Merge upstream 3.12.8 release

Summary: This applies all upstream changes from upstream git commit `8e8a4baf652f6e1cee7acde9d78c4b6154539748` to `2dc476bcb9142cd25d7e1d52392b73a3dcdf1756`, which upgrades us from 3.12.4 to 3.12.8

Reviewed By: parulgupta1004, aleivag

Differential Revision: D68864264

fbshipit-source-id: 3e6ba4815229c6e56ae2228f45eba7c606d9a82d

Author: itamaro

.azure-pipelines/ci.yml

@@ -1,11 +1,11 @@
-trigger: ['main', '3.12', '3.11', '3.10', '3.9', '3.8', '3.7']
+trigger: ['main', '3.13', '3.12', '3.11', '3.10', '3.9', '3.8']
 
 jobs:
 - job: Prebuild
   displayName: Pre-build checks
 
   pool:
-    vmImage: ubuntu-22.04
+    vmImage: ubuntu-24.04
 
   steps:
   - template: ./prebuild-checks.yml

.github/CODEOWNERS

@@ -141,6 +141,7 @@ Lib/ast.py                    @isidentical
 **/*dataclasses*              @ericvsmith
 
 **/*idlelib*                  @terryjreedy
+/Doc/library/idle.rst         @terryjreedy
 
 **/*typing*                   @gvanrossum @JelleZijlstra @AlexWaygood
 

.github/workflows/build.yml

@@ -1,8 +1,5 @@
 name: Tests
 
-# gh-84728: "paths-ignore" is not used to skip documentation-only PRs, because
-# it prevents to mark a job as mandatory. A PR cannot be merged if a job is
-# mandatory but not scheduled because of "paths-ignore".
 on:
   workflow_dispatch:
   push:
@@ -31,70 +28,19 @@ concurrency:
 
 jobs:
   check_source:
-    name: 'Check for source changes'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    outputs:
-      run-docs: ${{ steps.docs-changes.outputs.run-docs || false }}
-      run_tests: ${{ steps.check.outputs.run_tests }}
-      run_hypothesis: ${{ steps.check.outputs.run_hypothesis }}
-      config_hash: ${{ steps.config_hash.outputs.hash }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Check for source changes
-        id: check
-        run: |
-          if [ -z "$GITHUB_BASE_REF" ]; then
-            echo "run_tests=true" >> $GITHUB_OUTPUT
-          else
-            git fetch origin $GITHUB_BASE_REF --depth=1
-            # git diff "origin/$GITHUB_BASE_REF..." (3 dots) may be more
-            # reliable than git diff "origin/$GITHUB_BASE_REF.." (2 dots),
-            # but it requires to download more commits (this job uses
-            # "git fetch --depth=1").
-            #
-            # git diff "origin/$GITHUB_BASE_REF..." (3 dots) works with Git
-            # 2.26, but Git 2.28 is stricter and fails with "no merge base".
-            #
-            # git diff "origin/$GITHUB_BASE_REF.." (2 dots) should be enough on
-            # GitHub, since GitHub starts by merging origin/$GITHUB_BASE_REF
-            # into the PR branch anyway.
-            #
-            # https://github.com/python/core-workflow/issues/373
-            git diff --name-only origin/$GITHUB_BASE_REF.. | grep -qvE '(\.rst$|^Doc|^Misc|^\.pre-commit-config\.yaml$|\.ruff\.toml$)' && echo "run_tests=true" >> $GITHUB_OUTPUT || true
-          fi
-
-          # Check if we should run hypothesis tests
-          GIT_BRANCH=${GITHUB_BASE_REF:-${GITHUB_REF#refs/heads/}}
-          echo $GIT_BRANCH
-          if $(echo "$GIT_BRANCH" | grep -q -w '3\.\(8\|9\|10\|11\)'); then
-            echo "Branch too old for hypothesis tests"
-            echo "run_hypothesis=false" >> $GITHUB_OUTPUT
-          else
-            echo "Run hypothesis tests"
-            echo "run_hypothesis=true" >> $GITHUB_OUTPUT
-          fi
-      - name: Compute hash for config cache key
-        id: config_hash
-        run: |
-          echo "hash=${{ hashFiles('configure', 'configure.ac', '.github/workflows/build.yml') }}" >> $GITHUB_OUTPUT
-      - name: Get a list of the changed documentation-related files
-        if: github.event_name == 'pull_request'
-        id: changed-docs-files
-        uses: Ana06/[email protected]
-        with:
-          filter: |
-            Doc/**
-            Misc/**
-            .github/workflows/reusable-docs.yml
-          format: csv  # works for paths with spaces
-      - name: Check for docs changes
-        if: >-
-          github.event_name == 'pull_request'
-          && steps.changed-docs-files.outputs.added_modified_renamed != ''
-        id: docs-changes
-        run: |
-          echo "run-docs=true" >> "${GITHUB_OUTPUT}"
+    name: Change detection
+    # To use boolean outputs from this job, parse them as JSON.
+    # Here's some examples:
+    #
+    #   if: fromJSON(needs.check_source.outputs.run-docs)
+    #
+    #   ${{
+    #        fromJSON(needs.check_source.outputs.run_tests)
+    #        && 'truthy-branch'
+    #        || 'falsy-branch'
+    #   }}
+    #
+    uses: ./.github/workflows/reusable-change-detection.yml
 
   check-docs:
     name: Docs
@@ -145,6 +91,50 @@ jobs:
           name: abi-data
           path: ./Doc/data/*.abi
 
