beeware · freakboy3742 · Sep 1, 2026 · Sep 1, 2026 · Sep 1, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -1,11 +1,23 @@
-
 version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
+
+multi-ecosystem-groups:
+  dependencies:
     schedule:
       # Check for updates on the first Sunday of every month, 8PM UTC
       interval: "cron"
       cronjob: "0 20 * * sun#1"
+
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    patterns: ["*"]
+    multi-ecosystem-group: "dependencies"
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "pre-commit"
+    directory: "/"
+    patterns: ["*"]
+    multi-ecosystem-group: "dependencies"
     cooldown:
       default-days: 7
diff --git a/.github/workflows/check-pr-template.yml b/.github/workflows/check-pr-template.yml
@@ -4,6 +4,9 @@ on:
   pull_request:
     types: [opened, edited, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   check-pr-template:
     name: Check PR template

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -33,6 +33,9 @@ on:
         description: "The Zstandard version used for the build."
         value: ${{ jobs.config.outputs.ZSTD_VERSION }}
 
+permissions:
+  contents: read
+
 env:
   FORCE_COLOR: "1"
 
@@ -46,6 +49,12 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  pre-commit:
+    name: Pre-commit checks
+    uses: beeware/.github/.github/workflows/pre-commit-run.yml@main
+    with:
+      pre-commit-source: pre-commit
+
   config:
     runs-on: macOS-latest
     outputs:
@@ -60,10 +69,14 @@ jobs:
       ZSTD_VERSION: ${{ steps.extract.outputs.ZSTD_VERSION }}
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Extract config variables
         id: extract
+        env:
+          INPUTS_BUILD_NUMBER: ${{ inputs.build-number }}
         run: |
           PYTHON_VER=$(make config | grep "PYTHON_VER=" | cut -d "=" -f 2)
           PYTHON_VERSION=$(make config | grep "PYTHON_VERSION=" | cut -d "=" -f 2)
@@ -73,10 +86,10 @@ jobs:
           OPENSSL_VERSION=$(make config | grep "OPENSSL_VERSION=" | cut -d "=" -f 2)
           XZ_VERSION=$(make config | grep "XZ_VERSION=" | cut -d "=" -f 2)
           ZSTD_VERSION=$(make config | grep "ZSTD_VERSION=" | cut -d "=" -f 2)
-          if [ -z "${{ inputs.build-number }}" ]; then
+          if [ -z "${INPUTS_BUILD_NUMBER}" ]; then
             BUILD_NUMBER=custom
           else
-            BUILD_NUMBER=${{ inputs.build-number }}
+            BUILD_NUMBER=${INPUTS_BUILD_NUMBER}
           fi
 
           echo "PYTHON_VER=${PYTHON_VER}" | tee -a ${GITHUB_OUTPUT}
@@ -98,7 +111,9 @@ jobs:
         platform: ["macOS", "iOS", "tvOS", "watchOS", "visionOS"]
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Xcode
         # GitHub recommends explicitly selecting the desired Xcode version:
@@ -110,7 +125,7 @@ jobs:
           sudo xcode-select --switch /Applications/Xcode_16.4.app
 
       - name: Set up Python
-        uses: actions/setup-python@v7.0.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           # Appending -dev ensures that we can always build the dev release.
           # It's a no-op for versions that have been published.
@@ -120,12 +135,14 @@ jobs:
           check-latest: true
 
       - name: Build ${{ matrix.platform }}
+        env:
+          BUILD_NUMBER: ${{ needs.config.outputs.BUILD_NUMBER }}
         run: |
           # Do the build for the requested platform.
-          make ${{ matrix.platform }} BUILD_NUMBER=${{ needs.config.outputs.BUILD_NUMBER }}
+          make ${{ matrix.platform }} BUILD_NUMBER=${BUILD_NUMBER}
 
       - name: Upload build artefacts
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: Python-${{ needs.config.outputs.PYTHON_VER }}-${{ matrix.platform }}-support.${{ needs.config.outputs.BUILD_NUMBER }}.tar.gz
           path: dist/Python-${{ needs.config.outputs.PYTHON_VER }}-${{ matrix.platform }}-support.${{ needs.config.outputs.BUILD_NUMBER }}.tar.gz
@@ -145,7 +162,9 @@ jobs:
             briefcase-run-args: ' -d "iPhone 16e::iOS 18.5"'
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Xcode
         # GitHub recommends explicitly selecting the desired Xcode version:
@@ -157,14 +176,14 @@ jobs:
           sudo xcode-select --switch /Applications/Xcode_16.4.app
 
