PYTHON-6050 Build libbson 2.5.3 from source with Meson

.github/actions/setup-ccache/action.yml

@@ -0,0 +1,56 @@
+name: Setup ccache
+description: "Install ccache, configure it, and restore/save the cache"
+inputs:
+  key:
+    description: "Cache key for actions/cache"
+    required: true
+  restore-keys:
+    description: "Restore-key prefix for actions/cache"
+    required: true
+  maxsize:
+    description: "CCACHE_MAXSIZE"
+    required: false
+    default: "400M"
+  sloppiness:
+    description: "CCACHE_SLOPPINESS"
+    required: false
+    default: "pch_defines,time_macros"
+runs:
+  using: "composite"
+  steps:
+    - name: Configure ccache
+      shell: bash
+      env:
+        CCACHE_MAXSIZE: ${{ inputs.maxsize }}
+        CCACHE_SLOPPINESS: ${{ inputs.sloppiness }}
+      run: |
+        {
+          echo "CCACHE_BASEDIR=$GITHUB_WORKSPACE"
+          echo "CCACHE_DIR=$GITHUB_WORKSPACE/.ccache"
+          echo "CCACHE_COMPRESS=true"
+          echo "CCACHE_COMPRESSLEVEL=6"
+          echo "CCACHE_MAXSIZE=$CCACHE_MAXSIZE"
+          echo "CCACHE_SLOPPINESS=$CCACHE_SLOPPINESS"
+        } >> "$GITHUB_ENV"
+
+    - name: Install ccache
+      shell: bash
+      run: |
+        # Only used as a compiler launcher on GNU/Clang; ccache's MSVC launcher
+        # hangs compiler detection on Windows, so skip it there.
+        if [ "$RUNNER_OS" = "Linux" ]; then
+          sudo apt-get install -y ccache
+        elif [ "$RUNNER_OS" = "macOS" ]; then
+          brew install ccache
+        fi
+
+    - name: Restore/save ccache
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ${{ github.workspace }}/.ccache
+        key: ${{ inputs.key }}
+        restore-keys: ${{ inputs.restore-keys }}
+
+    - name: Zero ccache stats
+      shell: bash
+      run: ccache --zero-stats

.github/actions/setup-mongo-c-driver/action.yml

@@ -0,0 +1,32 @@
+name: Setup mongo-c-driver
+description: "Cache and fetch the mongo-c-driver release pinned in meson.build"
+runs:
+  using: "composite"
+  steps:
+    - name: Exclude the workspace from Windows Defender
+      if: runner.os == 'Windows'
+      shell: powershell
+      run: |
+        # Real-time MSVC compilation on GitHub-hosted Windows is throttled by
+        # Defender; excluding the workspace is the standard, big win.
+        Add-MpPreference -ExclusionPath "$env:GITHUB_WORKSPACE" -ErrorAction SilentlyContinue
+        Add-MpPreference -ExclusionPath "$env:GITHUB_WORKSPACE\build" -ErrorAction SilentlyContinue
+
+    - name: Read the pinned mongo-c-driver version
+      id: pinned
+      shell: bash
+      run: |
+        set -euo pipefail
+        VERSION=$(python -c "import re,pathlib; print(re.search(r\"mcd_version\s*=\s*'([0-9.]+)'\", pathlib.Path('meson.build').read_text()).group(1))")
+        echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+    - name: Restore/save mongo-c-driver tarball
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ${{ github.workspace }}/.mongo-c-driver
+        key: mcd-${{ steps.pinned.outputs.version }}-${{ runner.os }}-${{ github.sha }}
+        restore-keys: mcd-${{ steps.pinned.outputs.version }}-${{ runner.os }}-
+
+    - name: Fetch and extract mongo-c-driver
+      shell: bash
+      run: python scripts/fetch_mongo_c_driver.py

.github/workflows/codeql.yml

@@ -0,0 +1,54 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: ["master"]
+  pull_request:
+  schedule:
+    - cron: '17 10 * * 2'
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: c-cpp
+          build-mode: manual
+          # Configure with Meson so libbson's config.h/version.h are generated
+          # and the extension's compile flags are computed in one place, then
+          # compile bsonjs.c with the exact command recorded in
+          # compile_commands.json so the flags cannot drift from meson.build.
+          # CodeQL's tracer only extracts files the compiler is actually
+          # invoked on, so filtering to bsonjs.c keeps libbson out of scope.
+          manual-build-command: |
+            pip install "meson>=1.3" ninja
+            python3 scripts/fetch_mongo_c_driver.py
+            meson setup /tmp/codeql-build
+            cmd=$(jq -r '.[] | select(.file | endswith("bsonjs.c")) | .command' /tmp/codeql-build/compile_commands.json)
+            o=$(printf '%s' "$cmd" | grep -o '\-o [^ ]*' | cut -d' ' -f2)
+            (cd /tmp/codeql-build && mkdir -p "$(dirname "$o")" && bash -c "$cmd")
+        - language: python
+          build-mode: none
+        - language: actions
+          build-mode: none
+    steps:
+    - uses: mongodb-labs/drivers-github-tools/codeql@f137fdd28483af14ebf466ebc5aa789fbf867218 # v3
+      with:
+        language: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+        manual-build-command: ${{ matrix.manual-build-command }}
+        config: |
+          paths-ignore:
+            - 'test/**'

