wip: subscript always via __getitem__

## Summary

Return the revealed-type from the monkey-patched `revale_type`
implementation to
preserve the identity behavior.

This PR also isolates different script runs by assigning a different
`globals` dict for each script-run. See
https://github.com/pyodide/pyodide/issues/703

.github/CODEOWNERS

@@ -18,6 +18,7 @@
 /python/py-fuzzer/ @AlexWaygood
 
 # red-knot
-/crates/red_knot* @carljm @MichaReiser @AlexWaygood @sharkdp
-/crates/ruff_db/ @carljm @MichaReiser @AlexWaygood @sharkdp
-/scripts/knot_benchmark/ @carljm @MichaReiser @AlexWaygood @sharkdp
+/crates/red_knot* @carljm @MichaReiser @AlexWaygood @sharkdp @dcreager
+/crates/ruff_db/ @carljm @MichaReiser @AlexWaygood @sharkdp @dcreager
+/scripts/knot_benchmark/ @carljm @MichaReiser @AlexWaygood @sharkdp @dcreager
+/crates/red_knot_python_semantic @carljm @AlexWaygood @sharkdp @dcreager

.github/renovate.json5

@@ -40,6 +40,17 @@
     enabled: true,
   },
   packageRules: [
+    // Pin GitHub Actions to immutable SHAs.
+    {
+      matchDepTypes: ["action"],
+      pinDigests: true,
+    },
+    // Annotate GitHub Actions SHAs with a SemVer version.
+    {
+      extends: ["helpers:pinGitHubActionDigests"],
+      extractVersion: "^(?<version>v?\\d+\\.\\d+\\.\\d+)$",
+      versioning: "regex:^v?(?<major>\\d+)(\\.(?<minor>\\d+)\\.(?<patch>\\d+))?$",
+    },
     {
       // Group upload/download artifact updates, the versions are dependent
       groupName: "Artifact GitHub Actions dependencies",

.github/workflows/build-binaries.yml

@@ -39,17 +39,17 @@ jobs:
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-build') }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           submodules: recursive
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
         with:
           python-version: ${{ env.PYTHON_VERSION }}
       - name: "Prep README.md"
         run: python scripts/transform_readme.py --target pypi
       - name: "Build sdist"
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@22fe573c6ed0c03ab9b84e631cbfa49bddf6e20e # v1
         with:
           command: sdist
           args: --out dist
@@ -59,7 +59,7 @@ jobs:
           "${MODULE_NAME}" --help
           python -m "${MODULE_NAME}" --help
       - name: "Upload sdist"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: wheels-sdist
           path: dist
@@ -68,23 +68,23 @@ jobs:
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-build') }}
     runs-on: macos-14
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           submodules: recursive
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           architecture: x64
       - name: "Prep README.md"
         run: python scripts/transform_readme.py --target pypi
       - name: "Build wheels - x86_64"
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@22fe573c6ed0c03ab9b84e631cbfa49bddf6e20e # v1
         with:
           target: x86_64
           args: --release --locked --out dist
       - name: "Upload wheels"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: wheels-macos-x86_64
           path: dist
@@ -99,7 +99,7 @@ jobs:
           tar czvf $ARCHIVE_FILE $ARCHIVE_NAME
           shasum -a 256 $ARCHIVE_FILE > $ARCHIVE_FILE.sha256
       - name: "Upload binary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: artifacts-macos-x86_64
           path: |
@@ -110,18 +110,18 @@ jobs:
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-build') }}
     runs-on: macos-14
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           submodules: recursive
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           architecture: arm64
       - name: "Prep README.md"
         run: python scripts/transform_readme.py --target pypi
       - name: "Build wheels - aarch64"
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@22fe573c6ed0c03ab9b84e631cbfa49bddf6e20e # v1
         with:
           target: aarch64
           args: --release --locked --out dist
@@ -131,7 +131,7 @@ jobs:
           ruff --help
           python -m ruff --help
       - name: "Upload wheels"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: wheels-aarch64-apple-darwin
           path: dist
@@ -146,7 +146,7 @@ jobs:
           tar czvf $ARCHIVE_FILE $ARCHIVE_NAME
           shasum -a 256 $ARCHIVE_FILE > $ARCHIVE_FILE.sha256
       - name: "Upload binary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: artifacts-aarch64-apple-darwin
           path: |
@@ -166,18 +166,18 @@ jobs:
           - target: aarch64-pc-windows-msvc
             arch: x64
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           submodules: recursive
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           architecture: ${{ matrix.platform.arch }}
       - name: "Prep README.md"
         run: python scripts/transform_readme.py --target pypi
       - name: "Build wheels"
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@22fe573c6ed0c03ab9b84e631cbfa49bddf6e20e # v1
         with:
           target: ${{ matrix.platform.target }}
           args: --release --locked --out dist
@@ -192,7 +192,7 @@ jobs:
           "${MODULE_NAME}" --help
           python -m "${MODULE_NAME}" --help
       - name: "Upload wheels"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: wheels-${{ matrix.platform.target }}
           path: dist
@@ -203,7 +203,7 @@ jobs:
           7z a $ARCHIVE_FILE ./target/${{ matrix.platform.target }}/release/ruff.exe
           sha256sum $ARCHIVE_FILE > $ARCHIVE_FILE.sha256
       - name: "Upload binary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: artifacts-${{ matrix.platform.target }}
           path: |
@@ -219,18 +219,18 @@ jobs:
           - x86_64-unknown-linux-gnu
           - i686-unknown-linux-gnu
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           submodules: recursive
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           architecture: x64
       - name: "Prep README.md"
         run: python scripts/transform_readme.py --target pypi
       - name: "Build wheels"
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@22fe573c6ed0c03ab9b84e631cbfa49bddf6e20e # v1
         with:
           target: ${{ matrix.target }}
           manylinux: auto
@@ -242,7 +242,7 @@ jobs:
           "${MODULE_NAME}" --help
           python -m "${MODULE_NAME}" --help
       - name: "Upload wheels"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: wheels-${{ matrix.target }}
           path: dist
@@ -260,7 +260,7 @@ jobs:
           tar czvf $ARCHIVE_FILE $ARCHIVE_NAME
           shasum -a 256 $ARCHIVE_FILE > $ARCHIVE_FILE.sha256
       - name: "Upload binary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: artifacts-${{ matrix.target }}
           path: |
@@ -294,24 +294,24 @@ jobs:
             arch: arm
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           submodules: recursive
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
         with:
           python-version: ${{ env.PYTHON_VERSION }}
       - name: "Prep README.md"
         run: python scripts/transform_readme.py --target pypi
       - name: "Build wheels"
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@22fe573c6ed0c03ab9b84e631cbfa49bddf6e20e # v1
         with:
           target: ${{ matrix.platform.target }}
           manylinux: auto
           docker-options: ${{ matrix.platform.maturin_docker_options }}
           args: --release --locked --out dist
-      - uses: uraimo/run-on-arch-action@v2
-        if: matrix.platform.arch != 'ppc64'
+      - uses: uraimo/run-on-arch-action@ac33288c3728ca72563c97b8b88dda5a65a84448 # v2
+        if: ${{ matrix.platform.arch != 'ppc64' && matrix.platform.arch != 'ppc64le'}}
         name: Test wheel
         with:
           arch: ${{ matrix.platform.arch == 'arm' && 'armv6' || matrix.platform.arch }}
@@ -325,7 +325,7 @@ jobs:
             pip3 install ${{ env.PACKAGE_NAME }} --no-index --find-links dist/ --force-reinstall
             ruff --help
       - name: "Upload wheels"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: wheels-${{ matrix.platform.target }}
           path: dist
@@ -343,7 +343,7 @@ jobs:
           tar czvf $ARCHIVE_FILE $ARCHIVE_NAME
           shasum -a 256 $ARCHIVE_FILE > $ARCHIVE_FILE.sha256
       - name: "Upload binary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: artifacts-${{ matrix.platform.target }}
           path: |
@@ -359,18 +359,18 @@ jobs:
           - x86_64-unknown-linux-musl
           - i686-unknown-linux-musl
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           submodules: recursive
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           architecture: x64
       - name: "Prep README.md"
         run: python scripts/transform_readme.py --target pypi
       - name: "Build wheels"
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@22fe573c6ed0c03ab9b84e631cbfa49bddf6e20e # v1
         with:
           target: ${{ matrix.target }}
           manylinux: musllinux_1_2
@@ -387,7 +387,7 @@ jobs:
             .venv/bin/pip3 install ${{ env.PACKAGE_NAME }} --no-index --find-links dist/ --force-reinstall
             .venv/bin/${{ env.MODULE_NAME }} --help
       - name: "Upload wheels"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: wheels-${{ matrix.target }}
           path: dist
@@ -405,7 +405,7 @@ jobs:
           tar czvf $ARCHIVE_FILE $ARCHIVE_NAME
           shasum -a 256 $ARCHIVE_FILE > $ARCHIVE_FILE.sha256
       - name: "Upload binary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: artifacts-${{ matrix.target }}
           path: |
@@ -425,23 +425,23 @@ jobs:
             arch: armv7
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           submodules: recursive
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
         with:
           python-version: ${{ env.PYTHON_VERSION }}
       - name: "Prep README.md"
         run: python scripts/transform_readme.py --target pypi
       - name: "Build wheels"
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@22fe573c6ed0c03ab9b84e631cbfa49bddf6e20e # v1
         with:
           target: ${{ matrix.platform.target }}
           manylinux: musllinux_1_2
           args: --release --locked --out dist
           docker-options: ${{ matrix.platform.maturin_docker_options }}
-      - uses: uraimo/run-on-arch-action@v2
+      - uses: uraimo/run-on-arch-action@ac33288c3728ca72563c97b8b88dda5a65a84448 # v2
         name: Test wheel
         with:
           arch: ${{ matrix.platform.arch }}
@@ -454,7 +454,7 @@ jobs:
             .venv/bin/pip3 install ${{ env.PACKAGE_NAME }} --no-index --find-links dist/ --force-reinstall
             .venv/bin/${{ env.MODULE_NAME }} --help
       - name: "Upload wheels"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: wheels-${{ matrix.platform.target }}
           path: dist
@@ -472,7 +472,7 @@ jobs:
           tar czvf $ARCHIVE_FILE $ARCHIVE_NAME
           shasum -a 256 $ARCHIVE_FILE > $ARCHIVE_FILE.sha256
       - name: "Upload binary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: artifacts-${{ matrix.platform.target }}
           path: |

.github/workflows/build-docker.yml

@@ -33,14 +33,14 @@ jobs:
           - linux/amd64
           - linux/arm64
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           submodules: recursive
           persist-credentials: false
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
 
-      - uses: docker/login-action@v3
+      - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -63,7 +63,7 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
         with:
           images: ${{ env.RUFF_BASE_IMG }}
           # Defining this makes sure the org.opencontainers.image.version OCI label becomes the actual release version and not the branch name
@@ -79,7 +79,7 @@ jobs:
       # Adapted from https://docs.docker.com/build/ci/github-actions/multi-platform/
       - name: Build and push by digest
         id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6
         with:
           context: .
           platforms: ${{ matrix.platform }}
@@ -96,7 +96,7 @@ jobs:
           touch "/tmp/digests/${digest#sha256:}"
 
       - name: Upload digests
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: digests-${{ env.PLATFORM_TUPLE }}
           path: /tmp/digests/*
@@ -113,17 +113,17 @@ jobs:
     if: ${{ inputs.plan != '' && !fromJson(inputs.plan).announcement_tag_is_implicit }}
     steps:
       - name: Download digests
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
         with:
           path: /tmp/digests
           pattern: digests-*
           merge-multiple: true
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
         with:
           images: ${{ env.RUFF_BASE_IMG }}
           # Order is on purpose such that the label org.opencontainers.image.version has the first pattern with the full version
@@ -131,7 +131,7 @@ jobs:
             type=pep440,pattern={{ version }},value=${{ fromJson(inputs.plan).announcement_tag }}
             type=pep440,pattern={{ major }}.{{ minor }},value=${{ fromJson(inputs.plan).announcement_tag }}
 
-      - uses: docker/login-action@v3
+      - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -167,9 +167,9 @@ jobs:
           - debian:bookworm-slim,bookworm-slim,debian-slim
           - buildpack-deps:bookworm,bookworm,debian
     steps:
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
 
-      - uses: docker/login-action@v3
+      - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -219,7 +219,7 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
         # ghcr.io prefers index level annotations
         env:
           DOCKER_METADATA_ANNOTATIONS_LEVELS: index
@@ -231,7 +231,7 @@ jobs:
             ${{ env.TAG_PATTERNS }}
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6
         with:
           context: .
           platforms: linux/amd64,linux/arm64
@@ -256,17 +256,17 @@ jobs:
     if: ${{ inputs.plan != '' && !fromJson(inputs.plan).announcement_tag_is_implicit }}
     steps:
       - name: Download digests
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
         with:
           path: /tmp/digests
           pattern: digests-*
           merge-multiple: true
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
         env:
           DOCKER_METADATA_ANNOTATIONS_LEVELS: index
         with:
@@ -276,7 +276,7 @@ jobs:
             type=pep440,pattern={{ version }},value=${{ fromJson(inputs.plan).announcement_tag }}
             type=pep440,pattern={{ major }}.{{ minor }},value=${{ fromJson(inputs.plan).announcement_tag }}
 
-      - uses: docker/login-action@v3
+      - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}

.github/workflows/ci.yaml

@@ -26,83 +26,152 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       # Flag that is raised when any code that affects parser is changed
-      parser: ${{ steps.changed.outputs.parser_any_changed }}
+      parser: ${{ steps.check_parser.outputs.changed }}
       # Flag that is raised when any code that affects linter is changed
-      linter: ${{ steps.changed.outputs.linter_any_changed }}
+      linter: ${{ steps.check_linter.outputs.changed }}
       # Flag that is raised when any code that affects formatter is changed
-      formatter: ${{ steps.changed.outputs.formatter_any_changed }}
+      formatter: ${{ steps.check_formatter.outputs.changed }}
       # Flag that is raised when any code is changed
       # This is superset of the linter and formatter
-      code: ${{ steps.changed.outputs.code_any_changed }}
+      code: ${{ steps.check_code.outputs.changed }}
       # Flag that is raised when any code that affects the fuzzer is changed
-      fuzz: ${{ steps.changed.outputs.fuzz_any_changed }}
+      fuzz: ${{ steps.check_fuzzer.outputs.changed }}
+
+      # Flag that is set to "true" when code related to the playground changes.
+      playground: ${{ steps.check_playground.outputs.changed }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: tj-actions/changed-files@v45
-        id: changed
-        with:
-          files_yaml: |
-            parser:
-              - Cargo.toml
-              - Cargo.lock
-              - crates/ruff_python_trivia/**
-              - crates/ruff_source_file/**
-              - crates/ruff_text_size/**
-              - crates/ruff_python_ast/**
-              - crates/ruff_python_parser/**
-              - python/py-fuzzer/**
-              - .github/workflows/ci.yaml
+      - name: Determine merge base
+        id: merge_base
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.ref || 'main' }}
+        run: |
+          sha=$(git merge-base HEAD "origin/${BASE_REF}")
+          echo "sha=${sha}" >> "$GITHUB_OUTPUT"
 
