summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--.github/workflows/build.yml11
-rw-r--r--.github/workflows/documentation-links.yml6
-rw-r--r--.github/workflows/jit.yml6
-rw-r--r--.github/workflows/lint.yml2
-rw-r--r--.github/workflows/mypy.yml2
-rw-r--r--.github/workflows/require-pr-label.yml10
-rw-r--r--.github/workflows/reusable-change-detection.yml2
-rw-r--r--.github/workflows/reusable-docs.yml14
-rw-r--r--.github/workflows/reusable-macos.yml2
-rw-r--r--.github/workflows/reusable-tsan.yml9
-rw-r--r--.github/workflows/reusable-ubuntu.yml4
-rw-r--r--.github/workflows/reusable-wasi.yml12
-rw-r--r--.github/workflows/reusable-windows-msi.yml5
-rw-r--r--.github/workflows/reusable-windows.yml10
-rw-r--r--.github/workflows/stale.yml5
-rw-r--r--.github/workflows/verify-ensurepip-wheels.yml2
-rw-r--r--.github/zizmor.yml6
-rw-r--r--.pre-commit-config.yaml9
18 files changed, 89 insertions, 28 deletions
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9b2f19f..8787402 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -58,6 +58,7 @@ jobs:
- uses: actions/checkout@v4
with:
fetch-depth: 1
+ persist-credentials: false
- name: Runner image version
run: echo "IMAGE_VERSION=${ImageVersion}" >> "$GITHUB_ENV"
- name: Check Autoconf and aclocal versions
@@ -94,6 +95,8 @@ jobs:
if: needs.check_source.outputs.run_tests == 'true'
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- uses: actions/setup-python@v5
with:
python-version: '3.x'
@@ -268,6 +271,8 @@ jobs:
LD_LIBRARY_PATH: ${{ github.workspace }}/multissl/openssl/${{ matrix.openssl_ver }}/lib
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- name: Runner image version
run: echo "IMAGE_VERSION=${ImageVersion}" >> "$GITHUB_ENV"
- name: Restore config.cache
@@ -328,6 +333,8 @@ jobs:
PYTHONSTRICTEXTENSIONBUILD: 1
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- name: Register gcc problem matcher
run: echo "::add-matcher::.github/problem-matchers/gcc.json"
- name: Install Dependencies
@@ -411,7 +418,7 @@ jobs:
#
# (GH-104097) test_sysconfig is skipped because it has tests that are
# failing when executed from inside a virtual environment.
- ${{ env.VENV_PYTHON }} -m test \
+ "${VENV_PYTHON}" -m test \
-W \
-o \
-j4 \
@@ -446,6 +453,8 @@ jobs:
ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- name: Runner image version
run: echo "IMAGE_VERSION=${ImageVersion}" >> "$GITHUB_ENV"
- name: Restore config.cache
diff --git a/.github/workflows/documentation-links.yml b/.github/workflows/documentation-links.yml
index 43a7afe..fdb4b9a 100644
--- a/.github/workflows/documentation-links.yml
+++ b/.github/workflows/documentation-links.yml
@@ -10,9 +10,6 @@ on:
- 'Doc/**'
- '.github/workflows/doc.yml'
-permissions:
- pull-requests: write
-
concurrency:
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
cancel-in-progress: true
@@ -20,6 +17,9 @@ concurrency:
jobs:
documentation-links:
runs-on: ubuntu-latest
+ permissions:
+ pull-requests: write
+
steps:
- uses: readthedocs/actions/preview@v1
with:
diff --git a/.github/workflows/jit.yml b/.github/workflows/jit.yml
index ee30cf5..9b84998 100644
--- a/.github/workflows/jit.yml
+++ b/.github/workflows/jit.yml
@@ -32,6 +32,8 @@ jobs:
timeout-minutes: 90
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- name: Build tier two interpreter
run: |
./configure --enable-experimental-jit=interpreter --with-pydebug
@@ -85,6 +87,8 @@ jobs:
runner: ${{ github.repository_owner == 'python' && 'ubuntu-24.04-aarch64' || 'ubuntu-24.04' }}
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- uses: actions/setup-python@v5
with:
python-version: '3.11'
@@ -138,6 +142,8 @@ jobs:
- 19