+  check_autoconf_regen:
+    name: 'Check if Autoconf files are up to date'
+    # Don't use ubuntu-latest but a specific version to make the job
+    # reproducible: to get the same tools versions (autoconf, aclocal, ...)
+    runs-on: ubuntu-24.04
+    container:
+      image: ghcr.io/python/autoconf:2024.10.16.11360930377
+    timeout-minutes: 60
+    needs: check_source
+    if: needs.check_source.outputs.run_tests == 'true'
+    steps:
+      - name: Install Git
+        run: |
+          apt update && apt install git -yq
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+      - name: Runner image version
+        run: echo "IMAGE_VERSION=${ImageVersion}" >> $GITHUB_ENV
+      - name: Check Autoconf and aclocal versions
+        run: |
+          grep "Generated by GNU Autoconf 2.71" configure
+          grep "aclocal 1.16.5" aclocal.m4
+          grep -q "runstatedir" configure
+          grep -q "PKG_PROG_PKG_CONFIG" aclocal.m4
+      - name: Regenerate autoconf files
+        # Same command used by Tools/build/regen-configure.sh ($AUTORECONF)
+        run: autoreconf -ivf -Werror
+      - name: Check for changes
+        run: |
+          git add -u
+          changes=$(git status --porcelain)
+          # Check for changes in regenerated files
+          if test -n "$changes"; then
+            echo "Generated files not up to date."
+            echo "Perhaps you forgot to run make regen-configure ;)"
+            echo "configure files must be regenerated with a specific version of autoconf."
+            echo "$changes"
+            echo ""
+            git diff --staged || true
+            exit 1
+          fi
+
   check_generated_files:
     name: 'Check if generated files are up to date'
     # Don't use ubuntu-latest but a specific version to make the job
@@ -173,19 +163,10 @@ jobs:
         uses: hendrikmuhs/[email protected]
         with:
           save: false
-      - name: Check Autoconf and aclocal versions
-        run: |
-          grep "Generated by GNU Autoconf 2.71" configure
-          grep "aclocal 1.16.5" aclocal.m4
-          grep -q "runstatedir" configure
-          grep -q "PKG_PROG_PKG_CONFIG" aclocal.m4
       - name: Configure CPython
         run: |
           # Build Python with the libpython dynamic library
           ./configure --config-cache --with-pydebug --enable-shared
-      - name: Regenerate autoconf files
-        # Same command used by Tools/build/regen-configure.sh ($AUTORECONF)
-        run: autoreconf -ivf -Werror
       - name: Build CPython
         run: |
           # Deepfreeze will usually cause global objects to be added or removed,
@@ -216,45 +197,101 @@ jobs:
         run: make check-c-globals
 
   build_windows:
-    name: 'Windows'
+    name: >-
+      Windows
+      ${{ fromJSON(matrix.free-threading) && '(free-threading)' || '' }}
     needs: check_source
-    if: needs.check_source.outputs.run_tests == 'true'
+    if: fromJSON(needs.check_source.outputs.run_tests)
+    strategy:
+      matrix:
+        arch:
+        - Win32
+        - x64
+        - arm64
+        free-threading:
+        - false
+        # - true
     uses: ./.github/workflows/reusable-windows.yml
+    with:
+      arch: ${{ matrix.arch }}
+      free-threading: ${{ matrix.free-threading }}
+
+  build_windows_msi:
+    name: >-  # ${{ '' } is a hack to nest jobs under the same sidebar category
+      Windows MSI${{ '' }}
+    needs: check_source
+    if: fromJSON(needs.check_source.outputs.run-win-msi)
+    strategy:
+      matrix:
+        arch:
+        - x86
+        - x64
+        - arm64
+    uses: ./.github/workflows/reusable-windows-msi.yml
+    with:
+      arch: ${{ matrix.arch }}
 
