Sync upstream tag 20260825

.github/workflows/linux.yml

@@ -178,6 +178,7 @@ jobs:
             --platform linux \
             --labels "${STEPS_GET_LABELS_OUTPUTS_LABELS}" \
             --max-shards 2 \
+            --event ${{ github.event_name }} \
             ${{ (steps.check-pythonbuild.outputs.changed == 'true' || github.ref == 'refs/heads/main') && '--force-crate-build' || '' }} \
             --free-runners \
             > matrix.json

.github/workflows/macos.yml

@@ -92,7 +92,11 @@ jobs:
       - name: Generate build matrix
         id: set-matrix
         run: |
+<<<<<<< HEAD
           uv run ci-matrix.py --platform darwin --labels "${STEPS_GET_LABELS_OUTPUTS_LABELS}" ${{ (steps.check-pythonbuild.outputs.changed == 'true' || github.ref == 'refs/heads/main') && '--force-crate-build' || '' }} --free-runners > matrix.json
+=======
+          uv run ci-matrix.py --platform darwin --labels "${STEPS_GET_LABELS_OUTPUTS_LABELS}" --event ${{ github.event_name }} ${{ (steps.check-pythonbuild.outputs.changed == 'true' || github.ref == 'refs/heads/main') && '--force-crate-build' || '' }} > matrix.json
+>>>>>>> refs/tags/20260825
 
           # Extract python-build matrix
           echo "matrix=$(jq -c '."python-build"' matrix.json)" >> $GITHUB_OUTPUT
@@ -171,6 +175,12 @@ jobs:
           repository: phracker/MacOSX-SDKs
           ref: master
           path: macosx-sdks
+          sparse-checkout: |
+            /MacOSX10.15.sdk/SDKSettings.json
+            /MacOSX10.15.sdk/**/*.tbd
+            /MacOSX11.*.sdk/SDKSettings.json
+            /MacOSX11.*.sdk/**/*.tbd
+          sparse-checkout-cone-mode: false
           persist-credentials: false
 
       - name: Validate Distribution

.github/workflows/release.yml

@@ -89,3 +89,100 @@ jobs:
           subject-path: |
             dist/*.tar.gz
             dist/*.tar.zst
+<<<<<<< HEAD
+=======
+
+      - name: Publish to Astral mirror
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.MIRROR_R2_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.MIRROR_R2_SECRET_ACCESS_KEY }}
+          AWS_ENDPOINT_URL: https://${{ secrets.MIRROR_R2_CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com
+          AWS_DEFAULT_REGION: auto
+          R2_BUCKET: ${{ secrets.MIRROR_R2_BUCKET_NAME }}
+          PROJECT: python-build-standalone
+          VERSION: ${{ github.event.inputs.tag }}
+          DRY_RUN: ${{ github.event.inputs.dry-run }}
+        run: |
+          if [ "${DRY_RUN}" = 'true' ]; then
+            just release-upload-mirror-dry-run \
+              ${R2_BUCKET} \
+              github/${PROJECT}/releases/download/${VERSION}/ \
+              ${VERSION}
+          else
+            just release-upload-mirror \
+              ${R2_BUCKET} \
+              github/${PROJECT}/releases/download/${VERSION}/ \
+              ${VERSION}
+          fi
+
+      - name: Generate versions metadata
+        if: ${{ github.event.inputs.dry-run == 'false' }}
+        env:
+          GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+        run: uv run generate-version-metadata.py > dist/versions.ndjson
+
+      - name: Validate metadata
+        if: ${{ github.event.inputs.dry-run == 'false' }}
+        run: |
+          echo "Generated $(wc -l < dist/versions.ndjson) version entries"
+          head -c 1000 dist/versions.ndjson
+
+      - name: Set branch name
+        if: ${{ github.event.inputs.dry-run == 'false' }}
+        env:
+          TAG: ${{ github.event.inputs.tag }}
+        run: echo "BRANCH_NAME=update-versions-$TAG-$(date +%s)" >> $GITHUB_ENV
+
+      - name: Clone versions repo
+        if: ${{ github.event.inputs.dry-run == 'false' }}
+        run: git clone https://${{ secrets.ASTRAL_VERSIONS_PAT }}@github.com/astral-sh/versions.git astral-versions
+
+      - name: Update versions
+        if: ${{ github.event.inputs.dry-run == 'false' }}
+        run: cat dist/versions.ndjson | uv run astral-versions/scripts/insert-versions.py --name python-build-standalone
+
+      - name: Commit versions
+        if: ${{ github.event.inputs.dry-run == 'false' }}
+        env:
+          TAG: ${{ github.event.inputs.tag }}
+        working-directory: astral-versions
+        run: |
+          git config user.name "astral-versions-bot"
+          git config user.email "176161322+astral-versions-bot@users.noreply.github.com"
+
+          git checkout -b "$BRANCH_NAME"
+          git add -A
+          git commit -m "Update python-build-standalone to $TAG"
+
+      - name: Create Pull Request
+        if: ${{ github.event.inputs.dry-run == 'false' }}
+        env:
+          TAG: ${{ github.event.inputs.tag }}
+          GH_TOKEN: ${{ secrets.ASTRAL_VERSIONS_PAT }}
+        working-directory: astral-versions
+        run: |
+          pull_request_title="Update python-build-standalone versions for $TAG"
+
+          gh pr list --state open --json title --jq ".[] | select(.title == \"$pull_request_title\") | .number" | \
+            xargs -I {} gh pr close {}
+
+          git push origin "$BRANCH_NAME"
+
+          gh pr create --base main --head "$BRANCH_NAME" \
+            --title "$pull_request_title" \
+            --body "Automated versions update for $TAG" \
+            --label "automation"
+
+      - name: Merge Pull Request
+        if: ${{ github.event.inputs.dry-run == 'false' }}
+        env:
+          GH_TOKEN: ${{ secrets.ASTRAL_VERSIONS_PAT }}
+        working-directory: astral-versions
+        run: |
+          # Wait for PR to be created before merging
+          sleep 10
+          # Use admin to bypass required review
+          gh pr merge --squash --admin "$BRANCH_NAME"
+
+>>>>>>> refs/tags/20260825

