Sync with upstream

.editorconfig

@@ -0,0 +1,37 @@
+# https://editorconfig.org
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.rb]
+# Required since we use heredocs to assert against Hatchet output, and sometimes that output
+# contains trailing newlines. Our RuboCop config ensures these are only allowed in heredocs.
+trim_trailing_whitespace = false
+
+[*.sh]
+binary_next_line = true
+# We sadly have to use tabs in shell scripts otherwise we can't indent here documents:
+# https://www.gnu.org/software/bash/manual/html_node/Redirections.html#Here-Documents
+indent_style = tab
+shell_variant = bash
+switch_case_indent = true
+
+# Catches scripts that we can't give a .sh file extension, such as the Buildpack API scripts.
+[**/bin/**]
+binary_next_line = true
+indent_style = tab
+shell_variant = bash
+switch_case_indent = true
+
+# The setup-ruby GitHub Action creates this directory when caching is enabled, and if
+# it's not ignored will cause false positives when running shfmt in the CI lint job.
+[vendor/bundle/**]
+ignore = true
+
+[Makefile]
+indent_style = tab

.github/CODEOWNERS

@@ -1,8 +1,12 @@
 # Default to requesting pull request reviews from the Heroku Languages team.
+#ECCN:Open Source
+#GUSINFO:Heroku - Languages,Heroku Python Platform
 * @heroku/languages
 
 # However, request review from the language owner instead for files that are updated
 # by Dependabot or release automation, to reduce team review request noise.
 CHANGELOG.md @edmorley
 Gemfile.lock @edmorley
+/.github/workflows/ @edmorley
+/builds/Dockerfile @edmorley
 /requirements/ @edmorley

.github/dependabot.yml

@@ -13,6 +13,14 @@ updates:
         update-types:
           - "minor"
           - "patch"
+  - package-ecosystem: "docker"
+    directory: "/builds"
+    schedule:
+      interval: "monthly"
+    labels:
+      - "dependencies"
+      - "docker"
+      - "skip changelog"
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
@@ -28,3 +36,9 @@ updates:
     labels:
       - "dependencies"
       - "python"
+    groups:
+      # We don't limit grouping for Python to just minor/patch versions, since pip doesn't follow
+      # semver, plus having to update CHANGELOG.md means it's easier to just have a single PR.
+      python-dependencies:
+        patterns:
+          - "*"

.github/workflows/build_python_runtime.yml

@@ -5,17 +5,17 @@ on:
   workflow_dispatch:
     inputs:
       python_version:
-        description: "Python version (eg: 3.12.0)"
+        description: "Python version (eg: 3.13.0)"
         type: string
         required: true
       stack:
         description: "Stack(s)"
         type: choice
         options:
           - auto
-          - heroku-20
           - heroku-22
           - heroku-24
+          - heroku-26
         default: auto
         required: false
       dry_run:
@@ -36,14 +36,14 @@ env:
 # Unfortunately these jobs cannot be easily written as a matrix since `matrix.exclude` does not
 # support expression syntax, and the `matrix` context is not available inside the job `if` key.
 jobs:
-  heroku-20:
-    if: inputs.stack == 'heroku-20' || inputs.stack == 'auto'
+  heroku-22:
+    if: inputs.stack == 'heroku-22' || inputs.stack == 'auto'
     runs-on: pub-hk-ubuntu-24.04-xlarge
     env:
-      STACK_VERSION: "20"
+      STACK_VERSION: "22"
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Build Docker image
         run: docker build --platform="linux/amd64" --pull --tag buildenv --build-arg=STACK_VERSION builds/
       - name: Compile and package Python runtime
@@ -57,41 +57,43 @@ jobs:
         if: (!inputs.dry_run)
         run: aws s3 sync ./upload "s3://${S3_BUCKET}"
 