-            linter:
-              - Cargo.toml
-              - Cargo.lock
-              - crates/**
-              - "!crates/red_knot*/**"
-              - "!crates/ruff_python_formatter/**"
-              - "!crates/ruff_formatter/**"
-              - "!crates/ruff_dev/**"
-              - scripts/*
-              - python/**
-              - .github/workflows/ci.yaml
+      - name: Check if the parser code changed
+        id: check_parser
+        env:
+          MERGE_BASE: ${{ steps.merge_base.outputs.sha }}
+        run: |
+          if git diff --quiet "${MERGE_BASE}...HEAD" -- \
+            ':Cargo.toml' \
+            ':Cargo.lock' \
+            ':crates/ruff_python_trivia/**' \
+            ':crates/ruff_source_file/**' \
+            ':crates/ruff_text_size/**' \
+            ':crates/ruff_python_ast/**' \
+            ':crates/ruff_python_parser/**' \
+            ':python/py-fuzzer/**' \
+            ':.github/workflows/ci.yaml' \
+          ; then
+              echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+              echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
 
-            formatter:
-              - Cargo.toml
-              - Cargo.lock
-              - crates/ruff_python_formatter/**
-              - crates/ruff_formatter/**
-              - crates/ruff_python_trivia/**
-              - crates/ruff_python_ast/**
-              - crates/ruff_source_file/**
-              - crates/ruff_python_index/**
-              - crates/ruff_text_size/**
-              - crates/ruff_python_parser/**
-              - crates/ruff_dev/**
-              - scripts/*
-              - python/**
-              - .github/workflows/ci.yaml
+      - name: Check if the linter code changed
+        id: check_linter
+        env:
+          MERGE_BASE: ${{ steps.merge_base.outputs.sha }}
+        run: |
+          if git diff --quiet "${MERGE_BASE}...HEAD" -- ':Cargo.toml' \
+            ':Cargo.lock' \
+            ':crates/**' \
+            ':!crates/red_knot*/**' \
+            ':!crates/ruff_python_formatter/**' \
+            ':!crates/ruff_formatter/**' \
+            ':!crates/ruff_dev/**' \
+            ':!crates/ruff_db/**' \
+            ':scripts/*' \
+            ':python/**' \
+            ':.github/workflows/ci.yaml' \
+          ; then
+              echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+              echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
 
-            fuzz:
-              - fuzz/Cargo.toml
-              - fuzz/Cargo.lock
-              - fuzz/fuzz_targets/**
+      - name: Check if the formatter code changed
+        id: check_formatter
+        env:
+          MERGE_BASE: ${{ steps.merge_base.outputs.sha }}
+        run: |
+          if git diff --quiet "${MERGE_BASE}...HEAD" -- ':Cargo.toml' \
+            ':Cargo.lock' \
+            ':crates/ruff_python_formatter/**' \
+            ':crates/ruff_formatter/**' \
+            ':crates/ruff_python_trivia/**' \
+            ':crates/ruff_python_ast/**' \
+            ':crates/ruff_source_file/**' \
+            ':crates/ruff_python_index/**' \
+            ':crates/ruff_python_index/**' \
+            ':crates/ruff_text_size/**' \
+            ':crates/ruff_python_parser/**' \
+            ':scripts/*' \
+            ':python/**' \
+            ':.github/workflows/ci.yaml' \
+          ; then
+              echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+              echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
 
-            code:
-              - "**/*"
-              - "!**/*.md"
-              - "crates/red_knot_python_semantic/resources/mdtest/**/*.md"
-              - "!docs/**"
-              - "!assets/**"
+      - name: Check if the fuzzer code changed
+        id: check_fuzzer
+        env:
+          MERGE_BASE: ${{ steps.merge_base.outputs.sha }}
+        run: |
+          if git diff --quiet "${MERGE_BASE}...HEAD" -- ':Cargo.toml' \
+            ':Cargo.lock' \
+            ':fuzz/fuzz_targets/**' \
+            ':.github/workflows/ci.yaml' \
+          ; then
+              echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+              echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Check if there was any code related change
+        id: check_code
+        env:
+          MERGE_BASE: ${{ steps.merge_base.outputs.sha }}
+        run: |
+          if git diff --quiet "${MERGE_BASE}...HEAD" -- ':**/*' \
+            ':!**/*.md' \
+            ':crates/red_knot_python_semantic/resources/mdtest/**/*.md' \
+            ':!docs/**' \
+            ':!assets/**' \
+            ':.github/workflows/ci.yaml' \
+          ; then
+              echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+              echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Check if there was any playground related change
+        id: check_playground
+        env:
+          MERGE_BASE: ${{ steps.merge_base.outputs.sha }}
+        run: |
+          if git diff --quiet "${MERGE_BASE}...HEAD" -- \
+            ':playground/**' \
+          ; then
+              echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+              echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
 
   cargo-fmt:
     name: "cargo fmt"
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
       - name: "Install Rust toolchain"
@@ -116,10 +185,10 @@ jobs:
     if: ${{ needs.determine_changes.outputs.code == 'true' || github.ref == 'refs/heads/main' }}
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2
       - name: "Install Rust toolchain"
         run: |
           rustup component add clippy
@@ -136,20 +205,20 @@ jobs:
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-test') && (needs.determine_changes.outputs.code == 'true' || github.ref == 'refs/heads/main') }}
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2
       - name: "Install Rust toolchain"
         run: rustup show
       - name: "Install mold"
         uses: rui314/setup-mold@v1
       - name: "Install cargo nextest"
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@914ac1e29db2d22aef69891f032778d9adc3990d # v2
         with:
           tool: cargo-nextest
       - name: "Install cargo insta"
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@914ac1e29db2d22aef69891f032778d9adc3990d # v2
         with:
           tool: cargo-insta
       - name: "Run tests"
@@ -170,7 +239,7 @@ jobs:
         env:
           # Setting RUSTDOCFLAGS because `cargo doc --check` isn't yet implemented (https://github.com/rust-lang/cargo/issues/10025).
           RUSTDOCFLAGS: "-D warnings"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: ruff
           path: target/debug/ruff
@@ -182,20 +251,20 @@ jobs:
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-test') && (needs.determine_changes.outputs.code == 'true' || github.ref == 'refs/heads/main') }}
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2
       - name: "Install Rust toolchain"
         run: rustup show
       - name: "Install mold"
         uses: rui314/setup-mold@v1
       - name: "Install cargo nextest"
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@914ac1e29db2d22aef69891f032778d9adc3990d # v2
         with:
           tool: cargo-nextest
       - name: "Install cargo insta"
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@914ac1e29db2d22aef69891f032778d9adc3990d # v2
         with:
           tool: cargo-insta
       - name: "Run tests"
@@ -211,14 +280,14 @@ jobs:
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-test') && (needs.determine_changes.outputs.code == 'true' || github.ref == 'refs/heads/main') }}
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2
       - name: "Install Rust toolchain"
         run: rustup show
       - name: "Install cargo nextest"
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@914ac1e29db2d22aef69891f032778d9adc3990d # v2
         with:
           tool: cargo-nextest
       - name: "Run tests"
@@ -238,18 +307,18 @@ jobs:
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-test') && (needs.determine_changes.outputs.code == 'true' || github.ref == 'refs/heads/main') }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2
       - name: "Install Rust toolchain"
         run: rustup target add wasm32-unknown-unknown
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
         with:
           node-version: 20
           cache: "npm"
           cache-dependency-path: playground/package-lock.json
-      - uses: jetli/wasm-pack-action@v0.4.0
+      - uses: jetli/wasm-pack-action@0d096b08b4e5a7de8c28de67e11e945404e9eefa # v0.4.0
         with:
           version: v0.13.1
       - name: "Test ruff_wasm"
@@ -267,10 +336,10 @@ jobs:
     if: ${{ github.ref == 'refs/heads/main' }}
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2
       - name: "Install Rust toolchain"
         run: rustup show
       - name: "Install mold"
@@ -285,15 +354,15 @@ jobs:
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-test') && (needs.determine_changes.outputs.code == 'true' || github.ref == 'refs/heads/main') }}
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
-      - uses: SebRollen/toml-action@v1.2.0
+      - uses: SebRollen/toml-action@b1b3628f55fc3a28208d4203ada8b737e9687876 # v1.2.0
         id: msrv
         with:
           file: "Cargo.toml"
           field: "workspace.package.rust-version"
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2
       - name: "Install Rust toolchain"
         env:
           MSRV: ${{ steps.msrv.outputs.value }}
@@ -301,11 +370,11 @@ jobs:
       - name: "Install mold"
         uses: rui314/setup-mold@v1
       - name: "Install cargo nextest"
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@914ac1e29db2d22aef69891f032778d9adc3990d # v2
         with:
           tool: cargo-nextest
       - name: "Install cargo insta"
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@914ac1e29db2d22aef69891f032778d9adc3990d # v2
         with:
           tool: cargo-insta
       - name: "Run tests"
@@ -322,10 +391,10 @@ jobs:
     if: ${{ github.ref == 'refs/heads/main' || needs.determine_changes.outputs.fuzz == 'true' || needs.determine_changes.outputs.code == 'true' }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2
         with:
           workspaces: "fuzz -> target"
       - name: "Install Rust toolchain"
@@ -350,11 +419,11 @@ jobs:
     env:
       FORCE_COLOR: 1
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@v5
-      - uses: actions/download-artifact@v4
+      - uses: astral-sh/setup-uv@22695119d769bdb6f7032ad67b9bca0ef8c4a174 # v5
+      - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
         name: Download Ruff binary to test
         id: download-cached-binary
         with:
@@ -384,10 +453,10 @@ jobs:
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-test') && (needs.determine_changes.outputs.code == 'true' || github.ref == 'refs/heads/main') }}
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2
       - name: "Install Rust toolchain"
         run: rustup component add rustfmt
       # Run all code generation scripts, and verify that the current output is
@@ -416,21 +485,21 @@ jobs:
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-test') && github.event_name == 'pull_request' && needs.determine_changes.outputs.code == 'true' }}
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
         name: Download comparison Ruff binary
         id: ruff-target
         with:
           name: ruff
           path: target/debug
 
-      - uses: dawidd6/action-download-artifact@v8
+      - uses: dawidd6/action-download-artifact@20319c5641d495c8a52e688b7dc5fada6c3a9fbc # v8
         name: Download baseline Ruff binary
         with:
           name: ruff
@@ -518,13 +587,13 @@ jobs:
         run: |
           echo ${{ github.event.number }} > pr-number
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         name: Upload PR Number
         with:
           name: pr-number
           path: pr-number
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         name: Upload Results
         with:
           name: ecosystem-result
@@ -536,7 +605,7 @@ jobs:
     needs: determine_changes
     if: ${{ needs.determine_changes.outputs.code == 'true' || github.ref == 'refs/heads/main' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
       - uses: cargo-bins/cargo-binstall@main
@@ -549,18 +618,18 @@ jobs:
     timeout-minutes: 20
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-test') }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           architecture: x64
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2
       - name: "Prep README.md"
         run: python scripts/transform_readme.py --target pypi
       - name: "Build wheels"
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@22fe573c6ed0c03ab9b84e631cbfa49bddf6e20e # v1
         with:
           args: --out dist
       - name: "Test wheel"
@@ -576,19 +645,19 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
         with:
           python-version: ${{ env.PYTHON_VERSION }}
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2
       - name: "Install Rust toolchain"
         run: rustup show
       - name: "Install pre-commit"
         run: pip install pre-commit
       - name: "Cache pre-commit"
-        uses: actions/cache@v4
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
         with:
           path: ~/.cache/pre-commit
           key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
@@ -610,22 +679,22 @@ jobs:
     env:
       MKDOCS_INSIDERS_SSH_KEY_EXISTS: ${{ secrets.MKDOCS_INSIDERS_SSH_KEY != '' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
         with:
           python-version: "3.13"
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2
       - name: "Add SSH key"
         if: ${{ env.MKDOCS_INSIDERS_SSH_KEY_EXISTS == 'true' }}
-        uses: webfactory/ssh-agent@v0.9.0
+        uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
         with:
           ssh-private-key: ${{ secrets.MKDOCS_INSIDERS_SSH_KEY }}
       - name: "Install Rust toolchain"
         run: rustup show
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@22695119d769bdb6f7032ad67b9bca0ef8c4a174 # v5
       - name: "Install Insiders dependencies"
         if: ${{ env.MKDOCS_INSIDERS_SSH_KEY_EXISTS == 'true' }}
         run: uv pip install -r docs/requirements-insiders.txt --system
@@ -652,10 +721,10 @@ jobs:
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-test') && (needs.determine_changes.outputs.formatter == 'true' || github.ref == 'refs/heads/main') }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2
       - name: "Install Rust toolchain"
         run: rustup show
       - name: "Run checks"
@@ -674,21 +743,21 @@ jobs:
       - determine_changes
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-test') && (needs.determine_changes.outputs.code == 'true' || github.ref == 'refs/heads/main') }}
     steps:
-      - uses: extractions/setup-just@v2
+      - uses: extractions/setup-just@dd310ad5a97d8e7b41793f8ef055398d51ad4de6 # v2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         name: "Download ruff-lsp source"
         with:
           persist-credentials: false
           repository: "astral-sh/ruff-lsp"
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
         name: Download development ruff binary
         id: ruff-target
         with:
@@ -711,6 +780,39 @@ jobs:
 
           just test
 
+  check-playground:
+    name: "check playground"
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    needs:
+      - determine_changes
+    if: ${{ (needs.determine_changes.outputs.playground == 'true') }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
+      - name: "Install Rust toolchain"
+        run: rustup target add wasm32-unknown-unknown
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2
+      - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
+        with:
+          node-version: 22
+          cache: "npm"
+          cache-dependency-path: playground/package-lock.json
+      - uses: jetli/wasm-bindgen-action@20b33e20595891ab1a0ed73145d8a21fc96e7c29 # v0.2.0
+      - name: "Install Node dependencies"
+        run: npm ci
+        working-directory: playground
+      - name: "Build playgrounds"
+        run: npm run dev:wasm
+        working-directory: playground
+      - name: "Run TypeScript checks"
+        run: npm run check
+        working-directory: playground
+      - name: "Check formatting"
+        run: npm run fmt:check
+        working-directory: playground
+
   benchmarks:
     runs-on: ubuntu-24.04
     needs: determine_changes
@@ -718,17 +820,17 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: "Checkout Branch"
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2
 
