CI, build, and tooling related updates

.github/dependabot.yml

@@ -6,3 +6,17 @@ updates:
     schedule:
       # Check for updates to GitHub Actions every week
       interval: "weekly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  # Maintain Python build and test dependencies
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      python-dependencies:
+        patterns:
+          - "*"

.github/workflows/lint.yml

@@ -4,14 +4,21 @@ on:
   push:
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   clang-format:
     name: clang-format
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
       - name: Run clang-format style check for C/C++
-        uses: jidicula/clang-format-action@v4.18.0
+        uses: jidicula/clang-format-action@654a770daa28443dd111d133e4083e21c1075674 # v4.18.0
         with:
           clang-format-version: '17'
           check-path: 'src'
@@ -24,7 +31,6 @@ jobs:
       - uses: actions/checkout@v7
       - name: Install dependencies
         run: |
-          sudo apt-key adv --fetch-keys http://repos.codelite.org/CodeLite.asc
           sudo apt-get update
           sudo apt-get install -y automake autoconf libwxgtk3.2-dev clang-tidy
       - run: aclocal
@@ -38,17 +44,7 @@ jobs:
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
     steps:
       - uses: actions/checkout@v7
-      - uses: chartboost/ruff-action@v1
-
-  flake8:
-    runs-on: ubuntu-latest
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
-    steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
-        with:
-          python-version: "3.14"
-      - uses: py-actions/flake8@v2
+      - uses: astral-sh/ruff-action@4919ec5cf1f49eff0871dbcea0da843445b837e6 # v3
 
   cython-lint:
     runs-on: ubuntu-latest
@@ -74,6 +70,8 @@ jobs:
         uses: actions/setup-python@v7
         with:
           python-version: "3.14"
+          cache: pip
+          cache-dependency-path: pyproject.toml
       - name: Install pygambit (editable, picks up catalog/games directly)
         run: |
           python -m pip install -v -e ".[doc]"

.github/workflows/osxbinary.yml

@@ -8,23 +8,43 @@ on:
     - cron: '0 6 * * 4'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
-  macos-13:
-    runs-on: macos-14
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
+  macos:
+    name: macOS DMG (wxWidgets 3.2)
+    runs-on: macos-15
     steps:
       - uses: actions/checkout@v7
+      - name: Find latest wxWidgets 3.2.x release
+        run: |
+            version=$(git ls-remote --tags --refs https://github.com/wxWidgets/wxWidgets 'v3.2.*' \
+              | sed 's|.*refs/tags/v||' | grep -E '^3\.2\.[0-9]+$' | sort -V | tail -1)
+            test -n "${version}"
+            echo "Using wxWidgets ${version}"
+            echo "WX_VERSION=${version}" >> "$GITHUB_ENV"
       - name: Install dependencies
+        run: brew install automake autoconf
+      - name: Cache static wxWidgets build
+        id: wx-cache
+        uses: actions/cache@v6
+        with:
+          path: ~/wx-static
+          key: wx-static-${{ runner.os }}-${{ runner.arch }}-${{ env.WX_VERSION }}
+      - name: Build static wxWidgets
+        if: steps.wx-cache.outputs.cache-hit != 'true'
         run: |
-            brew install automake autoconf
-            curl -L -O https://github.com/wxWidgets/wxWidgets/releases/download/v3.2.8/wxWidgets-3.2.8.tar.bz2
-            tar xjf wxWidgets-3.2.8.tar.bz2
-            cd wxWidgets-3.2.8
+            curl -L -O "https://github.com/wxWidgets/wxWidgets/releases/download/v${WX_VERSION}/wxWidgets-${WX_VERSION}.tar.bz2"
+            tar xjf "wxWidgets-${WX_VERSION}.tar.bz2"
+            cd "wxWidgets-${WX_VERSION}"
             mkdir build-release
             cd build-release
-            ../configure --disable-shared --disable-sys-libs
-            make -j4
-            sudo make install
+            ../configure --prefix="$HOME/wx-static" --disable-shared --disable-sys-libs
+            make -j"$(sysctl -n hw.ncpu)"
+            make install
+      - name: Put wxWidgets on PATH
+        run: echo "$HOME/wx-static/bin" >> "$GITHUB_PATH"
       - run: aclocal
       - run: automake --add-missing
       - run: autoconf
@@ -35,7 +55,7 @@ jobs:
       - run: make dist
       - uses: actions/upload-artifact@v7
         with:
-          name: artifact-osx-14
+          name: artifact-osx
           path: "*.dmg"
       - uses: actions/upload-artifact@v7
         with:

.github/workflows/python.yml

@@ -4,20 +4,30 @@ on:
   push:
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   linux:
     runs-on: ubuntu-latest
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
     strategy:
       matrix:
-        python-version: ['3.10', '3.14']
+        python-version: ['3.11', '3.14', '3.15']
 
     steps:
       - uses: actions/checkout@v7
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
+          cache: pip
+          cache-dependency-path: pyproject.toml
       - name: Set up dependencies
         run: |
           python -m pip install --upgrade pip
@@ -34,8 +44,8 @@ jobs:
       - name: Run tests
         run: pytest --run-tutorials
 
