMMIT: ${{ github.event.inputs.git_commit || 'f6650f9ad73359051f3e558c2431a109bc016664' }}
-  CPYTHON_RELEASE: ${{ github.event.inputs.cpython_release || '3.12.3' }}
+  GIT_COMMIT: ${{ github.event.inputs.git_commit || '4f8bb3947cfbc20f970ff9d9531e1132a9e95396' }}
+  CPYTHON_RELEASE: ${{ github.event.inputs.cpython_release || '3.13.2' }}
 
 jobs:
   verify-input:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     outputs:
       # Needed because env vars are not available in the build-docs check below
       cpython_release: ${{ env.CPYTHON_RELEASE }}
@@ -57,8 +59,9 @@ jobs:
           echo "cpython_release: $CPYTHON_RELEASE"
 
       - name: "Checkout ${{ env.GIT_REMOTE }}/cpython"
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
+          persist-credentials: false
           repository: "${{ env.GIT_REMOTE }}/cpython"
           ref: "v${{ env.CPYTHON_RELEASE }}"
           path: "cpython"
@@ -71,24 +74,27 @@ jobs:
           fi
 
   build-source:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     needs:
       - verify-input
     steps:
       - name: "Checkout python/release-tools"
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: "Checkout ${{ env.GIT_REMOTE }}/cpython"
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
+          persist-credentials: false
           repository: "${{ env.GIT_REMOTE }}/cpython"
           ref: "v${{ env.CPYTHON_RELEASE }}"
           path: "cpython"
 
       - name: "Setup Python"
-        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
-          python-version: 3.11
+          python-version: 3.12
 
       - name: "Install source dependencies"
         run: |
@@ -101,30 +107,31 @@ jobs:
           python ../release.py --export "$CPYTHON_RELEASE" --skip-docs
 
       - name: "Upload the source artifacts"
-        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: source
           path: |
             cpython/${{ env.CPYTHON_RELEASE }}/src
 
   build-docs:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     needs:
       - verify-input
 
     # Docs aren't built for alpha or beta releases.
     if: (!(contains(needs.verify-input.outputs.cpython_release, 'a') || contains(needs.verify-input.outputs.cpython_release, 'b')))
     steps:
       - name: "Checkout ${{ env.GIT_REMOTE }}/cpython"
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
+          persist-credentials: false
           repository: "${{ env.GIT_REMOTE }}/cpython"
           ref: "v${{ env.CPYTHON_RELEASE }}"
 
       - name: "Setup Python"
-        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
-          python-version: 3.11
+          python-version: 3.12
 
       - name: "Install docs dependencies"
         run: |
@@ -143,19 +150,19 @@ jobs:
           SPHINXOPTS="-j10" make dist
 
       - name: "Upload the docs artifacts"
-        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: docs
           path: |
             Doc/dist/
 
   test-source:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     needs:
       - build-source
     steps:
       - name: "Download the source artifacts"
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: source
 

.github/workflows/test.yml

@@ -2,18 +2,27 @@ name: Test
 
 on: [push, pull_request, workflow_dispatch]
 
+permissions: {}
+
 env:
   FORCE_COLOR: 1
 
 jobs:
   tests:
     name: "Tests"
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.12", "3.13"]
+        os: [macos-latest, ubuntu-latest]
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
-          python-version: 3.x
+          python-version: ${{ matrix.python-version }}
           cache: pip
           cache-dependency-path: dev-requirements.txt
       - run: |
@@ -22,6 +31,6 @@ jobs:
           tox -e py
 
       - name: Upload coverage
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v5
         with:
           token: ${{ secrets.CODECOV_ORG_TOKEN }}

.pre-commit-config.yaml

@@ -1,59 +1,61 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.3.5
+    rev: v0.9.6
     hooks:
       - id: ruff
         args: [--exit-non-zero-on-fix]
 
   - repo: https://github.com/psf/black-pre-commit-mirror
-    rev: 24.4.2
+    rev: 25.1.0
     hooks:
       - id: black
 
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.6.0
+    rev: v5.0.0
     hooks:
       - id: check-added-large-files
       - id: check-case-conflict
       - id: check-merge-conflict
       - id: check-toml
       - id: check-yaml
-        exclude: windows-release/azure-pipelines.yml
+        exclude: windows-release/(azure-pipelines|msi-steps).yml
       - id: debug-statements
       - id: end-of-file-fixer
       - id: forbid-submodules
       - id: trailing-whitespace
 
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.28.1
+    rev: 0.31.1
     hooks:
       - id: check-dependabot
       - id: check-github-workflows
 
   - repo: https://github.com/rhysd/actionlint
-    rev: v1.6.27
+    rev: v1.7.7
     hooks:
       - id: actionlint
 
