Add Python 3.13 ci job and update actions

* 2025 updates try 2

no _logic_ changes, just version bumps and 3.13 support/default - some commented-out _potential_ fixes and explanatory text

* copy pasta

3.13

* undo commented-outs

revorted

* moar copy-pasta

😅

.github/workflows/build_python_3.10.yml

@@ -89,7 +89,7 @@ jobs:
         files: ${{github.workspace}}/outputs/*.pkg
 
     - name: Upload packages
-      uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: packages
         path: outputs/

.github/workflows/build_python_3.11.yml

@@ -84,7 +84,7 @@ jobs:
         files: ${{github.workspace}}/outputs/*.pkg
 
     - name: Upload packages
-      uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: packages
         path: outputs/

.github/workflows/build_python_3.12.yml

@@ -84,7 +84,7 @@ jobs:
         files: ${{github.workspace}}/outputs/*.pkg
 
     - name: Upload packages
-      uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: packages
         path: outputs/

.github/workflows/build_python_3.13.yml

@@ -0,0 +1,90 @@
+name: Build Python 3.13
+
+env:
+  TYPE: "recommended"
+  DEV_INSTALLER_ID: "Developer ID Installer: Mac Admins Open Source (T4SK8ZXCXG)"
+  DEV_APPLICATION_ID: "Developer ID Application: Mac Admins Open Source (T4SK8ZXCXG)"
+  NOTARY_APP_PASSWORD: ${{ secrets.NOTARY_APP_PASSWORD_MAOS }}
+  PYTHON_VERSION: "3.13.5"
+  PYTHON_MAJOR_VERSION: "3.13"
+
+on:
+  workflow_dispatch:
+  pull_request:
+
+jobs:
+  build:
+    runs-on: macos-13
+
+    steps:
+    - name: Checkout python repo
+      uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
+      with:
+        fetch-depth: 0
+
+    - name: Install Apple Developer ID Application certificates
+      uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
+      with:
+        keychain-password: ${{ github.run_id }}
+        p12-file-base64: ${{ secrets.APP_CERTIFICATES_P12_MAOS }}
+        p12-password: ${{ secrets.APP_CERTIFICATES_P12_PASSWORD_MAOS }}
+
+    - name: Install Apple Developer ID Installer certificates
+      uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
+      with:
+        create-keychain: false # do not create a new keychain for this value
+        keychain-password: ${{ github.run_id }}
+        p12-file-base64: ${{ secrets.PKG_CERTIFICATES_P12_MAOS }}
+        p12-password: ${{ secrets.PKG_CERTIFICATES_P12_PASSWORD_MAOS }}
+
+    - name: Run build package script
+      run: ./build_python_framework_pkgs.zsh "$TYPE" "$DEV_INSTALLER_ID" "$DEV_APPLICATION_ID" "$PYTHON_VERSION" "$PYTHON_MAJOR_VERSION" "${NOTARY_APP_PASSWORD}"
+
+    - name: get environment variables
+      id: get_env_var
+      run: |
+         echo "PYTHON_BUILD_VERSION=$(/bin/cat ./build_info.txt)" >> $GITHUB_ENV
+
+    - name: Generate changelog
+      id: changelog
+      uses: metcalfc/changelog-generator@afdcb9470aebdb2252c0c95a1c130723c9e21f3a # v4.1
+      with:
+        myToken: ${{ secrets.GITHUB_TOKEN }}
+        reverse: 'true'
+
+    - name: Create Release
+      id: create_release
+      uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v0.1.15
+      with:
+        name: Python ${{env.PYTHON_BUILD_VERSION}}
+        tag_name: v${{env.PYTHON_BUILD_VERSION}}
+        draft: false
+        prerelease: true
+        token: ${{ secrets.GITHUB_TOKEN }}
+        body: |
+            # Notes
+            Python ${{env.PYTHON_VERSION}} Framework
+
+            ## Changes
+            - Upgraded Python to 3.13.5
+            **Note: Some of these updates may have breaking changes. Always test your code before deploying to production!**
+            
+            Please see the `requirements_recommended.txt` for the current libraries being used.
+            
+            ${{ steps.changelog.outputs.changelog }}
+
+            # Flavors of Python
+            At this time, the automated build process will **only** create the Recommended package
+
+            ## Recommended
+            This is a Python.framework that contains everything from minimal, and a few libraries that various well known open source projects require.
+
+            ## Signing/Notarization
+            The signed package is fully notarized, including the Python.framework file
+        files: ${{github.workspace}}/outputs/*.pkg
+
+    - name: Upload packages
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      with:
+        name: packages
+        path: outputs/

.github/workflows/build_python_3.9.yml

@@ -89,7 +89,7 @@ jobs:
         files: ${{github.workspace}}/outputs/*.pkg
 
     - name: Upload packages
-      uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: packages
         path: outputs/

build_python_framework_pkgs.zsh

@@ -5,9 +5,9 @@
 # IMPORTANT
 # Run this with your current directory being the path where this script is located
 
