Use trusted publishing

.github/dependabot.yml

@@ -0,0 +1,12 @@
+# Please see the documentation for more information:
+# https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference
+
+version: 2
+updates:
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    assignees:
+      - kohtala

.github/workflows/build_sdist.yml

@@ -0,0 +1,83 @@
+name: Build sdist
+
+on:
+  pull_request:
+    branches:
+    - 4.x
+    - 5.x
+    paths-ignore:
+    - '.github/workflows/build_wheels_*'
+    - '.github/workflows/release.yml'
+  workflow_call:
+    inputs:
+      rolling:
+        type: boolean
+        default: false
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  Build_sdist:
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: [3.8]
+        platform: [x64]
+        with_contrib: [0, 1]
+        without_gui: [0, 1]
+        build_sdist: [1]
+    env:
+      ACTIONS_ALLOW_UNSECURE_COMMANDS: true
+      REPO_DIR: .
+      PROJECT_SPEC: opencv-python
+      PLAT: x86_64
+      MB_PYTHON_VERSION: ${{ matrix.python-version }}
+      TRAVIS_PYTHON_VERSION: ${{ matrix.python-version }}
+      MB_ML_VER: 2014
+      NP_TEST_DEP: numpy==1.19.4
+      TRAVIS_BUILD_DIR: ${{ github.workspace }}
+      CONFIG_PATH: travis_config.sh
+      DOCKER_IMAGE: quay.io/opencv-ci/opencv-python-manylinux2014-x86-64:20260725@sha256:b31dbd9260993812b011eeea543fe3bad30cd1803dd54963ffd74bb4b7e31f38
+      USE_CCACHE: 1
+      UNICODE_WIDTH: 32
+      SDIST: ${{ matrix.build_sdist || 0 }}
+      ENABLE_HEADLESS: ${{ matrix.without_gui || 0 }}
+      ENABLE_CONTRIB: ${{ matrix.with_contrib || 0 }}
+    steps:
+    - name: Cleanup
+      run: find . -mindepth 1 -delete
+      working-directory: ${{ github.workspace }}
+    - name: Setup environment
+      if: inputs.rolling == 'true' || github.event_name == 'workflow_dispatch'
+      run: |
+        echo "ENABLE_ROLLING=1" >> $GITHUB_ENV
+    - name: Checkout
+      uses: actions/checkout@v7
+      with:
+        submodules: false
+        fetch-depth: 0
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v7
+      with:
+        python-version: ${{ matrix.python-version }}
+        architecture: ${{ matrix.platform }}
+    - name: Build a package
+      run: |
+        set -e
+        # Build and package
+        set -x
+          python -m pip install --upgrade pip
+          python -m pip install scikit-build
+          python setup.py sdist --formats=gztar
+        set +x
+        # Install and run tests
+        set -x
+        echo "skipping tests because of sdist"
+    - name: saving artifacts
+      uses: actions/upload-artifact@v7
+      with:
+        name: build-${{ matrix.platform }}-sdist-${{ matrix.with_contrib }}-${{ matrix.without_gui }}-${{ matrix.build_sdist }}
+        path: dist/opencv*.tar.gz

.github/workflows/build_wheels_macos.yml

@@ -9,16 +9,21 @@ on:
       - '.github/workflows/build_wheels_manylinux*'
       - '.github/workflows/build_wheels_windows*'
       - '.github/workflows/build_wheels_macos_m1.yml'
-  release:
-    types: [published, edited]
-  schedule:
-    - cron: '0 3 * * 6'
+      - '.github/workflows/build_sdist.yml'
+      - '.github/workflows/release.yml'
+  workflow_call:
+    inputs:
+      rolling:
+        type: boolean
+        default: false
   workflow_dispatch:
 
