Famedly release/v1.143

.ci/scripts/auditwheel_wrapper.py

@@ -25,7 +25,6 @@
 import argparse
 import os
 import subprocess
-from typing import Optional
 from zipfile import ZipFile
 
 from packaging.tags import Tag
@@ -80,7 +79,7 @@ def cpython(wheel_file: str, name: str, version: Version, tag: Tag) -> str:
     return new_wheel_file
 
 
-def main(wheel_file: str, dest_dir: str, archs: Optional[str]) -> None:
+def main(wheel_file: str, dest_dir: str, archs: str | None) -> None:
     """Entry point"""
 
     # Parse the wheel file name into its parts. Note that `parse_wheel_filename`

.ci/scripts/calculate_builds.py

@@ -57,11 +57,12 @@ def set_output(key: str, value: str) -> None:
     "mod016": {"sic-version": "0.4.10", "sta-version": "0.12.0"},
     "mod017": {"sic-version": "0.2.2", "sta-version": "0.12.0"},
     "mod018": {"sic-version": "0.4.11", "sta-version": "0.12.0"},
+    "mod019": {"sic-version": "0.4.13", "sta-version": "0.12.0"},
 }
 
 # Adjust this section to decide what gets built and layered on top
 # THIS IS THE SECTION TO EDIT, after you have added the new versions above
-current_mod_packs_to_build = ["mod017", "mod018"]
+current_mod_packs_to_build = ["mod017", "mod019"]
 
 generated_jobs: list[dict[str, Any]] = []
 for mod_pack_job in current_mod_packs_to_build:

.ci/scripts/calculate_jobs.py

@@ -35,46 +35,55 @@ def set_output(key: str, value: str):
 
 # First calculate the various trial jobs.
 #
-# For PRs, we only run each type of test with the oldest Python version supported (which
-# is Python 3.10 right now)
+# For PRs, we only run each type of test with the oldest and newest Python
+# version that's supported. The oldest version ensures we don't accidentally
+# introduce syntax or code that's too new, and the newest ensures we don't use
+# code that's been dropped in the latest supported Python version.
 
 trial_sqlite_tests = [
     {
         "python-version": "3.10",
         "database": "sqlite",
         "extras": "all",
-    }
+    },
+    {
+        "python-version": "3.14",
+        "database": "sqlite",
+        "extras": "all",
+    },
 ]
 
 if not IS_PR:
+    # Otherwise, check all supported Python versions.
+    #
+    # Avoiding running all of these versions on every PR saves on CI time.
     trial_sqlite_tests.extend(
         {
             "python-version": version,
             "database": "sqlite",
             "extras": "all",
         }
-        for version in ("3.11", "3.12", "3.13", "3.14")
+        for version in ("3.11", "3.12", "3.13")
     )
 
+# Only test postgres against the earliest and latest Python versions that we
+# support in order to save on CI time.
 trial_postgres_tests = [
     {
         "python-version": "3.10",
         "database": "postgres",
-        "postgres-version": "13",
+        "postgres-version": "14",
         "extras": "all",
-    }
+    },
+    {
+        "python-version": "3.14",
+        "database": "postgres",
+        "postgres-version": "17",
+        "extras": "all",
+    },
 ]
 
-if not IS_PR:
-    trial_postgres_tests.append(
-        {
-            "python-version": "3.14",
-            "database": "postgres",
-            "postgres-version": "17",
-            "extras": "all",
-        }
-    )
-
+# Ensure that Synapse passes unit tests even with no extra dependencies installed.
 trial_no_extra_tests = [
     {
         "python-version": "3.10",

.ci/scripts/prepare_old_deps.sh

@@ -16,20 +16,23 @@ export VIRTUALENV_NO_DOWNLOAD=1
 # to select the lowest possible versions, rather than resorting to this sed script.
 