       - name: "Install Rust toolchain"
         run: rustup show
 
       - name: "Install codspeed"
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@914ac1e29db2d22aef69891f032778d9adc3990d # v2
         with:
           tool: cargo-codspeed
 
@@ -736,7 +838,7 @@ jobs:
         run: cargo codspeed build --features codspeed -p ruff_benchmark
 
       - name: "Run benchmarks"
-        uses: CodSpeedHQ/action@v3
+        uses: CodSpeedHQ/action@0010eb0ca6e89b80c88e8edaaa07cfe5f3e6664d # v3
         with:
           run: cargo codspeed run
           token: ${{ secrets.CODSPEED_TOKEN }}

.github/workflows/daily_fuzz.yaml

@@ -31,15 +31,15 @@ jobs:
     # Don't run the cron job on forks:
     if: ${{ github.repository == 'astral-sh/ruff' || github.event_name != 'schedule' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@v5
+      - uses: astral-sh/setup-uv@22695119d769bdb6f7032ad67b9bca0ef8c4a174 # v5
       - name: "Install Rust toolchain"
         run: rustup show
       - name: "Install mold"
         uses: rui314/setup-mold@v1
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2
       - name: Build ruff
         # A debug build means the script runs slower once it gets started,
         # but this is outweighed by the fact that a release build takes *much* longer to compile in CI
@@ -65,7 +65,7 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/daily_property_tests.yaml

@@ -30,14 +30,14 @@ jobs:
     # Don't run the cron job on forks:
     if: ${{ github.repository == 'astral-sh/ruff' || github.event_name != 'schedule' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
       - name: "Install Rust toolchain"
         run: rustup show
       - name: "Install mold"
         uses: rui314/setup-mold@v1
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2
       - name: Build Red Knot
         # A release build takes longer (2 min vs 1 min), but the property tests run much faster in release
         # mode (1.5 min vs 14 min), so the overall time is shorter with a release build.
@@ -59,7 +59,7 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/mypy_primer.yaml

@@ -28,16 +28,16 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           path: ruff
           fetch-depth: 0
           persist-credentials: false
 
       - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@22695119d769bdb6f7032ad67b9bca0ef8c4a174 # v5
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2
         with:
           workspaces: "ruff"
       - name: Install Rust toolchain
@@ -68,7 +68,7 @@ jobs:
             --type-checker knot \
             --old base_commit \
             --new "$GITHUB_SHA" \
-            --project-selector '/(mypy_primer|black|pyp|git-revise|zipp|arrow)$' \
+            --project-selector '/(mypy_primer|black|pyp|git-revise|zipp|arrow|isort|itsdangerous|rich|packaging|pybind11|pyinstrument)$' \
             --output concise \
             --debug > mypy_primer.diff || [ $? -eq 1 ]
 
@@ -81,13 +81,13 @@ jobs:
           echo ${{ github.event.number }} > pr-number
 
       - name: Upload diff
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: mypy_primer_diff
           path: mypy_primer.diff
 
       - name: Upload pr-number
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: pr-number
           path: pr-number

.github/workflows/mypy_primer_comment.yaml

@@ -16,7 +16,7 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: dawidd6/action-download-artifact@v8
+      - uses: dawidd6/action-download-artifact@20319c5641d495c8a52e688b7dc5fada6c3a9fbc # v8
         name: Download PR number
         with:
           name: pr-number
@@ -32,7 +32,7 @@ jobs:
             echo "pr-number=$(<pr-number)" >> "$GITHUB_OUTPUT"
           fi
 
-      - uses: dawidd6/action-download-artifact@v8
+      - uses: dawidd6/action-download-artifact@20319c5641d495c8a52e688b7dc5fada6c3a9fbc # v8
         name: "Download mypy_primer results"
         id: download-mypy_primer_diff
         if: steps.pr-number.outputs.pr-number
@@ -79,7 +79,7 @@ jobs:
           echo 'EOF' >> "$GITHUB_OUTPUT"
 
       - name: Find existing comment
-        uses: peter-evans/find-comment@v3
+        uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3
         if: steps.generate-comment.outcome == 'success'
         id: find-comment
         with:
@@ -89,7 +89,7 @@ jobs:
 
       - name: Create or update comment
         if: steps.find-comment.outcome == 'success'
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4
         with:
           comment-id: ${{ steps.find-comment.outputs.comment-id }}
           issue-number: ${{ steps.pr-number.outputs.pr-number }}

.github/workflows/notify-dependents.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Update pre-commit mirror"
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
         with:
           github-token: ${{ secrets.RUFF_PRE_COMMIT_PAT }}
           script: |

.github/workflows/pr-comment.yaml

@@ -16,7 +16,7 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: dawidd6/action-download-artifact@v8
+      - uses: dawidd6/action-download-artifact@20319c5641d495c8a52e688b7dc5fada6c3a9fbc # v8
         name: Download pull request number
         with:
           name: pr-number
@@ -32,7 +32,7 @@ jobs:
             echo "pr-number=$(<pr-number)" >> "$GITHUB_OUTPUT"
           fi
 
-      - uses: dawidd6/action-download-artifact@v8
+      - uses: dawidd6/action-download-artifact@20319c5641d495c8a52e688b7dc5fada6c3a9fbc # v8
         name: "Download ecosystem results"
         id: download-ecosystem-result
         if: steps.pr-number.outputs.pr-number
@@ -70,7 +70,7 @@ jobs:
           echo 'EOF' >> "$GITHUB_OUTPUT"
 
       - name: Find existing comment
-        uses: peter-evans/find-comment@v3
+        uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3
         if: steps.generate-comment.outcome == 'success'
         id: find-comment
         with:
@@ -80,7 +80,7 @@ jobs:
 
       - name: Create or update comment
         if: steps.find-comment.outcome == 'success'
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4
         with:
           comment-id: ${{ steps.find-comment.outputs.comment-id }}
           issue-number: ${{ steps.pr-number.outputs.pr-number }}

.github/workflows/publish-docs.yml

@@ -23,12 +23,12 @@ jobs:
     env:
       MKDOCS_INSIDERS_SSH_KEY_EXISTS: ${{ secrets.MKDOCS_INSIDERS_SSH_KEY != '' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: ${{ inputs.ref }}
           persist-credentials: true
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
         with:
           python-version: 3.12
 
@@ -61,14 +61,14 @@ jobs:
 
       - name: "Add SSH key"
         if: ${{ env.MKDOCS_INSIDERS_SSH_KEY_EXISTS == 'true' }}
-        uses: webfactory/ssh-agent@v0.9.0
+        uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
         with:
           ssh-private-key: ${{ secrets.MKDOCS_INSIDERS_SSH_KEY }}
 
       - name: "Install Rust toolchain"
         run: rustup show
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2
 
       - name: "Install Insiders dependencies"
         if: ${{ env.MKDOCS_INSIDERS_SSH_KEY_EXISTS == 'true' }}

.github/workflows/publish-knot-playground.yml

@@ -0,0 +1,58 @@
+# Publish the Red Knot playground.
+name: "[Knot Playground] Release"
+
+permissions: {}
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "crates/red_knot*/**"
+      - "crates/ruff_db/**"
+      - "crates/ruff_python_ast/**"
+      - "crates/ruff_python_parser/**"
+      - "playground/**"
+      - ".github/workflows/publish-knot-playground.yml"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name }}
+  cancel-in-progress: true
+
+env:
+  CARGO_INCREMENTAL: 0
+  CARGO_NET_RETRY: 10
+  CARGO_TERM_COLOR: always
+  RUSTUP_MAX_RETRIES: 10
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    env:
+      CF_API_TOKEN_EXISTS: ${{ secrets.CF_API_TOKEN != '' }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
+      - name: "Install Rust toolchain"
+        run: rustup target add wasm32-unknown-unknown
+      - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
+        with:
+          node-version: 22
+      - uses: jetli/wasm-bindgen-action@20b33e20595891ab1a0ed73145d8a21fc96e7c29 # v0.2.0
+      - name: "Install Node dependencies"
+        run: npm ci
+        working-directory: playground
+      - name: "Run TypeScript checks"
+        run: npm run check
+        working-directory: playground
+      - name: "Build Knot playground"
+        run: npm run build --workspace knot-playground
+        working-directory: playground
+      - name: "Deploy to Cloudflare Pages"
+        if: ${{ env.CF_API_TOKEN_EXISTS == 'true' }}
+        uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3.14.1
+        with:
+          apiToken: ${{ secrets.CF_API_TOKEN }}
+          accountId: ${{ secrets.CF_ACCOUNT_ID }}
+          # `github.head_ref` is only set during pull requests and for manual runs or tags we use `main` to deploy to production
+          command: pages deploy playground/knot/dist --project-name=knot-playground --branch ${{ github.head_ref || 'main' }} --commit-hash ${GITHUB_SHA}

.github/workflows/publish-playground.yml

@@ -24,36 +24,31 @@ jobs:
     env:
       CF_API_TOKEN_EXISTS: ${{ secrets.CF_API_TOKEN != '' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
       - name: "Install Rust toolchain"
         run: rustup target add wasm32-unknown-unknown
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
         with:
-          node-version: 20
+          node-version: 22
           cache: "npm"
           cache-dependency-path: playground/package-lock.json
-      - uses: jetli/wasm-pack-action@v0.4.0
-        with:
-          version: v0.13.1
-      - uses: jetli/wasm-bindgen-action@v0.2.0
-      - name: "Run wasm-pack"
-        run: wasm-pack build --target web --out-dir ../../playground/src/pkg crates/ruff_wasm
+      - uses: jetli/wasm-bindgen-action@20b33e20595891ab1a0ed73145d8a21fc96e7c29 # v0.2.0
       - name: "Install Node dependencies"
         run: npm ci
         working-directory: playground
       - name: "Run TypeScript checks"
         run: npm run check
         working-directory: playground
-      - name: "Build JavaScript bundle"
-        run: npm run build
+      - name: "Build Ruff playground"
+        run: npm run build --workspace ruff-playground
         working-directory: playground
       - name: "Deploy to Cloudflare Pages"
         if: ${{ env.CF_API_TOKEN_EXISTS == 'true' }}
-        uses: cloudflare/wrangler-action@v3.14.0
+        uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3.14.1
         with:
           apiToken: ${{ secrets.CF_API_TOKEN }}
           accountId: ${{ secrets.CF_ACCOUNT_ID }}
           # `github.head_ref` is only set during pull requests and for manual runs or tags we use `main` to deploy to production
-          command: pages deploy playground/dist --project-name=ruff-playground --branch ${{ github.head_ref || 'main' }} --commit-hash ${GITHUB_SHA}
+          command: pages deploy playground/ruff/dist --project-name=ruff-playground --branch ${{ github.head_ref || 'main' }} --commit-hash ${GITHUB_SHA}

.github/workflows/publish-pypi.yml

@@ -22,8 +22,8 @@ jobs:
       id-token: write
     steps:
       - name: "Install uv"
-        uses: astral-sh/setup-uv@v5
-      - uses: actions/download-artifact@v4
+        uses: astral-sh/setup-uv@22695119d769bdb6f7032ad67b9bca0ef8c4a174 # v5
+      - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
         with:
           pattern: wheels-*
           path: wheels

.github/workflows/publish-wasm.yml

@@ -29,15 +29,15 @@ jobs:
         target: [web, bundler, nodejs]
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
       - name: "Install Rust toolchain"
         run: rustup target add wasm32-unknown-unknown
-      - uses: jetli/wasm-pack-action@v0.4.0
+      - uses: jetli/wasm-pack-action@0d096b08b4e5a7de8c28de67e11e945404e9eefa # v0.4.0
         with:
           version: v0.13.1
-      - uses: jetli/wasm-bindgen-action@v0.2.0
+      - uses: jetli/wasm-bindgen-action@20b33e20595891ab1a0ed73145d8a21fc96e7c29 # v0.2.0
       - name: "Run wasm-pack build"
         run: wasm-pack build --target ${{ matrix.target }} crates/ruff_wasm
       - name: "Rename generated package"
@@ -45,7 +45,7 @@ jobs:
           jq '.name="@astral-sh/ruff-wasm-${{ matrix.target }}"' crates/ruff_wasm/pkg/package.json > /tmp/package.json
           mv /tmp/package.json crates/ruff_wasm/pkg
       - run: cp LICENSE crates/ruff_wasm/pkg # wasm-pack does not put the LICENSE file in the pkg
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
         with:
           node-version: 20
           registry-url: "https://registry.npmjs.org"

.github/workflows/release.yml

@@ -50,7 +50,7 @@ on:
 jobs:
   # Run 'dist plan' (or host) to determine what tasks we need to do
   plan:
-    runs-on: "ubuntu-20.04"
+    runs-on: "depot-ubuntu-latest-4"
     outputs:
       val: ${{ steps.plan.outputs.manifest }}
       tag: ${{ (inputs.tag != 'dry-run' && inputs.tag) || '' }}
@@ -59,7 +59,7 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           submodules: recursive
       - name: Install dist
@@ -68,7 +68,7 @@ jobs:
         shell: bash
         run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.25.2-prerelease.3/cargo-dist-installer.sh | sh"
       - name: Cache dist
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: cargo-dist-cache
           path: ~/.cargo/bin/dist
@@ -84,7 +84,7 @@ jobs:
           cat plan-dist-manifest.json
           echo "manifest=$(jq -c "." plan-dist-manifest.json)" >> "$GITHUB_OUTPUT"
       - name: "Upload dist-manifest.json"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: artifacts-plan-dist-manifest
           path: plan-dist-manifest.json
@@ -116,23 +116,23 @@ jobs:
       - plan
       - custom-build-binaries
       - custom-build-docker
-    runs-on: "ubuntu-20.04"
+    runs-on: "depot-ubuntu-latest-4"
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           submodules: recursive
       - name: Install cached dist
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
         with:
           name: cargo-dist-cache
           path: ~/.cargo/bin/
       - run: chmod +x ~/.cargo/bin/dist
       # Get all the local artifacts for the global tasks to use (for e.g. checksums)
       - name: Fetch local artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
         with:
           pattern: artifacts-*
           path: target/distrib/
@@ -150,7 +150,7 @@ jobs:
 
           cp dist-manifest.json "$BUILD_MANIFEST_NAME"
       - name: "Upload artifacts"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: artifacts-build-global
           path: |
@@ -167,22 +167,22 @@ jobs:
     if: ${{ always() && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.custom-build-binaries.result == 'skipped' || needs.custom-build-binaries.result == 'success') && (needs.custom-build-docker.result == 'skipped' || needs.custom-build-docker.result == 'success') }}
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    runs-on: "ubuntu-20.04"
+    runs-on: "depot-ubuntu-latest-4"
     outputs:
       val: ${{ steps.host.outputs.manifest }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           submodules: recursive
       - name: Install cached dist
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
         with:
           name: cargo-dist-cache
           path: ~/.cargo/bin/
       - run: chmod +x ~/.cargo/bin/dist
       # Fetch artifacts from scratch-storage
       - name: Fetch artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
         with:
           pattern: artifacts-*
           path: target/distrib/
@@ -196,7 +196,7 @@ jobs:
           cat dist-manifest.json
           echo "manifest=$(jq -c "." dist-manifest.json)" >> "$GITHUB_OUTPUT"
       - name: "Upload dist-manifest.json"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           # Overwrite the previous copy
           name: artifacts-dist-manifest
@@ -242,16 +242,16 @@ jobs:
     # still allowing individual publish jobs to skip themselves (for prereleases).
     # "host" however must run to completion, no skipping allowed!
     if: ${{ always() && needs.host.result == 'success' && (needs.custom-publish-pypi.result == 'skipped' || needs.custom-publish-pypi.result == 'success') && (needs.custom-publish-wasm.result == 'skipped' || needs.custom-publish-wasm.result == 'success') }}
-    runs-on: "ubuntu-20.04"
+    runs-on: "depot-ubuntu-latest-4"
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           submodules: recursive
       # Create a GitHub Release while uploading all files to it
       - name: "Download GitHub Artifacts"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
         with:
           pattern: artifacts-*
           path: artifacts

