Merge branch 'main' into add-zizmor

.codecov.yml

@@ -0,0 +1,33 @@
+# -- repository yaml --
+
+# Explicitly wait for all jobs to finish, as wait_for_ci prematurely triggers.
+# See https://github.com/python-trio/trio/issues/2689
+codecov:
+  notify:
+    # This number needs to be changed whenever the number of runs in CI is changed.
+    # Another option is codecov-cli: https://github.com/codecov/codecov-cli#send-notifications
+    after_n_builds: 31
+    wait_for_ci: false
+    notify_error: true # if uploads fail, replace cov comment with a comment with errors.
+  require_ci_to_pass: false
+
+  # Publicly exposing the token has some small risks from mistakes or malicious actors.
+  # See https://docs.codecov.com/docs/codecov-tokens for correctly configuring it.
+  token: 87cefb17-c44b-4f2f-8b30-1fff5769ce46
+
+# only post PR comment if coverage changes
+comment:
+  require_changes: true
+
+coverage:
+  # required range
+  precision: 5
+  round: down
+  range: 100..100
+  status:
+    project:
+      default:
+        target: 100%
+    patch:
+      default:
+        target: 100%  # require patches to be 100%

.github/workflows/ci.yml

@@ -14,9 +14,133 @@ concurrency:
   group: ${{ github.ref }}-${{ github.workflow }}-${{ github.event_name }}${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && format('-{0}', github.sha) || '' }}
   cancel-in-progress: true
 
+env:
+  dists-artifact-name: python-package-distributions
+  dist-name: trio
+
 jobs:
+  build:
+    name: 👷 dists
+
+    runs-on: ubuntu-latest
+
+    outputs:
+      dist-version: ${{ steps.dist-version.outputs.version }}
+      sdist-artifact-name: ${{ steps.artifact-name.outputs.sdist }}
+      wheel-artifact-name: ${{ steps.artifact-name.outputs.wheel }}
+
+    steps:
+      - name: Switch to using Python 3.11
+        uses: actions/setup-python@v5
+        with:
+          python-version: 3.11
+
+      - name: Grab the source from Git
+        uses: actions/checkout@v4
+
+      - name: Get the dist version
+        id: dist-version
+        run: >-
+          echo "version=$(
+          grep ^__version__ src/trio/_version.py
+          | sed 's#__version__ = "\([^"]\+\)"#\1#'
+          )"
+          >> "${GITHUB_OUTPUT}"
+
+      - name: Set the expected dist artifact names
+        id: artifact-name
+        run: |
+          echo 'sdist=${{ env.dist-name }}-*.tar.gz' >> "${GITHUB_OUTPUT}"
+          echo 'wheel=${{
+            env.dist-name
+          }}-*-py3-none-any.whl' >> "${GITHUB_OUTPUT}"
+
+      - name: Install build
+        run: python -Im pip install build
+
+      - name: Build dists
+        run: python -Im build
+      - name: Verify that the artifacts with expected names got created
+        run: >-
+          ls -1
+          dist/${{ steps.artifact-name.outputs.sdist }}
+          dist/${{ steps.artifact-name.outputs.wheel }}
+      - name: Store the distribution packages
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ env.dists-artifact-name }}
+          # NOTE: Exact expected file names are specified here
+          # NOTE: as a safety measure — if anything weird ends
+          # NOTE: up being in this dir or not all dists will be
+          # NOTE: produced, this will fail the workflow.
+          path: |
+            dist/${{ steps.artifact-name.outputs.sdist }}
+            dist/${{ steps.artifact-name.outputs.wheel }}
+          retention-days: 5
+
+      - name: >-
+          Smoke-test:
+          retrieve the project source from an sdist inside the GHA artifact
+        uses: re-actors/checkout-python-sdist@release/v2
+        with:
+          source-tarball-name: ${{ steps.artifact-name.outputs.sdist }}
+          workflow-artifact-name: ${{ env.dists-artifact-name }}
+
+      - name: >-
+          Smoke-test: move the sdist-retrieved dir into sdist-src
+        run: |
+          mv -v '${{ github.workspace }}' '${{ runner.temp }}/sdist-src'
+          mkdir -pv '${{ github.workspace }}'
+          mv -v '${{ runner.temp }}/sdist-src' '${{ github.workspace }}/sdist-src'
+        shell: bash -eEuo pipefail {0}
+
+      - name: >-
+          Smoke-test: grab the source from Git into git-src
+        uses: actions/checkout@v4
+        with:
+          path: git-src
+
+      - name: >-
+          Smoke-test: install test requirements from the Git repo
+        run: >-
+          python -Im
+          pip install -c test-requirements.txt -r test-requirements.txt
+        shell: bash -eEuo pipefail {0}
+        working-directory: git-src
+
+      - name: >-
+          Smoke-test: collect tests from the Git repo
+        env:
+          PYTHONPATH: src/
+        run: >-
+          pytest --collect-only -qq .
+          | sort
+          | tee collected-tests
+        shell: bash -eEuo pipefail {0}
+        working-directory: git-src
+
+      - name: >-
+          Smoke-test: collect tests from the sdist tarball
+        env:
+          PYTHONPATH: src/
+        run: >-
+          pytest --collect-only -qq .
+          | sort
+          | tee collected-tests
+        shell: bash -eEuo pipefail {0}
+        working-directory: sdist-src
+
+      - name: >-
+          Smoke-test:
+          verify that all the tests from Git are included in the sdist
+        run: diff --unified sdist-src/collected-tests git-src/collected-tests
+        shell: bash -eEuo pipefail {0}
+
   Windows:
     name: 'Windows (${{ matrix.python }}, ${{ matrix.arch }}${{ matrix.extra_name }})'
+    needs:
+      - build
+
     timeout-minutes: 20
     runs-on: 'windows-latest'
     strategy:
@@ -58,10 +182,11 @@ jobs:
         || false
       }}
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - name: Retrieve the project source from an sdist inside the GHA artifact
+        uses: re-actors/checkout-python-sdist@release/v2
         with:
-          persist-credentials: false
+          source-tarball-name: ${{ needs.build.outputs.sdist-artifact-name }}
+          workflow-artifact-name: ${{ env.dists-artifact-name }}
       - name: Setup python
         uses: actions/setup-python@v5
         with:
@@ -87,12 +212,18 @@ jobs:
         uses: codecov/codecov-action@v3
         with:
           directory: empty
-          token: 87cefb17-c44b-4f2f-8b30-1fff5769ce46
           name: Windows (${{ matrix.python }}, ${{ matrix.arch }}${{ matrix.extra_name }})
+          # multiple flags is marked as an error in codecov UI, but is actually fine
+          # https://github.com/codecov/feedback/issues/567
           flags: Windows,${{ matrix.python }}
+          # this option cannot be set in .codecov.yml
+          fail_ci_if_error: true
 
