.codespellrc

@@ -1,3 +1,3 @@
 [codespell]
 skip = .git,.mypy_cache,build,testdata
-ignore-words-list = fpr,claus,feld,nd,bu,ue,te,fo,afile,manuel
+ignore-words-list = fpr,claus,feld,nd,bu,ue,te,fo,afile,manuel,checkin,assertIn,rin

.github/dependabot.yml

@@ -0,0 +1,18 @@
+# Keep GitHub Actions up to date with GitHub's Dependabot...
+# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#package-ecosystem
+version: 2
+updates:
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    rebase-strategy: "disabled"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: weekly
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: weekly    

.github/gpg-error-config

@@ -0,0 +1,23 @@
+#!/bin/sh
+
+# gpg-error-config: simple replacement gpg-error-config that is a shim
+# for pkg-config.
+
+# Parse flags
+for arg in "$@"; do
+  case $arg in
+	--cflags)
+	  pkg-config --cflags gpg-error
+	  ;;
+	--libs)
+	  pkg-config --libs gpg-error
+	  ;;
+	--version)
+	  pkg-config --modversion gpg-error
+	  ;;
+	*)
+	  echo "Unknown option: $arg" >&2
+	  exit 1
+	  ;;
+  esac
+done

.github/gpgme-config

@@ -0,0 +1,29 @@
+#!/bin/bash
+
+# Parse gpgme-config-like flags, then invoke `pkg-config gpgme`:
+# * Pass --cflags and --libs through
+# * Map --version to --modversion
+# * Ignore --thread=pthread
+
+# Parse flags
+for arg in "$@"; do
+  case "$arg" in
+	--cflags|--libs|--modversion)
+	  flags="$flags $arg"
+	  ;;
+	--version)
+	  flags="$flags --modversion"
+	  ;;
+	--thread=pthread)
+	  ;;
+	--prefix)
+	  flags="$flags --variable=prefix"
+	  ;;
+	*)
+	  echo "Unknown flag: $arg" >&2
+	  exit 1
+	  ;;
+  esac
+done
+
+exec pkg-config gpgme $flags

.github/workflows/auto-merge.yml

@@ -0,0 +1,22 @@
+name: Dependabot auto-merge
+on: pull_request_target
+
+permissions:
+  pull-requests: write
+  contents: write
+
+jobs:
+  dependabot:
+    runs-on: ubuntu-latest
+    if: ${{ github.actor == 'dependabot[bot]' }}
+    steps:
+      - name: Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v2
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+      - name: Enable auto-merge for Dependabot PRs
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

.github/workflows/disperse.yml

@@ -2,13 +2,14 @@
 name: Disperse configuration
 
 "on":
-  - push
+  push:
+    branches: [ main, master ]
 
 jobs:
   build:
 
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
-      - uses: jelmer/action-disperse-validate@v1
+      - uses: actions/checkout@v4
+      - uses: jelmer/action-disperse-validate@v2

.github/workflows/docs.yml

@@ -3,6 +3,7 @@ name: API Docs
 
 on:
   push:
+    branches: [ main, master ]
   pull_request:
   schedule:
     - cron: "0 6 * * *" # Daily 6AM UTC build
@@ -12,9 +13,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - name: Set up Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5
         with:
           python-version: "3.10"
       - name: Install pydoctor

.github/workflows/python-distributions.yml

@@ -2,79 +2,164 @@ name: Build Python distributions
 
 on:
   push:
+    branches: [ main, master ]
+    tags:
+      - 'dulwich-*'
+  pull_request:
   schedule:
     - cron: "0 6 * * *" # Daily 6AM UTC build
 
