Merge branch 'main' into opt-authlib

Author: srittau

.flake8

@@ -2,7 +2,9 @@
 # Y: Flake8 is only used to run flake8-pyi, everything else is in Ruff
 select = Y
 # Ignore rules normally excluded by default
-extend-ignore = Y090,Y091
+# Also ignore Y041 (redundant (complex |) float | int), see
+# https://github.com/python/typeshed/issues/16059
+extend-ignore = Y041,Y090,Y091
 per-file-ignores =
   # Generated protobuf files:
   # Y021: Include docstrings

.github/renovate.json5

@@ -2,7 +2,7 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "dependencyDashboard": true,
   "suppressNotifications": ["prEditedNotification"],
-  "extends": ["config:recommended"],
+  "extends": ["config:recommended", "helpers:pinGitHubActionDigests"],
   "labels": ["bot: dependencies"],
   "rebaseLabel": ["bot: rebase"],
   "semanticCommits": "disabled",

.github/workflows/daily.yml

@@ -1,4 +1,4 @@
-name: Daily test
+name: Daily tests
 
 on:
   workflow_dispatch:
@@ -43,9 +43,11 @@ jobs:
       fail-fast: false
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Set up Python ${{ matrix.python-version }} on ${{ matrix.os }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip
@@ -67,8 +69,10 @@ jobs:
         shard-index: [0, 1, 2, 3]
       fail-fast: false
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.13"
           cache: pip
@@ -115,15 +119,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout typeshed
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           path: typeshed
+          persist-credentials: false
       - name: Checkout stub_uploader
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           repository: typeshed-internal/stub_uploader
           path: stub_uploader
-      - uses: astral-sh/setup-uv@v8.2.0
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           version-file: "typeshed/requirements-tests.txt"
       - name: Run tests
@@ -141,7 +147,7 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/github-script@v9
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/meta_tests.yml

@@ -1,5 +1,5 @@
 # This workflow is for testing typeshed's scripts and tests themselves
-name: Meta-tests
+name: Infrastructure tests
 
 on:
   workflow_dispatch:
@@ -28,18 +28,21 @@ concurrency:
 
 jobs:
   mypy:
-    name: Check scripts and tests with mypy
+    name: "mypy: type check"
     runs-on: ubuntu-latest
     strategy:
       matrix:
         platform: ["linux", "win32"]
       fail-fast: false
     steps:
-      - uses: actions/checkout@v7
-      - uses: astral-sh/setup-uv@v8.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           version-file: "requirements-tests.txt"
-      - run: |
+      - name: Run check_typeshed_structure.py
+        run: |
           uv run \
           --python=3.13 \
           --no-project \
@@ -48,42 +51,47 @@ jobs:
           --platform=${{ matrix.platform }}
 
   pyright:
-    name: Check scripts and tests with pyright
+    name: "pyright: type check"
     runs-on: ubuntu-latest
     strategy:
       matrix:
         python-platform: ["Linux", "Windows"]
       fail-fast: false
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.13"
-      - uses: astral-sh/setup-uv@v8.2.0
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           version-file: "requirements-tests.txt"
       - run: uv pip install -r requirements-tests.txt --system
       - name: Run pyright on typeshed
-        uses: jakebailey/pyright-action@v3
+        uses: jakebailey/pyright-action@8ec14b5cfe41f26e5f41686a31eb6012758217ef # v3
         with:
           version: PATH
           python-platform: ${{ matrix.python-platform }}
           python-version: "3.10" # Oldest version supported for running scripts and tests
           project: ./pyrightconfig.scripts_and_tests.json
 
   stubsabot-dry-run:
-    name: Stubsabot dry run
+    name: "stubsabot: dry run"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: astral-sh/setup-uv@v8.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           version-file: "requirements-tests.txt"
       - name: Git config
         run: |
           git config --global user.name stubsabot
           git config --global user.email '<>'
-      - run: |
+      - name: Run stubsabot
+        run: |
           uv run \
           --python=3.13 \
           --no-project \