   Ubuntu:
     name: 'Ubuntu (${{ matrix.python }}${{ matrix.extra_name }})'
+    needs:
+      - build
+
     timeout-minutes: 10
     runs-on: 'ubuntu-latest'
     strategy:
@@ -120,7 +251,14 @@ jobs:
         || false
       }}
     steps:
-      - name: Checkout
+      - name: Retrieve the project source from an sdist inside the GHA artifact
+        if: matrix.check_formatting != '1'
+        uses: re-actors/checkout-python-sdist@release/v2
+        with:
+          source-tarball-name: ${{ needs.build.outputs.sdist-artifact-name }}
+          workflow-artifact-name: ${{ env.dists-artifact-name }}
+      - name: Grab the source from Git
+        if: matrix.check_formatting == '1'
         uses: actions/checkout@v4
         with:
           persist-credentials: false
@@ -135,16 +273,21 @@ jobs:
         env:
           CHECK_FORMATTING: '${{ matrix.check_formatting }}'
           NO_TEST_REQUIREMENTS: '${{ matrix.no_test_requirements }}'
-      - if: always()
+      - if: >-
+          always()
+          && matrix.check_formatting != '1'
         uses: codecov/codecov-action@v3
         with:
           directory: empty
-          token: 87cefb17-c44b-4f2f-8b30-1fff5769ce46
           name: Ubuntu (${{ matrix.python }}${{ matrix.extra_name }})
           flags: Ubuntu,${{ matrix.python }}
+          fail_ci_if_error: true
 
   macOS:
     name: 'macOS (${{ matrix.python }})'
+    needs:
+      - build
+
     timeout-minutes: 15
     runs-on: 'macos-latest'
     strategy:
@@ -161,10 +304,11 @@ jobs:
         || false
       }}
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - name: Retrieve the project source from an sdist inside the GHA artifact
+        uses: re-actors/checkout-python-sdist@release/v2
         with:
-          persist-credentials: false
+          source-tarball-name: ${{ needs.build.outputs.sdist-artifact-name }}
+          workflow-artifact-name: ${{ env.dists-artifact-name }}
       - name: Setup python
         uses: actions/setup-python@v5
         with:
@@ -177,40 +321,51 @@ jobs:
         uses: codecov/codecov-action@v3
         with:
           directory: empty
-          token: 87cefb17-c44b-4f2f-8b30-1fff5769ce46
           name: macOS (${{ matrix.python }})
           flags: macOS,${{ matrix.python }}
+          fail_ci_if_error: true
 
