Allow for using a non-framework Python library.

.github/dependabot.yml

@@ -7,9 +7,13 @@ updates:
       # Check for updates on the first Sunday of every month, 8PM UTC
       interval: "cron"
       cronjob: "0 20 * * sun#1"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "pre-commit"
     directory: "/"
     schedule:
       # Check for updates on the first Sunday of every month, 8PM UTC
       interval: "cron"
       cronjob: "0 20 * * sun#1"
+    cooldown:
+      default-days: 7

.github/workflows/check-pr-template.yml

@@ -4,7 +4,9 @@ on:
   pull_request:
     types: [opened, edited, reopened, synchronize]
 
+permissions: {}
+
 jobs:
   check-pr-template:
     name: Check PR template
-    uses: beeware/.github/.github/workflows/pr-checklist.yml@main
+    uses: beeware/.github/.github/workflows/pr-checklist.yml@741cc5a311012ee0ee195938889a337449d01eeb  # main

.github/workflows/ci.yml

@@ -18,17 +18,23 @@ defaults:
 env:
   FORCE_COLOR: "1"
 
+permissions: {}
+
 jobs:
   pre-commit:
     name: Pre-commit checks
-    uses: beeware/.github/.github/workflows/pre-commit-run.yml@main
+    uses: beeware/.github/.github/workflows/pre-commit-run.yml@741cc5a311012ee0ee195938889a337449d01eeb  # main
+    permissions:
+      contents: read
     with:
       pre-commit-source: pre-commit
 
   verify-apps:
     name: Build apps
     needs: pre-commit
-    uses: beeware/.github/.github/workflows/app-build-verify.yml@main
+    uses: beeware/.github/.github/workflows/app-build-verify.yml@741cc5a311012ee0ee195938889a337449d01eeb  # main
+    permissions:
+      contents: read
     with:
       python-version: ${{ matrix.python-version }}
       runner-os: macos-15

.github/workflows/new-issue.yml

@@ -11,8 +11,9 @@ jobs:
   add-to-project:
     name: Add issue to BeeWare project
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
-      - uses: actions/add-to-project@v2.0.0
+      - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd  # v2.0.0
         with:
           project-url: https://github.com/orgs/beeware/projects/1
           github-token: ${{ secrets.BRUTUS_PAT_TOKEN }}

.github/workflows/update-binary.yml

@@ -4,13 +4,17 @@ on:
     tags:
     - 'b*'
 
+permissions: {}
+
 jobs:
   build-stubs:
     name: Build stub binaries
     runs-on: macos-26
     strategy:
+      fail-fast: false
       matrix:
         python-version: [ "3.10", "3.11", "3.12", "3.13", "3.14" ]
+        framework: [true, false]
     outputs:
       BUILD_NUMBER: ${{ steps.build-vars.outputs.BUILD_NUMBER }}
 
@@ -22,47 +26,77 @@ jobs:
       run: |
         export BUILD_NUMBER=$(basename $TAG_NAME)
         export PYTHON_TAG=$(python -c "print('${{ matrix.python-version }}'.split('-')[0])")
+        export STUB_PREFIX=${{ !matrix.framework && 'L' || '' }}
 
         echo "PYTHON_TAG=${PYTHON_TAG}" | tee -a $GITHUB_ENV
         echo "BUILD_NUMBER=${BUILD_NUMBER}" | tee -a $GITHUB_ENV
+        echo "STUB_PREFIX=${STUB_PREFIX}" | tee -a $GITHUB_ENV
+
+        # Expose BUILD_NUMBER as a step output so it can be consumed as a job output
+        echo "BUILD_NUMBER=${BUILD_NUMBER}" | tee -a $GITHUB_OUTPUT
 
     - name: Checkout Template
-      uses: actions/checkout@v7.0.0
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        persist-credentials: false
 
     - name: Setup Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v6.3.0
+      if: ${{ matrix.framework }}
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
       with:
         python-version: ${{ matrix.python-version }}
         allow-prereleases: true
 