 # Patch the project definitions in-place:
-# - Replace all lower and tilde bounds with exact bounds
-# - Replace all caret bounds---but not the one that defines the supported Python version!
-# - Delete all lines referring to psycopg2 --- so no testing of postgres support.
+# - `-E` use extended regex syntax.
+# - Don't modify the line that defines required Python versions.
+# - Replace all lower and tilde bounds with exact bounds.
+# - Replace all caret bounds with exact bounds.
+# - Delete all lines referring to psycopg2 - so no testing of postgres support.
 # - Use pyopenssl 17.0, which is the oldest version that works with
 #   a `cryptography` compiled against OpenSSL 1.1.
 # - Omit systemd: we're not logging to journal here.
 
-sed -i \
-   -e "s/[~>]=/==/g" \
-   -e '/^python = "^/!s/\^/==/g' \
-   -e "/psycopg2/d" \
-   -e 's/pyOpenSSL = "==16.0.0"/pyOpenSSL = "==17.0.0"/' \
-   -e '/systemd/d' \
-   pyproject.toml
+sed -i -E '
+  /^\s*requires-python\s*=/b
+  s/[~>]=/==/g
+  s/\^/==/g
+  /psycopg2/d
+  s/pyOpenSSL\s*==\s*16\.0\.0"/pyOpenSSL==17.0.0"/
+  /systemd/d
+' pyproject.toml
 
 echo "::group::Patched pyproject.toml"
 cat pyproject.toml

.git-blame-ignore-revs

@@ -26,3 +26,8 @@ c4268e3da64f1abb5b31deaeb5769adb6510c0a7
 # Update black to 23.1.0 (https://github.com/matrix-org/synapse/pull/15103)
 9bb2eac71962970d02842bca441f4bcdbbf93a11
 
+# Use type hinting generics in standard collections (https://github.com/element-hq/synapse/pull/19046)
+fc244bb592aa481faf28214a2e2ce3bb4e95d990
+
+# Write union types as X | Y where possible (https://github.com/element-hq/synapse/pull/19111)
+fcac7e0282b074d4bd3414d1c9c181e9701875d9

.github/workflows/docker.yml

@@ -123,7 +123,7 @@ jobs:
         uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
 
       - name: Calculate docker image tag
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
         with:
           images: ${{ matrix.repository }}
           flavor: |

.github/workflows/famedly-tests.yml

@@ -5,9 +5,9 @@ name: Tests
 # so a change to a pull request was triggering both. Also run tests when a tag is pushed.
 on:
   push:
-    branches: ["master", "release-*"]
+    branches: [ "master", "release-*" ]
     tags:
-      - '**'
+      - "**"
   pull_request:
   merge_group:
   workflow_dispatch:
@@ -191,6 +191,8 @@ jobs:
     needs:
       - calculate-test-jobs
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     strategy:
       matrix:
         job: ${{ fromJson(needs.calculate-test-jobs.outputs.trial_test_matrix) }}
@@ -229,11 +231,11 @@ jobs:
         run: until pg_isready -h localhost; do sleep 1; done
       # coverage is already installed from the pyproject.toml file
       - run: poetry run pip install coverage-enable-subprocess
-        # Normally, this Github runner has 2 cores(actually threads) available to it.
-        # Using only one trial test runner does not saturate the cpu. Rough experimentation in the past led to having 3
-        # of these runners per core as optimal, but now coverage is required and there may be the need
-        # to scale back a little. This should be 6 trial test runners/jobs
-      - run: poetry run coverage run -m twisted.trial -j$((`nproc` * 2 )) tests
+        # Normally, this Github runner has 4 cores(vCPUs) available to it.
+        # Just use that number to define the number of runners. Adding in
+        # --debug=core will display which measurement core is in use. For python 3.14+
+        # this is educational.
+      - run: poetry run coverage run --debug=core -m twisted.trial -j$((`nproc`)) tests
         env:
           SYNAPSE_POSTGRES: ${{ matrix.job.database == 'postgres' || '' }}
           SYNAPSE_POSTGRES_HOST: /var/run/postgresql
@@ -252,10 +254,11 @@ jobs:
           -exec echo "::endgroup::" \;
           || true
       - run: poetry run coverage combine
+      - run: poetry run coverage xml
       - name: Codecov - Upload coverage
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v5
         with:
-          token: ${{secrets.CODECOV_TOKEN}}
+          use_oidc: true
 
   sytest:
     if: ${{ !failure() && !cancelled() }}
@@ -362,6 +365,104 @@ jobs:
 
