feat: add support for Python 3.13t, 3.14t, and 3.15t in CI and Docker configurations

- Updated GitLab CI and GitHub Actions workflows to include new Python versions 3.13t, 3.14t, and 3.15t in the build matrix.
- Modified Dockerfiles for x86 and x86_64 architectures to support the new free-threaded Python versions, ensuring compatibility with musl.
- Enhanced the psutil compatibility smoke test to skip execution for the new free-threaded builds.
- Updated build scripts to handle the new Python versions and their specific configurations.

Author: scc-tw

.github/workflows/build.yml

@@ -13,7 +13,8 @@ jobs: {
         "strategy": {
             "matrix": {
                 "architecture": ["x86_64", "x86"],
-                "version": ["3.15", "3.14", "3.13", "3.12", "3.11", "3.10", "2.7"],
+                "version": ["3.15", "3.14", "3.13", "3.12", "3.11", "3.10", "2.7",
+                            "3.15t", "3.14t", "3.13t"],
             },
         },
         "steps": [
@@ -49,8 +50,8 @@ jobs: {
                     /opt/python/bin/python /tmp/smoke_stdlib.py",
             },
             {
-                "name": "psutil compatibility smoke test (Py3 only)",
-                "if": "matrix.version != '2.7'",
+                "name": "psutil compatibility smoke test (GIL Py3 only)",
+                "if": "matrix.version != '2.7' && !endsWith(matrix.version, 't')",
                 "run": "docker run --rm \
                     -v \"${{ github.workspace }}/ci/smoke_psutil.py:/tmp/smoke_psutil.py:ro\" \
                     release-${{ github.ref_name }}:${{ matrix.version }}-${{ matrix.architecture }} \

.gitlab-ci.yml

@@ -33,21 +33,27 @@ build:
     # PyPI (exercises the musllinux tag hook) and run a broad surface-area
     # smoke test against the shipped libc / /proc / subprocess plumbing.
     # smoke_psutil.py uses Py3-only syntax (f-strings), so skip it on 2.7.
+    # Skip on 2.7 (no f-strings in the script) and on free-threaded builds
+    # (PyPI doesn't ship `cp3Nt` psutil wheels yet → sdist fallback → source
+    # build in the debian final image would hit the glibc-headers mismatch).
     - |
-      if [ "$version" != "2.7" ]; then
-        docker run --rm \
-          -v "${CI_PROJECT_DIR}/ci/smoke_psutil.py:/tmp/smoke_psutil.py:ro" \
-          release-${PACKAGE_NAME}:${version}-${architecture} \
-          sh -c '/opt/python/bin/pip install --quiet --no-cache-dir psutil && /opt/python/bin/python /tmp/smoke_psutil.py'
-      fi
+      case "$version" in
+        2.7|*t) ;;
+        *)
+          docker run --rm \
+            -v "${CI_PROJECT_DIR}/ci/smoke_psutil.py:/tmp/smoke_psutil.py:ro" \
+            release-${PACKAGE_NAME}:${version}-${architecture} \
+            sh -c '/opt/python/bin/pip install --quiet --no-cache-dir psutil && /opt/python/bin/python /tmp/smoke_psutil.py'
+          ;;
+      esac
     - docker save release-${PACKAGE_NAME}:${version}-${architecture} > release-${version}-${architecture}.tar
     - bash ci/packing_release_tar.sh release-${version}-${architecture}.tar
     - gzip -9 build/release-${version}-${architecture}.tar
   artifacts:
     paths: ["build/release-${version}-${architecture}.tar.gz", "${version}-${architecture}.log"]
   parallel:
     matrix:
-      - version: ["3.15", "3.14", "3.13", "3.12", "3.11", "3.10", "2.7"]
+      - version: ["3.15", "3.14", "3.13", "3.12", "3.11", "3.10", "2.7", "3.15t", "3.14t", "3.13t"]
         architecture: ["x86_64", "x86"]
   tags: [shell]
   rules:
@@ -80,7 +86,7 @@ upload:
       "${PACKAGE_REGISTRY_URL}${PACKAGE_NAME}/${PACKAGE_VERSION}/release-${version}-${architecture}.tar.gz?${GET_FILE_ATTR_MAGIC}" >> ${version}-${architecture}-result.txt
   parallel:
     matrix:
-      - version: ["3.15", "3.14", "3.13", "3.12", "3.11", "3.10", "2.7"]
+      - version: ["3.15", "3.14", "3.13", "3.12", "3.11", "3.10", "2.7", "3.15t", "3.14t", "3.13t"]
         architecture: ["x86_64", "x86"]
   artifacts:
     paths: ["*-result.txt"]