 jobs:
+  define-matrix:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.merged-identifiers.outputs.merged-identifiers }}
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: 3.x
+          cache: pip
+      - name: Install jq
+        run: sudo apt-get update && sudo apt-get install -y jq
+      - name: Install cibuildwheel
+        run: pip install cibuildwheel
+      - name: Find build identifiers using cibuildwheel --print-build-identifiers
+        id: all-build-identifiers
+        run: |
+          echo "linux=$(cibuildwheel --platform linux --print-build-identifiers | tr '\n' ' ')" >> $GITHUB_OUTPUT
+          echo "macos=$(cibuildwheel --platform macos --print-build-identifiers | tr '\n' ' ')" >> $GITHUB_OUTPUT
+          echo "windows=$(cibuildwheel --platform windows --print-build-identifiers | tr '\n' ' ')" >> $GITHUB_OUTPUT
+      - name: Select build identifiers
+        id: select-build-identifiers
+        run: |
+          if [[ "$GITHUB_REF" = "refs/heads/main" ]] || [[ "$GITHUB_REF" = "refs/heads/master" ]] || [[ "$GITHUB_REF" = "refs/tags/"* ]]; then
+            echo 'linux=${{ steps.all-build-identifiers.outputs.linux }}' >> $GITHUB_OUTPUT
+            echo 'windows=${{ steps.all-build-identifiers.outputs.windows }}' >> $GITHUB_OUTPUT
+            echo 'macos=${{ steps.all-build-identifiers.outputs.macos }}' >> $GITHUB_OUTPUT
+          else
+            echo "linux=$(echo -n '${{ steps.all-build-identifiers.outputs.linux }}' | awk '{print $NF}')" >> $GITHUB_OUTPUT
+            echo "macos=$(echo -n '${{ steps.all-build-identifiers.outputs.macos }}' | awk '{print $NF}')" >> $GITHUB_OUTPUT
+            echo "windows=$(echo -n '${{ steps.all-build-identifiers.outputs.windows }}' | awk '{print $NF}')" >> $GITHUB_OUTPUT
+          fi
+      - name: Output build identifiers
+        id: json-identifiers
+        run: |
+          echo "linux=$(echo -n '${{ steps.select-build-identifiers.outputs.linux }}' | jq -R -s -c 'split(" ") | map(select(length > 0)) | [.[] | {os: "ubuntu-latest", "build-identifier": .}]')" >> $GITHUB_OUTPUT
+          echo "macos=$(echo -n '${{ steps.select-build-identifiers.outputs.macos }}' | jq -R -s -c 'split(" ") | map(select(length > 0)) | [.[] | {os: "macos-latest", "build-identifier": .}]')" >> $GITHUB_OUTPUT
+          echo "windows=$(echo -n '${{ steps.select-build-identifiers.outputs.windows }}' | jq -R -s -c 'split(" ") | map(select(length > 0)) | [.[] | {os: "windows-latest", "build-identifier": .}]')" >> $GITHUB_OUTPUT
+      - name: Merge build identifiers
+        id: merged-identifiers
+        run: |
+          echo merged-identifiers=$(echo -n '${{ steps.json-identifiers.outputs.linux }} ${{ steps.json-identifiers.outputs.macos }} ${{ steps.json-identifiers.outputs.windows }}' | jq -c -s 'add') >> $GITHUB_OUTPUT
+
   build-wheels:
     runs-on: ${{ matrix.os }}
+    needs: define-matrix
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        include: ${{ fromJSON(needs.define-matrix.outputs.matrix ) }}
       fail-fast: true
 
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-python@v3
-      - name: Install native dependencies (Ubuntu)
-        run: sudo apt-get update && sudo apt-get install -y libgpgme-dev libgpg-error-dev
-        if: "matrix.os == 'ubuntu-latest'"
-      - name: Install native dependencies (MacOS)
-        run: brew install swig gpgme
-        if: "matrix.os == 'macos-latest'"
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          cache: pip
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install setuptools wheel fastimport paramiko urllib3 cibuildwheel==2.16.2
-      - name: Install gpg on supported platforms
-        run: pip install -U gpg
-        if: "matrix.os != 'windows-latest'"
-      - name: Run test suite
-        run: python -m unittest dulwich.tests.test_suite
+          pip install setuptools wheel cibuildwheel setuptools-rust
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
+        uses: docker/setup-qemu-action@v3
         if: "matrix.os == 'ubuntu-latest'"
       - name: Build wheels
         run: python -m cibuildwheel --output-dir wheelhouse
         env:
-          CIBW_ARCHS_LINUX: x86_64 aarch64
-          CIBW_ARCHS_MACOS: x86_64 arm64 universal2
-          CIBW_ARCHS_WINDOWS: AMD64 x86
+          CIBW_BUILD: "${{ matrix.build-identifier }}*"
       - name: Upload wheels
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
+          name: artifact-${{ matrix.build-identifier }}
           path: ./wheelhouse/*.whl
 
+  build-pure-wheels:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          cache: pip
+      - run: pip install build
+      - run: PURE=true python -m build --wheel
+      - name: Upload pure wheels
+        uses: actions/upload-artifact@v4
+        with:
+          name: artifact-pure
+          path: ./dist/*.whl
+
   build-sdist:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-python@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          cache: pip
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
           pip install build
       - name: Build sdist
         run: python -m build --sdist
       - name: Upload sdist
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
+          name: artifact-source
           path: ./dist/*.tar.gz
 
+  test-sdist:
+    needs:
+      - build-sdist
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/setup-python@v5
+        with:
+          cache: pip
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          # Upgrade packging to avoid a bug in twine.
+          # See https://github.com/pypa/twine/issues/1216
+          pip install "twine>=6.1.0" "packaging>=24.2"
+      - name: Download sdist
+        uses: actions/download-artifact@v4
+        with:
+          name: artifact-source
+          path: dist
+      - name: Test sdist
+        run: twine check dist/*
+      - name: Test installation from sdist
+        run: pip install dist/*.tar.gz
+
   publish:
     runs-on: ubuntu-latest
     needs:
       - build-wheels
       - build-sdist
+      - build-pure-wheels
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/dulwich-')
+    permissions:
+      id-token: write
+    environment:
+      name: pypi
+      url: https://pypi.org/p/dulwich
     steps:
       - name: Download distributions
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@v4
         with:
-          name: artifact
+          merge-multiple: true
+          pattern: artifact-*
           path: dist
-      - name: Publish distributions
-        env:
-          TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
-          TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-        run: twine upload dist/*
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1