       - run: cargo test
 
+  invite-checker:
+    if: ${{ !failure() && !cancelled() }}
+    needs:
+      - linting-done
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout synapse
+        uses: actions/checkout@v4
+
+      - name: Checkout synapse-invite-checker
+        uses: actions/checkout@v4
+        with:
+          repository: famedly/synapse-invite-checker
+          path: synapse-invite-checker
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install hatch
+        run: pip install hatch
+
+      - name: Determine synapse git ref
+        id: synapse-ref
+        run: |
+          if [ "${{ github.event_name }}" == "pull_request" ]; then
+            echo "ref=${{ github.event.pull_request.head.ref }}" >> "$GITHUB_OUTPUT"
+            echo "repo=${{ github.event.pull_request.head.repo.full_name }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "ref=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "repo=${{ github.repository }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Update dependency to the current branch
+        working-directory: synapse-invite-checker
+        run: |
+          sed -i 's|"matrix-synapse[^"]*"|"matrix-synapse @ git+https://github.com/${{ steps.synapse-ref.outputs.repo }}.git@${{ steps.synapse-ref.outputs.ref }}"|' pyproject.toml
+          # Check if the file was actually modified
+          if git diff --exit-code pyproject.toml > /dev/null; then
+            echo "::error::The sed command did not modify pyproject.toml. Check if the 'matrix-synapse' dependency exists in the file."
+            exit 1
+          fi
+
+      - name: Run invite-checker tests
+        working-directory: synapse-invite-checker
+        run: hatch run cov
+
+  token-authenticator:
+    if: ${{ !failure() && !cancelled() }}
+    needs:
+      - linting-done
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout synapse
+        uses: actions/checkout@v4
+
+      - name: Checkout synapse-token-authenticator
+        uses: actions/checkout@v4
+        with:
+          repository: famedly/synapse-token-authenticator
+          path: synapse-token-authenticator
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install hatch
+        run: pip install hatch
+
+      - name: Determine synapse git ref
+        id: synapse-ref
+        run: |
+          if [ "${{ github.event_name }}" == "pull_request" ]; then
+            echo "ref=${{ github.event.pull_request.head.ref }}" >> "$GITHUB_OUTPUT"
+            echo "repo=${{ github.event.pull_request.head.repo.full_name }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "ref=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "repo=${{ github.repository }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Update dependency to the current branch
+        working-directory: synapse-token-authenticator
+        run: |
+          sed -i 's|"matrix-synapse[^"]*"|"matrix-synapse @ git+https://github.com/${{ steps.synapse-ref.outputs.repo }}.git@${{ steps.synapse-ref.outputs.ref }}"|' pyproject.toml
+          # Check if the file was actually modified
+          if git diff --exit-code pyproject.toml > /dev/null; then
+            echo "::error::The sed command did not modify pyproject.toml. Check if the 'matrix-synapse' dependency exists in the file."
+            exit 1
+          fi
+
+      - name: Run token-authenticator tests
+        working-directory: synapse-token-authenticator
+        run: hatch run cov
+
   otlp:
     if: ${{ !failure() && !cancelled() }}
     runs-on: ubuntu-latest
@@ -388,6 +489,8 @@ jobs:
       - sytest
       - complement
       - cargo-test
+      - invite-checker
+      - token-authenticator
       - linting-done
     runs-on: ubuntu-latest
     steps:

.github/workflows/push_complement_image.yml

@@ -55,7 +55,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Work out labels for complement image
         id: meta
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
         with:
           images: ghcr.io/${{ github.repository }}/complement-synapse
           tags: |

.github/workflows/tests.yml

@@ -617,7 +617,7 @@ jobs:
       matrix:
         include:
           - python-version: "3.10"
-            postgres-version: "13"
+            postgres-version: "14"
 
           - python-version: "3.14"
             postgres-version: "17"