-  heroku-22:
-    # On Heroku-22 we only support Python 3.9+.
-    if: inputs.stack == 'heroku-22' || (inputs.stack == 'auto' && !startsWith(inputs.python_version,'3.8.'))
-    runs-on: pub-hk-ubuntu-24.04-xlarge
+  heroku-24:
+    if: inputs.stack == 'heroku-24' || inputs.stack == 'auto'
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: ["amd64", "arm64"]
+    runs-on: ${{ matrix.arch == 'arm64' && 'pub-hk-ubuntu-24.04-arm-xlarge' || 'pub-hk-ubuntu-24.04-xlarge' }}
     env:
-      STACK_VERSION: "22"
+      STACK_VERSION: "24"
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Build Docker image
-        run: docker build --platform="linux/amd64" --pull --tag buildenv --build-arg=STACK_VERSION builds/
+        run: docker build --platform="linux/${{ matrix.arch }}" --pull --tag buildenv --build-arg=STACK_VERSION builds/
       - name: Compile and package Python runtime
         run: docker run --rm --volume="${PWD}/upload:/tmp/upload" buildenv ./build_python_runtime.sh "${{ inputs.python_version }}"
       - name: Test Python runtime
         run: |
           RUN_IMAGE='heroku/heroku:${{ env.STACK_VERSION }}'
-          ARCHIVE_FILENAME='python-${{ inputs.python_version }}-ubuntu-${{ env.STACK_VERSION }}.04-amd64.tar.zst'
+          ARCHIVE_FILENAME='python-${{ inputs.python_version }}-ubuntu-${{ env.STACK_VERSION }}.04-${{ matrix.arch }}.tar.zst'
           docker run --rm --volume="${PWD}/upload:/upload:ro" --volume="${PWD}/builds:/builds:ro" "${RUN_IMAGE}" /builds/test_python_runtime.sh "/upload/${ARCHIVE_FILENAME}"
       - name: Upload Python runtime archive to S3
         if: (!inputs.dry_run)
         run: aws s3 sync ./upload "s3://${S3_BUCKET}"
 
-  heroku-24:
-    # On Heroku-24 we only support Python 3.10+.
-    if: inputs.stack == 'heroku-24' || (inputs.stack == 'auto' && !startsWith(inputs.python_version,'3.8.') && !startsWith(inputs.python_version,'3.9.'))
+  heroku-26:
+    if: inputs.stack == 'heroku-26' || inputs.stack == 'auto'
     strategy:
       fail-fast: false
       matrix:
         arch: ["amd64", "arm64"]
     runs-on: ${{ matrix.arch == 'arm64' && 'pub-hk-ubuntu-24.04-arm-xlarge' || 'pub-hk-ubuntu-24.04-xlarge' }}
     env:
-      STACK_VERSION: "24"
+      STACK_VERSION: "26"
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Build Docker image
         run: docker build --platform="linux/${{ matrix.arch }}" --pull --tag buildenv --build-arg=STACK_VERSION builds/
       - name: Compile and package Python runtime

.github/workflows/check_changelog.yml

@@ -13,7 +13,7 @@ jobs:
     if: (!contains(github.event.pull_request.labels.*.name, 'skip changelog'))
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Check that CHANGELOG is touched
         run: |
           git fetch origin ${{ github.base_ref }} --depth 1 && \

.github/workflows/ci.yml

@@ -10,19 +10,27 @@ on:
 permissions:
   contents: read
 
+env:
+  # Used by shfmt and more.
+  FORCE_COLOR: 1
+
 jobs:
   lint:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Install Ruby and dependencies
         uses: ruby/setup-ruby@v1
         with:
           bundler-cache: true
-          ruby-version: "3.3"
+          ruby-version: "4.0"
       - name: Run ShellCheck
         run: make lint-scripts
+      - name: Run shfmt
+        uses: docker://mvdan/shfmt:latest
+        with:
+          args: "--diff ."
       - name: Run Rubocop
         run: bundle exec rubocop
 
@@ -31,24 +39,24 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        stack: ["heroku-20", "heroku-22", "heroku-24"]
+        stack: ["heroku-22", "heroku-24", "heroku-26"]
     env:
-      HATCHET_APP_LIMIT: 200
+      HATCHET_APP_LIMIT: 300
       HATCHET_DEFAULT_STACK: ${{ matrix.stack }}
       HATCHET_EXPENSIVE_MODE: 1
       HEROKU_API_KEY: ${{ secrets.HEROKU_API_KEY }}
       HEROKU_API_USER: ${{ secrets.HEROKU_API_USER }}
       HEROKU_DISABLE_AUTOUPDATE: 1
-      PARALLEL_SPLIT_TEST_PROCESSES: 60
-      RSPEC_RETRY_RETRY_COUNT: 3
+      PARALLEL_SPLIT_TEST_PROCESSES: 90
+      RSPEC_RETRY_RETRY_COUNT: 1
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Install Ruby and dependencies
         uses: ruby/setup-ruby@v1
         with:
           bundler-cache: true
-          ruby-version: "3.3"
+          ruby-version: "4.0"
       - name: Hatchet setup
         run: bundle exec hatchet ci:setup
       - name: Run Hatchet integration tests
@@ -57,17 +65,12 @@ jobs:
 
