Merge branch 'master' into handle-escape-less

.github/workflows/builddoc.yml

@@ -17,7 +17,7 @@ env:
   UV_SYSTEM_PYTHON: "1"  # make uv do global installs
 
 jobs:
-  build:
+  verbose:
     runs-on: ubuntu-latest
 
     steps:
@@ -40,7 +40,7 @@ jobs:
       run: >
         sphinx-build
         -M html ./doc ./build/sphinx
-        -vv
+        --verbose
         --jobs=auto
         --show-traceback
         --fail-on-warning

.github/workflows/create-release.yml

@@ -9,30 +9,81 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+env:
+  FORCE_COLOR: "1"
+  UV_SYSTEM_PYTHON: "1"  # make uv do global installs
+
 jobs:
   publish-pypi:
     runs-on: ubuntu-latest
     name: PyPI Release
     environment: release
+    if: github.repository_owner == 'sphinx-doc'
     permissions:
+      attestations: write  # for actions/attest
       id-token: write  # for PyPI trusted publishing
     steps:
       - uses: actions/checkout@v4
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
           python-version: "3"
-          cache: pip
-          cache-dependency-path: pyproject.toml
+      - name: Install uv
+        run: >
+          curl --no-progress-meter --location --fail
+          --proto '=https' --tlsv1.2
+          "https://astral.sh/uv/install.sh"
+          | sh
 
       - name: Install build dependencies (pypa/build, twine)
         run: |
-          pip install -U pip
-          pip install build twine
+          uv pip install build "twine>=5.1"
+          # resolution fails without betterproto and protobuf-specs
+          uv pip install "pypi-attestations~=0.0.12" "sigstore-protobuf-specs==0.3.2" "betterproto==2.0.0b6"
 
       - name: Build distribution
         run: python -m build
 
+      - name: Check distribution
+        run: |
+          twine check dist/*
+
+      - name: Create Sigstore attestations for built distributions
+        uses: actions/attest@v1
+        id: attest
+        with:
+          subject-path: "dist/*"
+          predicate-type: "https://docs.pypi.org/attestations/publish/v1"
+          predicate: "null"
+          show-summary: "true"
+
+      - name: Convert attestations to PEP 740
+        # workflow_ref example: sphinx-doc/sphinx/.github/workflows/create-release.yml@refs/heads/master
+        run: >
+          python utils/convert_attestations.py
+          "${{ steps.attest.outputs.bundle-path }}"
+          "https://github.com/${{ github.workflow_ref }}"
+
+      - name: Inspect PEP 740 attestations
+        run: |
+          python -m pypi_attestations inspect dist/*.publish.attestation
+
+      - name: Prepare attestation bundles for uploading
+        run: |
+          mkdir -p /tmp/attestation-bundles
+          cp "${{ steps.attest.outputs.bundle-path }}" /tmp/attestation-bundles/
+          cp dist/*.publish.attestation /tmp/attestation-bundles/
+
+      - name: Upload attestation bundles
+        uses: actions/upload-artifact@v4
+        with:
+          name: attestation-bundles
+          path: /tmp/attestation-bundles/
+
       - name: Mint PyPI API token
         id: mint-token
         uses: actions/github-script@v7
@@ -65,13 +116,13 @@ jobs:
           TWINE_USERNAME: "__token__"
           TWINE_PASSWORD: "${{ steps.mint-token.outputs.api-token }}"
         run: |
-          twine check dist/*
-          twine upload dist/*
+          twine upload dist/* --attestations
 
   github-release:
     runs-on: ubuntu-latest
     name: GitHub release
     environment: release
+    if: github.repository_owner == 'sphinx-doc'
     permissions:
       contents: write  # for softprops/action-gh-release to create GitHub release
     steps:

.github/workflows/lint.yml

@@ -83,6 +83,26 @@ jobs:
     - name: Type check with mypy
       run: mypy
 
+  pyright:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: "3"
+    - name: Install uv
+      run: >
+        curl --no-progress-meter --location --fail
+        --proto '=https' --tlsv1.2
+        "https://astral.sh/uv/install.sh"
+        | sh
+    - name: Install dependencies
+      run: uv pip install ".[lint,test]"
+    - name: Type check with pyright
+      run: pyright
+
   docs-lint:
     runs-on: ubuntu-latest
 