.github/workflows/mypy_primer.yml

@@ -1,4 +1,4 @@
-name: Run mypy_primer
+name: mypy_primer
 
 on:
   # Only run on PR, since we diff against main
@@ -25,11 +25,12 @@ jobs:
         shard-index: [0, 1, 2, 3, 4, 5]
       fail-fast: false
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           path: typeshed_to_test
           fetch-depth: 0
-      - uses: actions/setup-python@v6
+          persist-credentials: false
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.13"
       - name: Install dependencies
@@ -62,15 +63,15 @@ jobs:
         run: |
           echo ${{ github.event.pull_request.number }} | tee pr_number.txt
       - name: Upload mypy_primer diff + PR number
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: ${{ matrix.shard-index == 0 }}
         with:
           name: mypy_primer_diffs-${{ matrix.shard-index }}
           path: |
             diff_${{ matrix.shard-index }}.txt
             pr_number.txt
       - name: Upload mypy_primer diff
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: ${{ matrix.shard-index != 0 }}
         with:
           name: mypy_primer_diffs-${{ matrix.shard-index }}
@@ -84,7 +85,7 @@ jobs:
       contents: read
     steps:
       - name: Merge artifacts
-        uses: actions/upload-artifact/merge@v7
+        uses: actions/upload-artifact/merge@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: mypy_primer_diffs
           pattern: mypy_primer_diffs-*

.github/workflows/mypy_primer_comment.yml

@@ -1,9 +1,11 @@
-name: Comment with mypy_primer diff
+name: mypy_primer (comment)
 
-on:
+# workflow_run is needed to comment on PRs from forks. This workflow only reads
+# artifacts as data; it never checks out or executes PR code.
+on: # zizmor: ignore[dangerous-triggers]
   workflow_run:
     workflows:
-      - Run mypy_primer
+      - mypy_primer
     types:
       - completed
 
@@ -18,7 +20,7 @@ jobs:
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
     steps:
       - name: Download diffs
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             const fs = require('fs');
@@ -44,7 +46,7 @@ jobs:
 
       - name: Post comment
         id: post-comment
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -79,8 +81,7 @@ jobs:
             return prNumber
 
       - name: Hide old comments
-        # v0.4.0
-        uses: kanga333/comment-hider@c12bb20b48aeb8fc098e35967de8d4f8018fffdf
+        uses: kanga333/comment-hider@c12bb20b48aeb8fc098e35967de8d4f8018fffdf # v0.4.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           leave_visible: 1

.github/workflows/stubsabot.yml

@@ -1,14 +1,11 @@
-name: Run stubsabot daily
+name: Stubsabot
 
 on:
   workflow_dispatch:
   schedule:
     - cron: "0 0 * * *"
 
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
+permissions: {}
 
 env:
   FORCE_COLOR: 1
@@ -18,16 +15,20 @@ jobs:
     name: Upgrade stubs with stubsabot
     if: github.repository == 'python/typeshed'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write # Create, update, and label PRs.
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           # use an ssh key so that checks automatically run on stubsabot PRs
           ssh-key: ${{ secrets.STUBSABOT_SSH_PRIVATE_KEY }}
           fetch-depth: 0
-      - uses: astral-sh/setup-uv@v8.2.0
+          persist-credentials: true # stubsabot needs the SSH key to push branches.
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           version-file: "requirements-tests.txt"
-      - name: git config
+      - name: Git config
         run: |
           git config --global user.name stubsabot
           git config --global user.email '<>'
@@ -47,8 +48,10 @@ jobs:
     runs-on: ubuntu-latest
     needs: [stubsabot]
     if: ${{ github.repository == 'python/typeshed' && always() && (needs.stubsabot.result == 'failure') }}
+    permissions:
+      issues: write
     steps:
-      - uses: actions/github-script@v9
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/stubtest_stdlib.yml

@@ -1,4 +1,4 @@
-name: Stdlib stubtest
+name: "Stubtest: stdlib"
 
 on:
   workflow_dispatch:
@@ -39,9 +39,11 @@ jobs:
       fail-fast: false
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Set up Python ${{ matrix.python-version }} on ${{ matrix.os }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip

.github/workflows/stubtest_third_party.yml

@@ -1,4 +1,4 @@
-name: Third-party stubtest
+name: "Stubtest: third-party"
 
 on:
   pull_request:
@@ -36,10 +36,11 @@ jobs:
       fail-fast: false
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-python@v6
+          persist-credentials: false
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.13"
           cache: pip
@@ -54,7 +55,7 @@ jobs:
           # This only runs stubtest on changed stubs, because it is much faster.
           # Use the daily.yml workflow to run stubtest on all third party stubs.
           function find_stubs {
-            git diff --name-only origin/${{ github.base_ref }} HEAD | \
+            git diff --name-only "origin/${GITHUB_BASE_REF}" HEAD | \
             egrep ^stubs/ | cut -d "/" -f 2 | sort -u | \
             (while read stub; do [ -d "stubs/$stub" ] && echo -n "$stub " || true; done)
           }