6464 run : |
6565 apt update && apt install git -yq
6666 git config --global --add safe.directory "$GITHUB_WORKSPACE"
67- uses : actions/checkout@v6
67+ uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6868 with :
6969 fetch-depth : 1
7070 persist-credentials : false
@@ -101,10 +101,10 @@ jobs:
101101 needs : build-context
102102 if : needs.build-context.outputs.run-tests == 'true'
103103 steps :
104- - uses : actions/checkout@v6
104+ - uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
105105 with :
106106 persist-credentials : false
107- - uses : actions/setup-python@v6
107+ - uses : actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
108108 with :
109109 python-version : ' 3.x'
110110 - name : Runner image version
@@ -165,13 +165,21 @@ jobs:
165165 free-threading :
166166 - false
167167 - true
168+ interpreter :
169+ - switch-case
168170 exclude :
169171 # Skip Win32 on free-threaded builds
170172 - { arch: Win32, free-threading: true }
173+ include :
174+ # msvc::musttail is currently only supported on x64,
175+ # and only supported on 3.15+.
176+ - { arch: x64, free-threading: false, interpreter: tail-call }
177+ - { arch: x64, free-threading: true, interpreter: tail-call }
171178 uses : ./.github/workflows/reusable-windows.yml
172179 with :
173180 arch : ${{ matrix.arch }}
174181 free-threading : ${{ matrix.free-threading }}
182+ interpreter : ${{ matrix.interpreter }}
175183
176184 build-windows-msi :
177185 # ${{ '' } is a hack to nest jobs under the same sidebar category.
@@ -198,10 +206,10 @@ jobs:
198206 strategy :
199207 fail-fast : false
200208 matrix :
201- # macos-14 is M1 , macos-15-intel is Intel.
209+ # macos-26 is Apple Silicon , macos-15-intel is Intel.
202210 # macos-15-intel only runs tests against the GIL-enabled CPython.
203211 os :
204- - macos-14
212+ - macos-26
205213 - macos-15-intel
206214 free-threading :
207215 - false
@@ -284,7 +292,7 @@ jobs:
284292 SSLLIB_DIR : ${{ github.workspace }}/multissl/${{ matrix.ssllib.name }}/${{ matrix.ssllib.version }}
285293 LD_LIBRARY_PATH : ${{ github.workspace }}/multissl/${{ matrix.ssllib.name }}/${{ matrix.ssllib.version }}/lib
286294 steps :
287- - uses : actions/checkout@v6
295+ - uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
288296 with :
289297 persist-credentials : false
290298 - name : Runner image version
@@ -295,7 +303,7 @@ jobs:
295303 run : sudo ./.github/workflows/posix-deps-apt.sh
296304 - name : ' Restore SSL library build'
297305 id : cache-ssl-lib
298- uses : actions/cache@v5
306+ uses : actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
299307 with :
300308 path : ./multissl/${{ matrix.ssllib.name }}/${{ matrix.ssllib.version }}
301309 key : ${{ matrix.os }}-multissl-${{ matrix.ssllib.name }}-${{ matrix.ssllib.version }}
@@ -337,13 +345,13 @@ jobs:
337345 matrix :
338346 include :
339347 - arch : aarch64
340- runs-on : macos-14
348+ runs-on : macos-26
341349 - arch : x86_64
342350 runs-on : ubuntu-24.04
343351
344352 runs-on : ${{ matrix.runs-on }}
345353 steps :
346- - uses : actions/checkout@v6
354+ - uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
347355 with :
348356 persist-credentials : false
349357 - name : Build and test
@@ -356,7 +364,7 @@ jobs:
356364 timeout-minutes : 60
357365 runs-on : macos-14
358366 steps :
359- - uses : actions/checkout@v6
367+ - uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
360368 with :
361369 persist-credentials : false
362370
@@ -370,7 +378,13 @@ jobs:
370378 sudo xcode-select --switch /Applications/Xcode_15.4.app
371379
372380name : Build and test
373- run : python3 Apple ci iOS --fast-ci --simulator 'iPhone SE (3rd generation),OS=17.5'
381+ run : python3 Platforms/Apple ci iOS --fast-ci --simulator 'iPhone SE (3rd generation),OS=17.5'
382+
383+ build-emscripten :
384+ name : ' Emscripten'
385+ needs : build-context
386+ if : needs.build-context.outputs.run-emscripten == 'true'
387+ uses : ./.github/workflows/reusable-emscripten.yml
374388
375389 build-wasi :
376390 name : ' WASI'
