.coveragerc

@@ -29,3 +29,5 @@ exclude_lines =
 
     ^\s*if TYPE_CHECKING:
     ^\s*@overload( |$)
+
+    ^\s*@pytest\.mark\.xfail

.git-blame-ignore-revs

@@ -5,7 +5,7 @@
 #
 # To "install" it:
 #
-#   git config --local blame.ignoreRevsFile .gitblameignore
+#   git config --local blame.ignoreRevsFile .git-blame-ignore-revs
 
 # run black
 703e4b11ba76171eccd3f13e723c47b810ded7ef
@@ -31,3 +31,5 @@ c9df77cbd6a365dcb73c39618e4842711817e871
 4546d5445aaefe6a03957db028c263521dfb5c4b
 # Migration to ruff / ruff format
 4588653b2497ed25976b7aaff225b889fb476756
+# Use format specifiers instead of percent format
+4788165e69d08e10fc6b9c0124083fb358e2e9b0

.github/chronographer.yml

@@ -0,0 +1,20 @@
+---
+
+branch-protection-check-name: Changelog entry
+action-hints:
+  check-title-prefix: "Chronographer: "
+  external-docs-url: >-
+    https://docs.pytest.org/en/latest/contributing.html#preparing-pull-requests
+  inline-markdown: >-
+    See
+    https://docs.pytest.org/en/latest/contributing.html#preparing-pull-requests
+    for details.
+enforce-name:
+  suffix: .rst
+exclude:
+  humans:
+  - pyup-bot
+labels:
+  skip-changelog: skip news
+
+...

.github/patchback.yml

@@ -0,0 +1,7 @@
+---
+
+backport_branch_prefix: patchback/backports/
+backport_label_prefix: 'backport '  # IMPORTANT: the labels are space-delimited
+# target_branch_prefix: ''  # The project's backport branches are non-prefixed
+
+...

.github/workflows/deploy.yml

@@ -19,14 +19,21 @@ jobs:
       SETUPTOOLS_SCM_PRETEND_VERSION: ${{ github.event.inputs.version }}
     timeout-minutes: 10
 
+    # Required by attest-build-provenance-github.
+    permissions:
+      id-token: write
+      attestations: write
+
     steps:
     - uses: actions/checkout@v4
       with:
         fetch-depth: 0
         persist-credentials: false
 
     - name: Build and Check Package
-      uses: hynek/build-and-inspect-python-package@v2.4.0
+      uses: hynek/build-and-inspect-python-package@v2.12.0
+      with:
+        attest-build-provenance-github: 'true'
 
   deploy:
     if: github.repository == 'pytest-dev/pytest'
@@ -39,6 +46,8 @@ jobs:
       contents: write
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: true
 
     - name: Download Package
       uses: actions/download-artifact@v4
@@ -47,14 +56,18 @@ jobs:
         path: dist
 
     - name: Publish package to PyPI
-      uses: pypa/gh-action-pypi-publish@v1.8.14
+      uses: pypa/gh-action-pypi-publish@v1.12.4
+      with:
+        attestations: true
 
     - name: Push tag
+      env:
+          VERSION: ${{ github.event.inputs.version }}
       run: |
         git config user.name "pytest bot"
         git config user.email "pytestbot@gmail.com"
-        git tag --annotate --message=v${{ github.event.inputs.version }} ${{ github.event.inputs.version }} ${{ github.sha }}
-        git push origin ${{ github.event.inputs.version }}
+        git tag --annotate --message=v"$VERSION" "$VERSION" ${{ github.sha }}
+        git push origin "$VERSION"
 
   release-notes:
 
@@ -89,9 +102,11 @@ jobs:
         pip install --upgrade tox
 
     - name: Generate release notes
+      env:
+        VERSION: ${{ github.event.inputs.version }}
       run: |
         sudo apt-get install pandoc
-        tox -e generate-gh-release-notes -- ${{ github.event.inputs.version }} scripts/latest-release-notes.md
+        tox -e generate-gh-release-notes -- "$VERSION" scripts/latest-release-notes.md
 
     - name: Publish GitHub Release
       uses: softprops/action-gh-release@v2

.github/workflows/prepare-release-pr.yml

@@ -30,11 +30,12 @@ jobs:
     - uses: actions/checkout@v4
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Set up Python
       uses: actions/setup-python@v5
       with:
-        python-version: "3.8"
+        python-version: "3.x"
 
     - name: Install dependencies
       run: |
@@ -43,10 +44,16 @@ jobs:
 
     - name: Prepare release PR (minor/patch release)
       if: github.event.inputs.major == 'no'
+      env:
+        BRANCH: ${{ github.event.inputs.branch }}
+        PRERELEASE: ${{ github.event.inputs.prerelease }}
       run: |
-        tox -e prepare-release-pr -- ${{ github.event.inputs.branch }} ${{ github.token }} --prerelease='${{ github.event.inputs.prerelease }}'
+        tox -e prepare-release-pr -- "$BRANCH" ${{ github.token }} --prerelease="$PRERELEASE"
 
     - name: Prepare release PR (major release)
       if: github.event.inputs.major == 'yes'
+      env:
+        BRANCH: ${{ github.event.inputs.branch }}
+        PRERELEASE: ${{ github.event.inputs.prerelease }}
       run: |
-        tox -e prepare-release-pr -- ${{ github.event.inputs.branch }} ${{ github.token }} --major --prerelease='${{ github.event.inputs.prerelease }}'
+        tox -e prepare-release-pr -- "$BRANCH" ${{ github.token }} --major --prerelease="$PRERELEASE"