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- uses: actions/setup-python@v5
with:
python-version: '3.11'
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index ccde03f..d74ce8f 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -20,6 +20,8 @@ jobs:
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- uses: actions/setup-python@v5
with:
python-version: "3.x"
diff --git a/.github/workflows/mypy.yml b/.github/workflows/mypy.yml
index e5b0530..5dfa8d7 100644
--- a/.github/workflows/mypy.yml
+++ b/.github/workflows/mypy.yml
@@ -51,6 +51,8 @@ jobs:
timeout-minutes: 10
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- uses: actions/setup-python@v5
with:
python-version: "3.13"
diff --git a/.github/workflows/require-pr-label.yml b/.github/workflows/require-pr-label.yml
index bbedd22..0a6277c 100644
--- a/.github/workflows/require-pr-label.yml
+++ b/.github/workflows/require-pr-label.yml
@@ -4,15 +4,14 @@ on:
pull_request:
types: [opened, reopened, labeled, unlabeled, synchronize]
-permissions:
- issues: write
- pull-requests: write
-
jobs:
label-dnm:
name: DO-NOT-MERGE
if: github.repository_owner == 'python'
runs-on: ubuntu-latest
+ permissions:
+ issues: write
+ pull-requests: write
timeout-minutes: 10
steps:
@@ -28,6 +27,9 @@ jobs:
name: Unresolved review
if: github.repository_owner == 'python'
runs-on: ubuntu-latest
+ permissions:
+ issues: write
+ pull-requests: write
timeout-minutes: 10
steps:
diff --git a/.github/workflows/reusable-change-detection.yml b/.github/workflows/reusable-change-detection.yml
index 1a6fd33..964bd87 100644
--- a/.github/workflows/reusable-change-detection.yml
+++ b/.github/workflows/reusable-change-detection.yml
@@ -61,6 +61,8 @@ jobs:
- run: >-
echo '${{ github.event_name }}'
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- name: Check for source changes
id: check
run: |
diff --git a/.github/workflows/reusable-docs.yml b/.github/workflows/reusable-docs.yml
index 39a9739..3962d12 100644
--- a/.github/workflows/reusable-docs.yml
+++ b/.github/workflows/reusable-docs.yml
@@ -22,12 +22,14 @@ jobs:
env:
branch_base: 'origin/${{ github.event.pull_request.base.ref }}'
branch_pr: 'origin/${{ github.event.pull_request.head.ref }}'
+ commits: ${{ github.event.pull_request.commits }}
refspec_base: '+${{ github.event.pull_request.base.sha }}:remotes/origin/${{ github.event.pull_request.base.ref }}'
refspec_pr: '+${{ github.event.pull_request.head.sha }}:remotes/origin/${{ github.event.pull_request.head.ref }}'
steps:
- name: 'Check out latest PR branch commit'
uses: actions/checkout@v4
with:
+ persist-credentials: false
ref: >-
${{
github.event_name == 'pull_request'
@@ -39,15 +41,15 @@ jobs:
if: github.event_name == 'pull_request'
run: |
# Fetch enough history to find a common ancestor commit (aka merge-base):
- git fetch origin ${{ env.refspec_pr }} --depth=$(( ${{ github.event.pull_request.commits }} + 1 )) \
+ git fetch origin "${refspec_pr}" --depth=$(( commits + 1 )) \
--no-tags --prune --no-recurse-submodules
# This should get the oldest commit in the local fetched history (which may not be the commit the PR branched from):
- COMMON_ANCESTOR=$( git rev-list --first-parent --max-parents=0 --max-count=1 ${{ env.branch_pr }} )
+ COMMON_ANCESTOR=$( git rev-list --first-parent --max-parents=0 --max-count=1 "${branch_pr}" )
DATE=$( git log --date=iso8601 --format=%cd "${COMMON_ANCESTOR}" )
# Get all commits since that commit date from the base branch (eg: master or main):
- git fetch origin ${{ env.refspec_base }} --shallow-since="${DATE}" \
+ git fetch origin "${refspec_base}" --shallow-since="${DATE}" \
--no-tags --prune --no-recurse-submodules
- name: 'Set up Python'
uses: actions/setup-python@v5
