sync upstream

.gitattributes

@@ -0,0 +1 @@
+*.h text eol=lf

.github/FUNDING.yml

@@ -0,0 +1 @@
+github: jdavid

.github/dependabot.yml

@@ -0,0 +1,25 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: "monthly"
+    commit-message:
+      prefix: "chore(CI):"
+    groups:
+      actions:
+        patterns:
+          - "*"
+  # - package-ecosystem: pip
+  #   directory: .github/
+  #   schedule:
+  #     interval: "monthly"
+  #   groups:
+  #     pip:
+  #       patterns:
+  #         - "*"

.github/workflows/codespell.yml

@@ -0,0 +1,23 @@
+# Codespell configuration is within pyproject.toml
+---
+name: Codespell
+
+on:
+  pull_request:
+  push:
+
+permissions:
+  contents: read
+
+jobs:
+  codespell:
+    name: Check for spelling errors
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+      - name: Annotate locations with typos
+        uses: codespell-project/codespell-problem-matcher@v1
+      - name: Codespell
+        uses: codespell-project/actions-codespell@v2

.github/workflows/lint.yml

@@ -0,0 +1,32 @@
+name: Lints
+
+on:
+  pull_request:
+  push:
+    paths-ignore:
+    - '**.rst'
+
+jobs:
+  ruff:
+    runs-on: ubuntu-24.04
+
+    steps:
+    - name: Checkout pygit2
+      uses: actions/checkout@v5
+
+    - name: Set up Python
+      uses: actions/setup-python@v6
+      with:
+        python-version: '3.13'
+
+    - name: Install ruff
+      run: pip install ruff
+
+    - name: Format code with ruff
+      run: ruff format --diff
+
+    - name: Check code style with ruff
+      run: ruff check
+
+    - name: Check typing with mypy
+      run: LIBSSH2_VERSION=1.11.1 LIBGIT2_VERSION=1.9.1 /bin/sh build.sh mypy

.github/workflows/tests.yml

@@ -0,0 +1,71 @@
+name: Tests
+
+on:
+  pull_request:
+  push:
+    paths-ignore:
+    - '**.rst'
+
+jobs:
+  linux:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        include:
+        - os: ubuntu-24.04
+          python-version: '3.10'
+        - os: ubuntu-24.04
+          python-version: '3.13'
+        - os: ubuntu-24.04
+          python-version: 'pypy3.10'
+        - os: ubuntu-24.04-arm
+          python-version: '3.13'
+
+    steps:
+    - name: Checkout pygit2
+      uses: actions/checkout@v5
+
+    - name: Set up Python
+      uses: actions/setup-python@v6
+      with:
+        python-version: ${{ matrix.python-version }}
+
+    - name: Linux
+      run: |
+        sudo apt install tinyproxy
+        LIBSSH2_VERSION=1.11.1 LIBGIT2_VERSION=1.9.1 /bin/sh build.sh test
+
+  linux-s390x:
+    runs-on: ubuntu-24.04
+    if: github.ref == 'refs/heads/master'
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v5
+
+    - name: Build & test
+      uses: uraimo/run-on-arch-action@v3
+      with:
+        arch: s390x
+        distro: ubuntu22.04
+        install: |
+          apt-get update -q -y
+          apt-get install -q -y cmake libssl-dev python3-dev python3-venv wget
+        run: |
+          LIBSSH2_VERSION=1.11.1 LIBGIT2_VERSION=1.9.1 /bin/sh build.sh test
+      continue-on-error: true # Tests are expected to fail, see issue #812
+
+  macos-arm64:
+    runs-on: macos-latest
+    steps:
+    - name: Checkout pygit2
+      uses: actions/checkout@v5
+
+    - name: Set up Python
+      uses: actions/setup-python@v6
+      with:
+        python-version: '3.13'
+
+    - name: macOS
+      run: |
+        export OPENSSL_PREFIX=`brew --prefix openssl@3`
+        LIBSSH2_VERSION=1.11.1 LIBGIT2_VERSION=1.9.1 /bin/sh build.sh test

.github/workflows/wheels.yml

@@ -0,0 +1,142 @@
+name: Wheels
+
+on:
+  push:
+    branches:
+    - master
+    - wheels-*
+    tags:
+    - 'v*'
+
+jobs:
+  build_wheels:
+    name: Wheels for ${{ matrix.name }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        include:
+        - name: linux-amd
+          os: ubuntu-24.04
+        - name: linux-arm
+          os: ubuntu-24.04-arm
+        - name: macos
+          os: macos-13
+        - name: windows-x64
+          os: windows-latest
+        - name: windows-x86
+          os: windows-latest
+        - name: windows-arm64
+          # https://github.com/actions/partner-runner-images#available-images
+          os: windows-11-arm
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          # avoid leaking credentials in uploaded artifacts
+          persist-credentials: false
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.13'
+
+      - name: Install cibuildwheel
+        run: python -m pip install cibuildwheel~=3.1.1
+
+      - name: Build wheels
+        env:
+          CIBW_ARCHS_WINDOWS: ${{ matrix.name == 'windows-x86' && 'auto32' || 'native' }}
+        run: python -m cibuildwheel --output-dir wheelhouse
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheels-${{ matrix.name }}
+          path: ./wheelhouse/*.whl
+
+  build_wheels_ppc:
+    name: Wheels for linux-ppc
+    runs-on: ubuntu-24.04
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          # avoid leaking credentials in uploaded artifacts
+          persist-credentials: false
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.13'
+
+      - uses: docker/setup-qemu-action@v3
+        with:
+          platforms: linux/ppc64le
+
+      - name: Install cibuildwheel
+        run: python -m pip install cibuildwheel~=3.1.1
+
+      - name: Build wheels
+        run: python -m cibuildwheel --output-dir wheelhouse
+        env:
+          CIBW_ARCHS: ppc64le
+          CIBW_ENVIRONMENT: LIBSSH2_VERSION=1.11.1 LIBGIT2_VERSION=1.9.1 LIBGIT2=/project/ci
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheels-linux-ppc
+          path: ./wheelhouse/*.whl
+
+  sdist:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          # avoid leaking credentials in uploaded artifacts
+          persist-credentials: false
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.13'
+
+      - name: Build sdist
+        run: pipx run build --sdist --outdir dist
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheels-sdist
+          path: dist/*
+
+  twine-check:
+    name: Twine check
+    # It is good to do this check on non-tagged commits.
+    # Note, pypa/gh-action-pypi-publish (see job below) does this automatically.
+    if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+    needs: [build_wheels, build_wheels_ppc, sdist]
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/download-artifact@v5
+        with:
+          path: dist
+          pattern: wheels-*
+          merge-multiple: true
+      - name: check distribution files
+        run: pipx run twine check dist/*
+
+  pypi:
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    needs: [build_wheels, build_wheels_ppc]
+    runs-on: ubuntu-24.04
+
+    steps:
+    - uses: actions/download-artifact@v5
+      with:
+        path: dist
+        pattern: wheels-*
+        merge-multiple: true
+
+    - name: Display structure of downloaded files
+      run: ls -lh dist
+
+    - uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        user: __token__
+        password: ${{ secrets.PYPI_API_TOKEN }}