Merge pull request #3406 from pyenv/use_github_app_token

CI: add_version: use Github App token to create PR

.github/workflows/add_version.yml

@@ -15,13 +15,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6     
+      - uses: actions/setup-python@v6
         with:
           python-version: 3
           cache: 'pip'
           cache-dependency-path: plugins/python-build/scripts/requirements.txt
       - run: pip install -r plugins/python-build/scripts/requirements.txt
-      
+
       - name: check for a release
         run: |
           python plugins/python-build/scripts/add_cpython.py --verbose >added_versions.lst && rc=$? || rc=$?
@@ -37,11 +37,19 @@ jobs:
             f.write(f'branch_name=auto_add_version/{"_".join(versions)}\n')
             f.write(f'pr_name=Add CPython {", ".join(versions)}\n')
           os.remove("added_versions.lst")
-      
+
+      # https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#authenticating-with-github-app-generated-tokens
+      - name: Generate Github token
+        if: env.rc == 0
+        uses: actions/create-github-app-token@v2
+        id: generate-token
+        with:
+          app-id: ${{ vars.PYENV_BOT_APP_ID }}
+          private-key: ${{ secrets.PYENV_BOT_PRIVATE_KEY }}
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@v8
         if: env.rc == 0
         with:
           branch: ${{ env.branch_name }}
           title: ${{ env.pr_name }}
-          token: ${{ secrets.TOKEN_AUTO_PR }}
+          token: ${{ steps.generate-token.outputs.token }}

plugins/python-build/scripts/add_cpython.py

@@ -175,9 +175,6 @@ def handle_t_thunks(version, previous_version, is_prerelease_upgrade):
                               "mv",
                               previous_thunk_name,
                               thunk_name))
-    else:
-        logger.info(f"Deleting {previous_thunk_path}")
-        previous_thunk_path.unlink()
 
     logger.info(f"Writing {thunk_path}")
     thunk_path.write_text(T_THUNK, encoding='utf-8')

plugins/python-build/share/python-build/3.14.1

@@ -1,10 +0,0 @@
-prefer_openssl3
-export PYTHON_BUILD_CONFIGURE_WITH_OPENSSL=1
-export PYTHON_BUILD_TCLTK_USE_PKGCONFIG=1
-install_package "openssl-3.6.0" "https://github.com/openssl/openssl/releases/download/openssl-3.6.0/openssl-3.6.0.tar.gz#b6a5f44b7eb69e3fa35dbf15524405b44837a481d43d81daddde3ff21fcbb8e9" mac_openssl --if has_broken_mac_openssl
-install_package "readline-8.3" "http://ftpmirror.gnu.org/readline/readline-8.3.tar.gz#fe5383204467828cd495ee8d1d3c037a7eba1389c22bc6a041f627976f9061cc" mac_readline --if has_broken_mac_readline
-if has_tar_xz_support; then
-    install_package "Python-3.14.1" "https://www.python.org/ftp/python/3.14.1/Python-3.14.1.tar.xz#8dfa08b1959d9d15838a1c2dab77dc8d8ff4a553a1ed046dfacbc8095c6d42fc" standard verify_py314 copy_python_gdb ensurepip
-else
-    install_package "Python-3.14.1" "https://www.python.org/ftp/python/3.14.1/Python-3.14.1.tgz#8343f001dede23812c7e9c6064f776bade2ef5813f46f0ae4b5a4c10c9069e9a" standard verify_py314 copy_python_gdb ensurepip
-fi

plugins/python-build/share/python-build/3.15.0a6t

@@ -1,2 +0,0 @@
-export PYTHON_BUILD_FREE_THREADING=1
-source "${BASH_SOURCE[0]%t}"