.github/workflows/sync_typeshed.yaml

@@ -21,12 +21,12 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         name: Checkout Ruff
         with:
           path: ruff
           persist-credentials: true
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         name: Checkout typeshed
         with:
           repository: python/typeshed
@@ -70,7 +70,7 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.ignore

@@ -0,0 +1 @@
+!/.github/

.pre-commit-config.yaml

@@ -19,7 +19,7 @@ exclude: |
 
 repos:
   - repo: https://github.com/abravalheri/validate-pyproject
-    rev: v0.23
+    rev: v0.24
     hooks:
       - id: validate-pyproject
 
@@ -60,7 +60,7 @@ repos:
           - black==25.1.0
 
   - repo: https://github.com/crate-ci/typos
-    rev: v1.30.0
+    rev: v1.30.2
     hooks:
       - id: typos
 
@@ -74,7 +74,7 @@ repos:
         pass_filenames: false # This makes it a lot faster
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.9.9
+    rev: v0.11.0
     hooks:
       - id: ruff-format
       - id: ruff
@@ -84,7 +84,7 @@ repos:
 
   # Prettier
   - repo: https://github.com/rbubley/mirrors-prettier
-    rev: v3.5.2
+    rev: v3.5.3
     hooks:
       - id: prettier
         types: [yaml]
@@ -92,12 +92,12 @@ repos:
   # zizmor detects security vulnerabilities in GitHub Actions workflows.
   # Additional configuration for the tool is found in `.github/zizmor.yml`
   - repo: https://github.com/woodruffw/zizmor-pre-commit
-    rev: v1.4.1
+    rev: v1.5.1
     hooks:
       - id: zizmor
 
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.31.2
+    rev: 0.31.3
     hooks:
       - id: check-github-workflows
 

BREAKING_CHANGES.md

@@ -1,6 +1,8 @@
 # Breaking Changes
 
-## 0.10.0
+## 0.11.0
+
+This is a follow-up to release 0.10.0. Because of a mistake in the release process, the `requires-python` inference changes were not included in that release. Ruff 0.11.0 now includes this change as well as the stabilization of the preview behavior for `PGH004`.
 
 - **Changes to how the Python version is inferred when a `target-version` is not specified** ([#16319](https://github.com/astral-sh/ruff/pull/16319))
 
@@ -23,6 +25,13 @@
         search for the closest `pyproject.toml` in the parent directories and use its
         `requires-python` setting.
 
+## 0.10.0
+
+- **Changes to how the Python version is inferred when a `target-version` is not specified** ([#16319](https://github.com/astral-sh/ruff/pull/16319))
+
+    Because of a mistake in the release process, the `requires-python` inference changes are not included in this release and instead shipped as part of 0.11.0.
+    You can find a description of this change in the 0.11.0 section.
+
 - **Updated `TYPE_CHECKING` behavior** ([#16669](https://github.com/astral-sh/ruff/pull/16669))
 
     Previously, Ruff only recognized typechecking blocks that tested the `typing.TYPE_CHECKING` symbol. Now, Ruff recognizes any local variable named `TYPE_CHECKING`. This release also removes support for the legacy `if 0:` and `if False:` typechecking checks. Use a local `TYPE_CHECKING` variable instead.

CHANGELOG.md

@@ -1,13 +1,50 @@
 # Changelog
 
-## 0.10.0
+## 0.11.2
 
-Check out the [blog post](https://astral.sh/blog/ruff-v0.10.0) for a migration guide and overview of the changes!
+### Preview features
+
+- [syntax-errors] Fix false-positive syntax errors emitted for annotations on variadic parameters before Python 3.11 ([#16878](https://github.com/astral-sh/ruff/pull/16878))
+
+## 0.11.1
+
+### Preview features
+
+- \[`airflow`\] Add `chain`, `chain_linear` and `cross_downstream` for `AIR302` ([#16647](https://github.com/astral-sh/ruff/pull/16647))
+- [syntax-errors] Improve error message and range for pre-PEP-614 decorator syntax errors ([#16581](https://github.com/astral-sh/ruff/pull/16581))
+- [syntax-errors] PEP 701 f-strings before Python 3.12 ([#16543](https://github.com/astral-sh/ruff/pull/16543))
+- [syntax-errors] Parenthesized context managers before Python 3.9 ([#16523](https://github.com/astral-sh/ruff/pull/16523))
+- [syntax-errors] Star annotations before Python 3.11 ([#16545](https://github.com/astral-sh/ruff/pull/16545))
+- [syntax-errors] Star expression in index before Python 3.11 ([#16544](https://github.com/astral-sh/ruff/pull/16544))
+- [syntax-errors] Unparenthesized assignment expressions in sets and indexes ([#16404](https://github.com/astral-sh/ruff/pull/16404))
+
+### Bug fixes
+
+- Server: Allow `FixAll` action in presence of version-specific syntax errors ([#16848](https://github.com/astral-sh/ruff/pull/16848))
+- \[`flake8-bandit`\] Allow raw strings in `suspicious-mark-safe-usage` (`S308`) #16702 ([#16770](https://github.com/astral-sh/ruff/pull/16770))
+- \[`refurb`\] Avoid panicking `unwrap` in `verbose-decimal-constructor` (`FURB157`) ([#16777](https://github.com/astral-sh/ruff/pull/16777))
+- \[`refurb`\] Fix starred expressions fix (`FURB161`) ([#16550](https://github.com/astral-sh/ruff/pull/16550))
+- Fix `--statistics` reporting for unsafe fixes ([#16756](https://github.com/astral-sh/ruff/pull/16756))
+
+### Rule changes
+
+- \[`flake8-executables`\] Allow `uv run` in shebang line for `shebang-missing-python` (`EXE003`) ([#16849](https://github.com/astral-sh/ruff/pull/16849),[#16855](https://github.com/astral-sh/ruff/pull/16855))
+
+### CLI
+
+- Add `--exit-non-zero-on-format` ([#16009](https://github.com/astral-sh/ruff/pull/16009))
+
+### Documentation
+
+- Update Ruff tutorial to avoid non-existent fix in `__init__.py` ([#16818](https://github.com/astral-sh/ruff/pull/16818))
+- \[`flake8-gettext`\] Swap `format-` and `printf-in-get-text-func-call` examples (`INT002`, `INT003`) ([#16769](https://github.com/astral-sh/ruff/pull/16769))
+
+## 0.11.0
+
+This is a follow-up to release 0.10.0. Because of a mistake in the release process, the `requires-python` inference changes were not included in that release. Ruff 0.11.0 now includes this change as well as the stabilization of the preview behavior for `PGH004`.
 
 ### Breaking changes
 
-See also, the "Remapped rules" section which may result in disabled rules.
-
 - **Changes to how the Python version is inferred when a `target-version` is not specified** ([#16319](https://github.com/astral-sh/ruff/pull/16319))
 
     In previous versions of Ruff, you could specify your Python version with:
@@ -29,13 +66,36 @@ See also, the "Remapped rules" section which may result in disabled rules.
         search for the closest `pyproject.toml` in the parent directories and use its
         `requires-python` setting.
 
+### Stabilization
+
+The following behaviors have been stabilized:
+
+- [`blanket-noqa`](https://docs.astral.sh/ruff/rules/blanket-noqa/) (`PGH004`): Also detect blanked file-level noqa comments (and not just line level comments).
+
+### Preview features
+
+- [syntax-errors] Tuple unpacking in `for` statement iterator clause before Python 3.9 ([#16558](https://github.com/astral-sh/ruff/pull/16558))
+
+## 0.10.0
+
+Check out the [blog post](https://astral.sh/blog/ruff-v0.10.0) for a migration guide and overview of the changes!
+
+### Breaking changes
+
+See also, the "Remapped rules" section which may result in disabled rules.
+
+- **Changes to how the Python version is inferred when a `target-version` is not specified** ([#16319](https://github.com/astral-sh/ruff/pull/16319))
+
+    Because of a mistake in the release process, the `requires-python` inference changes are not included in this release and instead shipped as part of 0.11.0.
+    You can find a description of this change in the 0.11.0 section.
+
 - **Updated `TYPE_CHECKING` behavior** ([#16669](https://github.com/astral-sh/ruff/pull/16669))
 
     Previously, Ruff only recognized typechecking blocks that tested the `typing.TYPE_CHECKING` symbol. Now, Ruff recognizes any local variable named `TYPE_CHECKING`. This release also removes support for the legacy `if 0:` and `if False:` typechecking checks. Use a local `TYPE_CHECKING` variable instead.
 
 - **More robust noqa parsing** ([#16483](https://github.com/astral-sh/ruff/pull/16483))
 
-    The syntax for both file-level and in-line suppression comments has been unified and made more robust to certain errors. In most cases, this will result in more suppression comments being read by Ruff, but there are a few instances where previously read comments will now log an error to the user instead. Please refer to the documentation on [_Error suppression_](https://docs.astral.sh/ruff/linter/#error-suppression) for the full specification.
+    The syntax for both file-level and in-line suppression comments has been unified and made more robust to certain errors. In most cases, this will result in more suppression comments being read by Ruff, but there are a few instances where previously read comments will now log an error to the user instead. Please refer to the documentation on [*Error suppression*](https://docs.astral.sh/ruff/linter/#error-suppression) for the full specification.
 
 - **Avoid unnecessary parentheses around with statements with a single context manager and a trailing comment** ([#14005](https://github.com/astral-sh/ruff/pull/14005))
 
@@ -86,7 +146,6 @@ The following behaviors have been stabilized:
 
 - [`bad-staticmethod-argument`](https://docs.astral.sh/ruff/rules/bad-staticmethod-argument/) (`PLW0211`) [`invalid-first-argument-name-for-class-method`](https://docs.astral.sh/ruff/rules/invalid-first-argument-name-for-class-method/) (`N804`): `__new__` methods are now no longer flagged by `invalid-first-argument-name-for-class-method` (`N804`) but instead by `bad-staticmethod-argument` (`PLW0211`)
 - [`bad-str-strip-call`](https://docs.astral.sh/ruff/rules/bad-str-strip-call/) (`PLE1310`): The rule now applies to objects which are known to have type `str` or `bytes`.
-- [`blanket-noqa`](https://docs.astral.sh/ruff/rules/blanket-noqa/) (`PGH004`): Also detect blanked file-level noqa comments (and not just line level comments).
 - [`custom-type-var-for-self`](https://docs.astral.sh/ruff/rules/custom-type-var-for-self/) (`PYI019`): More accurate detection of custom `TypeVars` replaceable by `Self`. The range of the diagnostic is now the full function header rather than just the return annotation.
 - [`invalid-argument-name`](https://docs.astral.sh/ruff/rules/invalid-argument-name/) (`N803`): Ignore argument names of functions decorated with `typing.override`
 - [`invalid-envvar-default`](https://docs.astral.sh/ruff/rules/invalid-envvar-default/) (`PLW1508`): Detect default value arguments to `os.environ.get` with invalid type.
@@ -1362,11 +1421,11 @@ The following rules have been stabilized and are no longer in preview:
 
 The following behaviors have been stabilized:
 
-- [`cancel-scope-no-checkpoint`](https://docs.astral.sh/ruff/rules/cancel-scope-no-checkpoint/) (`ASYNC100`): Support `asyncio` and `anyio` context mangers.
-- [`async-function-with-timeout`](https://docs.astral.sh/ruff/rules/async-function-with-timeout/) (`ASYNC109`): Support `asyncio` and `anyio` context mangers.
-- [`async-busy-wait`](https://docs.astral.sh/ruff/rules/async-busy-wait/) (`ASYNC110`): Support `asyncio` and `anyio` context mangers.
-- [`async-zero-sleep`](https://docs.astral.sh/ruff/rules/async-zero-sleep/) (`ASYNC115`): Support `anyio` context mangers.
-- [`long-sleep-not-forever`](https://docs.astral.sh/ruff/rules/long-sleep-not-forever/) (`ASYNC116`): Support `anyio` context mangers.
+- [`cancel-scope-no-checkpoint`](https://docs.astral.sh/ruff/rules/cancel-scope-no-checkpoint/) (`ASYNC100`): Support `asyncio` and `anyio` context managers.
+- [`async-function-with-timeout`](https://docs.astral.sh/ruff/rules/async-function-with-timeout/) (`ASYNC109`): Support `asyncio` and `anyio` context managers.
+- [`async-busy-wait`](https://docs.astral.sh/ruff/rules/async-busy-wait/) (`ASYNC110`): Support `asyncio` and `anyio` context managers.
+- [`async-zero-sleep`](https://docs.astral.sh/ruff/rules/async-zero-sleep/) (`ASYNC115`): Support `anyio` context managers.
+- [`long-sleep-not-forever`](https://docs.astral.sh/ruff/rules/long-sleep-not-forever/) (`ASYNC116`): Support `anyio` context managers.
 