+  - repo: https://github.com/woodruffw/zizmor-pre-commit
+    rev: v1.3.1
+    hooks:
+      - id: zizmor
+
   - repo: https://github.com/tox-dev/pyproject-fmt
-    rev: 2.1.3
+    rev: v2.5.0
     hooks:
       - id: pyproject-fmt
 
   - repo: https://github.com/abravalheri/validate-pyproject
-    rev: v0.18
+    rev: v0.23
     hooks:
       - id: validate-pyproject
 
   - repo: https://github.com/tox-dev/tox-ini-fmt
-    rev: 1.3.1
+    rev: 1.5.0
     hooks:
       - id: tox-ini-fmt
 
   - repo: meta
     hooks:
       - id: check-hooks-apply
       - id: check-useless-excludes
-
-ci:
-  autoupdate_schedule: quarterly

add_to_pydotorg.py

@@ -29,8 +29,9 @@
 import re
 import subprocess
 import sys
+from collections.abc import Generator
 from os import path
-from typing import Any, Generator, NoReturn
+from typing import Any, NoReturn
 
 import requests
 
@@ -422,13 +423,23 @@ def has_sigstore_signature(filename: str) -> bool:
         filename_sigstore = filename + ".sigstore"
 
         if os.path.exists(filename_sigstore):
-            run_cmd(sigstore_verify_argv + ["--bundle", filename_sigstore, filename])
+            run_cmd(
+                sigstore_verify_argv + ["--bundle", filename_sigstore, filename],
+                stderr=subprocess.STDOUT,  # Sigstore sends stderr on success.
+            )
 
         # We use an 'or' here to error out if one of the files is missing.
         if os.path.exists(filename_sig) or os.path.exists(filename_crt):
             run_cmd(
                 sigstore_verify_argv
-                + ["--certificate", filename_crt, "--signature", filename_sig, filename]
+                + [
+                    "--certificate",
+                    filename_crt,
+                    "--signature",
+                    filename_sig,
+                    filename,
+                ],
+                stderr=subprocess.STDOUT,  # Sigstore sends stderr on success.
             )
 
 

buildbotapi.py

@@ -1,4 +1,3 @@
-import asyncio
 import json
 from dataclasses import dataclass
 from typing import Any, cast
@@ -12,7 +11,6 @@
 class Builder:
     builderid: int
     description: str | None
-    masterids: list[int]
     name: str
     tags: list[str]
 
@@ -23,26 +21,6 @@ def __hash__(self) -> int:
         return hash(self.builderid)
 
 
-@dataclass
-class Build:
-    id: int
-    is_currently_failing: bool
-    builderid: int
-    builder: Builder | None
-
-    def __init__(self, **kwargs: Any) -> None:
-        self.__dict__.update(**kwargs)
-        self.id = int(kwargs.get("number", -1))
-        self.is_currently_failing = kwargs.get("currently_failing", False)
-        self.builder = None
-
-    def __eq__(self, other: object) -> bool:
-        return isinstance(other, Build) and self.id == other.id
-
-    def __hash__(self) -> int:
-        return hash(self.id)
-
-
 class BuildBotAPI:
     def __init__(self, session: ClientSession) -> None:
         self._session = session
@@ -91,44 +69,3 @@ async def is_builder_failing_currently(self, builder: Builder) -> bool:
         if build["results"] == 2:
             return True
         return False
-
-    async def get_build(self, builder_id: int, build_id: int) -> Build:
-        data = await self._fetch_json(
-            f"https://buildbot.python.org/all/api/v2/builders/{builder_id}"
-            f"/builds/{build_id}"
-        )
-        (build_data,) = data["builds"]
-        build: Build = Build(**build_data)
-        build.builder = (await self.all_builders())[build.builderid]
-        build.is_currently_failing = await self.is_builder_failing_currently(
-            build.builder
-        )
-        return build
-
-    async def get_recent_failures(self, limit: int = 100) -> set[Build]:
-        data = await self._fetch_json(
-            f"https://buildbot.python.org/all/api/v2/builds?"
-            f"complete__eq=true&&results__eq=2&&"
-            f"order=-complete_at&&limit={limit}"
-        )
-
-        stable_builders = await self.stable_builders()
-
-        all_failures = {
-            Build(**build)
-            for build in data["builds"]
-            if build["builderid"] in stable_builders
-        }
-
-        for failure in all_failures:
-            failure.builder = stable_builders[failure.builderid]
-
-        async def _get_missing_info(failure: Build) -> None:
-            assert failure.builder is not None
-            failure.is_currently_failing = await self.is_builder_failing_currently(
-                failure.builder
-            )
-
-        await asyncio.gather(*[_get_missing_info(failure) for failure in all_failures])
-
-        return all_failures

dev-requirements.in

@@ -1,3 +1,4 @@
 pytest
+pytest-aiohttp
 pytest-cov
 pytest-mock