Merge branch 'main' into pep639

Author: ncoghlan

.github/workflows/zizmor.yml

@@ -0,0 +1,38 @@
+# From https://woodruffw.github.io/zizmor/usage/#use-in-github-actions
+
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+jobs:
+  zizmor:
+    name: zizmor latest via PyPI
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      # required for workflows in private repositories
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Install the latest version of uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Run zizmor 🌈
+        run: uvx zizmor --format sarif source/guides/github-actions-ci-cd-sample/* > results.sarif
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif
+          category: zizmor

source/guides/writing-pyproject-toml.rst

@@ -236,7 +236,7 @@ To install a command as part of your package, declare it in the
 
 In this example, after installing your project, a ``spam-cli`` command
 will be available. Executing this command will do the equivalent of
-``from spam import main_cli; main_cli()``.
+``import sys; from spam import main_cli; sys.exit(main_cli())``.
 
 On Windows, scripts packaged this way need a terminal, so if you launch
 them from within a graphical application, they will make a terminal pop

source/specifications/dependency-specifiers.rst

@@ -128,6 +128,8 @@ Whitespace
 Non line-breaking whitespace is mostly optional with no semantic meaning. The
 sole exception is detecting the end of a URL requirement.
 
+.. _dependency-specifiers-names:
+
 Names
 -----
 
@@ -142,6 +144,8 @@ with re.IGNORECASE) is::
 
     ^([A-Z0-9]|[A-Z0-9][A-Z0-9._-]*[A-Z0-9])$
 
+.. _dependency-specifiers-extras:
+
 Extras
 ------
 
@@ -159,6 +163,8 @@ are listed in the "security" extra of requests.
 
 If multiple extras are listed, all the dependencies are unioned together.
 
+.. _dependency-specifiers-versions:
+
 Versions
 --------
 
@@ -170,6 +176,8 @@ via a URL. Version comparison are also used in the markers feature. The
 optional brackets around a version are present for compatibility with
 :pep:`345` but should not be generated, only accepted.
 
+.. _dependency-specifiers-environment-markers:
+
 Environment Markers
 -------------------
 
@@ -294,6 +302,8 @@ The ``implementation_version`` marker variable is derived from
 This environment markers section, initially defined through :pep:`508`, supersedes the environment markers
 section in :pep:`345`.
 
+.. _dependency-specifiers-grammar:
+
 Complete Grammar
 ================
 

source/specifications/direct-url-data-structure.rst

@@ -49,6 +49,8 @@ Additionally, the user:password section of the URL MAY be a
 well-known, non security sensitive string. A typical example is ``git``
 in the case of a URL such as ``ssh://[email protected]/user/repo``.
 
+.. _direct-url-data-structure-vcs:
+
 VCS URLs
 --------
 
@@ -72,6 +74,8 @@ as a dictionary with the following keys:
   ``commit_id`` in order to reference an immutable
   version of the source code.
 
+.. _direct-url-data-structure-archive:
+
 Archive URLs
 ------------
 
@@ -104,6 +108,8 @@ When both the ``hash`` and ``hashes`` keys are present, the hash represented in
 ``hash`` key MUST also be present in the ``hashes`` dictionary, so consumers can
 consider the ``hashes`` key only if it is present, and fall back to ``hash`` otherwise.
 
+.. _direct-url-data-structure-local-directory:
+
 Local directories
 -----------------
 
@@ -118,13 +124,17 @@ be compliant with :rfc:`8089`. In
 particular, the path component must be absolute. Symbolic links SHOULD be
 preserved when making relative paths absolute.
 
+.. _direct-url-data-structure-subdirectories:
+
 Projects in subdirectories
 --------------------------
 
 A top-level ``subdirectory`` field MAY be present containing a directory path,
 relative to the root of the VCS repository, source archive or local directory,
 to specify where ``pyproject.toml`` or ``setup.py`` is located.
 
+.. _direct-url-data-structure-registered-vcs:
+
 Registered VCS
 ==============
 

source/specifications/source-distribution-format.rst

@@ -20,6 +20,8 @@ specification.
 
 Source distributions are also known as *sdists* for short.
 
+.. _source-distribution-format-source-tree:
+
 Source trees
 ============
 
@@ -30,6 +32,8 @@ directories. :pep:`517` and :pep:`518` specify what is required to meet the
 definition of what :file:`pyproject.toml` must contain for something to be
 deemed a source tree.
 
+.. _source-distribution-format-sdist:
+
 Source distribution file name
 =============================