 The following fixes have been stabilized:
 
@@ -1448,7 +1507,7 @@ The following fixes have been stabilized:
 
 ## 0.5.6
 
-Ruff 0.5.6 automatically enables linting and formatting of notebooks in _preview mode_.
+Ruff 0.5.6 automatically enables linting and formatting of notebooks in *preview mode*.
 You can opt-out of this behavior by adding `*.ipynb` to the `extend-exclude` setting.
 
 ```toml
@@ -2201,7 +2260,7 @@ To setup `ruff server` with your editor, refer to the [README.md](https://github
 
 ### Server
 
-_This section is devoted to updates for our new language server, written in Rust._
+*This section is devoted to updates for our new language server, written in Rust.*
 
 - Enable ruff-specific source actions ([#10916](https://github.com/astral-sh/ruff/pull/10916))
 - Refreshes diagnostics for open files when file configuration is changed ([#10988](https://github.com/astral-sh/ruff/pull/10988))
@@ -3608,7 +3667,7 @@ Read Ruff's new [versioning policy](https://docs.astral.sh/ruff/versioning/).
 - \[`refurb`\] Add `single-item-membership-test` (`FURB171`) ([#7815](https://github.com/astral-sh/ruff/pull/7815))
 - \[`pylint`\] Add `and-or-ternary` (`R1706`) ([#7811](https://github.com/astral-sh/ruff/pull/7811))
 
-_New rules are added in [preview](https://docs.astral.sh/ruff/preview/)._
+*New rules are added in [preview](https://docs.astral.sh/ruff/preview/).*
 
 ### Configuration
 

Cargo.toml

@@ -63,7 +63,7 @@ colored = { version = "3.0.0" }
 console_error_panic_hook = { version = "0.1.7" }
 console_log = { version = "1.0.0" }
 countme = { version = "3.0.1" }
-compact_str = "0.8.0"
+compact_str = "0.9.0"
 criterion = { version = "0.5.1", default-features = false }
 crossbeam = { version = "0.8.4" }
 dashmap = { version = "6.0.1" }
@@ -71,7 +71,7 @@ dir-test = { version = "0.4.0" }
 dunce = { version = "1.0.5" }
 drop_bomb = { version = "0.1.5" }
 env_logger = { version = "0.11.0" }
-etcetera = { version = "0.8.0" }
+etcetera = { version = "0.10.0" }
 fern = { version = "0.7.0" }
 filetime = { version = "0.2.23" }
 getrandom = { version = "0.3.1" }
@@ -123,7 +123,7 @@ rayon = { version = "1.10.0" }
 regex = { version = "1.10.2" }
 rustc-hash = { version = "2.0.0" }
 # When updating salsa, make sure to also update the revision in `fuzz/Cargo.toml`
-salsa = { git = "https://github.com/salsa-rs/salsa.git", rev = "095d8b2b8115c3cf8bf31914dd9ea74648bb7cf9" }
+salsa = { git = "https://github.com/salsa-rs/salsa.git", rev = "d758691ba17ee1a60c5356ea90888d529e1782ad" }
 schemars = { version = "0.8.16" }
 seahash = { version = "4.1.0" }
 serde = { version = "1.0.197", features = ["derive"] }
@@ -154,6 +154,7 @@ toml = { version = "0.8.11" }
 tracing = { version = "0.1.40" }
 tracing-flame = { version = "0.2.0" }
 tracing-indicatif = { version = "0.3.6" }
+tracing-log = { version = "0.2.0" }
 tracing-subscriber = { version = "0.3.18", default-features = false, features = [
     "env-filter",
     "fmt",
@@ -326,3 +327,9 @@ github-custom-job-permissions = { "build-docker" = { packages = "write", content
 install-updater = false
 # Path that installers should place binaries in
 install-path = ["$XDG_BIN_HOME/", "$XDG_DATA_HOME/../bin", "~/.local/bin"]
+# Temporarily allow changes to the `release` workflow, in which we pin actions
+# to a SHA instead of a tag (https://github.com/astral-sh/uv/issues/12253)
+allow-dirty = ["ci"]
+
+[workspace.metadata.dist.github-custom-runners]
+global = "depot-ubuntu-latest-4"

README.md

@@ -149,8 +149,8 @@ curl -LsSf https://astral.sh/ruff/install.sh | sh
 powershell -c "irm https://astral.sh/ruff/install.ps1 | iex"
 
 # For a specific version.
-curl -LsSf https://astral.sh/ruff/0.10.0/install.sh | sh
-powershell -c "irm https://astral.sh/ruff/0.10.0/install.ps1 | iex"
+curl -LsSf https://astral.sh/ruff/0.11.2/install.sh | sh
+powershell -c "irm https://astral.sh/ruff/0.11.2/install.ps1 | iex"
 ```
 