       - name: Get build artifact
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: Python-${{ needs.config.outputs.PYTHON_VER }}-${{ matrix.platform }}-support.${{ needs.config.outputs.BUILD_NUMBER }}.tar.gz
           path: dist
           merge-multiple: true
 
       - name: Set up Python
-        uses: actions/setup-python@v7.0.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           # Appending -dev ensures that we can always build the dev release.
           # It's a no-op for versions that have been published.
@@ -173,10 +192,11 @@ jobs:
           # It's an edge case, but when a new alpha is released, we need to use it ASAP.
           check-latest: true
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: beeware/Python-support-testbed
           path: Python-support-testbed
+          persist-credentials: false
 
       - name: Install dependencies
         run: |
@@ -186,7 +206,11 @@ jobs:
       - name: Run support testbed check
         timeout-minutes: 15
         working-directory: Python-support-testbed
-        run: briefcase run ${{ matrix.platform }} Xcode --test ${{ matrix.briefcase-run-args }} -C support_package=\'../dist/Python-${{ needs.config.outputs.PYTHON_VER }}-${{ matrix.platform }}-support.${{ needs.config.outputs.BUILD_NUMBER }}.tar.gz\'
+        env:
+          PYTHON_VER: ${{ needs.config.outputs.PYTHON_VER }}
+          BUILD_NUMBER: ${{ needs.config.outputs.BUILD_NUMBER }}
+        run: |
+          briefcase run ${{ matrix.platform }} Xcode --test ${{ matrix.briefcase-run-args }} -C support_package=\'../dist/Python-${PYTHON_VER}-${{ matrix.platform }}-support.${BUILD_NUMBER}.tar.gz\'
 
   cpython-testbed:
     name: CPython testbed (${{ matrix.platform }})
@@ -203,10 +227,12 @@ jobs:
             testbed-args: '--simulator "Apple Vision Pro,arch=arm64,OS=2.5"'
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Get build artifact
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: Python-${{ needs.config.outputs.PYTHON_VER }}-${{ matrix.platform }}-support.${{ needs.config.outputs.BUILD_NUMBER }}.tar.gz
           path: dist
@@ -222,7 +248,7 @@ jobs:
           sudo xcode-select --switch /Applications/Xcode_16.4.app
 
       - name: Set up Python
-        uses: actions/setup-python@v7.0.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           # Appending -dev ensures that we can always build the dev release.
           # It's a no-op for versions that have been published.
@@ -232,10 +258,13 @@ jobs:
           check-latest: true
 
       - name: Unpack support package
+        env:
+          PYTHON_VER: ${{ needs.config.outputs.PYTHON_VER }}
+          BUILD_NUMBER: ${{ needs.config.outputs.BUILD_NUMBER }}
         run: |
-          mkdir -p support/${{ needs.config.outputs.PYTHON_VER }}/${{ matrix.platform }}
-          cd support/${{ needs.config.outputs.PYTHON_VER }}/${{ matrix.platform }}
-          tar zxvf ../../../dist/Python-${{ needs.config.outputs.PYTHON_VER }}-${{ matrix.platform }}-support.${{ needs.config.outputs.BUILD_NUMBER }}.tar.gz
+          mkdir -p support/${PYTHON_VER}/${{ matrix.platform }}
+          cd support/${PYTHON_VER}/${{ matrix.platform }}
+          tar zxvf ../../../dist/Python-${PYTHON_VER}-${{ matrix.platform }}-support.${BUILD_NUMBER}.tar.gz
 
       - name: Run CPython testbed
         timeout-minutes: 15
@@ -268,17 +297,19 @@ jobs:
             multiarch: arm64-iphoneos
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Get build artifact
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: Python-${{ needs.config.outputs.PYTHON_VER }}-${{ matrix.platform }}-support.${{ needs.config.outputs.BUILD_NUMBER }}.tar.gz
           path: dist
           merge-multiple: true
 
       - name: Set up Python
-        uses: actions/setup-python@v7.0.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           # Appending -dev ensures that we can always build the dev release.
           # It's a no-op for versions that have been published.
@@ -288,26 +319,30 @@ jobs:
           check-latest: true
 
