From ae5f384f132d231e0374304e987aa035f8ed8591 Mon Sep 17 00:00:00 2001
From: Colin Watson <colin.watson@chainguard.dev>
Date: Wed, 24 Dec 2025 12:41:38 +0000
Subject: [PATCH] py3-b*: switch to git-checkout

Signed-off-by: Colin Watson <colin.watson@chainguard.dev>
---
 py3-babel.yaml          | 19 +++++++++++++------
 py3-backoff.yaml        | 15 +++++++++------
 py3-beautifulsoup4.yaml |  9 +++++----
 py3-bokeh.yaml          | 19 +++++++++++++------
 py3-botocore.yaml       | 14 ++++++++------
 5 files changed, 48 insertions(+), 28 deletions(-)

diff --git a/py3-babel.yaml b/py3-babel.yaml
index 539494e186f..671bc6ee9fe 100644
--- a/py3-babel.yaml
+++ b/py3-babel.yaml
@@ -1,7 +1,7 @@
 package:
   name: py3-babel
   version: "2.17.0"
-  epoch: 2
+  epoch: 3
   description: Python3 i18n tool
   copyright:
     - license: BSD-3-Clause
@@ -24,12 +24,17 @@ environment:
   contents:
     packages:
       - py3-supported-build-base
+      - python3
 
 pipeline:
-  - uses: fetch
+  - uses: git-checkout
     with:
-      uri: https://files.pythonhosted.org/packages/source/B/Babel/babel-${{package.version}}.tar.gz
-      expected-sha256: 0c54cffb19f690cdcc52a3b50bcbf71e07a808d1c80d549f2459b9d2cf0afb9d
+      repository: https://github.com/python-babel/babel
+      tag: v${{package.version}}
+      expected-commit: b50a1d2186c20f3359f7e10853d2b2225a46ed40
+
+  # This downloads from unicode.org, but it checks the expected SHA-512 hash.
+  - runs: scripts/download_import_cldr.py
 
 subpackages:
   - range: py-versions
@@ -110,5 +115,7 @@ test:
 update:
   enabled: true
   shared: true
-  release-monitor:
-    identifier: 11984
+  github:
+    identifier: python-babel/babel
+    strip-prefix: v
+    tag-filter-prefix: v
diff --git a/py3-backoff.yaml b/py3-backoff.yaml
index 405796c387e..24efa8025f0 100644
--- a/py3-backoff.yaml
+++ b/py3-backoff.yaml
@@ -1,7 +1,7 @@
 package:
   name: py3-backoff
   version: 2.2.1
-  epoch: 6
+  epoch: 7
   description: Function decoration for backoff and retry
   copyright:
     - license: MIT
@@ -27,10 +27,11 @@ environment:
       - py3-supported-poetry
 
 pipeline:
-  - uses: fetch
+  - uses: git-checkout
     with:
-      expected-sha256: 03f829f5bb1923180821643f8753b0502c3b682293992485b0eef2807afa5cba
-      uri: https://files.pythonhosted.org/packages/source/b/backoff/backoff-${{package.version}}.tar.gz
+      repository: https://github.com/litl/backoff
+      tag: v${{package.version}}
+      expected-commit: d9d80a92d5a4483373acdaf9faa4068c85b3d268
 
 subpackages:
   - range: py-versions
@@ -78,5 +79,7 @@ test:
 
 update:
   enabled: true
-  release-monitor:
-    identifier: 44448
+  github:
+    identifier: litl/backoff
+    strip-prefix: v
+    tag-filter-prefix: v
diff --git a/py3-beautifulsoup4.yaml b/py3-beautifulsoup4.yaml
index 5518f59d04b..83bf8346f86 100644
--- a/py3-beautifulsoup4.yaml
+++ b/py3-beautifulsoup4.yaml
@@ -1,7 +1,7 @@
 package:
   name: py3-beautifulsoup4
   version: "4.14.3"
-  epoch: 0
+  epoch: 1
   description: Screen-scraping library
   copyright:
     - license: MIT
@@ -27,10 +27,11 @@ environment:
       - py3-supported-hatchling
 
 pipeline:
-  - uses: fetch
+  - uses: git-checkout
     with:
-      expected-sha256: 6292b1c5186d356bba669ef9f7f051757099565ad9ada5dd630bd9de5fa7fb86
-      uri: https://files.pythonhosted.org/packages/source/b/beautifulsoup4/beautifulsoup4-${{package.version}}.tar.gz
+      repository: https://git.launchpad.net/beautifulsoup
+      tag: ${{package.version}}
+      expected-commit: 974559b0e411a92c0422f5a6c26b78e676ec457e
 
 subpackages:
   - range: py-versions
diff --git a/py3-bokeh.yaml b/py3-bokeh.yaml
index 274507a2878..0ec242c922e 100644
--- a/py3-bokeh.yaml
+++ b/py3-bokeh.yaml
@@ -2,7 +2,7 @@
 package:
   name: py3-bokeh
   version: "3.8.1"
-  epoch: 0
+  epoch: 1
   description: Interactive plots and applications in the browser from Python
   copyright:
     - license: BSD-3-Clause
@@ -27,6 +27,8 @@ environment:
       - build-base
       - busybox
       - ca-certificates-bundle
+      - nodejs
+      - npm
       - py3-supported-cython
       - py3-supported-pip
       - py3-supported-python-dev
@@ -34,10 +36,14 @@ environment:
       - wolfi-base
 
 pipeline:
-  - uses: fetch
+  - uses: git-checkout
     with:
-      expected-sha256: 40df8e632de367399d06979cbd76c9e68a133a3138e1adde37c4a4715ecb4d6e
-      uri: https://files.pythonhosted.org/packages/source/b/bokeh/bokeh-${{package.version}}.tar.gz
+      repository: https://github.com/bokeh/bokeh
+      tag: ${{package.version}}
+      expected-commit: 7e37a6395b36d3249a4d45263ddc2a26a7234906
+
+  # bokeh's build process requires full tag history.
+  - runs: git fetch --tags
 
 subpackages:
   - range: py-versions
@@ -120,8 +126,9 @@ subpackages:
 
 update:
   enabled: true
-  release-monitor:
-    identifier: 78655
+  github:
+    identifier: bokeh/bokeh
+    use-tag: true
 
 test:
   pipeline:
diff --git a/py3-botocore.yaml b/py3-botocore.yaml
index d11bfbab65a..93e40f494bf 100644
--- a/py3-botocore.yaml
+++ b/py3-botocore.yaml
@@ -1,7 +1,7 @@
 package:
   name: py3-botocore
   version: "1.42.16"
-  epoch: 0
+  epoch: 1
   description: The low-level, core functionality of Boto3
   copyright:
     - license: Apache-2.0
@@ -26,10 +26,11 @@ environment:
       - py3-supported-build-base
 
 pipeline:
-  - uses: fetch
+  - uses: git-checkout
     with:
-      uri: https://files.pythonhosted.org/packages/source/b/botocore/botocore-${{package.version}}.tar.gz
-      expected-sha256: 29ee8555cd5d5023350405387cedcf3fe1c7f02fcb8060bf9e01602487482c25
+      repository: https://github.com/boto/botocore
+      tag: ${{package.version}}
+      expected-commit: d8a1f97a31ce17bb1f1cee90aae19ff21e29500b
 
 subpackages:
   - range: py-versions
@@ -118,5 +119,6 @@ test:
 
 update:
   enabled: true
-  release-monitor:
-    identifier: 29738
+  github:
+    identifier: boto/botocore
+    use-tag: true