 You can also install Ruff via [Homebrew](https://formulae.brew.sh/formula/ruff), [Conda](https://anaconda.org/conda-forge/ruff),
@@ -183,7 +183,7 @@ Ruff can also be used as a [pre-commit](https://pre-commit.com/) hook via [`ruff
 ```yaml
 - repo: https://github.com/astral-sh/ruff-pre-commit
   # Ruff version.
-  rev: v0.10.0
+  rev: v0.11.2
   hooks:
     # Run the linter.
     - id: ruff

crates/red_knot/src/args.rs

@@ -50,6 +50,8 @@ pub(crate) struct CheckCommand {
 
     /// Path to the Python installation from which Red Knot resolves type information and third-party dependencies.
     ///
+    /// If not specified, Red Knot will look at the `VIRTUAL_ENV` environment variable.
+    ///
     /// Red Knot will search in the path's `site-packages` directories for type information and
     /// third-party imports.
     ///
@@ -75,6 +77,14 @@ pub(crate) struct CheckCommand {
     #[clap(flatten)]
     pub(crate) rules: RulesArg,
 
+    /// The format to use for printing diagnostic messages.
+    #[arg(long)]
+    pub(crate) output_format: Option<OutputFormat>,
+
+    /// Control when colored output is used.
+    #[arg(long, value_name = "WHEN")]
+    pub(crate) color: Option<TerminalColor>,
+
     /// Use exit code 1 if there are any warning-level diagnostics.
     #[arg(long, conflicts_with = "exit_zero", default_missing_value = "true", num_args=0..1)]
     pub(crate) error_on_warning: Option<bool>,
@@ -117,6 +127,9 @@ impl CheckCommand {
                 ..EnvironmentOptions::default()
             }),
             terminal: Some(TerminalOptions {
+                output_format: self
+                    .output_format
+                    .map(|output_format| RangedValue::cli(output_format.into())),
                 error_on_warning: self.error_on_warning,
             }),
             rules,
@@ -211,3 +224,46 @@ impl clap::Args for RulesArg {
         Self::augment_args(cmd)
     }
 }
+
+/// The diagnostic output format.
+#[derive(Copy, Clone, Hash, Debug, PartialEq, Eq, PartialOrd, Ord, Default, clap::ValueEnum)]
+pub enum OutputFormat {
+    /// Print diagnostics verbosely, with context and helpful hints.
+    ///
+    /// Diagnostic messages may include additional context and
+    /// annotations on the input to help understand the message.
+    #[default]
+    #[value(name = "full")]
+    Full,
+    /// Print diagnostics concisely, one per line.
+    ///
+    /// This will guarantee that each diagnostic is printed on
+    /// a single line. Only the most important or primary aspects
+    /// of the diagnostic are included. Contextual information is
+    /// dropped.
+    #[value(name = "concise")]
+    Concise,
+}
+
+impl From<OutputFormat> for ruff_db::diagnostic::DiagnosticFormat {
+    fn from(format: OutputFormat) -> ruff_db::diagnostic::DiagnosticFormat {
+        match format {
+            OutputFormat::Full => Self::Full,
+            OutputFormat::Concise => Self::Concise,
+        }
+    }
+}
+
+/// Control when colored output is used.
+#[derive(Copy, Clone, Hash, Debug, PartialEq, Eq, PartialOrd, Ord, Default, clap::ValueEnum)]
+pub(crate) enum TerminalColor {
+    /// Display colors if the output goes to an interactive terminal.
+    #[default]
+    Auto,
+
+    /// Always display colors.
+    Always,
+
+    /// Never display colors.
+    Never,
+}

crates/red_knot/src/main.rs

@@ -4,7 +4,7 @@ use std::process::{ExitCode, Termination};
 use anyhow::Result;
 use std::sync::Mutex;
 
-use crate::args::{Args, CheckCommand, Command};
+use crate::args::{Args, CheckCommand, Command, TerminalColor};
 use crate::logging::setup_tracing;
 use anyhow::{anyhow, Context};
 use clap::Parser;
@@ -76,10 +76,14 @@ pub(crate) fn version() -> Result<()> {
 }
 
 fn run_check(args: CheckCommand) -> anyhow::Result<ExitStatus> {
+    set_colored_override(args.color);
+
     let verbosity = args.verbosity.level();
     countme::enable(verbosity.is_trace());
     let _guard = setup_tracing(verbosity)?;
 
+    tracing::debug!("Version: {}", version::version());
+
     // The base path to which all CLI arguments are relative to.
     let cwd = {
         let cwd = std::env::current_dir().context("Failed to get the current working directory")?;
@@ -255,15 +259,16 @@ impl MainLoop {
                     result,
                     revision: check_revision,
                 } => {
+                    let terminal_settings = db.project().settings(db).terminal();
                     let display_config = DisplayDiagnosticConfig::default()
+                        .format(terminal_settings.output_format)
                         .color(colored::control::SHOULD_COLORIZE.should_colorize());
 
-                    let min_error_severity =
-                        if db.project().settings(db).terminal().error_on_warning {
-                            Severity::Warning
-                        } else {
-                            Severity::Error
-                        };
+                    let min_error_severity = if terminal_settings.error_on_warning {
+                        Severity::Warning
+                    } else {
+                        Severity::Error
+                    };
 
                     if check_revision == revision {
                         if db.project().files(db).is_empty() {
@@ -360,3 +365,21 @@ enum MainLoopMessage {
     ApplyChanges(Vec<watch::ChangeEvent>),
     Exit,
 }
+
+fn set_colored_override(color: Option<TerminalColor>) {
+    let Some(color) = color else {
+        return;
+    };
+
+    match color {
+        TerminalColor::Auto => {
+            colored::control::unset_override();
+        }
+        TerminalColor::Always => {
+            colored::control::set_override(true);
+        }
+        TerminalColor::Never => {
+            colored::control::set_override(false);
+        }
+    }
+}

crates/red_knot/tests/cli.rs

@@ -219,7 +219,7 @@ fn configuration_rule_severity() -> anyhow::Result<()> {
     5 |     x = a
     6 |
     7 | print(x)  # possibly-unresolved-reference
-      |       - Name `x` used when possibly not defined
+      |       ^ Name `x` used when possibly not defined
       |
 
     Found 2 diagnostics
@@ -244,7 +244,7 @@ fn configuration_rule_severity() -> anyhow::Result<()> {
      --> <temp_dir>/test.py:2:5
       |
     2 | y = 4 / 0
-      |     ----- Cannot divide object of type `Literal[4]` by zero
+      |     ^^^^^ Cannot divide object of type `Literal[4]` by zero
     3 |
     4 | for a in range(0, y):
       |
@@ -306,7 +306,7 @@ fn cli_rule_severity() -> anyhow::Result<()> {
     7 |     x = a
     8 |
     9 | print(x)  # possibly-unresolved-reference
-      |       - Name `x` used when possibly not defined
+      |       ^ Name `x` used when possibly not defined
       |
 
     Found 3 diagnostics
@@ -331,7 +331,7 @@ fn cli_rule_severity() -> anyhow::Result<()> {
      --> <temp_dir>/test.py:2:8
       |
     2 | import does_not_exit
-      |        ------------- Cannot resolve import `does_not_exit`
+      |        ^^^^^^^^^^^^^ Cannot resolve import `does_not_exit`
     3 |
     4 | y = 4 / 0
       |
@@ -342,7 +342,7 @@ fn cli_rule_severity() -> anyhow::Result<()> {
     2 | import does_not_exit
     3 |
     4 | y = 4 / 0
-      |     ----- Cannot divide object of type `Literal[4]` by zero
+      |     ^^^^^ Cannot divide object of type `Literal[4]` by zero
     5 |
     6 | for a in range(0, y):
       |
@@ -393,7 +393,7 @@ fn cli_rule_severity_precedence() -> anyhow::Result<()> {
     5 |     x = a
     6 |
     7 | print(x)  # possibly-unresolved-reference
-      |       - Name `x` used when possibly not defined
+      |       ^ Name `x` used when possibly not defined
       |
 
     Found 2 diagnostics
@@ -419,7 +419,7 @@ fn cli_rule_severity_precedence() -> anyhow::Result<()> {
      --> <temp_dir>/test.py:2:5
       |
     2 | y = 4 / 0
-      |     ----- Cannot divide object of type `Literal[4]` by zero
+      |     ^^^^^ Cannot divide object of type `Literal[4]` by zero
     3 |
     4 | for a in range(0, y):
       |
@@ -456,7 +456,7 @@ fn configuration_unknown_rules() -> anyhow::Result<()> {
       |
     2 | [tool.knot.rules]
     3 | division-by-zer = "warn" # incorrect rule name
-      | --------------- Unknown lint rule `division-by-zer`
+      | ^^^^^^^^^^^^^^^ Unknown lint rule `division-by-zer`
       |
 
     Found 1 diagnostic
@@ -498,7 +498,7 @@ fn exit_code_only_warnings() -> anyhow::Result<()> {
      --> <temp_dir>/test.py:1:7
       |
     1 | print(x)  # [unresolved-reference]
-      |       - Name `x` used when not defined
+      |       ^ Name `x` used when not defined
       |
 
     Found 1 diagnostic
@@ -528,7 +528,7 @@ fn exit_code_only_info() -> anyhow::Result<()> {
       |
     2 | from typing_extensions import reveal_type
     3 | reveal_type(1)
-      | -------------- info: Revealed type is `Literal[1]`
+      | ^^^^^^^^^^^^^^ Revealed type is `Literal[1]`
       |
 
     Found 1 diagnostic
@@ -558,7 +558,7 @@ fn exit_code_only_info_and_error_on_warning_is_true() -> anyhow::Result<()> {
       |
     2 | from typing_extensions import reveal_type
     3 | reveal_type(1)
-      | -------------- info: Revealed type is `Literal[1]`
+      | ^^^^^^^^^^^^^^ Revealed type is `Literal[1]`
       |
 
     Found 1 diagnostic
@@ -581,7 +581,7 @@ fn exit_code_no_errors_but_error_on_warning_is_true() -> anyhow::Result<()> {
      --> <temp_dir>/test.py:1:7
       |
     1 | print(x)  # [unresolved-reference]
-      |       - Name `x` used when not defined
+      |       ^ Name `x` used when not defined
       |
 
     Found 1 diagnostic
@@ -613,7 +613,7 @@ fn exit_code_no_errors_but_error_on_warning_is_enabled_in_configuration() -> any
      --> <temp_dir>/test.py:1:7
       |
     1 | print(x)  # [unresolved-reference]
-      |       - Name `x` used when not defined
+      |       ^ Name `x` used when not defined
       |
 
     Found 1 diagnostic
@@ -642,7 +642,7 @@ fn exit_code_both_warnings_and_errors() -> anyhow::Result<()> {
      --> <temp_dir>/test.py:2:7
       |
     2 | print(x)     # [unresolved-reference]
-      |       - Name `x` used when not defined
+      |       ^ Name `x` used when not defined
     3 | print(4[1])  # [non-subscriptable]
       |
 
@@ -680,7 +680,7 @@ fn exit_code_both_warnings_and_errors_and_error_on_warning_is_true() -> anyhow::
      --> <temp_dir>/test.py:2:7
       |
     2 | print(x)     # [unresolved-reference]
-      |       - Name `x` used when not defined
+      |       ^ Name `x` used when not defined
     3 | print(4[1])  # [non-subscriptable]
       |
 
@@ -718,7 +718,7 @@ fn exit_code_exit_zero_is_true() -> anyhow::Result<()> {
      --> <temp_dir>/test.py:2:7
       |
     2 | print(x)     # [unresolved-reference]
-      |       - Name `x` used when not defined
+      |       ^ Name `x` used when not defined
     3 | print(4[1])  # [non-subscriptable]
       |
 
@@ -778,7 +778,7 @@ fn user_configuration() -> anyhow::Result<()> {
      --> <temp_dir>/project/main.py:2:5
       |
     2 | y = 4 / 0
-      |     ----- Cannot divide object of type `Literal[4]` by zero
+      |     ^^^^^ Cannot divide object of type `Literal[4]` by zero
     3 |
     4 | for a in range(0, y):
       |
@@ -789,7 +789,7 @@ fn user_configuration() -> anyhow::Result<()> {
     5 |     x = a
     6 |
     7 | print(x)
-      |       - Name `x` used when possibly not defined
+      |       ^ Name `x` used when possibly not defined
       |
 
     Found 2 diagnostics
@@ -820,7 +820,7 @@ fn user_configuration() -> anyhow::Result<()> {
      --> <temp_dir>/project/main.py:2:5
       |
     2 | y = 4 / 0
-      |     ----- Cannot divide object of type `Literal[4]` by zero
+      |     ^^^^^ Cannot divide object of type `Literal[4]` by zero
     3 |
     4 | for a in range(0, y):
       |
@@ -967,6 +967,30 @@ fn check_non_existing_path() -> anyhow::Result<()> {
     Ok(())
 }
 
+#[test]
+fn concise_diagnostics() -> anyhow::Result<()> {
+    let case = TestCase::with_file(
+        "test.py",
+        r#"
+        print(x)     # [unresolved-reference]
+        print(4[1])  # [non-subscriptable]
+        "#,
+    )?;
+
+    assert_cmd_snapshot!(case.command().arg("--output-format=concise"), @r"
+    success: false
+    exit_code: 1
+    ----- stdout -----
+    warning[lint:unresolved-reference] <temp_dir>/test.py:2:7: Name `x` used when not defined
+    error[lint:non-subscriptable] <temp_dir>/test.py:3:7: Cannot subscript object of type `Literal[4]` with no `__getitem__` method
+    Found 2 diagnostics
+
+    ----- stderr -----
+    ");
+
+    Ok(())
+}
+
 struct TestCase {
     _temp_dir: TempDir,
     _settings_scope: SettingsBindDropGuard,

crates/red_knot/tests/file_watching.rs

@@ -1,5 +1,3 @@
-#![allow(clippy::disallowed_names)]
-
 use std::collections::HashSet;
 use std::io::Write;
 use std::time::{Duration, Instant};
@@ -14,9 +12,9 @@ use red_knot_python_semantic::{resolve_module, ModuleName, PythonPlatform};
 use ruff_db::files::{system_path_to_file, File, FileError};
 use ruff_db::source::source_text;
 use ruff_db::system::{
-    OsSystem, System, SystemPath, SystemPathBuf, UserConfigDirectoryOverrideGuard,
+    file_time_now, OsSystem, System, SystemPath, SystemPathBuf, UserConfigDirectoryOverrideGuard,
 };
-use ruff_db::Upcast;
+use ruff_db::{Db as _, Upcast};
 use ruff_python_ast::PythonVersion;
 
 struct TestCase {
@@ -464,7 +462,7 @@ fn update_file(path: impl AsRef<SystemPath>, content: &str) -> anyhow::Result<()
 
         std::thread::sleep(Duration::from_nanos(10));
 
-        filetime::set_file_handle_times(&file, None, Some(filetime::FileTime::now()))?;
+        filetime::set_file_handle_times(&file, None, Some(file_time_now()))?;
     }
 }
 
@@ -1790,3 +1788,82 @@ fn changes_to_user_configuration() -> anyhow::Result<()> {
 
     Ok(())
 }
+
+/// Tests that renaming a file from `lib.py` to `Lib.py` is correctly reflected.
+///
+/// This test currently fails on case-insensitive systems because `Files` is case-sensitive
+/// but the `System::metadata` call isn't. This means that
+/// Red Knot considers both `Lib.py` and `lib.py` to exist when only `lib.py` does
+///
+/// The incoming change events then are no-ops because they don't change either file's
+/// status nor does it update their last modified time (renaming a file doesn't bump it's
+/// last modified timestamp).
+///
+/// Fixing this requires to either make `Files` case-insensitive and store the
+/// real-case path (if it differs) on `File` or make `Files` use a
+/// case-sensitive `System::metadata` call. This does open the question if all
+/// `System` calls should be case sensitive. This would be the most consistent
+/// but might be hard to pull off.
+///
+/// What the right solution is also depends on if Red Knot itself should be case
+/// sensitive or not. E.g. should `include="src"` be case sensitive on all systems
+/// or only on case-sensitive systems?
+///
+/// Lastly, whatever solution we pick must also work well with VS Code which,
+/// unfortunately ,doesn't propagate casing-only renames.
+/// <https://github.com/rust-lang/rust-analyzer/issues/9581>
+#[ignore]
+#[test]
+fn rename_files_casing_only() -> anyhow::Result<()> {
+    let mut case = setup([("lib.py", "class Foo: ...")])?;
+
+    assert!(
+        resolve_module(case.db(), &ModuleName::new("lib").unwrap()).is_some(),
+        "Expected `lib` module to exist."
+    );
+    assert_eq!(
+        resolve_module(case.db(), &ModuleName::new("Lib").unwrap()),
+        None,
+        "Expected `Lib` module not to exist"
+    );
+
+    // Now rename `lib.py` to `Lib.py`
+    if case.db().system().case_sensitivity().is_case_sensitive() {
+        std::fs::rename(
+            case.project_path("lib.py").as_std_path(),
+            case.project_path("Lib.py").as_std_path(),
+        )
+        .context("Failed to rename `lib.py` to `Lib.py`")?;
+    } else {
+        // On case-insensitive file systems, renaming a file to a different casing is a no-op.
+        // Rename to a different name first
+        std::fs::rename(
+            case.project_path("lib.py").as_std_path(),
+            case.project_path("temp.py").as_std_path(),
+        )
+        .context("Failed to rename `lib.py` to `temp.py`")?;
+
+        std::fs::rename(
+            case.project_path("temp.py").as_std_path(),
+            case.project_path("Lib.py").as_std_path(),
+        )
+        .context("Failed to rename `temp.py` to `Lib.py`")?;
+    }
+
+    let changes = case.stop_watch(event_for_file("Lib.py"));
+    case.apply_changes(changes);
+
+    // Resolving `lib` should now fail but `Lib` should now succeed
+    assert_eq!(
+        resolve_module(case.db(), &ModuleName::new("lib").unwrap()),
+        None,
+        "Expected `lib` module to no longer exist."
+    );
+
+    assert!(
+        resolve_module(case.db(), &ModuleName::new("Lib").unwrap()).is_some(),
+        "Expected `Lib` module to exist"
+    );
+
+    Ok(())
+}

crates/red_knot_project/src/db.rs

@@ -59,9 +59,8 @@ impl ProjectDatabase {
         self.with_db(|db| db.project().check(db))
     }
 
+    #[tracing::instrument(level = "debug", skip(self))]
     pub fn check_file(&self, file: File) -> Result<Vec<Box<dyn OldDiagnosticTrait>>, Cancelled> {
-        let _span = tracing::debug_span!("check_file", file=%file.path(self)).entered();
-
         self.with_db(|db| self.project().check_file(db, file))
     }
 

crates/red_knot_project/src/lib.rs

@@ -195,7 +195,8 @@ impl Project {
                 let project_span = project_span.clone();
 
                 scope.spawn(move |_| {
-                    let check_file_span = tracing::debug_span!(parent: &project_span, "check_file", file=%file.path(&db));
+                    let check_file_span =
+                        tracing::debug_span!(parent: &project_span, "check_file", ?file);
                     let _entered = check_file_span.entered();
 
                     let file_diagnostics = check_file_impl(&db, file);
@@ -325,7 +326,7 @@ impl Project {
         self.files(db).contains(&file)
     }
 
-    #[tracing::instrument(level = "debug", skip(db))]
+    #[tracing::instrument(level = "debug", skip(self, db))]
     pub fn remove_file(self, db: &mut dyn Db, file: File) {
         tracing::debug!(
             "Removing file `{}` from project `{}`",

crates/red_knot_project/src/metadata.rs

@@ -64,7 +64,7 @@ impl ProjectMetadata {
     }
 
     /// Loads a project from a set of options with an optional pyproject-project table.
-    pub(crate) fn from_options(
+    pub fn from_options(
         mut options: Options,
         root: SystemPathBuf,
         project: Option<&Project>,

crates/red_knot_project/src/metadata/options.rs

@@ -2,7 +2,7 @@ use crate::metadata::value::{RangedValue, RelativePathBuf, ValueSource, ValueSou
 use crate::Db;
 use red_knot_python_semantic::lint::{GetLintError, Level, LintSource, RuleSelection};
 use red_knot_python_semantic::{ProgramSettings, PythonPath, PythonPlatform, SearchPathSettings};
-use ruff_db::diagnostic::{DiagnosticId, OldDiagnosticTrait, Severity, Span};
+use ruff_db::diagnostic::{DiagnosticFormat, DiagnosticId, OldDiagnosticTrait, Severity, Span};
 use ruff_db::files::system_path_to_file;
 use ruff_db::system::{System, SystemPath};
 use ruff_macros::Combine;
@@ -37,11 +37,19 @@ pub struct Options {
 
 impl Options {
     pub(crate) fn from_toml_str(content: &str, source: ValueSource) -> Result<Self, KnotTomlError> {
-        let _guard = ValueSourceGuard::new(source);
+        let _guard = ValueSourceGuard::new(source, true);
         let options = toml::from_str(content)?;
         Ok(options)
     }
 
+    pub fn deserialize_with<'de, D>(source: ValueSource, deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        let _guard = ValueSourceGuard::new(source, false);
+        Self::deserialize(deserializer)
+    }
+
     pub(crate) fn to_program_settings(
         &self,
         project_root: &SystemPath,
@@ -106,9 +114,14 @@ impl Options {
             custom_typeshed: typeshed.map(|path| path.absolute(project_root, system)),
             python_path: python
                 .map(|python_path| {
-                    PythonPath::SysPrefix(python_path.absolute(project_root, system))
+                    PythonPath::from_cli_flag(python_path.absolute(project_root, system))
                 })
-                .unwrap_or(PythonPath::KnownSitePackages(vec![])),
+                .or_else(|| {
+                    std::env::var("VIRTUAL_ENV")
+                        .ok()
+                        .map(PythonPath::from_virtual_env_var)
+                })
+                .unwrap_or_else(|| PythonPath::KnownSitePackages(vec![])),
         }
     }
 
@@ -120,6 +133,11 @@ impl Options {
 
         if let Some(terminal) = self.terminal.as_ref() {
             settings.set_terminal(TerminalSettings {
+                output_format: terminal
+                    .output_format
+                    .as_deref()
+                    .copied()
+                    .unwrap_or_default(),
                 error_on_warning: terminal.error_on_warning.unwrap_or_default(),
             });
         }
@@ -277,6 +295,11 @@ impl FromIterator<(RangedValue<String>, RangedValue<Level>)> for Rules {
 #[serde(rename_all = "kebab-case", deny_unknown_fields)]
 #[cfg_attr(feature = "schemars", derive(schemars::JsonSchema))]
 pub struct TerminalOptions {
+    /// The format to use for printing diagnostic messages.
+    ///
+    /// Defaults to `full`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output_format: Option<RangedValue<DiagnosticFormat>>,
     /// Use exit code 1 if there are any warning-level diagnostics.
     ///
     /// Defaults to `false`.

crates/red_knot_project/src/metadata/pyproject.rs

@@ -34,7 +34,7 @@ impl PyProject {
         content: &str,
         source: ValueSource,
     ) -> Result<Self, PyProjectError> {
-        let _guard = ValueSourceGuard::new(source);
+        let _guard = ValueSourceGuard::new(source, true);
         toml::from_str(content).map_err(PyProjectError::TomlSyntax)
     }
 }

crates/red_knot_project/src/metadata/settings.rs

@@ -1,6 +1,7 @@
 use std::sync::Arc;
 
 use red_knot_python_semantic::lint::RuleSelection;
+use ruff_db::diagnostic::DiagnosticFormat;
 
 /// The resolved [`super::Options`] for the project.
 ///
@@ -49,5 +50,6 @@ impl Settings {
 
 #[derive(Debug, Clone, PartialEq, Eq, Default)]
 pub struct TerminalSettings {
+    pub output_format: DiagnosticFormat,
     pub error_on_warning: bool,
 }

crates/red_knot_project/src/metadata/value.rs

@@ -19,6 +19,7 @@ pub enum ValueSource {
     /// Ideally, we'd use [`ruff_db::files::File`] but we can't because the database hasn't been
     /// created when loading the configuration.
     File(Arc<SystemPathBuf>),
+
     /// The value comes from a CLI argument, while it's left open if specified using a short argument,
     /// long argument (`--extra-paths`) or `--config key=value`.
     Cli,
@@ -41,18 +42,18 @@ thread_local! {
     /// Use the [`ValueSourceGuard`] to initialize the thread local before calling into any
     /// deserialization code. It ensures that the thread local variable gets cleaned up
     /// once deserialization is done (once the guard gets dropped).
-    static VALUE_SOURCE: RefCell<Option<ValueSource>> = const { RefCell::new(None) };
+    static VALUE_SOURCE: RefCell<Option<(ValueSource, bool)>> = const { RefCell::new(None) };
 }
 
 /// Guard to safely change the [`VALUE_SOURCE`] for the current thread.
 #[must_use]
 pub(super) struct ValueSourceGuard {
-    prev_value: Option<ValueSource>,
+    prev_value: Option<(ValueSource, bool)>,
 }
 
 impl ValueSourceGuard {
-    pub(super) fn new(source: ValueSource) -> Self {
-        let prev = VALUE_SOURCE.replace(Some(source));
+    pub(super) fn new(source: ValueSource, is_toml: bool) -> Self {
+        let prev = VALUE_SOURCE.replace(Some((source, is_toml)));
         Self { prev_value: prev }
     }
 }
@@ -265,18 +266,24 @@ where
     where
         D: Deserializer<'de>,
     {
-        let spanned: Spanned<T> = Spanned::deserialize(deserializer)?;
-        let span = spanned.span();
-        let range = TextRange::new(
-            TextSize::try_from(span.start).expect("Configuration file to be smaller than 4GB"),
-            TextSize::try_from(span.end).expect("Configuration file to be smaller than 4GB"),
-        );
+        VALUE_SOURCE.with_borrow(|source| {
+            let (source, has_span) = source.clone().unwrap();
 
-        Ok(VALUE_SOURCE.with_borrow(|source| {
-            let source = source.clone().unwrap();
+            if has_span {
+                let spanned: Spanned<T> = Spanned::deserialize(deserializer)?;
+                let span = spanned.span();
+                let range = TextRange::new(
+                    TextSize::try_from(span.start)
+                        .expect("Configuration file to be smaller than 4GB"),
+                    TextSize::try_from(span.end)
+                        .expect("Configuration file to be smaller than 4GB"),
+                );
 
-            Self::with_range(spanned.into_inner(), source, range)
-        }))
+                Ok(Self::with_range(spanned.into_inner(), source, range))
+            } else {
+                Ok(Self::new(T::deserialize(deserializer)?, source))
+            }
+        })
     }
 }
 

crates/red_knot_python_semantic/resources/mdtest/annotations/annotated.md

@@ -29,7 +29,7 @@ It is invalid to parameterize `Annotated` with less than two arguments.
 ```py
 from typing_extensions import Annotated
 