       - name: Unpack support package
+        env:
+          PYTHON_VER: ${{ needs.config.outputs.PYTHON_VER }}
+          BUILD_NUMBER: ${{ needs.config.outputs.BUILD_NUMBER }}
         run: |
-          mkdir -p support/${{ needs.config.outputs.PYTHON_VER }}/${{ matrix.platform }}
-          cd support/${{ needs.config.outputs.PYTHON_VER }}/${{ matrix.platform }}
-          tar zxvf ../../../dist/Python-${{ needs.config.outputs.PYTHON_VER }}-${{ matrix.platform }}-support.${{ needs.config.outputs.BUILD_NUMBER }}.tar.gz
+          mkdir -p support/${PYTHON_VER}/${{ matrix.platform }}
+          cd support/${PYTHON_VER}/${{ matrix.platform }}
+          tar zxvf ../../../dist/Python-${PYTHON_VER}-${{ matrix.platform }}-support.${BUILD_NUMBER}.tar.gz
 
       - name: Run cross-platform environment test
         env:
           PYTHON_CROSS_PLATFORM: ${{ matrix.platform }}
           PYTHON_CROSS_SLICE: ${{ matrix.slice }}
           PYTHON_CROSS_MULTIARCH: ${{ matrix.multiarch }}
+          PYTHON_VER: ${{ needs.config.outputs.PYTHON_VER }}
         run: |
           # Create and activate a native virtual environment
-          python${{ needs.config.outputs.PYTHON_VER }} -m venv cross-venv
+          python${PYTHON_VER} -m venv cross-venv
           source cross-venv/bin/activate
 
           # Install pytest
           python -m pip install pytest
 
           # Convert venv into cross-venv
-          python support/${{ needs.config.outputs.PYTHON_VER }}/${{ matrix.platform }}/Python.xcframework/${{ matrix.slice }}/platform-config/${{ matrix.multiarch }}/make_cross_venv.py cross-venv
+          python support/${PYTHON_VER}/${{ matrix.platform }}/Python.xcframework/${{ matrix.slice }}/platform-config/${{ matrix.multiarch }}/make_cross_venv.py cross-venv
 
           # Run the test suite
           python -m pytest tests
diff --git a/.github/workflows/new-issue.yml b/.github/workflows/new-issue.yml
@@ -7,12 +7,16 @@ on:
       - reopened
       - transferred
 
+permissions:
+  issues: write
+  contents: read
+
 jobs:
   add-to-project:
     name: Add issue to BeeWare project
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v2.0.0
+      - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
         with:
           project-url: https://github.com/orgs/beeware/projects/1
           github-token: ${{ secrets.BRUTUS_PAT_TOKEN }}
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
@@ -4,14 +4,19 @@ on:
   release:
     types: published
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Python environment
-        uses: actions/setup-python@v7.0.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.X"
 
