[pull] master from sphinx-doc:master

.gitattributes

@@ -51,6 +51,8 @@ tests/roots/test-pycode/cp_1251_coded.py dos
 
 # Non UTF-8 encodings
 tests/roots/test-pycode/cp_1251_coded.py working-tree-encoding=windows-1251
+tests/roots/test-root/wrongenc.inc working-tree-encoding=latin-1
+tests/roots/test-warnings/wrongenc.inc working-tree-encoding=latin-1
 
 # Generated files
 # https://github.com/github/linguist/blob/master/docs/overrides.md
@@ -62,4 +64,5 @@ tests/roots/test-pycode/cp_1251_coded.py working-tree-encoding=windows-1251
 
 tests/js/fixtures/**/*.js                           generated
 sphinx/search/minified-js/*.js                      generated
+sphinx/search/_stopwords/                           generated
 sphinx/themes/bizstyle/static/css3-mediaqueries.js  generated

.github/workflows/builddoc.yml

@@ -21,22 +21,22 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: "3"
     - name: Install graphviz
       run: sudo apt-get install --no-install-recommends --yes graphviz
     - name: Install uv
-      uses: astral-sh/setup-uv@v5
+      uses: astral-sh/setup-uv@v6
       with:
         version: latest
         enable-cache: false
     - name: Install dependencies
-      run: uv pip install .[docs]
+      run: uv pip install . --group docs
     - name: Render the documentation
       run: >
         sphinx-build

.github/workflows/create-release.yml

@@ -27,31 +27,27 @@ jobs:
       attestations: write  # for actions/attest
       id-token: write  # for actions/attest & PyPI trusted publishing
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           persist-credentials: false
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3"
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v6
         with:
           version: latest
           enable-cache: false
 
       - name: Install build dependencies (pypa/build, twine)
-        run: |
-          uv pip install build "twine>=5.1"
-          # resolution fails without betterproto
-          uv pip install pypi-attestations==0.0.21 betterproto==2.0.0b6
+        run: uv pip install --group package
 
       - name: Build distribution
         run: python -m build
 
       - name: Check distribution
-        run: |
-          twine check dist/*
+        run: twine check dist/*
 
       - name: Create Sigstore attestations for built distributions
         uses: actions/attest@v1
@@ -90,39 +86,10 @@ jobs:
           name: attestation-bundles
           path: /tmp/attestation-bundles/
 
-      - name: Mint PyPI API token
-        id: mint-token
-        uses: actions/github-script@v7
-        with:
-          # language=JavaScript
-          script: |
-            // retrieve the ambient OIDC token
-            const oidc_request_token = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
-            const oidc_request_url = process.env.ACTIONS_ID_TOKEN_REQUEST_URL;
-            const oidc_resp = await fetch(`${oidc_request_url}&audience=pypi`, {
-              headers: {Authorization: `bearer ${oidc_request_token}`},
-            });
-            const oidc_token = (await oidc_resp.json()).value;
-
-            // exchange the OIDC token for an API token
-            const mint_resp = await fetch('https://pypi.org/_/oidc/github/mint-token', {
-              method: 'post',
-              body: `{"token": "${oidc_token}"}` ,
-              headers: {'Content-Type': 'application/json'},
-            });
-            const api_token = (await mint_resp.json()).token;
-
-            // mask the newly minted API token, so that we don't accidentally leak it
-            core.setSecret(api_token)
-            core.setOutput('api-token', api_token)
-
       - name: Upload to PyPI
         env:
           TWINE_NON_INTERACTIVE: "true"
-          TWINE_USERNAME: "__token__"
-          TWINE_PASSWORD: "${{ steps.mint-token.outputs.api-token }}"
-        run: |
-          twine upload dist/* --attestations
+        run: twine upload dist/* --attestations
 
   github-release:
     runs-on: ubuntu-latest
@@ -132,12 +99,12 @@ jobs:
     permissions:
       contents: write  # for softprops/action-gh-release to create GitHub release
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           persist-credentials: false
       - name: Get release version
         id: get_version
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: core.setOutput('version', context.ref.replace("refs/tags/v", ""))
 

.github/workflows/lint.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
 
@@ -42,84 +42,102 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: "3"
     - name: Install uv
-      uses: astral-sh/setup-uv@v5
+      uses: astral-sh/setup-uv@v6
       with:
         version: latest
         enable-cache: false
     - name: Install dependencies
-      run: uv pip install ".[lint,test]"
+      run: uv pip install -r pyproject.toml --group package --group test --group types
     - name: Type check with mypy
       run: mypy
 
   pyright:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: "3"
     - name: Install uv
-      uses: astral-sh/setup-uv@v5
+      uses: astral-sh/setup-uv@v6
       with:
         version: latest
         enable-cache: false
     - name: Install dependencies
-      run: uv pip install ".[lint,test]"
+      run: uv pip install -r pyproject.toml --group package --group test --group types
     - name: Type check with pyright
       run: pyright
 
   docs-lint:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: "3"
     - name: Install uv
-      uses: astral-sh/setup-uv@v5
+      uses: astral-sh/setup-uv@v6
       with:
         version: latest
         enable-cache: false
     - name: Install dependencies
-      run: uv pip install --upgrade sphinx-lint
+      run: uv pip install --group lint
     - name: Lint documentation with sphinx-lint
       run: make doclinter
 
   twine:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: "3"
     - name: Install uv
-      uses: astral-sh/setup-uv@v5
+      uses: astral-sh/setup-uv@v6
       with:
         version: latest
         enable-cache: false
     - name: Install dependencies
-      run: uv pip install --upgrade twine build
+      run: uv pip install --group package
     - name: Lint with twine
       run: |
         python -m build .
         twine check dist/*
+
+  prettier:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v5
+    - name: Set up Node.js
+      uses: actions/setup-node@v5
+      with:
+        node-version: "20"
+        cache: "npm"
+    - run: >
+        npx [email protected]
+        --check
+        "sphinx/themes/**/*.js"
+        "!sphinx/themes/bizstyle/static/css3-mediaqueries*.js"
+        "tests/js/**/*.{js,mjs}"
+        "!tests/js/fixtures/**"

.github/workflows/lock.yml

@@ -15,7 +15,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-    - uses: actions/github-script@v7
+    - uses: actions/github-script@v8
       with:
         retries: 3
         # language=JavaScript