+permissions:
+  contents: read
 
 jobs:
   Build:
-    runs-on: python-macos-intel
+    runs-on: macos-15-intel
     strategy:
       fail-fast: false
       matrix:
@@ -46,37 +51,38 @@ jobs:
       ENABLE_CONTRIB: ${{ matrix.with_contrib }}
       PIP_INDEX_URL: https://pypi.tuna.tsinghua.edu.cn/simple
     steps:
-    - name: Cleanup
-      run: find . -mindepth 1 -delete
-      working-directory: ${{ github.workspace }}
     - name: Setup environment
+      if: inputs.rolling == 'true' || github.event_name == 'workflow_dispatch'
       run: |
-        if [[ "${{ github.event_name }}" == "schedule" || "${{ github.event_name }}" == "workflow_dispatch" ]]; then
-          echo "ENABLE_ROLLING=1" >> $GITHUB_ENV
-        fi
+        echo "ENABLE_ROLLING=1" >> $GITHUB_ENV
     - name: Checkout
       uses: actions/checkout@v7
       with:
         submodules: false
         fetch-depth: 0
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v7
+      with:
+        python-version: ${{ matrix.python-version }}
+        architecture: ${{ matrix.platform }}
     - name: Build a package
       run: |
         git submodule update --init multibuild
         echo $ENABLE_CONTRIB > contrib.enabled
         echo $ENABLE_HEADLESS > headless.enabled
         export MACOSX_DEPLOYMENT_TARGET=14.0
-        python${{ matrix.python-version }} -m pip install toml && python${{ matrix.python-version }} -c 'import toml; c = toml.load("pyproject.toml"); print("\n".join(c["build-system"]["requires"]))' | python${{ matrix.python-version }} -m pip install -r /dev/stdin
-        python${{ matrix.python-version }} setup.py bdist_wheel --py-limited-api=cp37 --dist-dir=wheelhouse -v
+        python -m pip install toml && python -c 'import toml; c = toml.load("pyproject.toml"); print("\n".join(c["build-system"]["requires"]))' | python -m pip install -r /dev/stdin
+        python setup.py bdist_wheel --py-limited-api=cp37 --dist-dir=wheelhouse -v
         delocate-wheel ${{ github.workspace }}/wheelhouse/opencv*
     - name: Saving a wheel accordingly to matrix
       uses: actions/upload-artifact@v7
       with:
-        name: wheel-${{ matrix.with_contrib }}-${{ matrix.without_gui }}-${{ matrix.build_sdist }}
+        name: build-${{ matrix.platform }}-macos-${{ matrix.with_contrib }}-${{ matrix.without_gui }}-${{ matrix.build_sdist }}
         path: wheelhouse/opencv*.whl
 
