Merge branch 'master' into master

Author: mattangus

.github/ISSUE_TEMPLATE/crash.md

@@ -15,7 +15,7 @@ labels: "crash"
 
 **Traceback**
 
-```
+```python-traceback
 (Insert traceback and other messages from mypy here -- use `--show-traceback`.)
 ```
 
@@ -25,6 +25,11 @@ labels: "crash"
 appreciated.  We also very much appreciate it if you try to narrow the
 source down to a small stand-alone example.)
 
+```python
+# Ideally, a small sample program that demonstrates the problem.
+# Or even better, a reproducible playground link https://mypy-play.net/ (use the "Gist" button)
+```
+
 **Your Environment**
 
 <!-- Include as many relevant details about the environment you experienced the bug in -->

.github/workflows/build_wheels.yml

@@ -6,14 +6,16 @@ on:
     tags: ['*']
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   build-wheels:
     if: github.repository == 'python/mypy'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: '3.11'

.github/workflows/docs.yml

@@ -12,6 +12,9 @@ on:
     # so it's important to do the docs build on all PRs touching mypy/errorcodes.py
     # in case somebody's adding a new error code without any docs
     - 'mypy/errorcodes.py'
+    # Part of the documentation is automatically generated from the options
+    # definitions in mypy/main.py
+    - 'mypy/main.py'
     - 'mypyc/doc/**'
     - '**/*.rst'
     - '**/*.md'
@@ -35,11 +38,13 @@ jobs:
       VERIFY_MYPY_ERROR_CODES: 1
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: '3.12'
       - name: Install tox
-        run: pip install tox==4.21.2
+        run: pip install tox==4.26.0
       - name: Setup tox environment
         run: tox run -e ${{ env.TOXENV }} --notest
       - name: Test

.github/workflows/mypy_primer.yml

@@ -26,21 +26,20 @@ jobs:
   mypy_primer:
     name: Run mypy_primer
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     strategy:
       matrix:
-        shard-index: [0, 1, 2, 3, 4]
+        shard-index: [0, 1, 2, 3, 4, 5]
       fail-fast: false
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
         with:
           path: mypy_to_test
           fetch-depth: 0
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
-          python-version: "3.12"
+          python-version: "3.14"
       - name: Install dependencies
         run: |
           python -m pip install -U pip
@@ -64,19 +63,20 @@ jobs:
             mypy_primer \
             --repo mypy_to_test \
             --new $GITHUB_SHA --old base_commit \
-            --num-shards 5 --shard-index ${{ matrix.shard-index }} \
+            --num-shards 6 --shard-index ${{ matrix.shard-index }} \
             --debug \
             --additional-flags="--debug-serialize" \
             --output concise \
+            --mypy-install-librt \
             | tee diff_${{ matrix.shard-index }}.txt
           ) || [ $? -eq 1 ]
       - if: ${{ matrix.shard-index == 0 }}
         name: Save PR number
         run: |
           echo ${{ github.event.pull_request.number }} | tee pr_number.txt
-      - if: ${{ matrix.shard-index == 0 }}
-        name: Upload mypy_primer diff + PR number
+      - name: Upload mypy_primer diff + PR number
         uses: actions/upload-artifact@v4
+        if: ${{ matrix.shard-index == 0 }}
         with:
           name: mypy_primer_diffs-${{ matrix.shard-index }}
           path: |
@@ -93,8 +93,6 @@ jobs:
     name: Join artifacts
     runs-on: ubuntu-latest
     needs: [mypy_primer]
-    permissions:
-      contents: read
     steps:
       - name: Merge artifacts
         uses: actions/upload-artifact/merge@v4

.github/workflows/mypy_primer_comment.yml

@@ -1,20 +1,21 @@
 name: Comment with mypy_primer diff
 
-on:
+on:  # zizmor: ignore[dangerous-triggers]
   workflow_run:
     workflows:
       - Run mypy_primer
     types:
       - completed
 
-permissions:
-  contents: read
-  pull-requests: write
+permissions: {}
 
 jobs:
   comment:
     name: Comment PR from mypy_primer
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
     steps:
       - name: Download diffs
@@ -48,7 +49,7 @@ jobs:
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
-            const MAX_CHARACTERS = 30000
+            const MAX_CHARACTERS = 50000
             const MAX_CHARACTERS_PER_PROJECT = MAX_CHARACTERS / 3
 
             const fs = require('fs')

.github/workflows/sync_typeshed.yml

@@ -5,20 +5,22 @@ on:
   schedule:
     - cron: "0 0 1,15 * *"
 
-permissions:
-  contents: write
-  pull-requests: write
+permissions: {}
 
 jobs:
   sync_typeshed:
     name: Sync typeshed
     if: github.repository == 'python/mypy'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: true  # needed to `git push` the PR branch
         # TODO: use whatever solution ends up working for
         # https://github.com/python/typeshed/issues/8434
       - uses: actions/setup-python@v5