+    - name: Setup Miniconda
+      if: ${{ !matrix.framework }}
+      uses: conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5  # v4.0.1
+      with:
+        python-version: ${{ matrix.python-version }}
+        auto-update-conda: true
+        activate-environment: briefcase-env
+
     - name: Install Dependencies
       run: |
         python -m pip install --upgrade pip
-        python -m pip install git+https://github.com/beeware/briefcase.git
+        # TODO: use the WIP branch to build until the feature is finalized.
+        python -m pip install git+https://github.com/freakboy3742/briefcase.git@alt-env-support
+
+    - name: Create Framework stub app
+      if: ${{ matrix.framework }}
+      run: |
+        # Generate the stub app
+        cd stub
+        briefcase create macOS Xcode
 
-    - name: Generate Xcode App Template
+    - name: Create Non-framework stub app
+      if: ${{ !matrix.framework }}
       run: |
         # Generate the stub app
+        cd stub
+        briefcase create macOS Xcode -C env_manager=\"conda\" -C universal_build=false
+
+    - name: Build Stub App
+      run: |
         cd stub
         briefcase build macOS Xcode
 
-        echo "Build ${{ env.PYTHON_TAG }}-${{ env.BUILD_NUMBER }} console stub artefact"
+        echo "Build ${PYTHON_TAG}-${BUILD_NUMBER} ${{ !matrix.framework && 'non-framework' || 'framework' }} console stub artefact"
         mv "./build/console-stub/macos/xcode/build/Release/Console Stub.app/Contents/MacOS/Console Stub" Stub
         codesign --remove-signature Stub
-        zip Console-Stub-${{ env.PYTHON_TAG }}-${{ env.BUILD_NUMBER }}.zip Stub
+        zip Console-${STUB_PREFIX}Stub-${PYTHON_TAG}-${BUILD_NUMBER}.zip Stub
 
-        echo "Build ${{ env.PYTHON_TAG }}-${{ env.BUILD_NUMBER }} GUI stub artefact"
+        echo "Build ${PYTHON_TAG}-${BUILD_NUMBER} ${{ !matrix.framework && 'non-framework' || 'framework' }} GUI stub artefact"
         mv "./build/gui-stub/macos/xcode/build/Release/GUI Stub.app/Contents/MacOS/GUI Stub" Stub
         codesign --remove-signature Stub
-        zip GUI-Stub-${{ env.PYTHON_TAG }}-${{ env.BUILD_NUMBER }}.zip Stub
+        zip GUI-${STUB_PREFIX}Stub-${PYTHON_TAG}-${BUILD_NUMBER}.zip Stub
 
         echo "Stub binaries:"
         ls -1 *.zip
 
     - name: Upload build artefacts
-      uses: actions/upload-artifact@v7.0.1
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
-        name: ${{ env.PYTHON_TAG }}-stubs
+        name: ${{ env.PYTHON_TAG }}-${{ env.STUB_PREFIX }}Stubs
         path: stub/*.zip
 
     - name: Upload Release Asset to S3
@@ -74,29 +108,29 @@ jobs:
         python -m pip install -U setuptools
         python -m pip install awscli
 
-        aws s3 cp stub/Console-Stub-${{ env.PYTHON_TAG }}-${{ env.BUILD_NUMBER }}.zip s3://briefcase-support/python/${{ env.PYTHON_TAG }}/macOS/Console-Stub-${{ env.PYTHON_TAG }}-${{ env.BUILD_NUMBER }}.zip
-        aws s3 cp stub/GUI-Stub-${{ env.PYTHON_TAG }}-${{ env.BUILD_NUMBER }}.zip s3://briefcase-support/python/${{ env.PYTHON_TAG }}/macOS/GUI-Stub-${{ env.PYTHON_TAG }}-${{ env.BUILD_NUMBER }}.zip
+        aws s3 cp stub/Console-${STUB_PREFIX}Stub-${PYTHON_TAG}-${BUILD_NUMBER}.zip s3://briefcase-support/python/${PYTHON_TAG}/macOS/Console-${STUB_PREFIX}Stub-${PYTHON_TAG}-${BUILD_NUMBER}.zip
+        aws s3 cp stub/GUI-${STUB_PREFIX}Stub-${PYTHON_TAG}-${BUILD_NUMBER}.zip s3://briefcase-support/python/${PYTHON_TAG}/macOS/GUI-${STUB_PREFIX}Stub-${PYTHON_TAG}-${BUILD_NUMBER}.zip
 