@@ -388,7 +402,7 @@ jobs:
388402 OPENSSL_VER : 3.5.5
389403 PYTHONSTRICTEXTENSIONBUILD : 1
390404 steps :
391- - uses : actions/checkout@v6
405+ - uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
392406 with :
393407 persist-credentials : false
394408 - name : Register gcc problem matcher
@@ -402,7 +416,7 @@ jobs:
402416 echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >> "$GITHUB_ENV"
403417name : ' Restore OpenSSL build'
404418 id : cache-openssl
405- uses : actions/cache@v5
419+ uses : actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
406420 with :
407421 path : ./multissl/openssl/${{ env.OPENSSL_VER }}
408422 key : ${{ runner.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
@@ -449,7 +463,7 @@ jobs:
449463 ./python -m venv "$VENV_LOC" && "$VENV_PYTHON" -m pip install -r "${GITHUB_WORKSPACE}/Tools/requirements-hypothesis.txt"
450464name : ' Restore Hypothesis database'
451465 id : cache-hypothesis-database
452- uses : actions/cache@v5
466+ uses : actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
453467 with :
454468 path : ${{ env.CPYTHON_BUILDDIR }}/.hypothesis/
455469 key : hypothesis-database-${{ github.head_ref || github.run_id }}
@@ -476,7 +490,7 @@ jobs:
476490 -x test_subprocess \
477491 -x test_signal \
478492 -x test_sysconfig
479- uses : actions/upload-artifact@v7
493+ uses : actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
480494 if : always()
481495 with :
482496 name : hypothesis-example-db
@@ -497,7 +511,7 @@ jobs:
497511 PYTHONSTRICTEXTENSIONBUILD : 1
498512 ASAN_OPTIONS : detect_leaks=0:allocator_may_return_null=1:handle_segv=0
499513 steps :
500- - uses : actions/checkout@v6
514+ - uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
501515 with :
502516 persist-credentials : false
503517 - name : Runner image version
@@ -507,7 +521,7 @@ jobs:
507521 - name : Install dependencies
508522 run : sudo ./.github/workflows/posix-deps-apt.sh
509523 - name : Set up GCC-10 for ASAN
510- uses : egor-tensin/setup-gcc@v2
524+ uses : egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
511525 with :
512526 version : 10
513527 - name : Configure OpenSSL env vars
@@ -517,7 +531,7 @@ jobs:
517531 echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >> "$GITHUB_ENV"
518532name : ' Restore OpenSSL build'
519533 id : cache-openssl
520- uses : actions/cache@v5
534+ uses : actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
521535 with :
522536 path : ./multissl/openssl/${{ env.OPENSSL_VER }}
523537 key : ${{ matrix.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
@@ -564,7 +578,7 @@ jobs:
564578 needs : build-context
565579 if : needs.build-context.outputs.run-ubuntu == 'true'
566580 steps :
567- - uses : actions/checkout@v6
581+ - uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
568582 with :
569583 persist-credentials : false
570584 - name : Runner image version
@@ -600,6 +614,7 @@ jobs:
600614 needs.build-context.outputs.run-ci-fuzz == 'true'
601615 || needs.build-context.outputs.run-ci-fuzz-stdlib == 'true'
602616permissions :
617+ contents : read
603618 security-events : write
604619 strategy :
605620 fail-fast : false
@@ -651,6 +666,7 @@ jobs:
651666 - build-ubuntu
652667 - build-ubuntu-ssltests
653668 - build-ios
669+ - build-emscripten
654670 - build-wasi
655671 - test-hypothesis
656672 - build-asan
@@ -665,6 +681,7 @@ jobs:
665681 with :
666682 allowed-failures : >-
667683 build-android,
684+ build-emscripten,
668685 build-windows-msi,
669686 build-ubuntu-ssltests,
670687 test-hypothesis,
@@ -707,6 +724,7 @@ jobs:
707724 }}
708725 ${{ !fromJSON(needs.build-context.outputs.run-android) && 'build-android,' || '' }}
709726 ${{ !fromJSON(needs.build-context.outputs.run-ios) && 'build-ios,' || '' }}
727+ ${{ !fromJSON(needs.build-context.outputs.run-emscripten) && 'build-emscripten,' || '' }}
710728 ${{ !fromJSON(needs.build-context.outputs.run-wasi) && 'build-wasi,' || '' }}
711729jobs : ${{ toJSON(needs) }}
712730 traceback_timestamps : ' iso'
0 commit comments