@@ -69,7 +71,7 @@ jobs:
if: github.event_name == 'pull_request'
run: |
python Doc/tools/check-warnings.py \
- --annotate-diff '${{ env.branch_base }}' '${{ env.branch_pr }}' \
+ --annotate-diff "${branch_base}" "${branch_pr}" \
--fail-if-regression \
--fail-if-improved \
--fail-if-new-news-nit
@@ -81,6 +83,8 @@ jobs:
timeout-minutes: 60
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- name: 'Set up Python'
uses: actions/setup-python@v5
with:
@@ -99,6 +103,8 @@ jobs:
timeout-minutes: 60
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- uses: actions/cache@v4
with:
path: ~/.cache/pip
diff --git a/.github/workflows/reusable-macos.yml b/.github/workflows/reusable-macos.yml
index 4c3dd10..36ae3e2 100644
--- a/.github/workflows/reusable-macos.yml
+++ b/.github/workflows/reusable-macos.yml
@@ -29,6 +29,8 @@ jobs:
runs-on: ${{ inputs.os }}
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- name: Runner image version
run: echo "IMAGE_VERSION=${ImageVersion}" >> "$GITHUB_ENV"
- name: Restore config.cache
diff --git a/.github/workflows/reusable-tsan.yml b/.github/workflows/reusable-tsan.yml
index 7a4d81f..b5144ca 100644
--- a/.github/workflows/reusable-tsan.yml
+++ b/.github/workflows/reusable-tsan.yml
@@ -23,8 +23,13 @@ jobs:
name: 'Thread sanitizer'
runs-on: ubuntu-24.04
timeout-minutes: 60
+ env:
+ OPTIONS: ${{ inputs.options }}
+ SUPPRESSIONS_PATH: ${{ inputs.suppressions_path }}
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- name: Runner image version
run: echo "IMAGE_VERSION=${ImageVersion}" >> "$GITHUB_ENV"
- name: Restore config.cache
@@ -47,7 +52,7 @@ jobs:
sudo sysctl -w vm.mmap_rnd_bits=28
- name: TSAN Option Setup
run: |
- echo "TSAN_OPTIONS=log_path=${GITHUB_WORKSPACE}/tsan_log suppressions=${GITHUB_WORKSPACE}/${{ inputs.suppressions_path }} handle_segv=0" >> "$GITHUB_ENV"
+ echo "TSAN_OPTIONS=log_path=${GITHUB_WORKSPACE}/tsan_log suppressions=${GITHUB_WORKSPACE}/${SUPPRESSIONS_PATH} handle_segv=0" >> "$GITHUB_ENV"
echo "CC=clang" >> "$GITHUB_ENV"
echo "CXX=clang++" >> "$GITHUB_ENV"
- name: Add ccache to PATH
@@ -59,7 +64,7 @@ jobs:
save: ${{ github.event_name == 'push' }}
max-size: "200M"
- name: Configure CPython
- run: ${{ inputs.options }}
+ run: "${OPTIONS}"
- name: Build CPython
run: make -j4
- name: Display build info
diff --git a/.github/workflows/reusable-ubuntu.yml b/.github/workflows/reusable-ubuntu.yml
index 2869202..46c5429 100644
--- a/.github/workflows/reusable-ubuntu.yml
+++ b/.github/workflows/reusable-ubuntu.yml
@@ -28,6 +28,8 @@ jobs:
TERM: linux
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- name: Register gcc problem matcher
run: echo "::add-matcher::.github/problem-matchers/gcc.json"
- name: Install dependencies
@@ -94,7 +96,7 @@ jobs:
if: ${{ !inputs.free-threading }}
run: >-
python Tools/build/check_warnings.py
- --compiler-output-file-path=${{ env.CPYTHON_BUILDDIR }}/compiler_output_ubuntu.txt
+ --compiler-output-file-path="${CPYTHON_BUILDDIR}/compiler_output_ubuntu.txt"
--warning-ignore-file-path "${GITHUB_WORKSPACE}/Tools/build/.warningignore_ubuntu"
--compiler-output-type=gcc
--fail-on-regression
diff --git a/.github/workflows/reusable-wasi.yml b/.github/workflows/reusable-wasi.yml
index 3f96c88..4356d9c 100644
--- a/.github/workflows/reusable-wasi.yml
+++ b/.github/workflows/reusable-wasi.yml
@@ -20,6 +20,8 @@ jobs:
CROSS_BUILD_WASI: cross-build/wasm32-wasip1
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
# No problem resolver registered as one doesn't currently exist for Clang.
- name: "Install wasmtime"
uses: bytecodealliance/actions/wasmtime/setup@v1
@@ -34,9 +36,9 @@ jobs:
- name: "Install WASI SDK" # Hard-coded to x64.
