Merge branch 'master' into issue-11198/deterministic-nested-collectio…

…n-element-ordering

.flake8

@@ -29,4 +29,3 @@ exclude =
     doc/usage/extensions/example*.py,
 per-file-ignores =
     tests/*: E501
-    sphinx/util/jsdump.py: SIM905

.github/workflows/builddoc.yml

@@ -1,14 +1,20 @@
-name: Build document
+name: Render documentation
 
-on: [push, pull_request]
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
 
 permissions:
   contents: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+env:
+  FORCE_COLOR: "1"
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -27,11 +33,11 @@ jobs:
         python -m pip install .[docs]
     - name: Render the documentation
       run: >
-        python
-        -X dev
-        -X warn_default_encoding
-        -m sphinx
+        sphinx-build
         -M html ./doc ./build/sphinx
+        -T
         -W
+        --jobs=auto
         -n
+        -vvv
         --keep-going

.github/workflows/create-release.yml

@@ -4,20 +4,87 @@ on:
   push:
     tags:
     - "v*.*.*"
+  workflow_dispatch:
 
 permissions:
   contents: read
 
 jobs:
-  create-release:
+  publish-pypi:
+    runs-on: ubuntu-latest
+    name: PyPI Release
+    environment: release
     permissions:
-      contents: write  # for softprops/action-gh-release to create GitHub release
+      id-token: write  # for PyPI trusted publishing
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: 3
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Install build dependencies (pypa/build, twine)
+        run: |
+          pip install -U pip
+          pip install build twine
+
+      - name: Build distribution
+        run: python -m build
+
+      - name: Mint PyPI API token
+        id: mint-token
+        uses: actions/github-script@v6
+        with:
+          # language=JavaScript
+          script: |
+            // retrieve the ambient OIDC token
+            const oidc_request_token = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+            const oidc_request_url = process.env.ACTIONS_ID_TOKEN_REQUEST_URL;
+            const oidc_resp = await fetch(`${oidc_request_url}&audience=pypi`, {
+              headers: {Authorization: `bearer ${oidc_request_token}`},
+            });
+            const oidc_token = (await oidc_resp.json()).value;
+  
+            // exchange the OIDC token for an API token
+            const mint_resp = await fetch('https://pypi.org/_/oidc/github/mint-token', {
+              method: 'post',
+              body: `{"token": "${oidc_token}"}` ,
+              headers: {'Content-Type': 'application/json'},
+            });
+            const api_token = (await mint_resp.json()).token;
+
+            // mask the newly minted API token, so that we don't accidentally leak it
+            core.setSecret(api_token)
+            core.setOutput('api-token', api_token)
+
+      - name: Upload to PyPI
+        env:
+          TWINE_NON_INTERACTIVE: "true"
+          TWINE_USERNAME: "__token__"
+          TWINE_PASSWORD: "${{ steps.mint-token.outputs.api-token }}"
+        run: |
+          twine check dist/*
+          twine upload dist/*
+
+  github-release:
     runs-on: ubuntu-latest
+    name: GitHub release
+    environment: release
+    permissions:
+      contents: write  # for softprops/action-gh-release to create GitHub release
     steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Release
+      - uses: actions/checkout@v3
+      - name: Get release version
+        id: get_version
+        uses: actions/github-script@v6
+        with:
+          script: core.setOutput('version', context.ref.replace("refs/tags/v", ""))
+
+      - name: Create GitHub release
         uses: softprops/action-gh-release@v1
         if: startsWith(github.ref, 'refs/tags/')
         with:
+          name: "Sphinx ${{ steps.get_version.outputs.version }}"
           body: "Changelog: https://www.sphinx-doc.org/en/master/changes.html"

.github/workflows/latex.yml

@@ -6,7 +6,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:

.github/workflows/lint.yml

@@ -6,7 +6,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 env:

.github/workflows/main.yml

@@ -6,14 +6,14 @@ permissions:
   contents: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 env:
   FORCE_COLOR: "1"
   PYTHONDEVMODE: "1"  # -X dev
   PYTHONWARNDEFAULTENCODING: "1"  # -X warn_default_encoding
-  PYTHONWARNINGS: "error,always:unclosed:ResourceWarning::"  # default: all warnings as errors, except ResourceWarnings about unclosed items
+  PYTHONWARNINGS: "error"  # default: all warnings as errors
 
 jobs:
   ubuntu:
@@ -23,14 +23,15 @@ jobs:
       fail-fast: false
       matrix:
         python:
-        - "3.8"
         - "3.9"
         - "3.10"
         - "3.11"
         - "3.12-dev"
+        - "3.13-dev"
         docutils:
         - "0.18"
         - "0.19"
+        - "0.20"
 
     steps:
     - uses: actions/checkout@v3
@@ -57,13 +58,7 @@ jobs:
       env:
         PYTHONWARNINGS: ""
     - name: Install Docutils ${{ matrix.docutils }}
-      run: python -m pip install --upgrade "docutils==${{ matrix.docutils }}.*"
-      if: "!endsWith(matrix.python, '-dev')"
-      env:
-        PYTHONWARNINGS: "error,default:pkg_resources is deprecated:DeprecationWarning::,default:Deprecated call to `pkg_resources.declare_namespace:DeprecationWarning::"
-    - name: Install Docutils ${{ matrix.docutils }} (ignore warnings)
-      run: python -m pip install --upgrade "docutils==${{ matrix.docutils }}.*"
-      if: "endsWith(matrix.python, '-dev')"
+      run: python -m pip install --upgrade "docutils~=${{ matrix.docutils }}.0"
       env:
         PYTHONWARNINGS: ""
     - name: Test with pytest

.github/workflows/nodejs.yml

@@ -6,7 +6,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:

AUTHORS

@@ -93,12 +93,3 @@ Contributors
 * Zac Hatfield-Dodds -- doctest reporting improvements, intersphinx performance
 
 Many thanks for all contributions!
-
-Included software
-=================
-
-There are also a few modules or functions incorporated from other
-authors and projects:
-
-* sphinx.util.jsdump uses the basestring encoding from simplejson,
-  written by Bob Ippolito, released under the MIT license