3.13t/x86/Dockerfile

@@ -0,0 +1,182 @@
+FROM --platform=linux/386 alpine:3.22 AS base_builder
+
+ENV PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
+    LANG=C.UTF-8 \
+    IS_32BIT=1 \
+    ZLIB_VERSION=1.3.2 \
+    FFI_VERSION=3.5.2 \
+    EXPAT_VERSION=2.7.5 \
+    GDBM_VERSION=1.26 \
+    LZMA_VERSION=4.32.7 \
+    GETTEXT_VERSION=1.0 \
+    NCURSES_VERSION=6.6 \
+    OPENSSL_VERSION=3.5.6 \
+    READLINE_VERSION=8.3 \
+    TCL_VERSION=8.6.17 \
+    XZ_VERSION=5.8.3 \
+    BZIP2_VERSION=1.0.8 \
+    UUID_VERSION=2.40.4 \
+    SQLITE_VERSION=3530000 \
+    SQLITE_VERSION_LITERIAL=3.53.0 \
+    SQLITE_YEAR=2026
+WORKDIR /src
+RUN set -eux && apk add --no-cache ca-certificates tzdata && \
+    apk add --no-cache --virtual .build-deps tar xz bluez-dev dpkg-dev dpkg findutils gcc file g++ \
+        libc-dev libnsl-dev libtirpc-dev linux-headers make pax-utils tk tk-dev util-linux-dev wget \
+        bison flex gawk patch
+
+# # =========== musl ===========
+FROM --platform=linux/386 debian:bookworm AS musl_builder
+ARG DEBIAN_FRONTEND=noninteractive
+ENV TZ=Asia/Taipei \
+    IS_32BIT=1
+
+RUN apt-get update -y && apt-get upgrade -y && \
+    apt-get install -y build-essential wget git file tar xz-utils dpkg-dev libnsl-dev libtirpc-dev uuid-dev patch
+
+WORKDIR /src
+COPY ["common/build/deplib/build_musl.sh", "3.13t/x86/deplib/config.mak", "."]
+RUN set -eux && ./build_musl.sh
+
+# =========== libz ===========
+FROM base_builder AS libz_builder
+COPY ["common/build/deplib/build_zlib.sh", "."]
+RUN set -eux && ./build_zlib.sh
+
+# =========== ffi ===========
+FROM libz_builder AS ffi_builder
+COPY ["common/build/deplib/build_ffi.sh", "."]
+RUN set -eux && ./build_ffi.sh
+
+# =========== expat ===========
+FROM ffi_builder AS expat_builder
+COPY ["common/build/deplib/build_expat.sh", "."]
+RUN set -eux && ./build_expat.sh
+
+# =========== gdbm ===========
+FROM expat_builder AS gdbm_builder
+COPY ["common/build/deplib/build_gdbm.sh", "."]
+RUN set -eux && ./build_gdbm.sh
+
+# =========== lzma ===========
+FROM gdbm_builder AS lzma_builder
+COPY ["common/build/deplib/build_lzma.sh", "."]
+RUN set -eux && ./build_lzma.sh
+
+# =========== gettext ===========
+FROM lzma_builder AS gettext_builder
+COPY ["common/build/deplib/build_gettext.sh", "."]
+RUN set -eux && ./build_gettext.sh
+
+# =========== ncurses ===========
+FROM gettext_builder AS ncurses_builder
+COPY ["common/build/deplib/build_ncurses.sh", "."]
+RUN set -eux && ./build_ncurses.sh
+
+# =========== openssl ===========
+FROM ncurses_builder AS openssl_builder
+COPY ["common/build/deplib/build_openssl.sh", "."]
+RUN set -eux && ./build_openssl.sh
+
+# =========== readline ===========
+FROM openssl_builder AS readline_builder
+COPY ["common/build/deplib/build_readline.sh", "common/patches/common/ncurses/fix-ncurses-underlinking.patch", "."]
+RUN set -eux && ./build_readline.sh
+
+# =========== tcl ===========
+FROM readline_builder AS tcl_builder
+COPY ["common/build/deplib/build_tcl.sh", "."]
+RUN set -eux && ./build_tcl.sh
+
+# =========== xz ===========
+FROM tcl_builder AS xz_builder
+COPY ["common/build/deplib/build_xz.sh", "."]
+RUN set -eux && ./build_xz.sh
+
+# =========== bzip2 ===========
+FROM xz_builder AS bzip2_builder
+COPY ["common/build/deplib/build_bzip2.sh", "."]
+RUN set -eux && ./build_bzip2.sh
+
+# =========== uuid ===========
+FROM bzip2_builder AS uuid_builder
+COPY ["common/build/deplib/build_uuid.sh", "."]