if: steps.cache-wasi-sdk.outputs.cache-hit != 'true'
run: |
- mkdir ${{ env.WASI_SDK_PATH }} && \
- curl -s -S --location https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${{ env.WASI_SDK_VERSION }}/wasi-sdk-${{ env.WASI_SDK_VERSION }}.0-x86_64-linux.tar.gz | \
- tar --strip-components 1 --directory ${{ env.WASI_SDK_PATH }} --extract --gunzip
+ mkdir "${WASI_SDK_PATH}" && \
+ curl -s -S --location "https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${WASI_SDK_VERSION}/wasi-sdk-${WASI_SDK_VERSION}.0-x86_64-linux.tar.gz" | \
+ tar --strip-components 1 --directory "${WASI_SDK_PATH}" --extract --gunzip
- name: "Configure ccache action"
uses: hendrikmuhs/ccache-action@v1.2
with:
@@ -72,6 +74,6 @@ jobs:
- name: "Make host"
run: python3 Tools/wasm/wasi.py make-host
- name: "Display build info"
- run: make --directory ${{ env.CROSS_BUILD_WASI }} pythoninfo
+ run: make --directory "${CROSS_BUILD_WASI}" pythoninfo
- name: "Test"
- run: make --directory ${{ env.CROSS_BUILD_WASI }} test
+ run: make --directory "${CROSS_BUILD_WASI}" test
diff --git a/.github/workflows/reusable-windows-msi.yml b/.github/workflows/reusable-windows-msi.yml
index abdb1a1..d0d53db 100644
--- a/.github/workflows/reusable-windows-msi.yml
+++ b/.github/workflows/reusable-windows-msi.yml
@@ -17,8 +17,11 @@ jobs:
runs-on: windows-latest
timeout-minutes: 60
env:
+ ARCH: ${{ inputs.arch }}
IncludeFreethreaded: true
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- name: Build CPython installer
- run: .\Tools\msi\build.bat --doc -${{ inputs.arch }}
+ run: .\Tools\msi\build.bat --doc -"${ARCH}"
diff --git a/.github/workflows/reusable-windows.yml b/.github/workflows/reusable-windows.yml
index 12b68d6..459d2b2 100644
--- a/.github/workflows/reusable-windows.yml
+++ b/.github/workflows/reusable-windows.yml
@@ -26,8 +26,12 @@ jobs:
name: 'build and test (${{ inputs.arch }})'
runs-on: ${{ inputs.os }}
timeout-minutes: 60
+ env:
+ ARCH: ${{ inputs.arch }}
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- name: Register MSVC problem matcher
if: inputs.arch != 'Win32'
run: echo "::add-matcher::.github/problem-matchers/msvc.json"
@@ -35,8 +39,9 @@ jobs:
run: >-
.\\PCbuild\\build.bat
-e -d -v
- -p ${{ inputs.arch }}
+ -p "${ARCH}"
${{ fromJSON(inputs.free-threading) && '--disable-gil' || '' }}
+ shell: bash
- name: Display build info # FIXME(diegorusso): remove the `if`
if: inputs.arch != 'arm64'
run: .\\python.bat -m test.pythoninfo
@@ -44,6 +49,7 @@ jobs:
if: inputs.arch != 'arm64'
run: >-
.\\PCbuild\\rt.bat
- -p ${{ inputs.arch }}
+ -p "${ARCH}"
-d -q --fast-ci
${{ fromJSON(inputs.free-threading) && '--disable-gil' || '' }}
+ shell: bash
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index f97587e..7578189 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -4,14 +4,13 @@ on:
schedule:
- cron: "0 */6 * * *"
-permissions:
- pull-requests: write
-
jobs:
stale:
if: github.repository_owner == 'python'
runs-on: ubuntu-latest
+ permissions:
+ pull-requests: write
timeout-minutes: 10
steps:
diff --git a/.github/workflows/verify-ensurepip-wheels.yml b/.github/workflows/verify-ensurepip-wheels.yml
index 83b007f..463e7bf 100644
--- a/.github/workflows/verify-ensurepip-wheels.yml
+++ b/.github/workflows/verify-ensurepip-wheels.yml
@@ -26,6 +26,8 @@ jobs:
timeout-minutes: 10
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- uses: actions/setup-python@v5
with:
python-version: '3'
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..eeda8d9
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,6 @@
+# Configuration for the zizmor static analysis tool, run via pre-commit in CI
+# https://woodruffw.github.io/zizmor/configuration/
+rules:
+ dangerous-triggers:
+ ignore:
+ - documentation-links.yml
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index ccaf239..107f3b2 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,6 +1,6 @@
repos:
- repo: https://github.com/astral-sh/ruff-pre-commit
- rev: v0.7.1
+ rev: v0.8.2
hooks:
- id: ruff
name: Run Ruff (lint) on Doc/
@@ -51,7 +51,7 @@ repos:
types_or: [c, inc, python, rst]
- repo: https://github.com/python-jsonschema/check-jsonschema
- rev: 0.29.4
+ rev: 0.30.0
hooks:
- id: check-dependabot
- id: check-github-workflows
@@ -61,6 +61,11 @@ repos:
hooks:
- id: actionlint
+ - repo: https://github.com/woodruffw/zizmor-pre-commit
+ rev: v0.8.0
+ hooks:
+ - id: zizmor
+
- repo: https://github.com/sphinx-contrib/sphinx-lint
rev: v1.0.0
hooks:
generated by cgit v0.12 at 2025-03-19 21:29:51 (GMT)