   container-test:
     runs-on: ubuntu-24.04
-    defaults:
-      run:
-        # Work around lack of TTY causing errors when using `docker run -it`:
-        # https://github.com/actions/runner/issues/241
-        shell: 'script -q -e -c "bash -eo pipefail {0}"'
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       # These test both the local development `make run` workflow and that `bin/report` completes successfully
       # for both passing and failing builds (since `bin/report` can't easily be tested via Hatchet tests).
       - name: Run buildpack using default app fixture
         run: make run
       - name: Run buildpack using an app fixture that's expected to fail
-        run: make run FIXTURE=spec/fixtures/python_version_invalid/
+        run: make run FIXTURE=spec/fixtures/python_version_file_invalid_version/ COMPILE_FAILURE_EXIT_CODE=0

.github/workflows/hatchet_app_cleaner.yml

@@ -19,12 +19,12 @@ jobs:
       HEROKU_DISABLE_AUTOUPDATE: 1
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Install Ruby and dependencies
         uses: ruby/setup-ruby@v1
         with:
           bundler-cache: true
-          ruby-version: "3.3"
+          ruby-version: "4.0"
       - name: Run Hatchet destroy
         # Only apps older than 10 minutes are destroyed, to ensure that any
         # in progress CI runs are not interrupted.

.github/workflows/release.yml

@@ -0,0 +1,36 @@
+name: Release Buildpack
+
+on:
+  # Auto-trigger when the "Prepare release" PR (created by the
+  # _classic-buildpack-prepare-release.yml workflow) is merged.
+  pull_request:
+    branches:
+      - main
+    types:
+      - closed
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  contents: write
+
+jobs:
+  release:
+    name: Release
+    # On `pull_request`, only run for the merged auto-generated
+    # "Prepare release" PR (branch name set by
+    # _classic-buildpack-prepare-release.yml). Manual dispatches always run.
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.pull_request.merged == true &&
+       github.event.pull_request.head.repo.full_name == github.repository &&
+       github.event.pull_request.head.ref == 'prepare-release' &&
+       github.event.pull_request.user.login == 'heroku-linguist[bot]')
+    uses: heroku/languages-github-actions/.github/workflows/_classic-buildpack-publish.yml@latest
+    with:
+      buildpack_id: "heroku/python"
+      app_id: ${{ vars.LINGUIST_GH_APP_ID }}
+    secrets:
+      app_private_key: ${{ secrets.LINGUIST_GH_PRIVATE_KEY }}
+      slack_webhook_url: ${{ secrets.BUILDPACK_RELEASE_FAILURE_WEBHOOK_URL }}
+      honeycomb_api_key: ${{ secrets.HONEYCOMB_API_KEY }}

.gitignore

@@ -1,5 +1,4 @@
 __pycache__/
-.hatchet/repos/
 .venv/
 # The setup-ruby GitHub Action creates this directory when caching is enabled, so we ignore
 # it here so it does not show up in the output of `git ls-files` for `make lint-scripts`.

.rubocop.yml

@@ -1,4 +1,4 @@
-require:
+plugins:
   - rubocop-rspec
 
 AllCops:

.shellcheckrc

@@ -1,15 +1,2 @@
 # Enable all checks, including the optional ones that are off by default.
 enable=all
-
-# TODO: Triage and potentially enable more of these optional checks.
-
-# SC2154 (warning): var is referenced but not assigned.
-disable=SC2154
-# SC2250 (style): Prefer putting braces around variable references even when not strictly required.
-disable=SC2250
-# SC2310 (info): This function is invoked in an 'if' condition so set -e will be disabled.
-disable=SC2310
-# SC2311 (info): Bash implicitly disabled set -e for this function invocation because it's inside a command substitution.
-disable=SC2311
-# SC2312 (info): Consider invoking this command separately to avoid masking its return value
-disable=SC2312