.github/workflows/main.yml

@@ -29,19 +29,20 @@ jobs:
   ubuntu:
     runs-on: ubuntu-latest
     name: Python ${{ matrix.python }} (Docutils ${{ matrix.docutils }})
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
         python:
-        - "3.10"
         - "3.11"
         - "3.12"
+        - "3.13"
         docutils:
         - "0.20"
         - "0.21"
 #        include:
 #        # test every supported Docutils version for the latest supported Python
-#        - python: "3.12"
+#        - python: "3.13"
 #          docutils: "0.20"
 
     steps:
@@ -72,28 +73,30 @@ jobs:
   deadsnakes:
     runs-on: ubuntu-latest
     name: Python ${{ matrix.python }} (Docutils ${{ matrix.docutils }})
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
         python:
-        - "3.13-dev"
+        - "3.14"
         docutils:
         - "0.20"
         - "0.21"
 
     steps:
     - uses: actions/checkout@v4
     - name: Set up Python ${{ matrix.python }} (deadsnakes)
-      uses: deadsnakes/action@v3.1.0
+      uses: deadsnakes/action@v3.2.0
       with:
-        python-version: ${{ matrix.python }}
+        python-version: ${{ matrix.python }}-dev
     - name: Check Python version
       run: python --version --version
     - name: Install graphviz
       run: sudo apt-get install graphviz
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
+        sed -i 's/flit_core>=3.7/flit_core @ git+https:\/\/github.com\/pypa\/flit.git#subdirectory=flit_core/' pyproject.toml
         python -m pip install .[test]
     - name: Install Docutils ${{ matrix.docutils }}
       run: python -m pip install --upgrade "docutils~=${{ matrix.docutils }}.0"
@@ -102,22 +105,20 @@ jobs:
       env:
         PYTHONWARNINGS: "error"  # treat all warnings as errors
 
-  deadsnakes-free-threraded:
+  free-threaded:
     runs-on: ubuntu-latest
-    name: Python ${{ matrix.python }} (Docutils ${{ matrix.docutils }}; free-threaded)
+    name: Python ${{ matrix.python }} (free-threaded)
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
         python:
-        - "3.13-dev"
-        docutils:
-        - "0.20"
-        - "0.21"
+        - "3.13"
 
     steps:
     - uses: actions/checkout@v4
     - name: Set up Python ${{ matrix.python }} (deadsnakes)
-      uses: deadsnakes/action@v3.1.0
+      uses: deadsnakes/action@v3.2.0
       with:
         python-version: ${{ matrix.python }}
         nogil: true
@@ -129,8 +130,40 @@ jobs:
       run: |
         python -m pip install --upgrade pip
         python -m pip install .[test]
-    - name: Install Docutils ${{ matrix.docutils }}
-      run: python -m pip install --upgrade "docutils~=${{ matrix.docutils }}.0"
+    # markupsafe._speedups has not declared that it can run safely without the GIL
+    - name: Remove markupsafe._speedups
+      run: rm -rf "$(python -c 'from markupsafe._speedups import __file__ as f; print(f)')"
+    - name: Test with pytest
+      run: python -m pytest -vv --durations 25
+      env:
+        PYTHONWARNINGS: "error"  # treat all warnings as errors
+
+  deadsnakes-free-threaded:
+    runs-on: ubuntu-latest
+    name: Python ${{ matrix.python }} (free-threaded)
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        python:
+        - "3.14"
+
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up Python ${{ matrix.python }} (deadsnakes)
+      uses: deadsnakes/[email protected]
+      with:
+        python-version: ${{ matrix.python }}-dev
+        nogil: true
+    - name: Check Python version
+      run: python --version --version
+    - name: Install graphviz
+      run: sudo apt-get install graphviz
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        sed -i 's/flit_core>=3.7/flit_core @ git+https:\/\/github.com\/pypa\/flit.git#subdirectory=flit_core/' pyproject.toml
+        python -m pip install .[test]
     # markupsafe._speedups has not declared that it can run safely without the GIL
     - name: Remove markupsafe._speedups
       run: rm -rf "$(python -c 'from markupsafe._speedups import __file__ as f; print(f)')"
@@ -142,6 +175,7 @@ jobs:
   windows:
     runs-on: windows-2019
     name: Windows
+    timeout-minutes: 15
 
     steps:
     - uses: actions/checkout@v4
@@ -167,6 +201,7 @@ jobs:
   docutils-latest:
     runs-on: ubuntu-latest
     name: Docutils HEAD
+    timeout-minutes: 15
 
     steps:
     - name: Install epubcheck
@@ -204,6 +239,7 @@ jobs:
   oldest-supported:
     runs-on: ubuntu-latest
     name: Oldest supported
+    timeout-minutes: 15
 
     steps:
     - uses: actions/checkout@v4
@@ -233,6 +269,7 @@ jobs:
   latex:
     runs-on: ubuntu-latest
     name: LaTeX
+    timeout-minutes: 15
     container:
       image: ghcr.io/sphinx-doc/sphinx-ci
 
@@ -262,6 +299,7 @@ jobs:
     if: github.event_name == 'push' && github.repository_owner == 'sphinx-doc'
     runs-on: ubuntu-latest
     name: Coverage
+    timeout-minutes: 15
 
     steps:
     - uses: actions/checkout@v4

.github/workflows/transifex.yml

@@ -67,7 +67,7 @@ jobs:
     - name: Compile message catalogs
       run: python utils/babel_runner.py compile
     - name: Create Pull Request
-      uses: peter-evans/create-pull-request@v6
+      uses: peter-evans/create-pull-request@v7
       with:
         add-paths: |
           sphinx/locale