.github/workflows/dist.yml

@@ -23,19 +23,61 @@ defaults:
   run:
     shell: bash -eux {0}
 
+permissions:
+  contents: read
+
 jobs:
   build_wheels:
     runs-on: ${{ matrix.os }}
     strategy:
+      fail-fast: false
       matrix:
-        os: [macos-latest, windows-latest, ubuntu-24.04-arm, ubuntu-latest]
+        os: [macos-latest, windows-2022, ubuntu-24.04-arm, ubuntu-latest]
     name: Build CPython-${{ matrix.os }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: pypa/cibuildwheel@4726cd35bb13f7bde50cf2761f2499ac7b3aa32c # v4.1.1
-      - uses: actions/upload-artifact@v7
+      - name: Set up ccache
+        if: runner.os != 'Windows'
+        uses: ./.github/actions/setup-ccache
+        with:
+          key: ccache-${{ runner.os }}-${{ github.sha }}
+          restore-keys: ccache-${{ runner.os }}-
+      - name: Set up mongo-c-driver
+        uses: ./.github/actions/setup-mongo-c-driver
+      - name: Build wheels (macOS/Linux)
+        if: runner.os != 'Windows'
+        uses: pypa/cibuildwheel@4726cd35bb13f7bde50cf2761f2499ac7b3aa32c # v4.1.1
+      - name: Build wheels (Windows AMD64)
+        if: runner.os == 'Windows'
+        uses: pypa/cibuildwheel@4726cd35bb13f7bde50cf2761f2499ac7b3aa32c # v4.1.1
+        env:
+          CIBW_ARCHS: AMD64
+      # Meson's --vsenv activates only the x64 toolset, and its Python
+      # dependency check rejects a 32-bit Python against an x64 compiler
+      # ("Need python for x86_64, but found x86"). Exporting the x86 toolset
+      # environment here makes Meson skip its own activation (VSINSTALLDIR is
+      # set) and detect the x86 compiler instead, so the host machine reads
+      # as x86 and matches the 32-bit Python.
+      - name: Export the x86 MSVC environment
+        if: runner.os == 'Windows'
+        shell: powershell
+        run: |
+          $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
+          $vcvarsall = & $vswhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -find "VC\Auxiliary\Build\vcvarsall.bat" | Select-Object -First 1
+          if (-not $vcvarsall) { throw "vcvarsall.bat not found" }
+          cmd /s /c "`"$vcvarsall`" x86 && set" | ForEach-Object {
+            if ($_ -match '^([^=]+)=(.*)$') {
+              Add-Content -Path $env:GITHUB_ENV -Value "$($Matches[1])=$($Matches[2])"
+            }
+          }
+      - name: Build wheels (Windows x86)
+        if: runner.os == 'Windows'
+        uses: pypa/cibuildwheel@4726cd35bb13f7bde50cf2761f2499ac7b3aa32c # v4.1.1
+        env:
+          CIBW_ARCHS: x86
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ matrix.os }}-wheel
           path: ./wheelhouse/*.whl
@@ -50,12 +92,12 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: 3.9
+          python-version: 3.11
       - name: Build SDist
         run: |
           python -m pip install build
           python -m build --sdist
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: "sdist"
           path: dist/*.tar.gz
@@ -65,13 +107,13 @@ jobs:
     name: Download Wheels
     steps:
       - name: Download all workflow run artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       - name: Flatten directory
         working-directory: .
         run: |
           find . -mindepth 2 -type f -exec mv {} . \;
           find . -type d -empty -delete
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: all-dist-${{ github.run_id }}
           path: "./*"

.github/workflows/release-python.yml

@@ -29,6 +29,9 @@ defaults:
   run:
     shell: bash -eux {0}
 
+permissions:
+  contents: read
+
 jobs:
   pre-publish:
     environment: release
@@ -73,7 +76,7 @@ jobs:
       id-token: write
     steps:
     - name: Download all the dists
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: all-dist-${{ github.run_id }}
         path: dist/