-# error: [invalid-type-form] "`Annotated` requires at least two arguments when used in an annotation or type expression"
+# error: [invalid-type-form] "`typing.Annotated` requires at least two arguments when used in a type expression"
 def _(x: Annotated):
     reveal_type(x)  # revealed: Unknown
 
@@ -39,11 +39,11 @@ def _(flag: bool):
     else:
         X = bool
 
-    # error: [invalid-type-form] "`Annotated` requires at least two arguments when used in an annotation or type expression"
+    # error: [invalid-type-form] "`typing.Annotated` requires at least two arguments when used in a type expression"
     def f(y: X):
         reveal_type(y)  # revealed: Unknown | bool
 
-# error: [invalid-type-form] "`Annotated` requires at least two arguments when used in an annotation or type expression"
+# error: [invalid-type-form] "`typing.Annotated` requires at least two arguments when used in a type expression"
 def _(x: Annotated | bool):
     reveal_type(x)  # revealed: Unknown | bool
 
@@ -73,12 +73,10 @@ Inheriting from `Annotated[T, ...]` is equivalent to inheriting from `T` itself.
 ```py
 from typing_extensions import Annotated
 
-# TODO: False positive
-# error: [invalid-base]
 class C(Annotated[int, "foo"]): ...
 
 # TODO: Should be `tuple[Literal[C], Literal[int], Literal[object]]`
-reveal_type(C.__mro__)  # revealed: tuple[Literal[C], Unknown, Literal[object]]
+reveal_type(C.__mro__)  # revealed: tuple[Literal[C], @Todo(Inference of subscript on special form), Literal[object]]
 ```
 
 ### Not parameterized

crates/red_knot_python_semantic/resources/mdtest/annotations/callable.md

@@ -4,8 +4,10 @@ References:
 
 - <https://typing.readthedocs.io/en/latest/spec/callables.html#callable>
 
-TODO: Use `collections.abc` as importing from `typing` is deprecated but this requires support for
-`*` imports. See: <https://docs.python.org/3/library/typing.html#deprecated-aliases>.
+Note that `typing.Callable` is deprecated at runtime, in favour of `collections.abc.Callable` (see:
+<https://docs.python.org/3/library/typing.html#deprecated-aliases>). However, removal of
+`typing.Callable` is not currently planned, and the canonical location of the stub for the symbol in
+typeshed is still `typing.pyi`.
 
 ## Invalid forms
 
@@ -47,8 +49,10 @@ def _(c: Callable[42, str]):
 Or, when one of the parameter type is invalid in the list:
 
 ```py
+# error: [invalid-type-form] "Int literals are not allowed in this context in a type expression"
+# error: [invalid-type-form] "Boolean literals are not allowed in this context in a type expression"
 def _(c: Callable[[int, 42, str, False], None]):
-    # revealed: (int, @Todo(number literal in type expression), str, @Todo(boolean literal in type expression), /) -> None
+    # revealed: (int, Unknown, str, Unknown, /) -> None
     reveal_type(c)
 ```
 
@@ -61,7 +65,7 @@ from typing import Callable
 
 # error: [invalid-type-form] "Special form `typing.Callable` expected exactly two arguments (parameter types and return type)"
 def _(c: Callable[[int, str]]):
-    reveal_type(c)  # revealed: (int, str, /) -> Unknown
+    reveal_type(c)  # revealed: (...) -> Unknown
 ```
 
 Or, an ellipsis:
@@ -72,6 +76,18 @@ def _(c: Callable[...]):
     reveal_type(c)  # revealed: (...) -> Unknown
 ```
 
+Or something else that's invalid in a type expression generally:
+
+```py
+# fmt: off
+
+def _(c: Callable[  # error: [invalid-type-form] "Special form `typing.Callable` expected exactly two arguments (parameter types and return type)"
+            {1, 2}  # error: [invalid-type-form] "The first argument to `Callable` must be either a list of types, ParamSpec, Concatenate, or `...`"
+        ]
+    ):
+    reveal_type(c)  # revealed: (...) -> Unknown
+```
+
 ### More than two arguments
 
 We can't reliably infer the callable type if there are more then 2 arguments because we don't know
@@ -85,6 +101,48 @@ def _(c: Callable[[int], str, str]):
     reveal_type(c)  # revealed: (...) -> Unknown
 ```
 
+### List as the second argument
+
+```py
+from typing import Callable
+
+# fmt: off
+
+def _(c: Callable[
+            int,  # error: [invalid-type-form] "The first argument to `Callable` must be either a list of types, ParamSpec, Concatenate, or `...`"
+            [str]  # error: [invalid-type-form] "List literals are not allowed in this context in a type expression"
+        ]
+    ):
+    reveal_type(c)  # revealed: (...) -> Unknown
+```
+
+### List as both arguments
+
+```py
+from typing import Callable
+
+# error: [invalid-type-form] "List literals are not allowed in this context in a type expression"
+def _(c: Callable[[int], [str]]):
+    reveal_type(c)  # revealed: (int, /) -> Unknown
+```
+
+### Three list arguments
+
+```py
+from typing import Callable
+
+# fmt: off
+
+
+def _(c: Callable[  # error: [invalid-type-form] "Special form `typing.Callable` expected exactly two arguments (parameter types and return type)"
+            [int],
+            [str],  # error: [invalid-type-form] "List literals are not allowed in this context in a type expression"
+            [bytes]  # error: [invalid-type-form] "List literals are not allowed in this context in a type expression"
+        ]
+    ):
+    reveal_type(c)  # revealed: (...) -> Unknown
+```
+
 ## Simple
 
 A simple `Callable` with multiple parameters and a return type:
@@ -96,6 +154,39 @@ def _(c: Callable[[int, str], int]):
     reveal_type(c)  # revealed: (int, str, /) -> int
 ```
 
+## Union
+
+```py
+from typing import Callable, Union
+
+def _(
+    c: Callable[[Union[int, str]], int] | None,
+    d: None | Callable[[Union[int, str]], int],
+    e: None | Callable[[Union[int, str]], int] | int,
+):
+    reveal_type(c)  # revealed: ((int | str, /) -> int) | None
+    reveal_type(d)  # revealed: None | ((int | str, /) -> int)
+    reveal_type(e)  # revealed: None | ((int | str, /) -> int) | int
+```
+
+## Intersection
+
+```py
+from typing import Callable, Union
+from knot_extensions import Intersection, Not
+
+def _(
+    c: Intersection[Callable[[Union[int, str]], int], int],
+    d: Intersection[int, Callable[[Union[int, str]], int]],
+    e: Intersection[int, Callable[[Union[int, str]], int], str],
+    f: Intersection[Not[Callable[[int, str], Intersection[int, str]]]],
+):
+    reveal_type(c)  # revealed: ((int | str, /) -> int) & int
+    reveal_type(d)  # revealed: int & ((int | str, /) -> int)
+    reveal_type(e)  # revealed: int & ((int | str, /) -> int) & str
+    reveal_type(f)  # revealed: ~((int, str, /) -> int & str)
+```
+
 ## Nested
 
 A nested `Callable` as one of the parameter types:

crates/red_knot_python_semantic/resources/mdtest/annotations/invalid.md

@@ -9,6 +9,8 @@ import typing
 from knot_extensions import AlwaysTruthy, AlwaysFalsy
 from typing_extensions import Literal, Never
 
+class A: ...
+
 def _(
     a: type[int],
     b: AlwaysTruthy,
@@ -18,28 +20,95 @@ def _(
     f: Literal[b"foo"],
     g: tuple[int, str],
     h: Never,
+    i: int,
+    j: A,
 ):
     def foo(): ...
     def invalid(
-        i: a,  # error: [invalid-type-form] "Variable of type `type[int]` is not allowed in a type expression"
-        j: b,  # error: [invalid-type-form]
-        k: c,  # error: [invalid-type-form]
-        l: d,  # error: [invalid-type-form]
-        m: e,  # error: [invalid-type-form]
-        n: f,  # error: [invalid-type-form]
-        o: g,  # error: [invalid-type-form]
-        p: h,  # error: [invalid-type-form]
-        q: typing,  # error: [invalid-type-form]
-        r: foo,  # error: [invalid-type-form]
+        a_: a,  # error: [invalid-type-form] "Variable of type `type[int]` is not allowed in a type expression"
+        b_: b,  # error: [invalid-type-form]
+        c_: c,  # error: [invalid-type-form]
+        d_: d,  # error: [invalid-type-form]
+        e_: e,  # error: [invalid-type-form]
+        f_: f,  # error: [invalid-type-form]
+        g_: g,  # error: [invalid-type-form]
+        h_: h,  # error: [invalid-type-form]
+        i_: typing,  # error: [invalid-type-form]
+        j_: foo,  # error: [invalid-type-form]
+        k_: i,  # error: [invalid-type-form] "Variable of type `int` is not allowed in a type expression"
+        l_: j,  # error: [invalid-type-form] "Variable of type `A` is not allowed in a type expression"
     ):
-        reveal_type(i)  # revealed: Unknown
-        reveal_type(j)  # revealed: Unknown
-        reveal_type(k)  # revealed: Unknown
-        reveal_type(l)  # revealed: Unknown
-        reveal_type(m)  # revealed: Unknown
-        reveal_type(n)  # revealed: Unknown
-        reveal_type(o)  # revealed: Unknown
-        reveal_type(p)  # revealed: Unknown
-        reveal_type(q)  # revealed: Unknown
-        reveal_type(r)  # revealed: Unknown
+        reveal_type(a_)  # revealed: Unknown
+        reveal_type(b_)  # revealed: Unknown
+        reveal_type(c_)  # revealed: Unknown
+        reveal_type(d_)  # revealed: Unknown
+        reveal_type(e_)  # revealed: Unknown
+        reveal_type(f_)  # revealed: Unknown
+        reveal_type(g_)  # revealed: Unknown
+        reveal_type(h_)  # revealed: Unknown
+        reveal_type(i_)  # revealed: Unknown
+        reveal_type(j_)  # revealed: Unknown
+```
+
+## Invalid AST nodes
+
+```py
+def bar() -> None:
+    return None
+
+def _(
+    a: 1,  # error: [invalid-type-form] "Int literals are not allowed in this context in a type expression"
+    b: 2.3,  # error: [invalid-type-form] "Float literals are not allowed in type expressions"
+    c: 4j,  # error: [invalid-type-form] "Complex literals are not allowed in type expressions"
+    d: True,  # error: [invalid-type-form] "Boolean literals are not allowed in this context in a type expression"
+    e: int | b"foo",  # error: [invalid-type-form] "Bytes literals are not allowed in this context in a type expression"
+    f: 1 and 2,  # error: [invalid-type-form] "Boolean operations are not allowed in type expressions"
+    g: 1 or 2,  # error: [invalid-type-form] "Boolean operations are not allowed in type expressions"
+    h: (foo := 1),  # error: [invalid-type-form] "Named expressions are not allowed in type expressions"
+    i: not 1,  # error: [invalid-type-form] "Unary operations are not allowed in type expressions"
+    j: lambda: 1,  # error: [invalid-type-form] "`lambda` expressions are not allowed in type expressions"
+    k: 1 if True else 2,  # error: [invalid-type-form] "`if` expressions are not allowed in type expressions"
+    l: await 1,  # error: [invalid-type-form] "`await` expressions are not allowed in type expressions"
+    m: (yield 1),  # error: [invalid-type-form] "`yield` expressions are not allowed in type expressions"
+    n: (yield from [1]),  # error: [invalid-type-form] "`yield from` expressions are not allowed in type expressions"
+    o: 1 < 2,  # error: [invalid-type-form] "Comparison expressions are not allowed in type expressions"
+    p: bar(),  # error: [invalid-type-form] "Function calls are not allowed in type expressions"
+    q: int | f"foo",  # error: [invalid-type-form] "F-strings are not allowed in type expressions"
+    r: [1, 2, 3][1:2],  # error: [invalid-type-form] "Slices are not allowed in type expressions"
+):
+    reveal_type(a)  # revealed: Unknown
+    reveal_type(b)  # revealed: Unknown
+    reveal_type(c)  # revealed: Unknown
+    reveal_type(d)  # revealed: Unknown
+    reveal_type(e)  # revealed: int | Unknown
+    reveal_type(f)  # revealed: Unknown
+    reveal_type(g)  # revealed: Unknown
+    reveal_type(h)  # revealed: Unknown
+    reveal_type(i)  # revealed: Unknown
+    reveal_type(j)  # revealed: Unknown
+    reveal_type(k)  # revealed: Unknown
+    reveal_type(p)  # revealed: Unknown
+    reveal_type(q)  # revealed: int | Unknown
+    reveal_type(r)  # revealed: @Todo(generics)
+```
+
+## Invalid Collection based AST nodes
+
+```py
+def _(
+    a: {1: 2},  # error: [invalid-type-form] "Dict literals are not allowed in type expressions"
+    b: {1, 2},  # error: [invalid-type-form] "Set literals are not allowed in type expressions"
+    c: {k: v for k, v in [(1, 2)]},  # error: [invalid-type-form] "Dict comprehensions are not allowed in type expressions"
+    d: [k for k in [1, 2]],  # error: [invalid-type-form] "List comprehensions are not allowed in type expressions"
+    e: {k for k in [1, 2]},  # error: [invalid-type-form] "Set comprehensions are not allowed in type expressions"
+    f: (k for k in [1, 2]),  # error: [invalid-type-form] "Generator expressions are not allowed in type expressions"
+    g: [int, str],  # error: [invalid-type-form] "List literals are not allowed in this context in a type expression"
+):
+    reveal_type(a)  # revealed: Unknown
+    reveal_type(b)  # revealed: Unknown
+    reveal_type(c)  # revealed: Unknown
+    reveal_type(d)  # revealed: Unknown
+    reveal_type(e)  # revealed: Unknown
+    reveal_type(f)  # revealed: Unknown
+    reveal_type(g)  # revealed: Unknown
 ```

crates/red_knot_python_semantic/resources/mdtest/annotations/literal.md

@@ -127,6 +127,13 @@ Literal: _SpecialForm
 ```py
 from other import Literal
 
