Merge branch 'main' into feat-truststore

.github/actions/bootstrap-poetry/action.yaml

@@ -8,9 +8,6 @@ inputs:
   python-latest:
     description: Use an uncached Python if a newer match is available
     default: 'false'
-  python-prereleases:
-    description: Allow usage of pre-release Python versions
-    default: 'false'
   poetry-spec:
     description: pip-compatible installation specification to use for Poetry
     default: 'poetry'
@@ -32,7 +29,7 @@ runs:
       with:
         python-version: ${{ inputs.python-version }}
         check-latest: ${{ inputs.python-latest == 'true' }}
-        allow-prereleases: ${{ inputs.python-prereleases == 'true' }}
+        allow-prereleases: true
         update-environment: false
 
     - run: >

.github/workflows/.tests-matrix.yaml

@@ -78,25 +78,47 @@ jobs:
     if: inputs.run-pytest-export
     steps:
       - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
-
-      - uses: ./.github/actions/bootstrap-poetry
         with:
-          python-version: ${{ inputs.python-version }}
+          path: poetry
 
-      - uses: ./.github/actions/poetry-install
+      - uses: ./poetry/.github/actions/bootstrap-poetry
         with:
-          args: --with github-actions
+          python-version: ${{ inputs.python-version }}
 
-      - run: poetry run pip list --format json | jq -r '.[] | "\(.name)=\(.version)"' >> $GITHUB_OUTPUT
-        id: package-versions
+      - name: Get poetry-plugin-export version
+        run: |
+          PLUGIN_VERSION=$(curl -s https://pypi.org/pypi/poetry-plugin-export/json | jq -r ".info.version")
+          echo "Found version ${PLUGIN_VERSION}"
+          echo version=${PLUGIN_VERSION} >> $GITHUB_OUTPUT
+        id: poetry-plugin-export-version
 
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+      - name: Check out poetry-plugin-export
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           path: poetry-plugin-export
           repository: python-poetry/poetry-plugin-export
-          ref: refs/tags/${{ steps.package-versions.outputs.poetry-plugin-export }}
-
-      - run: poetry run -C .. pytest -v
-        working-directory: ./poetry-plugin-export
-
-      - run: git -C poetry-plugin-export diff --exit-code --stat HEAD
+          ref: refs/tags/${{ steps.poetry-plugin-export-version.outputs.version }}
+
+      - name: Use local poetry
+        working-directory: poetry-plugin-export
+        run: poetry add --lock --group dev ../poetry
+
+      # This step can be removed after having released a poetry-plugin-export version
+      # that has cffi>=1.17.0 in its lock file.
+      - name: Force more recent cffi (workaround for Python 3.13)
+        working-directory: poetry-plugin-export
+        run: poetry update --lock cffi
+
+      - name: Install
+        working-directory: poetry-plugin-export
+        run: poetry install
+
+      - name: Run tests
+        working-directory: poetry-plugin-export
+        run: poetry run pytest -v
+
+      - name: Check for clean working tree
+        working-directory: poetry-plugin-export
+        run: |
+          git checkout -- pyproject.toml poetry.lock
+          git diff --exit-code --stat HEAD

.github/workflows/docs.yaml

@@ -31,10 +31,20 @@ jobs:
         with:
           repository: python-poetry/website
 
+      # use .github from pull request target instead of pull_request.head
+      # for pull_request_target trigger to avoid arbitrary code execution
       - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
-          path: poetry
+          path: poetry-github
+          sparse-checkout: .github
+
+      # only checkout docs from pull_request.head to not use something else by accident
+      # for pull_request_target trigger (security)
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+        with:
+          path: poetry-docs
           ref: ${{ github.event.pull_request.head.sha }}
+          sparse-checkout: docs
 
       - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
@@ -44,16 +54,16 @@ jobs:
         with:
           hugo-version: '0.83.1'
 
-      - uses: ./poetry/.github/actions/bootstrap-poetry
+      - uses: ./poetry-github/.github/actions/bootstrap-poetry
 
-      - uses: ./poetry/.github/actions/poetry-install
+      - uses: ./poetry-github/.github/actions/poetry-install
         with:
           args: --no-root --only main
 
       - name: website-build
         run: |
           # Rebuild the docs files from the PR checkout.
-          poetry run python bin/website build --local ./poetry
+          poetry run python bin/website build --local ./poetry-docs
           # Build website assets (CSS/JS).
           npm ci && npm run prod
           # Build the static website.

.github/workflows/tests.yaml

@@ -123,7 +123,13 @@ jobs:
             image: windows-2022
           - name: macOS aarch64
             image: macos-14
-        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12"]
+        python-version:
+          - "3.8"
+          - "3.9"
+          - "3.10"
+          - "3.11"
+          - "3.12"
+          - "3.13"
       fail-fast: false
 
   status:

.pre-commit-hooks.yaml

@@ -14,15 +14,6 @@
   pass_filenames: false
   files: ^(.*/)?(poetry\.lock|pyproject\.toml)$
 
-- id: poetry-export
-  name: poetry-export
-  description: run poetry export to sync lock file with requirements.txt
-  entry: poetry export
-  language: python
-  pass_filenames: false
-  files: ^(.*/)?poetry\.lock$
-  args: ["-f", "requirements.txt", "-o", "requirements.txt"]
-
 - id: poetry-install
   name: poetry-install
   description: run poetry install to install dependencies from the lock file

docs/basic-usage.md

@@ -38,16 +38,18 @@ The `pyproject.toml` file is what is the most important here. This will orchestr
 your project and its dependencies. For now, it looks like this:
 
 ```toml
-[tool.poetry]
+[project]
 name = "poetry-demo"
 version = "0.1.0"
 description = ""
-authors = ["Sébastien Eustace <sebastien@eustace.io>"]
+authors = [
+    {name = "Sébastien Eustace", email = "sebastien@eustace.io"}
+]
 readme = "README.md"
-packages = [{include = "poetry_demo"}]
+requires-python = ">=3.8"
 
-[tool.poetry.dependencies]
-python = "^3.7"
+[tool.poetry]
+packages = [{include = "poetry_demo"}]
 
 
 [build-system]
@@ -122,7 +124,20 @@ In the [pyproject section]({{< relref "pyproject" >}}) you can see which fields
 
 ### Specifying dependencies
 
-If you want to add dependencies to your project, you can specify them in the `tool.poetry.dependencies` section.
+If you want to add dependencies to your project, you can specify them in the
+`project` or `tool.poetry.dependencies` section.
+See the [Dependency specification]({{< relref "dependency-specification" >}})
+for more information.
+
+```toml
+[project]
+# ...
+dependencies = [
+    "pendulum (>=2.1,<3.0)"
+]
+```
+
+or
 
 ```toml
 [tool.poetry.dependencies]