.github/workflows/windows.yml

@@ -92,7 +92,11 @@ jobs:
       - name: Generate build matrix
         id: set-matrix
         run: |
+<<<<<<< HEAD
           uv run ci-matrix.py --platform windows --labels "${STEPS_GET_LABELS_OUTPUTS_LABELS}" ${{ (steps.check-pythonbuild.outputs.changed == 'true' || github.ref == 'refs/heads/main') && '--force-crate-build' || '' }} --free-runners > matrix.json
+=======
+          uv run ci-matrix.py --platform windows --labels "${STEPS_GET_LABELS_OUTPUTS_LABELS}" --event ${{ github.event_name }} ${{ (steps.check-pythonbuild.outputs.changed == 'true' || github.ref == 'refs/heads/main') && '--force-crate-build' || '' }} > matrix.json
+>>>>>>> refs/tags/20260825
 
           # Extract python-build matrix
           echo "matrix=$(jq -c '."python-build"' matrix.json)" >> $GITHUB_OUTPUT
@@ -186,4 +190,7 @@ jobs:
         run: |
           $Dists = Resolve-Path -Path "dist/*.tar.zst" -Relative
           .\pythonbuild.exe validate-distribution $Dists
+          if ($LASTEXITCODE -ne 0) {
+            exit $LASTEXITCODE
+          }
           uv run --no-dev test-distribution.py $Dists

BENCHMARKS.md

@@ -0,0 +1,43 @@
+## python-build-standalone performance
+
+<img 
+    width="1820" height="1730" 
+    alt="Shows a chart with violin plots with benchmark results" 
+    src="https://github.com/user-attachments/assets/5499f9ce-ee02-4485-baa2-9d982fe457e6"
+/>
+
+The figure above compares CPython 3.14.6 performance across several distributions using pyperformance. Each [violin](https://en.wikipedia.org/wiki/Violin_plot) represents the distribution of per-benchmark mean runtime ratios between an alternative CPython distribution and python-build-standalone on the same platform and architecture. Ratios greater than 1 indicate that python-build-standalone was faster; ratios less than 1 indicate that the alternative distribution was faster.
+
+The horizontal axis uses a logarithmic scale. The vertical marker within each violin indicates the geometric mean of the runtime ratios, which is also expressed as a percentage beside each distribution.
+
+From top to bottom, the distributions shown are:
+* The Docker `python:3.14` image for x86-64, providing CPython 3.14.6.
+* A conda-forge Python 3.14.6 environment for `linux-64`.
+* The system Python 3.14.6 in a `fedora:44` x86-64 Docker container.
+* The system Python 3.14.6 in a `debian:forky` x86-64 Docker container.
+* CPython 3.14.6 from the [Python.org macOS installer](https://www.python.org/ftp/python/3.14.6/python-3.14.6-macos11.pkg) on an arm64 Mac.
+* A conda-forge Python 3.14.6 environment for `osx-arm64`.
+* CPython 3.14.6 installed through Homebrew on an arm64 Mac.
+* CPython 3.14.6 from the Python.org Windows installer for x86-64.
+* A conda-forge Python 3.14.6 environment for `win-64`.
+
+The reference interpreter for each comparison was the corresponding platform- and architecture-matched python-build-standalone CPython 3.14.6 distribution from the [`20260623` release](https://github.com/astral-sh/python-build-standalone/releases#release-20260623), installed using `uv`.
+
+Benchmarks were run in early to mid-July 2026 and reflect the distributions and packages available during that period.
+
+Supporting material, including [Dockerfiles](https://github.com/jjhelmus/cpython-benchmarks/tree/main/containers), commands for creating conda environments, and scripts for running the benchmarks, can be found in [jjhelmus/cpython-benchmarks](https://github.com/jjhelmus/cpython-benchmarks). This repository also contains the raw data and the [script](https://github.com/jjhelmus/cpython-benchmarks/blob/main/plot_pbs_314_comparison.py) used to produce the figure.
+
+### Benchmark methodology
+
+Benchmarks were executed from a virtual environment created with the reference interpreter into which pyperformance 1.14.0 was installed. Results were collected using:
+``` shell
+pyperformance run --rigorous --warmups 2 --output <logfile>
+```
+
+The complete benchmark suite was run at least twice to assess consistency.
+
+Linux benchmarks were run inside Docker containers on an Ubuntu 24.04 host with an Intel Core i9-9900K processor. Hyper-Threading and Intel SpeedStep were disabled.
+
+macOS benchmarks were run on a MacBook Pro with an Apple M5 Max processor.
+
+Windows benchmarks were run on a Windows 11 host with an Intel Core i5-9500 processor. Intel Turbo Boost was disabled; this processor does not support Hyper-Threading.

