dynamically add supported Python versions to tox matrix, drawing from package metadata (requires-python)

[zacharyburnett]

closes #325

adds fill, fill_platforms, and fill_factors parameters to the tox.yml workflow call. fill: true will append toxenvs to the existing envs: list, namely the currently supported Python versions, with factors from fill_factors and repeated for each platform in fill_platforms.

Python versions are first drawn from the current public Python releases that are not yet end-of-life (pulled from endoflife.date API), and then filtered based on the requires-python pins in the package metadata, if it exists.

For instance, setting

with:
  ...
  fill: true
  fill_factors: xdist
  fill_platforms: linux

for jwst (which currently specifies requires-python = ">=3.11,<3.14") adds the following toxenvs to envs:

- linux: py313-xdist
- linux: py312-xdist
- linux: py311-xdist

To read the metadata, I imported peppyproject, a Python project metadata abstraction library I wrote to convert setup.cfg to pyproject.toml (but it also works well in this use case, as it will input metadata from pyproject.toml, setup.cfg, or setup.py).

[zacharyburnett]

EDIT: never mind it was a dumb issue with conditionals, ignore this for now!

@Cadair if you have time, could you take a look at why it's failing here: https://github.com/OpenAstronomy/github-actions-workflows/actions/runs/19116707014/job/54627509255?pr=326#step:5:13

Run pipx run supported_pythons.py
creating virtual environment...
installing supported-pythons-py...
Fatal error from pip prevented installation. Full pip output in file:
    /opt/pipx/logs/cmd_2025-11-05_21.22.00_pip_errors.log

Some possibly relevant errors from pip install:
    ERROR: Could not find a version that satisfies the requirement supported-pythons-py (from versions: none)
    ERROR: No matching distribution found for supported-pythons-py
Error installing supported-pythons-py.
Error: Process completed with exit code 1.

it looks to me like it's trying to install the script as a package, though I'm not sure why

[zacharyburnett]

zimzor says this opens a security vulnerability in which an attacker could pass arbitrary shell expressions to fill_platforms or fill_factors:
https://results.pre-commit.ci/run/github/463175679/1773164253.bP-bx2P8T5SnpGjTr9AzmA

may expand into attacker-controllable code

Is this something we should worry about? Anyone using this workflow already has arbitrary code execution privileges via tox

[zacharyburnett]

I set that step to be ignored by zimzor, let me know if we want to change it instead!

[Cadair]

If it's possible to it would be good to not have to ignore this. I don't think we are relying on shell expansion here, so running these variables through env should work?

[zacharyburnett]

What do you mean by running them through env?

[zacharyburnett]

It looks like we're also ignoring zizmor 's warning for the set-outputs call to tox_matrix.py as well

[Cadair]

I'd like to cut a release soon, so let's get this in and then I'll cut one.