-  macos-14:
-    runs-on: macos-14
+  macos-latest:
+    runs-on: macos-latest
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
     strategy:
       matrix:
@@ -47,12 +57,14 @@ jobs:
         uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: pyproject.toml
       - name: Set up dependencies
         run: |
           python -m pip install --upgrade pip
       - name: Build extension
         run: |
-          python -m pip install -v .[test,doc]
+          python -m pip install -v ".[test,doc]"
           pip install "gtdraw @ git+https://github.com/gambitproject/gtdraw.git@main"
       - name: Run tests
         run: pytest --run-tutorials
@@ -70,12 +82,14 @@ jobs:
         uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: pyproject.toml
       - name: Set up dependencies
         run: |
           python -m pip install --upgrade pip
       - name: Build extension
         run: |
-          python -m pip install -v .[test,doc]
+          python -m pip install -v ".[test,doc]"
           pip install "gtdraw @ git+https://github.com/gambitproject/gtdraw.git@main"
       - name: Run tests
         run: pytest --run-tutorials
@@ -93,13 +107,15 @@ jobs:
         uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: pyproject.toml
       - name: Set up dependencies
         run: |
           python -m pip install --upgrade pip
       - name: Build extension
         shell: bash
         run: |
-          python -m pip install -v .[test,doc]
+          python -m pip install -v ".[test,doc]"
           pip install "gtdraw @ git+https://github.com/gambitproject/gtdraw.git@main"
       - name: Run tests
         run: pytest --run-tutorials

.github/workflows/release.yml

@@ -15,14 +15,18 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Extract changelog for this version
+        env:
+          REF_NAME: ${{ github.ref_name }}
         run: |
-          VERSION="${{ github.ref_name }}"
+          VERSION="${REF_NAME}"
           python3 build_support/releases/extract_changelog.py "${VERSION#v}"
 
       - name: Determine prerelease status
         id: version
+        env:
+          REF_NAME: ${{ github.ref_name }}
         run: |
-          VERSION="${{ github.ref_name }}"
+          VERSION="${REF_NAME}"
           if [[ "${VERSION#v}" =~ -(alpha|beta|rc) ]]; then
             echo "prerelease_flag=--prerelease" >> "$GITHUB_OUTPUT"
           else
@@ -32,8 +36,11 @@ jobs:
       - name: Create GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
+          REF_NAME: ${{ github.ref_name }}
+          PRERELEASE_FLAG: ${{ steps.version.outputs.prerelease_flag }}
         run: |
-          gh release create "${{ github.ref_name }}" \
-            --title "Gambit ${{ github.ref_name }}" \
+          # shellcheck disable=SC2086  # the flag must vanish when empty
+          gh release create "${REF_NAME}" \
+            --title "Gambit ${REF_NAME}" \
             --notes-file release_notes.md \
-            ${{ steps.version.outputs.prerelease_flag }}
+            ${PRERELEASE_FLAG}

.github/workflows/tools.yml

@@ -4,15 +4,22 @@ on:
   push:
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   linux:
+    name: Linux (wxWidgets 3.2)
     runs-on: ubuntu-latest
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
     steps:
       - uses: actions/checkout@v7
       - name: Install dependencies
         run: |
-          sudo apt-key adv --fetch-keys http://repos.codelite.org/CodeLite.asc
           sudo apt-get update
           sudo apt-get install -y automake autoconf libwxgtk3.2-dev
       - name: Configure build with autotools
@@ -33,27 +40,29 @@ jobs:
           sudo make install
 
   macos:
+    name: macOS (wxWidgets 3.3)
     runs-on: macos-15
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
     steps:
       - uses: actions/checkout@v7
       - name: Install dependencies
-        run: brew install automake autoconf wxwidgets
+        run: brew install automake autoconf wxwidgets@3.3
       - run: aclocal
       - run: automake --add-missing
       - run: autoconf
       - run: ./configure
       - run: make
 
   windows:
+    name: Windows (wxWidgets 3.2)
     runs-on: windows-latest
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
     defaults:
       run:
         shell: msys2 {0}
     steps:
       - uses: actions/checkout@v7
-      - uses: msys2/setup-msys2@v2
+      - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2
         with:
           install: mingw-w64-x86_64-toolchain make automake autoconf
       - run: pacman -S --noconfirm mingw-w64-x86_64-wxwidgets3.2

.github/workflows/wheel-smoke.yml

@@ -1,13 +1,32 @@
-
 name: pygambit wheel smoke test
 
 on:
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
-  windows-cp314:
-    runs-on: windows-latest
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
+  smoke:
+    name: ${{ matrix.name }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Windows cp314
+            os: windows-latest
+            build: cp314-win_amd64
+          - name: Linux cp314
+            os: ubuntu-latest
+            build: cp314-manylinux_x86_64
+          - name: macOS cp314
+            os: macos-15
+            build: cp314-macosx_arm64
+    runs-on: ${{ matrix.os }}
 
     steps:
       - uses: actions/checkout@v7
@@ -19,8 +38,8 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           pip install cibuildwheel
-      - name: Build and smoke-test cp314 Windows wheel
+      - name: Build and smoke-test wheel
         run: |
           python -m cibuildwheel --output-dir wheelhouse/
         env:
-          CIBW_BUILD: "cp314-win_amd64"
+          CIBW_BUILD: ${{ matrix.build }}