   # run CI on a musl linux
   Alpine:
     name: "Alpine"
+    needs:
+      - build
+
     runs-on: ubuntu-latest
     container: alpine
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
       - name: Install necessary packages
         # can't use setup-python because that python doesn't seem to work;
         # `python3-dev` (rather than `python:alpine`) for some ctypes reason,
         # `nodejs` for pyright (`node-env` pulls in nodejs but that takes a while and can time out the test).
         # `perl` for a platform independent `sed -i` alternative
         run: apk update && apk add python3-dev bash nodejs perl
+      - name: Retrieve the project source from an sdist inside the GHA artifact
+        # must be after `apk add` because it relies on `bash` existing
+        uses: re-actors/checkout-python-sdist@release/v2
+        with:
+          source-tarball-name: ${{ needs.build.outputs.sdist-artifact-name }}
+          workflow-artifact-name: ${{ env.dists-artifact-name }}
       - name: Enter virtual environment
         run: python -m venv .venv
       - name: Run tests
         run: source .venv/bin/activate && ./ci.sh
+      - name: Get Python version for codecov flag
+        id: get-version
+        run: echo "version=$(python -V | cut -d' ' -f2 | cut -d'.' -f1,2)" >> "${GITHUB_OUTPUT}"
       - if: always()
         uses: codecov/codecov-action@v3
         with:
           directory: empty
-          token: 87cefb17-c44b-4f2f-8b30-1fff5769ce46
           name: Alpine
-          flags: Alpine,3.12
+          flags: Alpine,${{ steps.get-version.outputs.version }}
+          fail_ci_if_error: true
 
   Cython:
     name: "Cython"
+    needs:
+      - build
+
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -225,26 +380,46 @@ jobs:
           - python: '3.13' # We support running cython3 on 3.13
             cython: '>=3'  # cython 3 (or greater)
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - name: Retrieve the project source from an sdist inside the GHA artifact
+        uses: re-actors/checkout-python-sdist@release/v2
         with:
-          persist-credentials: false
+          source-tarball-name: ${{ needs.build.outputs.sdist-artifact-name }}
+          workflow-artifact-name: ${{ env.dists-artifact-name }}
       - name: Setup python
         uses: actions/setup-python@v5
         with:
             python-version: '${{ matrix.python }}'
             cache: pip
         # setuptools is needed to get distutils on 3.12, which cythonize requires
       - name: install trio and setuptools
-        run: python -m pip install --upgrade pip . setuptools
+        run: python -m pip install --upgrade pip . setuptools 'coverage[toml]'
+
+      - name: add cython plugin to the coveragepy config
+        run: >-
+          sed -i 's#plugins\s=\s\[\]#plugins = ["Cython.Coverage"]#'
+          pyproject.toml
 
       - name: install cython & compile pyx file
+        env:
+          CFLAGS: ${{ env.CFLAGS }} -DCYTHON_TRACE_NOGIL=1
         run: |
           python -m pip install "cython${{ matrix.cython }}"
-          cythonize --inplace tests/cython/test_cython.pyx
+          cythonize --inplace -X linetrace=True tests/cython/test_cython.pyx
 
       - name: import & run module
-        run: python -c 'import tests.cython.test_cython'
+        run: coverage run -m tests.cython.run_test_cython
+
+      - name: get Python version for codecov flag
+        id: get-version
+        run: >-
+          echo "version=$(python -V | cut -d' ' -f2 | cut -d'.' -f1,2)"
+          >> "${GITHUB_OUTPUT}"
+      - if: always()
+        uses: codecov/codecov-action@v5
+        with:
+          name: Cython
+          flags: Cython,${{ steps.get-version.outputs.version }}
+          fail_ci_if_error: true
 
   # https://github.com/marketplace/actions/alls-green#why
   check:  # This job does nothing and is only used for the branch protection

.gitignore

@@ -1,3 +1,6 @@
+# In case somebody wants to restore the directory for local testing
+notes-to-self/
+
 # Project-specific generated files
 docs/build/
 

.pre-commit-config.yaml

@@ -22,7 +22,7 @@ repos:
     hooks:
       - id: black
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.8.2
+    rev: v0.8.3
     hooks:
       - id: ruff
         types: [file]