+RUN set -eux && ./build_uuid.sh
+
+# =========== sqlite3 ===========
+FROM uuid_builder AS sqlite3_builder
+COPY ["common/build/deplib/build_sqlite3.sh", "."]
+RUN set -eux && ./build_sqlite3.sh
+
+# =========== Python ===========
+FROM sqlite3_builder AS python_builder
+ENV PYTHON_VERSION=3.13.13 \
+    DISABLE_GIL=1 \
+    PYTHON_PIP_VERSION=26.0.1 \
+    PYTHON_SETUPTOOLS_VERSION=82.0.1
+
+COPY ["common/build/deplib/build_python.sh", "common/build/deplib/install_pip.sh", "."]
+RUN set -eux && ./build_python.sh && ./install_pip.sh
+
+# =========== launcher (static C binary, replaces shell wrappers) ===========
+FROM musl_builder AS launcher_builder
+ENV MUSL_ARCH=i386
+WORKDIR /src
+COPY ["common/build/wrappers/launcher.c", "./launcher.c"]
+# config.mak carries `MUSL_VER = X.Y.Z`; drop the patch component and bake
+# `X.Y` into the launcher as MUSL_VERSION so the site hook can hand pip the
+# matching `musllinux_X_Y_*` wheel tag without subprocess'ing ld.so every
+# Python startup.
+RUN set -eux && \
+    MUSL_VER=$(awk -F'=' '/^MUSL_VER[[:space:]]*=/ { gsub(/[[:space:]]/, "", $2); print $2 }' /src/config.mak) && \
+    MUSL_TAG=$(echo "$MUSL_VER" | cut -d. -f1,2) && \
+    test -n "$MUSL_TAG" && \
+    /opt/musl/bin/${MUSL_ARCH}-linux-musl-gcc -static -Os -s \
+        -DMUSL_ARCH="\"${MUSL_ARCH}\"" \
+        -DMUSL_VERSION="\"${MUSL_TAG}\"" \
+        launcher.c -o launcher && \
+    file launcher
+
+# =========== patch_stage ===========
+FROM --platform=linux/386 debian:latest AS patch_stage
+ARG DEBIAN_FRONTEND=noninteractive
+ENV TZ=Asia/Taipei \
+    IS_32BIT=1
+
+RUN apt-get update -y && apt-get install -y patchelf file
+
+COPY --from=python_builder /opt/shared_libraries /opt/shared_libraries
+COPY --from=python_builder /opt/python /opt/python
+
+COPY ["common/build/wrappers/packing-initializer", "."]
+RUN ./packing-initializer && rm -rf packing-initializer
+
+COPY --from=launcher_builder /src/launcher /tmp/launcher
+RUN install -m 0755 /tmp/launcher /opt/python/bin/python3 && \
+    install -m 0755 /tmp/launcher /opt/python/bin/pip3 && \
+    rm /tmp/launcher && \
+    cd /opt/python/bin && \
+    ln -sf python3 python && \
+    ln -sf pip3 pip
+
+# Copy shipped musl runtime and rewrite RPATH on Python's bundled ELFs so
+# $ORIGIN-relative lookups resolve inside the installed tree. No .interp
+# patching is needed — the static launcher invokes ld-musl.so directly.
+COPY --from=musl_builder /opt/musl /opt/musl
+COPY ["common/build/wrappers/rpath-patcher.sh", "."]
+RUN set -eux && ./rpath-patcher.sh
+
+# Site-level hook that tells pip/packaging the shipped libc is musl so wheel
+# resolution picks `musllinux_*` wheels instead of glibc-built manylinux
+# wheels. Runs on every Python startup via the .pth but is a no-op unless
+# the launcher has set _STANDALONE_PYTHON_MUSL_VERSION in the env.
+COPY ["common/build/wrappers/standalone_python_musl.py", \
+      "common/build/wrappers/standalone_python_musl.pth", \
+      "/opt/python/lib/python3.13t/site-packages/"]
+
+# =========== final ===========
+FROM --platform=linux/386 debian:latest AS final
+ARG DEBIAN_FRONTEND=noninteractive
+ENV TZ=Asia/Taipei
+
+COPY --from=patch_stage /opt/python /opt/python

3.13t/x86/deplib/config.mak

@@ -0,0 +1,5 @@
+TARGET = i386-linux-musl
+GCC_VER = 15.1.0
+MUSL_VER = 1.2.5
+COMMON_CONFIG += CFLAGS="-g0 -O3" CXXFLAGS="-g0 -O3" LDFLAGS="-s"
+GCC_CONFIG += --enable-default-pie --enable-static-pie