   build_macos:
-    name: 'macOS'
+    name: >-
+      macOS
+      ${{ fromJSON(matrix.free-threading) && '(free-threading)' || '' }}
     needs: check_source
     if: needs.check_source.outputs.run_tests == 'true'
+    strategy:
+      fail-fast: false
+      matrix:
+        # Cirrus and macos-14 are M1, macos-13 is default GHA Intel.
+        # macOS 13 only runs tests against the GIL-enabled CPython.
+        # Cirrus used for upstream, macos-14 for forks.
+        os:
+        - ghcr.io/cirruslabs/macos-runner:sonoma
+        - macos-14
+        - macos-13
+        is-fork:  # only used for the exclusion trick
+        - ${{ github.repository_owner != 'python' }}
+        free-threading:
+        - false
+        # - true
+        exclude:
+        - os: ghcr.io/cirruslabs/macos-runner:sonoma
+          is-fork: true
+        - os: macos-14
+          is-fork: false
+        - os: macos-13
+          free-threading: true
     uses: ./.github/workflows/reusable-macos.yml
     with:
       config_hash: ${{ needs.check_source.outputs.config_hash }}
-      # Cirrus and macos-14 are M1, macos-13 is default GHA Intel.
-      # Cirrus used for upstream, macos-14 for forks.
-      os-matrix: '["ghcr.io/cirruslabs/macos-runner:sonoma", "macos-14", "macos-13"]'
+      free-threading: ${{ matrix.free-threading }}
+      os: ${{ matrix.os }}
 
   build_ubuntu:
-    name: 'Ubuntu'
+    name: >-
+      Ubuntu
+      ${{ fromJSON(matrix.free-threading) && '(free-threading)' || '' }}
     needs: check_source
     if: needs.check_source.outputs.run_tests == 'true'
+    strategy:
+      matrix:
+        free-threading:
+        - false
+        # - true
     uses: ./.github/workflows/reusable-ubuntu.yml
     with:
       config_hash: ${{ needs.check_source.outputs.config_hash }}
-      options: |
-        ../cpython-ro-srcdir/configure \
-          --config-cache \
-          --with-pydebug \
-          --with-openssl=$OPENSSL_DIR
+      free-threading: ${{ matrix.free-threading }}
 
   build_ubuntu_ssltests:
     name: 'Ubuntu SSL tests with OpenSSL'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ matrix.os }}
     timeout-minutes: 60
     needs: check_source
     if: needs.check_source.outputs.run_tests == 'true'
     strategy:
       fail-fast: false
       matrix:
-        openssl_ver: [1.1.1w, 3.0.13, 3.1.5, 3.2.1]
+        os: [ubuntu-22.04]
+        openssl_ver: [3.0.15, 3.1.7, 3.2.3, 3.3.2]
     env:
       OPENSSL_VER: ${{ matrix.openssl_ver }}
       MULTISSL_DIR: ${{ github.workspace }}/multissl
@@ -283,7 +320,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ./multissl/openssl/${{ env.OPENSSL_VER }}
-        key: ${{ runner.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
+        key: ${{ matrix.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
     - name: Install OpenSSL
       if: steps.cache-openssl.outputs.cache-hit != 'true'
       run: python3 Tools/ssl/multissltests.py --steps=library --base-directory $MULTISSL_DIR --openssl $OPENSSL_VER --system Linux
@@ -310,7 +347,7 @@ jobs:
     needs: check_source
     if: needs.check_source.outputs.run_tests == 'true' && needs.check_source.outputs.run_hypothesis == 'true'
     env:
-      OPENSSL_VER: 3.0.13
+      OPENSSL_VER: 3.0.15
       PYTHONSTRICTEXTENSIONBUILD: 1
     steps:
     - uses: actions/checkout@v4
@@ -388,7 +425,7 @@ jobs:
         path: ./hypothesis
         key: hypothesis-database-${{ github.head_ref || github.run_id }}
         restore-keys: |
-          - hypothesis-database-
+          hypothesis-database-
     - name: "Run tests"
       working-directory: ${{ env.CPYTHON_BUILDDIR }}
       run: |
@@ -423,7 +460,7 @@ jobs:
     needs: check_source
     if: needs.check_source.outputs.run_tests == 'true'
     env:
-      OPENSSL_VER: 3.0.13
+      OPENSSL_VER: 3.0.15
       PYTHONSTRICTEXTENSIONBUILD: 1
       ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0
     steps:
@@ -453,7 +490,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ./multissl/openssl/${{ env.OPENSSL_VER }}
-        key: ${{ runner.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
+        key: ${{ matrix.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
     - name: Install OpenSSL
       if: steps.cache-openssl.outputs.cache-hit != 'true'
       run: python3 Tools/ssl/multissltests.py --steps=library --base-directory $MULTISSL_DIR --openssl $OPENSSL_VER --system Linux
@@ -495,6 +532,7 @@ jobs:
     - build_ubuntu
     - build_ubuntu_ssltests
     - build_windows
+    - build_windows_msi
     - test_hypothesis
     - build_asan
     - build_tsan
@@ -508,6 +546,7 @@ jobs:
         allowed-failures: >-
           build_macos,
           build_ubuntu_ssltests,
+          build_windows_msi,
           test_hypothesis,
         allowed-skips: >-
           ${{