-# Harcoded versions
-RP_SHA="fb4dd9b024b249c71713f14d887f4bcea78aa8b0"
-MP_SHA="0fcd47faf0fb2b4e8a0256a77be315a3cb6ab319"
+# Harcoded (commit) versions of relocatable-python & munki-pkg
+RP_SHA="8ee72fe3a5dbef733365370ebf44f25022b895ef" # https://github.com/gregneagle/relocatable-python/commits/main/
+MP_SHA="96cffb4eac9207c1130404ec1fee8f4777fa38fd" # https://github.com/munki/munki-pkg/commits/main/
 MACOS_VERSION=11 # use 10.9 for non-universal
 PYTHON_PRERELEASE_VERSION=
 PYTHON_BASEURL="https://www.python.org/ftp/python/%s/python-%s${PYTHON_PRERELEASE_VERSION}-macos%s.pkg"
@@ -56,13 +56,13 @@ fi
 if [ -n "$4" ]; then
   PYTHON_VERSION=$4
 else
-  PYTHON_VERSION=3.12.1
+  PYTHON_VERSION=3.13.5
 fi
 
 if [ -n "$5" ]; then
   PYTHON_MAJOR_VERSION=$5
 else
-  PYTHON_MAJOR_VERSION=3.12
+  PYTHON_MAJOR_VERSION=3.13
 fi
 # Set python bin version based on PYTHON_VERSION
 PYTHON_BIN_VERSION="${PYTHON_VERSION%.*}"
@@ -96,7 +96,7 @@ if [ -d "${PIPCACHEDIR}" ]; then
     /usr/bin/sudo /bin/rm -rf "${PIPCACHEDIR}"
 fi
 
-# kill homebrew packages
+# kill homebrew packages on GitHub runner
 /usr/local/bin/brew remove --force $(/usr/local/bin/brew list)
 
 # Ensure Xcode is set to run-time
@@ -153,6 +153,9 @@ fi
 if [[ "${PYTHON_MAJOR_VERSION}" == "3.12" ]]; then
   /bin/ln -s "$PYTHON_BIN_NEW" "$TOOLSDIR/$TYPE/payload/usr/local/bin/managed_python3"
 fi
+if [[ "${PYTHON_MAJOR_VERSION}" == "3.13" ]]; then
+  /bin/ln -s "$PYTHON_BIN_NEW" "$TOOLSDIR/$TYPE/payload/usr/local/bin/managed_python3"
+fi
 
 SB_RESULT="$?"
 if [ "${SB_RESULT}" != "0" ]; then

requirements_recommended.txt

@@ -1,42 +1,42 @@
 asn1crypto==1.5.1
 aspy.yaml==1.3.0
-attrs==23.2.0
-black==24.1.1
+attrs==25.3.0
+black==25.1.0
 --no-binary black
-certifi==2023.11.17
-cffi==1.16.0
+certifi==2025.6.15
+cffi==1.17.1
 --no-binary cffi
 cfgv==3.4.0
-charset-normalizer==3.3.2
+charset-normalizer==3.4.2
 --no-binary charset-normalizer
-click==8.1.7
-distlib==0.3.8
-docklib==1.3.0
+click==8.2.1
+distlib==0.3.9
+docklib==2.0.0
 entrypoints==0.4
-filelock==3.13.1
-flake8==7.0.0
-flake8-bugbear==24.1.17
-identify==2.5.33
-idna==3.6
-isort==5.13.2
+filelock==3.18.0
+flake8==7.3.0
+flake8-bugbear==24.12.12
+identify==2.6.12
+idna==3.10
+isort==6.0.1
 mccabe==0.7.0
-mypy-extensions==1.0.0
-nodeenv==1.8.0
-packaging==23.2
+mypy-extensions==1.1.0
+nodeenv==1.9.1
+packaging==25.0
 pathspec==0.12.1
-platformdirs==4.2.0
-pre-commit==3.6.0
-pycodestyle==2.11.1
-pycparser==2.21
-pyflakes==3.2.0
-pyobjc==10.1
-PyYAML==6.0.1
+platformdirs==4.3.8
+pre-commit==4.2.0
+pycodestyle==2.14.0
+pycparser==2.22
+pyflakes==3.4.0
+pyobjc==11.1
+PyYAML==6.0.2
 --no-binary PyYAML
-requests==2.31.0
-six==1.16.0
-tokenize-rt==5.2.0
-tomli==2.0.1
-urllib3==2.2.0
-virtualenv==20.25.0
-xattr==1.0.0
+requests==2.32.4
+six==1.17.0
+tokenize-rt==6.2.0
+tomli==2.2.1
+urllib3==2.5.0
+virtualenv==20.31.2
+xattr==1.1.4
 --no-binary xattr