   Test:
     needs: [Build]
-    runs-on: python-macos-intel
+    runs-on: macos-26-intel
     strategy:
       fail-fast: false
       matrix:
@@ -107,104 +113,32 @@ jobs:
     - name: Download a wheel accordingly to matrix
       uses: actions/download-artifact@v8
       with:
-        name: wheel-${{ matrix.with_contrib }}-${{ matrix.without_gui }}-${{ matrix.build_sdist }}
+        name: build-${{ matrix.platform }}-macos-${{ matrix.with_contrib }}-${{ matrix.without_gui }}-${{ matrix.build_sdist }}
         path: wheelhouse/
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v7
+      with:
+        python-version: ${{ matrix.python-version }}
+        architecture: ${{ matrix.platform }}
     - name: Create Venv for test
       run: |
         test -d "${{ github.workspace }}/opencv_test" && rm -rf "${{ github.workspace }}/opencv_test"
-        python${{ matrix.python-version }} -m venv ${{ github.workspace }}/opencv_test
+        python -m venv ${{ github.workspace }}/opencv_test
     - name: Package installation
       run: |
         source ${{ github.workspace }}/opencv_test/bin/activate
-        python${{ matrix.python-version }} -m pip install --upgrade pip
-        python${{ matrix.python-version }} -m pip install --no-cache --force-reinstall wheelhouse/opencv*.whl
+        python -m pip install --upgrade pip
+        python -m pip install --no-cache --force-reinstall wheelhouse/opencv*.whl
         cd ${{ github.workspace }}/tests
-        python${{ matrix.python-version }} get_build_info.py
+        python get_build_info.py
     - name: Run tests
       run: |
         source ${{ github.workspace }}/opencv_test/bin/activate
         cd ${{ github.workspace }}/opencv
-        python${{ matrix.python-version }} modules/python/test/test.py -v --repo .
+        python modules/python/test/test.py -v --repo .
     - name: Pylint test
       run: |
         source ${{ github.workspace }}/opencv_test/bin/activate
-        python${{ matrix.python-version }} -m pip install pylint==2.15.9
+        python -m pip install pylint==2.15.9
         cd ${{ github.workspace }}/tests
-        python${{ matrix.python-version }} -m pylint $PYLINT_TEST_FILE
-
-  Release_rolling:
-    if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
-    needs: [Build, Test]
-    runs-on: ubuntu-22.04
-    environment: opencv-python-rolling-release
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - uses: actions/download-artifact@v8
-        with:
-          name: wheels
-          path: wheelhouse/
-      - name: Upload wheels for opencv_python_rolling
-        run: |
-          python -m pip install twine
-          python -m twine upload -u ${{ secrets.OPENCV_PYTHON_ROLLING_USERNAME }} -p ${{ secrets.OPENCV_PYTHON_ROLLING_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_python_rolling-*
-      - name: Upload wheels for opencv_contrib_python_rolling
-        run: |
-          python -m pip install twine
-          python -m twine upload -u ${{ secrets.OPENCV_CONTRIB_PYTHON_ROLLING_USERNAME }} -p ${{ secrets.OPENCV_CONTRIB_PYTHON_ROLLING_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_contrib_python_rolling-*
-      - name: Upload wheels for opencv_python_headless_rolling
-        run: |
-          python -m pip install twine
-          python -m twine upload -u ${{ secrets.OPENCV_PYTHON_HEADLESS_ROLLING_USERNAME }} -p ${{ secrets.OPENCV_PYTHON_HEADLESS_ROLLING_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_python_headless_rolling-*
-      - name: Upload wheels for opencv_contrib_python_headless_rolling
-        run: |
-          python -m pip install twine
-          python -m twine upload -u ${{ secrets.OPENCV_CONTRIB_PYTHON_HEADLESS_ROLLING_USERNAME }} -p ${{ secrets.OPENCV_CONTRIB_PYTHON_HEADLESS_ROLLING_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_contrib_python_headless_rolling-*
-
-  Pre-release:
-    if: github.event_name == 'release' && github.event.release.prerelease
-    needs: [Build, Test]
-    runs-on: ubuntu-22.04
-    environment: test-opencv-python-release
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - uses: actions/download-artifact@v8
-        with:
-          path: wheelhouse/
-      - name: Upload all wheels
-        run: |
-          tree
-          python -m pip install twine
-          python -m twine upload --repository testpypi -u ${{ secrets.PYPI_USERNAME }} -p ${{ secrets.PYPI_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_*
-
-  Release:
-    if: github.event_name == 'release' && !github.event.release.prerelease
-    needs: [Build, Test]
-    runs-on: ubuntu-22.04
-    environment: opencv-python-release
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - uses: actions/download-artifact@v8
-        with:
-          path: wheelhouse/
-      - name: Upload wheels for opencv_python
-        run: |
-          python -m pip install twine
-          python -m twine upload -u ${{ secrets.OPENCV_PYTHON_USERNAME }} -p ${{ secrets.OPENCV_PYTHON_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_python-*
-      - name: Upload wheels for opencv_contrib_python
-        run: |
-          python -m pip install twine
-          python -m twine upload -u ${{ secrets.OPENCV_CONTRIB_PYTHON_USERNAME }} -p ${{ secrets.OPENCV_CONTRIB_PYTHON_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_contrib_python-*
-      - name: Upload wheels for opencv_python_headless
-        run: |
-          python -m pip install twine
-          python -m twine upload -u ${{ secrets.OPENCV_PYTHON_HEADLESS_USERNAME }} -p ${{ secrets.OPENCV_PYTHON_HEADLESS_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_python_headless-*
-      - name: Upload wheels for opencv_contrib_python_headless
-        run: |
-          python -m pip install twine
-          python -m twine upload -u ${{ secrets.OPENCV_CONTRIB_PYTHON_HEADLESS_USERNAME }} -p ${{ secrets.OPENCV_CONTRIB_PYTHON_HEADLESS_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_contrib_python_headless-*
+        python -m pylint $PYLINT_TEST_FILE