CONTRIBUTING.rst

@@ -8,28 +8,41 @@ Building distributions
 See the [documentation](https://gregoryszorc.com/docs/python-build-standalone/main/building.html)
 for instructions on building distributions locally.
 
-CI labels
-=========
-By default, submitting a pull request triggers a complete build of all
-distributions in CI, which can be time-consuming.
+Pull request labels
+===================
+By default, pull requests build a small subset of targets defined in
+``ci-defaults.yaml`` under ``pull_request``. Pushes to ``main`` build the full
+matrix from ``ci-targets.yaml``.
 
-To conserve CI resources and reduce build times, you can limit the matrix of
-distributions built by applying specific labels to your pull request. Only
-distributions matching the specified labels will be built.
+Pull request labels can be used to change what CI builds:
 
-The following label prefixes can be used to customize the build matrix:
+* ``platform:<value>`` filters the selected targets by platform.
+* ``arch:<value>`` filters the selected targets by architecture.
+* ``libc:<value>`` filters the selected targets by libc.
+* ``python:<value>`` filters the selected Python versions.
+* ``build:<value>`` filters the selected build options by component.
 
-* `platform`
-* `python`
-* `build`
-* `arch`
-* `libc`
+The ``:all`` labels expand only their own dimension:
 
-To bypass CI entirely for changes that do not affect the build (such as
-documentation updates), use the `ci:skip` label.
+* ``platform:all`` expands the selected platforms.
+* ``arch:all`` expands the selected architectures.
+* ``libc:all`` expands the selected libc variants.
+* ``python:all`` expands the selected Python versions.
+* ``build:all`` expands the selected build options.
 
-Please utilize these tags when appropriate for your changes to minimize CI
-resource consumption.
+Use ``ci:all-targets`` to build the full matrix from ``ci-targets.yaml``.
+
+Examples:
+
+* ``platform:linux`` builds only the Linux targets from ``ci-defaults.yaml``.
+* ``python:3.13`` builds the default targets with Python 3.13.
+* ``build:pgo`` builds the selected targets whose build options include ``pgo``.
+* ``platform:linux,arch:all,libc:all,python:all,build:all`` builds the full
+  Linux matrix.
+
+To bypass CI entirely for changes that do not affect the build, use the
+``ci:skip`` label. The ``documentation`` label is treated the same way. To run
+a dry-run build matrix, use ``ci:dry-run``.
 
 Releases
 ========

ci-defaults.yaml

@@ -0,0 +1,28 @@
+# Describes the default targets that CI will build for different events.
+
+pull_request:
+  python_version: "3.14"
+
+  targets:
+    x86_64-pc-windows-msvc:
+      build_options:
+        - pgo
+
+    aarch64-apple-darwin:
+      build_options:
+        - pgo+lto
+
+    x86_64-unknown-linux-gnu:
+      build_options:
+        - pgo+lto
+        - freethreaded+pgo+lto
+
+    x86_64-unknown-linux-musl:
+      build_options:
+        - lto
+        - lto+static
+        - freethreaded+lto
+
+    armv7-unknown-linux-gnueabihf:
+      build_options:
+        - lto