Merge branch '3.14' into pr-145397

Author: ambv

.github/actionlint.yaml

@@ -1,8 +1,3 @@
-self-hosted-runner:
-  # Pending https://github.com/rhysd/actionlint/issues/533
-  # and https://github.com/rhysd/actionlint/issues/571
-  labels: ["windows-11-arm", "macos-15-intel"]
-
 config-variables: null
 
 paths:

.github/workflows/build.yml

@@ -64,7 +64,7 @@ jobs:
       - name: Install dependencies
         run: |
             sudo ./.github/workflows/posix-deps-apt.sh
-            sudo apt-get install -yq abigail-tools
+            sudo apt-get install -yq --no-install-recommends abigail-tools
       - name: Build CPython
         env:
           CFLAGS: -g3 -O0
@@ -158,8 +158,6 @@ jobs:
         run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
       - name: Install dependencies
         run: sudo ./.github/workflows/posix-deps-apt.sh
-      - name: Add ccache to PATH
-        run: echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
       - name: Configure CPython
         run: |
           # Build Python with the libpython dynamic library
@@ -443,9 +441,6 @@ jobs:
     - name: Install OpenSSL
       if: steps.cache-openssl.outputs.cache-hit != 'true'
       run: python3 Tools/ssl/multissltests.py --steps=library --base-directory "$MULTISSL_DIR" --openssl "$OPENSSL_VER" --system Linux
-    - name: Add ccache to PATH
-      run: |
-        echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
     - name: Setup directory envs for out-of-tree builds
       run: |
         echo "CPYTHON_RO_SRCDIR=$(realpath -m "${GITHUB_WORKSPACE}"/../cpython-ro-srcdir)" >> "$GITHUB_ENV"
@@ -561,9 +556,6 @@ jobs:
     - name: Install OpenSSL
       if: steps.cache-openssl.outputs.cache-hit != 'true'
       run: python3 Tools/ssl/multissltests.py --steps=library --base-directory "$MULTISSL_DIR" --openssl "$OPENSSL_VER" --system Linux
-    - name: Add ccache to PATH
-      run: |
-        echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
     - name: Configure CPython
       run: ./configure --config-cache --with-address-sanitizer --without-pymalloc
     - name: Build CPython

.github/workflows/posix-deps-apt.sh

@@ -1,10 +1,9 @@
 #!/bin/sh
 apt-get update
 
-apt-get -yq install \
+apt-get -yq --no-install-recommends install \
     build-essential \
     pkg-config \
-    ccache \
     gdb \
     lcov \
     libb2-dev \

.github/workflows/regen-abidump.sh

@@ -2,7 +2,7 @@ set -ex
 
 export DEBIAN_FRONTEND=noninteractive
 ./.github/workflows/posix-deps-apt.sh
-apt-get install -yq abigail-tools python3
+apt-get install -yq --no-install-recommends abigail-tools python3
 export CFLAGS="-g3 -O0"
 ./configure --enable-shared && make
 make regen-abidump

.github/workflows/reusable-docs.yml

@@ -92,7 +92,7 @@ jobs:
         restore-keys: |
           ubuntu-doc-
     - name: 'Install Dependencies'
-      run: sudo ./.github/workflows/posix-deps-apt.sh && sudo apt-get install wamerican
+      run: sudo ./.github/workflows/posix-deps-apt.sh && sudo apt-get install --no-install-recommends wamerican
     - name: 'Configure CPython'
       run: ./configure --with-pydebug
     - name: 'Build CPython'

.github/workflows/reusable-san.yml

@@ -66,9 +66,6 @@ jobs:
       env:
         SANITIZER: ${{ inputs.sanitizer }}
         SAN_LOG_OPTION: log_path=${{ github.workspace }}/san_log
-    - name: Add ccache to PATH
-      run: |
-        echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
     - name: Configure CPython
       run: >-
         ./configure

.github/workflows/reusable-ubuntu.yml

@@ -42,7 +42,7 @@ jobs:
       if: ${{ fromJSON(inputs.bolt-optimizations) }}
       run: |
         sudo bash -c "$(wget -O - https://apt.llvm.org/llvm.sh)" ./llvm.sh 19
-        sudo apt-get install bolt-19
+        sudo apt-get install --no-install-recommends bolt-19
         echo PATH="$(llvm-config-19 --bindir):$PATH" >> $GITHUB_ENV
     - name: Configure OpenSSL env vars
       run: |
@@ -58,9 +58,6 @@ jobs:
     - name: Install OpenSSL
       if: steps.cache-openssl.outputs.cache-hit != 'true'
       run: python3 Tools/ssl/multissltests.py --steps=library --base-directory "$MULTISSL_DIR" --openssl "$OPENSSL_VER" --system Linux
-    - name: Add ccache to PATH
-      run: |
-        echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
     - name: Setup directory envs for out-of-tree builds
       run: |
         echo "CPYTHON_RO_SRCDIR=$(realpath -m "${GITHUB_WORKSPACE}"/../cpython-ro-srcdir)" >> "$GITHUB_ENV"

.github/workflows/reusable-wasi.yml

@@ -38,8 +38,6 @@ jobs:
         mkdir "${WASI_SDK_PATH}" && \
         curl -s -S --location "https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${WASI_SDK_VERSION}/wasi-sdk-${WASI_SDK_VERSION}.0-x86_64-linux.tar.gz" | \
         tar --strip-components 1 --directory "${WASI_SDK_PATH}" --extract --gunzip
-    - name: "Add ccache to PATH"
-      run: echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
     - name: "Install Python"
       uses: actions/setup-python@v6
       with:

.github/workflows/verify-expat.yml

@@ -0,0 +1,32 @@
+name: Verify bundled libexpat
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - 'Modules/expat/**'
+      - '.github/workflows/verify-expat.yml'
+  pull_request:
+    paths:
+      - 'Modules/expat/**'
+      - '.github/workflows/verify-expat.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - name: Download and verify bundled libexpat files
+        run: |
+          ./Modules/expat/refresh.sh
+          git diff --exit-code Modules/expat/

.github/zizmor.yml

@@ -1,5 +1,5 @@
 # Configuration for the zizmor static analysis tool, run via prek in CI
-# https://woodruffw.github.io/zizmor/configuration/
+# https://docs.zizmor.sh/configuration/
 rules:
   dangerous-triggers:
     ignore: