Merge branch 'main' into lazy-numpy

Author: aatle

.github/workflows/build-debian-multiarch.yml

@@ -121,7 +121,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Download all multiarch artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v5
       with:
         name: pygame-multiarch-armv7-dist
         path: ~/artifacts

.github/workflows/build-macos.yml

@@ -32,7 +32,7 @@ jobs:
 
       - name: Test for Mac Deps cache hit
         id: macdep-cache
-        uses: actions/cache@v4.2.3
+        uses: actions/cache@v4.2.4
         with:
           path: ${{ github.workspace }}/pygame_mac_deps_${{ matrix.macarch }}
           # The hash of all files in buildconfig manylinux-build and macdependencies is
@@ -99,14 +99,14 @@ jobs:
       - uses: actions/checkout@v4.2.2
 
       - name: pip cache
-        uses: actions/cache@v4.2.3
+        uses: actions/cache@v4.2.4
         with:
           path: ~/Library/Caches/pip  # This cache path is only right on mac
           key: pip-cache-${{ matrix.macarch }}-${{ matrix.os }}
 
       - name: Fetch Mac deps
         id: macdep-cache
-        uses: actions/cache@v4.2.3
+        uses: actions/cache@v4.2.4
         with:
           path: ${{ github.workspace }}/pygame_mac_deps_${{ matrix.macarch }}
           key: macdep-${{ hashFiles('buildconfig/manylinux-build/**') }}-${{ hashFiles('buildconfig/macdependencies/*.sh') }}-${{ matrix.macarch }}
@@ -115,10 +115,10 @@ jobs:
       - name: Install uv for speed
         uses: astral-sh/setup-uv@v6
         with:
-          version: "0.5.26"
+          version: "0.8.3"
 
       - name: Build and test wheels
-        uses: pypa/cibuildwheel@v2.23.2
+        uses: pypa/cibuildwheel@v3.1.3
 
       - uses: actions/upload-artifact@v4
         with:

.github/workflows/build-manylinux.yml

@@ -36,7 +36,7 @@ jobs:
     - uses: actions/checkout@v4.2.2
 
     - name: Log in to the Container registry
-      uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
+      uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1
       with:
         registry: ghcr.io
         username: ${{ github.actor }}
@@ -49,7 +49,7 @@ jobs:
 
     - name: Extract metadata (tags, labels) for Docker
       id: meta
-      uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804
+      uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f
       with:
         images: ghcr.io/${{ github.repository }}_${{ matrix.arch }}
         tags: type=raw,value=${{ hashFiles('buildconfig/manylinux-build/**') }}
@@ -74,7 +74,7 @@ jobs:
         CIBW_MANYLINUX_AARCH64_IMAGE: ghcr.io/${{ github.repository }}_aarch64:${{ steps.meta.outputs.version }}
         CIBW_MANYLINUX_PYPY_AARCH64_IMAGE: ghcr.io/${{ github.repository }}_aarch64:${{ steps.meta.outputs.version }}
 
-      uses: pypa/cibuildwheel@v2.23.2
+      uses: pypa/cibuildwheel@v3.1.3
 
     # We upload the generated files under github actions assets
     - name: Upload dist

.github/workflows/build-ubuntu-coverage.yml

@@ -40,10 +40,10 @@ jobs:
       - name: Install uv for speed
         uses: astral-sh/setup-uv@v6
         with:
-          version: "0.5.26"
+          version: "0.8.3"
 
       - name: Build and test wheels
-        uses: pypa/cibuildwheel@v2.23.2
+        uses: pypa/cibuildwheel@v3.1.3
 
       - uses: actions/upload-artifact@v4
         with:

.github/workflows/build-windows.yml

@@ -29,7 +29,7 @@ jobs:
       - uses: actions/checkout@v4.2.2
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           path: pygame-wheels
           merge-multiple: true
@@ -41,7 +41,7 @@ jobs:
         run: echo "VER=${GITHUB_REF_NAME#'release/'}" >> $GITHUB_OUTPUT
 
       - name: Generate release attestation
-        uses: actions/attest-build-provenance@v2.3.0
+        uses: actions/attest-build-provenance@v2.4.0
         with:
           subject-path: "pygame-wheels/*"
 

.github/workflows/cppcheck.yml

@@ -1,10 +1,13 @@
-# This workflow runs a build with a python version that has debug symbols
+# This workflow runs a build with a python version that has debug symbols.
+# Also generates coverage information from unit tests. Note that for intrinsics,
+# it only runs what gets compiled and would naturally run. It also is limited to
+# what can run in a CI environment.
 # Update this workflow when our min/max python minor versions update
 # This workflow is necessary to ensure that we can build and run with
 # a debug python build without too much worrying about SIGABRT being thrown
 # IMPORTANT: binaries are not to be uploaded from this workflow!
 
-name: Ubuntu debug python
+name: Ubuntu Checks
 defaults:
   run:
     shell: bash -leo pipefail {0}
@@ -23,7 +26,7 @@ on:
       - '*.md'
       - '.github/workflows/*.yml'
       # re-include current file to not be excluded
-      - '!.github/workflows/build-ubuntu-debug-python.yml'
+      - '!.github/workflows/run-ubuntu-checks.yml'
 
   pull_request:
     branches: main
@@ -35,23 +38,24 @@ on:
       - '*.md'
       - '.github/workflows/*.yml'
       # re-include current file to not be excluded
-      - '!.github/workflows/build-ubuntu-debug-python.yml'
+      - '!.github/workflows/run-ubuntu-checks.yml'
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-ubuntu-debug-python
+  group: ${{ github.workflow }}-${{ github.ref }}-ubuntu-checks
   cancel-in-progress: true
 
 jobs:
-  debug_python:
+  debug_coverage:
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false  # if a particular matrix build fails, don't skip the rest
       matrix:
         os: [ ubuntu-24.04 ]
         # check our min python (minor) version and our max python (minor) version
         python: [
-          3.9.21,
-          3.13.1
+          3.9.23,
+          3.13.5,
+          3.14.0rc1
         ]
 
     env:
@@ -69,7 +73,7 @@ jobs:
       # https://github.com/orgs/community/discussions/47863
       run: |
         sudo apt-get update --fix-missing
-
+        sudo apt-get install lcov -y
         sudo apt-get install libsdl2-dev libsdl2-image-dev libsdl2-mixer-dev libsdl2-ttf-dev libfreetype6-dev libportmidi-dev -y
 
     - name: Install pyenv
@@ -84,7 +88,7 @@ jobs:
 
     - name: Cache debug python build
       id: cache-python
-      uses: actions/cache@v4.2.3
+      uses: actions/cache@v4.2.4
       with:
         key: ${{ matrix.python }}
         path: ~/.pyenv/versions/${{ matrix.python }}-debug/**
@@ -98,7 +102,7 @@ jobs:
       id: build-pygame-ce
       run: |
         pyenv global ${{ matrix.python }}-debug
-        python dev.py build --lax
+        python dev.py build --lax --coverage --sanitize undefined
 
     - name: Run tests
       env:
@@ -107,3 +111,56 @@ jobs:
       run: |
         pyenv global ${{ matrix.python }}-debug
         python -m pygame.tests -v --exclude opengl,music,timing --time_out 300
+
+    - name: Generate coverage
+      id: gen-coverage
+      # want to continue regardless of whether a test failed or not as long as the job wasn't cancelled
+      if: ${{ steps.build-pygame-ce.conclusion == 'success' && !cancelled() }}
+      run: |
+        lcov --capture --directory . --output-file ./coverage.info
+        genhtml ./coverage.info --output-directory ./out
+
+    # We upload the generated files under github actions assets
+    - name: Upload coverage html
+      # want to continue only if the coverage generation was successful
+      if: ${{ steps.gen-coverage.conclusion == 'success' && !cancelled() }}
+      uses: actions/upload-artifact@v4
+      with:
+        name: pygame-coverage-${{ matrix.os }}-${{ matrix.python }}
+        path: ./out
+
+  # Run cppcheck static analysis on src_c changes
+  run-cppcheck:
+    runs-on: ubuntu-24.04
+    needs: debug_coverage
+
+    steps:
+    - uses: actions/checkout@v4.2.2
+      with:
+        fetch-depth: 0  # fetch full history
+
+    - name: Check if any src_c files changed
+      id: check-changes
+      continue-on-error: true
+      run: |
+        if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+          CHANGED_FILES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD)
+        else
+          CHANGED_FILES=$(git diff --name-only HEAD^1...HEAD)
+        fi
+        echo "Changed files: $CHANGED_FILES"
+        echo "$CHANGED_FILES" | grep '^src_c/' || echo "skip=true" >> "$GITHUB_OUTPUT"
+
+    - name: Install cppcheck
+      if: steps.check-changes.outputs.skip != 'true'
+      run: |
+        sudo apt-get update --fix-missing
+        sudo apt install cppcheck
+
+    - name: Run Static Checker
+      if: steps.check-changes.outputs.skip != 'true'
+      run: cppcheck src_c --enable=performance,portability,warning \
+        --suppress=*:src_c/freetype/ft_cache.c --suppress=*:src_c/scrap* \
+        --suppress=*:src_c/scale_mmx*.c --suppress=*:src_c/SDL_gfx/* \
+        --suppress=missingReturn --suppress=syntaxError -DWITH_THREAD -j $(nproc) \
+        -DPG_MAJOR_VERSION -DPG_MINOR_VERSION -DPG_PATCH_VERSION -DPG_VERSION_TAG