.github/ISSUE_TEMPLATE/feature.md

@@ -6,8 +6,8 @@ labels: "feature"
 
 **Feature**
 
-(A clear and concise description of your feature proposal.)
+<!-- Enter a clear and concise description of your feature proposal here. -->
 
 **Pitch**
 
-(Please explain why this feature should be implemented and how it would be used. Add examples, if applicable.)
+<!-- Please explain why this feature should be implemented and how it would be used. Add examples, if applicable. -->

.github/workflows/build_wheels.yml

@@ -5,12 +5,15 @@ on:
     branches: [main, master, 'release*']
     tags: ['*']
 
+permissions:
+  contents: write
+
 jobs:
   build-wheels:
     if: github.repository == 'python/mypy'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: actions/setup-python@v4
         with:
           python-version: '3.11'

.github/workflows/docs.yml

@@ -8,12 +8,23 @@ on:
   pull_request:
     paths:
     - 'docs/**'
+    # We now have a docs check that fails if any error codes don't have documentation,
+    # so it's important to do the docs build on all PRs touching mypy/errorcodes.py
+    # in case somebody's adding a new error code without any docs
+    - 'mypy/errorcodes.py'
     - 'mypyc/doc/**'
     - '**/*.rst'
     - '**/*.md'
     - CREDITS
     - LICENSE
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   docs:
     runs-on: ubuntu-latest
@@ -22,12 +33,12 @@ jobs:
       TOX_SKIP_MISSING_INTERPRETERS: False
       VERIFY_MYPY_ERROR_CODES: 1
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: actions/setup-python@v4
         with:
           python-version: '3.8'
       - name: Install tox
-        run: pip install --upgrade 'setuptools!=50' tox==4.4.4
+        run: pip install --upgrade 'setuptools!=50' tox==4.11.0
       - name: Setup tox environment
         run: tox run -e ${{ env.TOXENV }} --notest
       - name: Test

.github/workflows/mypy_primer.yml

@@ -15,6 +15,9 @@ on:
     - 'mypy/test/**'
     - 'test-data/**'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
@@ -30,7 +33,7 @@ jobs:
         shard-index: [0, 1, 2, 3, 4]
       fail-fast: false
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: mypy_to_test
           fetch-depth: 0

.github/workflows/sync_typeshed.yml

@@ -15,7 +15,7 @@ jobs:
     if: github.repository == 'python/mypy'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
         # TODO: use whatever solution ends up working for

.github/workflows/test.yml

@@ -15,6 +15,9 @@ on:
     - CREDITS
     - LICENSE
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
@@ -61,15 +64,15 @@ jobs:
           tox_extra_args: "-n 2"
           test_mypyc: true
         - name: Test suite with py312-ubuntu, mypyc-compiled
-          python: '3.12-dev'
+          python: '3.12'
           arch: x64
           os: ubuntu-latest
           toxenv: py
           tox_extra_args: "-n 2"
           test_mypyc: true
 
-        - name: mypyc runtime tests with py38-macos
-          python: '3.8.17'
+        - name: mypyc runtime tests with py39-macos
+          python: '3.9.18'
           arch: x64
           os: macos-latest
           toxenv: py
@@ -116,7 +119,7 @@ jobs:
       # Pytest
       PYTEST_ADDOPTS: --color=yes
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - uses: actions/setup-python@v4
       with:
         python-version: ${{ matrix.python }}
@@ -130,7 +133,7 @@ jobs:
         ./misc/build-debug-python.sh $PYTHONVERSION $PYTHONDIR $VENV
         source $VENV/bin/activate
     - name: Install tox
-      run: pip install --upgrade 'setuptools!=50' tox==4.4.4
+      run: pip install setuptools==68.2.2 tox==4.11.0
     - name: Compiled with mypyc
       if: ${{ matrix.test_mypyc }}
       run: |
@@ -159,7 +162,7 @@ jobs:
       CXX: i686-linux-gnu-g++
       CC: i686-linux-gnu-gcc
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Install 32-bit build dependencies
         run: |
           sudo dpkg --add-architecture i386 && \
@@ -182,7 +185,7 @@ jobs:
           default: 3.11.1
           command: python -c "import platform; print(f'{platform.architecture()=} {platform.machine()=}');"
       - name: Install tox
-        run: pip install --upgrade 'setuptools!=50' tox==4.4.4
+        run: pip install setuptools==68.2.2 tox==4.11.0
       - name: Setup tox environment
         run: tox run -e py --notest
       - name: Test

.github/workflows/test_stubgenc.yml

@@ -12,14 +12,21 @@ on:
     - 'mypy/stubdoc.py'
     - 'test-data/stubgen/**'
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   stubgenc:
     # Check stub file generation for a small pybind11 project
     # (full text match is required to pass)
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
 
     - name: Setup 🐍 3.8
       uses: actions/setup-python@v4

.pre-commit-config.yaml

@@ -1,16 +1,18 @@
 exclude: '^(mypyc/external/)|(mypy/typeshed/)'  # Exclude all vendored code from lints
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.4.0  # must match test-requirements.txt
+    rev: v4.5.0  # must match test-requirements.txt
     hooks:
       - id: trailing-whitespace
       - id: end-of-file-fixer
-  - repo: https://github.com/hauntsaninja/black-pre-commit-mirror
-    rev: 23.3.0  # must match test-requirements.txt
+  - repo: https://github.com/psf/black-pre-commit-mirror
+    rev: 23.9.1  # must match test-requirements.txt
     hooks:
       - id: black
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.0.272  # must match test-requirements.txt
+    rev: v0.1.0  # must match test-requirements.txt
     hooks:
       - id: ruff
         args: [--exit-non-zero-on-fix]
+ci:
+  autoupdate_schedule: quarterly