@@ -32,22 +37,25 @@ jobs:
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          TAG: ${{ steps.build-vars.outputs.TAG }}
+          PYTHON_VER: ${{ steps.build-vars.outputs.PYTHON_VER }}
+          BUILD_NUMBER: ${{ steps.build-vars.outputs.BUILD_NUMBER }}
         run: |
           python -m pip install -U pip
           python -m pip install -U setuptools
           python -m pip install awscli
           # macOS build
-          curl -o macOS-artefact.tar.gz -L https://github.com/beeware/Python-Apple-support/releases/download/${{ steps.build-vars.outputs.TAG }}/Python-${{ steps.build-vars.outputs.PYTHON_VER }}-macOS-support.${{ steps.build-vars.outputs.BUILD_NUMBER }}.tar.gz
-          aws s3 cp macOS-artefact.tar.gz s3://briefcase-support/python/${{ steps.build-vars.outputs.PYTHON_VER }}/macOS/Python-${{ steps.build-vars.outputs.PYTHON_VER }}-macOS-support.${{ steps.build-vars.outputs.BUILD_NUMBER }}.tar.gz
+          curl -o macOS-artefact.tar.gz -L https://github.com/beeware/Python-Apple-support/releases/download/${TAG}/Python-${PYTHON_VER}-macOS-support.${BUILD_NUMBER}.tar.gz
+          aws s3 cp macOS-artefact.tar.gz s3://briefcase-support/python/${PYTHON_VER}/macOS/Python-${PYTHON_VER}-macOS-support.${BUILD_NUMBER}.tar.gz
           # iOS build
-          curl -o iOS-artefact.tar.gz -L https://github.com/beeware/Python-Apple-support/releases/download/${{ steps.build-vars.outputs.TAG }}/Python-${{ steps.build-vars.outputs.PYTHON_VER }}-iOS-support.${{ steps.build-vars.outputs.BUILD_NUMBER }}.tar.gz
-          aws s3 cp iOS-artefact.tar.gz s3://briefcase-support/python/${{ steps.build-vars.outputs.PYTHON_VER }}/iOS/Python-${{ steps.build-vars.outputs.PYTHON_VER }}-iOS-support.${{ steps.build-vars.outputs.BUILD_NUMBER }}.tar.gz
+          curl -o iOS-artefact.tar.gz -L https://github.com/beeware/Python-Apple-support/releases/download/${TAG}/Python-${PYTHON_VER}-iOS-support.${BUILD_NUMBER}.tar.gz
+          aws s3 cp iOS-artefact.tar.gz s3://briefcase-support/python/${PYTHON_VER}/iOS/Python-${PYTHON_VER}-iOS-support.${BUILD_NUMBER}.tar.gz
           # tvOS build
-          curl -o tvOS-artefact.tar.gz -L https://github.com/beeware/Python-Apple-support/releases/download/${{ steps.build-vars.outputs.TAG }}/Python-${{ steps.build-vars.outputs.PYTHON_VER }}-tvOS-support.${{ steps.build-vars.outputs.BUILD_NUMBER }}.tar.gz
-          aws s3 cp tvOS-artefact.tar.gz s3://briefcase-support/python/${{ steps.build-vars.outputs.PYTHON_VER }}/tvOS/Python-${{ steps.build-vars.outputs.PYTHON_VER }}-tvOS-support.${{ steps.build-vars.outputs.BUILD_NUMBER }}.tar.gz
+          curl -o tvOS-artefact.tar.gz -L https://github.com/beeware/Python-Apple-support/releases/download/${TAG}/Python-${PYTHON_VER}-tvOS-support.${BUILD_NUMBER}.tar.gz
+          aws s3 cp tvOS-artefact.tar.gz s3://briefcase-support/python/${PYTHON_VER}/tvOS/Python-${PYTHON_VER}-tvOS-support.${BUILD_NUMBER}.tar.gz
           # watchOS build
-          curl -o watchOS-artefact.tar.gz -L https://github.com/beeware/Python-Apple-support/releases/download/${{ steps.build-vars.outputs.TAG }}/Python-${{ steps.build-vars.outputs.PYTHON_VER }}-watchOS-support.${{ steps.build-vars.outputs.BUILD_NUMBER }}.tar.gz
-          aws s3 cp watchOS-artefact.tar.gz s3://briefcase-support/python/${{ steps.build-vars.outputs.PYTHON_VER }}/watchOS/Python-${{ steps.build-vars.outputs.PYTHON_VER }}-watchOS-support.${{ steps.build-vars.outputs.BUILD_NUMBER }}.tar.gz
+          curl -o watchOS-artefact.tar.gz -L https://github.com/beeware/Python-Apple-support/releases/download/${TAG}/Python-${PYTHON_VER}-watchOS-support.${BUILD_NUMBER}.tar.gz
+          aws s3 cp watchOS-artefact.tar.gz s3://briefcase-support/python/${PYTHON_VER}/watchOS/Python-${PYTHON_VER}-watchOS-support.${BUILD_NUMBER}.tar.gz
           # visionOS build
-          curl -o visionOS-artefact.tar.gz -L https://github.com/beeware/Python-Apple-support/releases/download/${{ steps.build-vars.outputs.TAG }}/Python-${{ steps.build-vars.outputs.PYTHON_VER }}-visionOS-support.${{ steps.build-vars.outputs.BUILD_NUMBER }}.tar.gz
-          aws s3 cp visionOS-artefact.tar.gz s3://briefcase-support/python/${{ steps.build-vars.outputs.PYTHON_VER }}/visionOS/Python-${{ steps.build-vars.outputs.PYTHON_VER }}-visionOS-support.${{ steps.build-vars.outputs.BUILD_NUMBER }}.tar.gz
+          curl -o visionOS-artefact.tar.gz -L https://github.com/beeware/Python-Apple-support/releases/download/${TAG}/Python-${PYTHON_VER}-visionOS-support.${BUILD_NUMBER}.tar.gz
+          aws s3 cp visionOS-artefact.tar.gz s3://briefcase-support/python/${PYTHON_VER}/visionOS/Python-${PYTHON_VER}-visionOS-support.${BUILD_NUMBER}.tar.gz