Reorganize how we test downstreams and add more

.github/downstream.d/certbot-josepy.sh

@@ -0,0 +1,19 @@
+#!/bin/bash -ex
+
+case "${1}" in
+    install)
+        git clone --depth=1 https://github.com/certbot/josepy
+        cd josepy
+        git rev-parse HEAD
+        curl -sSL https://install.python-poetry.org | python3 -
+        "${HOME}/.local/bin/poetry" export -f constraints.txt --dev --without-hashes -o constraints.txt
+        pip install -e . pytest -c constraints.txt
+        ;;
+    run)
+        cd josepy
+        pytest tests
+        ;;
+    *)
+        exit 1
+        ;;
+esac

.github/downstream.d/certbot.sh

@@ -0,0 +1,23 @@
+#!/bin/bash -ex
+
+case "${1}" in
+    install)
+        git clone --depth=1 https://github.com/certbot/certbot
+        cd certbot
+        git rev-parse HEAD
+        tools/pip_install.py -e ./acme[test]
+        tools/pip_install.py -e ./certbot[test]
+        pip install -U pyopenssl
+        ;;
+    run)
+        cd certbot
+        # Ignore some warnings for now since they're now automatically promoted
+        # to errors. We can probably remove this when acme gets split into
+        # its own repo
+        pytest -Wignore certbot
+        pytest acme
+        ;;
+    *)
+        exit 1
+        ;;
+esac

.github/downstream.d/twisted.sh

@@ -0,0 +1,17 @@
+#!/bin/bash -ex
+
+case "${1}" in
+    install)
+        git clone --depth=1 https://github.com/twisted/twisted
+        cd twisted
+        git rev-parse HEAD
+        pip install ".[all_non_platform]"
+        ;;
+    run)
+        cd twisted
+        python -m twisted.trial -j4 src/twisted
+        ;;
+    *)
+        exit 1
+        ;;
+esac

.github/workflows/ci.yml

@@ -44,8 +44,6 @@ jobs:
           - {VERSION: "3.9", TOXENV: "py39-useWheel"}
           # Random order
           - {VERSION: "3.9", TOXENV: "py39-randomorder"}
-          # Downstreams
-          - {VERSION: "3.11", TOXENV: "py311-twistedTrunk"}
           # Meta
           - {VERSION: "3.9", TOXENV: "check-manifest"}
           - {VERSION: "3.11", TOXENV: "lint"}
@@ -82,9 +80,31 @@ jobs:
           RUSTUP_HOME: /root/.rustup
       - uses: ./.github/actions/upload-coverage
 
+  linux-downstream:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        DOWNSTREAM:
+          - twisted
+          - certbot
+          - certbot-josepy
+        PYTHON:
+          - 3.12
+    name: "Downstream tests for ${{ matrix.DOWNSTREAM }}"
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.PYTHON }}
+      - run: ./.github/downstream.d/${{ matrix.DOWNSTREAM }}.sh install
+      - run: pip install .
+      - run: ./.github/downstream.d/${{ matrix.DOWNSTREAM }}.sh run
+
   all-green:
     runs-on: ubuntu-latest
-    needs: [linux, linux-docker]
+    needs: [linux, linux-docker, linux-downstream]
     if: ${{ always() }}
     timeout-minutes: 3
     steps:

tox.ini

@@ -1,5 +1,5 @@
 [tox]
-envlist = py{py3,37,38,39,310,311,312,313}{,-cryptographyMinimum}{,-useWheel}{,-randomorder},py311-twistedTrunk,check-manifest,lint,py311-mypy,docs,coverage-report
+envlist = py{py3,37,38,39,310,311,312,313}{,-cryptographyMinimum}{,-useWheel}{,-randomorder},check-manifest,lint,py311-mypy,docs,coverage-report
 
 [testenv]
 allowlist_externals =
@@ -32,15 +32,6 @@ commands =
     coverage run --parallel -m OpenSSL.debug
     coverage run --parallel -m pytest -v {posargs}
 
-[testenv:py311-twistedTrunk]
-deps =
-    pyasn1!=0.5.0
-    Twisted[all_non_platform] @ git+https://github.com/twisted/twisted
-setenv =
-commands =
-    python -m OpenSSL.debug
-    python -m twisted.trial -j4 --reporter=text twisted
-
 [testenv:lint]
 basepython = python3
 deps =