   make-release:
     name: Make Release
-    runs-on: macOS-latest
+    runs-on: macos-26
     needs: [ build-stubs ]
+    permissions:
+      contents: write
     steps:
     - name: Get build artifacts
-      uses: actions/download-artifact@v8.0.1
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
       with:
         path: dist
         merge-multiple: true
 
     - name: Create Release
-      uses: ncipollo/release-action@v1.21.0
-      with:
-        name: ${{ needs.build-stubs.outputs.BUILD_NUMBER }}
-        tag: ${{ needs.build-stubs.outputs.BUILD_NUMBER }}
-        draft: true
-        body: |
-          Build ${{ needs.build-stubs.outputs.BUILD_NUMBER }} of the Briefcase macOS stub binary.
-
-          Includes support for Python 3.10-3.14.
-
-        artifacts: "dist/*"
+      env:
+        GH_TOKEN: ${{ github.token }}
+        BUILD_NUMBER: ${{ needs.build-stubs.outputs.BUILD_NUMBER }}
+      run: |
+        gh release create "${BUILD_NUMBER}" dist/* \
+          --repo "${GITHUB_REPOSITORY}" \
+          --title "${BUILD_NUMBER}" \
+          --draft \
+          --notes "$(printf 'Build %s of the Briefcase macOS stub binary.\n\nIncludes support for Python 3.10-3.14.\n' "${BUILD_NUMBER}")"

.pre-commit-config.yaml

@@ -8,3 +8,7 @@ repos:
       - id: check-case-conflict
       - id: end-of-file-fixer
       - id: trailing-whitespace
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.25.2
+    hooks:
+      - id: zizmor

cookiecutter.json

@@ -16,6 +16,7 @@
     "universal_build": true,
     "host_arch": "arm64",
     "min_os_version": "11.0",
+    "use_framework": true,
     "_extensions": [
         "briefcase.integrations.cookiecutter.PythonVersionExtension",
         "briefcase.integrations.cookiecutter.PListExtension"

stub/pyproject.toml

@@ -10,11 +10,11 @@ template = ".."
 
 [tool.briefcase.app.gui-stub]
 formal_name = "GUI Stub"
-description = "A stub binary for GUI apps that can be integrated into the macOS app template"
+description = "A stub binary for macOS GUI apps"
 sources = ['src/gui_stub']
 
 [tool.briefcase.app.console-stub]
 formal_name = "Console Stub"
-description = "A stub binary for console apps that can be integrated into the macOS app template"
+description = "A stub binary for macOS console apps"
 sources = ['src/console_stub']
 console_app = true

{{ cookiecutter.format }}/{{ cookiecutter.class_name }}/main.m

@@ -5,7 +5,11 @@
 #import <Foundation/Foundation.h>
 #import <AppKit/AppKit.h>
 #import <Cocoa/Cocoa.h>
+{%- if cookiecutter.use_framework %}
 #import <Python/Python.h>
+{%- else %}
+#import <Python.h>
+{%- endif %}
 #include <dlfcn.h>
 #include <libgen.h>
 #include <mach-o/dyld.h>
@@ -96,7 +100,11 @@ int main(int argc, char *argv[]) {
 
         // Set the home for the Python interpreter
         python_tag = @"{{ cookiecutter.python_version|py_tag }}";
+{%- if cookiecutter.use_framework %}
         python_home = [NSString stringWithFormat:@"%@/Python.framework/Versions/%@", frameworksPath, python_tag, nil];
+{%- else %}
+        python_home = [NSString stringWithFormat:@"%@/python/", resourcePath, nil];
+{%- endif %}
         debug_log(@"PythonHome: %@", python_home);
         wtmp_str = Py_DecodeLocale([python_home UTF8String], NULL);
         status = PyConfig_SetString(&config, &config.home, wtmp_str);