+# TODO: can we add a subdiagnostic here saying something like:
+#
+#     `other.Literal` and `typing.Literal` have similar names, but are different symbols and don't have the same semantics
+#
+# ?
+#
+# error: [invalid-type-form] "Int literals are not allowed in this context in a type expression"
 a1: Literal[26]
 
 def f():
@@ -149,7 +156,7 @@ def f():
 ```py
 from typing import Literal
 
-# error: [invalid-type-form] "`Literal` requires at least one argument when used in a type expression"
+# error: [invalid-type-form] "`typing.Literal` requires at least one argument when used in a type expression"
 def _(x: Literal):
     reveal_type(x)  # revealed: Unknown
 ```

crates/red_knot_python_semantic/resources/mdtest/annotations/new_types.md

@@ -0,0 +1,20 @@
+# NewType
+
+Currently, red-knot doesn't support `typing.NewType` in type annotations.
+
+## Valid forms
+
+```py
+from typing_extensions import NewType
+from types import GenericAlias
+
+A = NewType("A", int)
+B = GenericAlias(A, ())
+
+def _(
+    a: A,
+    b: B,
+):
+    reveal_type(a)  # revealed: @Todo(Support for `typing.NewType` instances in type expressions)
+    reveal_type(b)  # revealed: @Todo(Support for `typing.GenericAlias` instances in type expressions)
+```

crates/red_knot_python_semantic/resources/mdtest/annotations/optional.md

@@ -45,3 +45,13 @@ def f():
     # revealed: int | None
     reveal_type(a)
 ```
+
+## Invalid
+
+```py
+from typing import Optional
+
+# error: [invalid-type-form] "`typing.Optional` requires exactly one argument when used in a type expression"
+def f(x: Optional) -> None:
+    reveal_type(x)  # revealed: Unknown
+```

crates/red_knot_python_semantic/resources/mdtest/annotations/stdlib_typing_aliases.md

@@ -81,8 +81,7 @@ reveal_type(DictSubclass.__mro__)
 
 class SetSubclass(typing.Set): ...
 
-# TODO: should have `Generic`, should not have `Unknown`
-# revealed: tuple[Literal[SetSubclass], Literal[set], Unknown, Literal[object]]
+# revealed: tuple[Literal[SetSubclass], Literal[set], Literal[MutableSet], Literal[AbstractSet], Literal[Collection], Literal[Iterable], Literal[Container], @Todo(protocol), Literal[object]]
 reveal_type(SetSubclass.__mro__)
 
 class FrozenSetSubclass(typing.FrozenSet): ...
@@ -114,8 +113,7 @@ reveal_type(DefaultDictSubclass.__mro__)
 
 class DequeSubclass(typing.Deque): ...
 
-# TODO: Should be (DequeSubclass, deque, MutableSequence, Sequence, Reversible, Collection, Sized, Iterable, Container, Generic, object)
-# revealed: tuple[Literal[DequeSubclass], Literal[deque], Unknown, Literal[object]]
+# revealed: tuple[Literal[DequeSubclass], Literal[deque], Literal[MutableSequence], Literal[Sequence], Literal[Reversible], Literal[Collection], Literal[Iterable], Literal[Container], @Todo(protocol), Literal[object]]
 reveal_type(DequeSubclass.__mro__)
 
 class OrderedDictSubclass(typing.OrderedDict): ...

crates/red_knot_python_semantic/resources/mdtest/annotations/union.md

@@ -59,3 +59,13 @@ def f():
     # revealed: int | str
     reveal_type(a)
 ```
+
+## Invalid
+
+```py
+from typing import Union
+
+# error: [invalid-type-form] "`typing.Union` requires at least one argument when used in a type expression"
+def f(x: Union) -> None:
+    reveal_type(x)  # revealed: Unknown
+```

crates/red_knot_python_semantic/resources/mdtest/annotations/unsupported_special_forms.md

@@ -18,7 +18,7 @@ def f(*args: Unpack[Ts]) -> tuple[Unpack[Ts]]:
     # TODO: should understand the annotation
     reveal_type(args)  # revealed: tuple
 
-    reveal_type(Alias)  # revealed: @Todo(Invalid or unsupported `KnownInstanceType` in `Type::to_type_expression`)
+    reveal_type(Alias)  # revealed: @Todo(Support for `typing.TypeAlias`)
 
 def g() -> TypeGuard[int]: ...
 def h() -> TypeIs[int]: ...
@@ -29,13 +29,34 @@ def i(callback: Callable[Concatenate[int, P], R_co], *args: P.args, **kwargs: P.
     # TODO: should understand the annotation
     reveal_type(kwargs)  # revealed: dict
 
-    # TODO: not an error; remove once `call` is implemented for `Callable`
-    # error: [call-non-callable]
     return callback(42, *args, **kwargs)
 
 class Foo:
     def method(self, x: Self):
-        reveal_type(x)  # revealed: @Todo(Invalid or unsupported `KnownInstanceType` in `Type::to_type_expression`)
+        reveal_type(x)  # revealed: @Todo(Support for `typing.Self`)
+```
+
+## Type expressions
+
+One thing that is supported is error messages for using special forms in type expressions.
+
+```py
+from typing_extensions import Unpack, TypeGuard, TypeIs, Concatenate, ParamSpec
+
+def _(
+    a: Unpack,  # error: [invalid-type-form] "`typing.Unpack` requires exactly one argument when used in a type expression"
+    b: TypeGuard,  # error: [invalid-type-form] "`typing.TypeGuard` requires exactly one argument when used in a type expression"
+    c: TypeIs,  # error: [invalid-type-form] "`typing.TypeIs` requires exactly one argument when used in a type expression"
+    d: Concatenate,  # error: [invalid-type-form] "`typing.Concatenate` requires at least two arguments when used in a type expression"
+    e: ParamSpec,
+) -> None:
+    reveal_type(a)  # revealed: Unknown
+    reveal_type(b)  # revealed: Unknown
+    reveal_type(c)  # revealed: Unknown
+    reveal_type(d)  # revealed: Unknown
+
+    def foo(a_: e) -> None:
+        reveal_type(a_)  # revealed: @Todo(Support for `typing.ParamSpec` instances in type expressions)
 ```
 
 ## Inheritance

crates/red_knot_python_semantic/resources/mdtest/annotations/unsupported_type_qualifiers.md

@@ -1,6 +1,6 @@
 # Unsupported type qualifiers
 
-## Not yet supported
+## Not yet fully supported
 
 Several type qualifiers are unsupported by red-knot currently. However, we also don't emit
 false-positive errors if you use one in an annotation:
@@ -19,6 +19,33 @@ class Bar(TypedDict):
     z: ReadOnly[bytes]
 ```
 
+## Type expressions
+
+One thing that is supported is error messages for using type qualifiers in type expressions.
+
+```py
+from typing_extensions import Final, ClassVar, Required, NotRequired, ReadOnly
+
+def _(
+    a: (
+        Final  # error: [invalid-type-form] "Type qualifier `typing.Final` is not allowed in type expressions (only in annotation expressions)"
+        | int
+    ),
+    b: (
+        ClassVar  # error: [invalid-type-form] "Type qualifier `typing.ClassVar` is not allowed in type expressions (only in annotation expressions)"
+        | int
+    ),
+    c: Required,  # error: [invalid-type-form] "Type qualifier `typing.Required` is not allowed in type expressions (only in annotation expressions, and only with exactly one argument)"
+    d: NotRequired,  # error: [invalid-type-form] "Type qualifier `typing.NotRequired` is not allowed in type expressions (only in annotation expressions, and only with exactly one argument)"
+    e: ReadOnly,  # error: [invalid-type-form] "Type qualifier `typing.ReadOnly` is not allowed in type expressions (only in annotation expressions, and only with exactly one argument)"
+) -> None:
+    reveal_type(a)  # revealed: Unknown | int
+    reveal_type(b)  # revealed: Unknown | int
+    reveal_type(c)  # revealed: Unknown
+    reveal_type(d)  # revealed: Unknown
+    reveal_type(e)  # revealed: Unknown
+```
+
 ## Inheritance
 
 You can't inherit from a type qualifier.

crates/red_knot_python_semantic/resources/mdtest/assignment/augmented.md

@@ -10,6 +10,10 @@ reveal_type(x)  # revealed: Literal[2]
 x = 1.0
 x /= 2
 reveal_type(x)  # revealed: int | float
+
+x = (1, 2)
+x += (3, 4)
+reveal_type(x)  # revealed: tuple[Literal[1], Literal[2], Literal[3], Literal[4]]
 ```
 
 ## Dunder methods
@@ -161,3 +165,18 @@ def f(flag: bool, flag2: bool):
 
     reveal_type(f)  # revealed: int | str | float
 ```
+
+## Implicit dunder calls on class objects
+
+```py
+class Meta(type):
+    def __iadd__(cls, other: int) -> str:
+        return ""
+
+class C(metaclass=Meta): ...
+
+cls = C
+cls += 1
+
+reveal_type(cls)  # revealed: str
+```

crates/red_knot_python_semantic/resources/mdtest/attributes.md

@@ -551,6 +551,7 @@ reveal_type(C().x)  # revealed: str
 class C:
     def __init__(self) -> None:
         # error: [too-many-positional-arguments]
+        # error: [invalid-argument-type]
         self.x: int = len(1, 2, 3)
 ```
 
@@ -697,10 +698,10 @@ class Base:
         self.defined_in_init: str | None = "value in base"
 
 class Intermediate(Base):
-    # Re-declaring base class attributes with the *same *type is fine:
+    # Redeclaring base class attributes with the *same *type is fine:
     base_class_attribute_1: str | None = None
 
-    # Re-declaring them with a *narrower type* is unsound, because modifications
+    # Redeclaring them with a *narrower type* is unsound, because modifications
     # through a `Base` reference could violate that constraint.
     #
     # Mypy does not report an error here, but pyright does: "… overrides symbol
@@ -712,7 +713,7 @@ class Intermediate(Base):
     # TODO: This should be an error
     base_class_attribute_2: str
 
-    # Re-declaring attributes with a *wider type* directly violates LSP.
+    # Redeclaring attributes with a *wider type* directly violates LSP.
     #
     # In this case, both mypy and pyright report an error.
     #
@@ -818,40 +819,74 @@ def _(flag: bool):
     if flag:
         class C1:
             x = 1
+            y: int = 1
 
     else:
         class C1:
             x = 2
+            y: int | str = "b"
 
     reveal_type(C1.x)  # revealed: Unknown | Literal[1, 2]
+    reveal_type(C1.y)  # revealed: int | str
+
+    C1.y = 100
+    # error: [invalid-assignment] "Object of type `Literal["problematic"]` is not assignable to attribute `y` on type `Literal[C1, C1]`"
+    C1.y = "problematic"
 
     class C2:
         if flag:
             x = 3
+            y: int = 3
         else:
             x = 4
+            y: int | str = "d"
 
     reveal_type(C2.x)  # revealed: Unknown | Literal[3, 4]
+    reveal_type(C2.y)  # revealed: int | str
+
+    C2.y = 100
+    # error: [invalid-assignment] "Object of type `None` is not assignable to attribute `y` of type `int | str`"
+    C2.y = None
+    # TODO: should be an error, needs more sophisticated union handling in `validate_attribute_assignment`
+    C2.y = "problematic"
 
     if flag:
         class Meta3(type):
             x = 5
+            y: int = 5
 
     else:
         class Meta3(type):
             x = 6
+            y: int | str = "f"
 
     class C3(metaclass=Meta3): ...
     reveal_type(C3.x)  # revealed: Unknown | Literal[5, 6]
+    reveal_type(C3.y)  # revealed: int | str
+
+    C3.y = 100
+    # error: [invalid-assignment] "Object of type `None` is not assignable to attribute `y` of type `int | str`"
+    C3.y = None
+    # TODO: should be an error, needs more sophisticated union handling in `validate_attribute_assignment`
+    C3.y = "problematic"
 
     class Meta4(type):
         if flag:
             x = 7
+            y: int = 7
         else:
             x = 8
+            y: int | str = "h"
 
     class C4(metaclass=Meta4): ...
     reveal_type(C4.x)  # revealed: Unknown | Literal[7, 8]
+    reveal_type(C4.y)  # revealed: int | str
+
+    C4.y = 100
+    # error: [invalid-assignment] "Object of type `None` is not assignable to attribute `y` of type `int | str`"
+    C4.y = None
+    # TODO: should be an error, needs more sophisticated union handling in `validate_attribute_assignment`
+    C4.y = "problematic"
 ```
 
 ## Unions with possibly unbound paths
@@ -875,8 +910,14 @@ def _(flag1: bool, flag2: bool):
     # error: [possibly-unbound-attribute] "Attribute `x` on type `Literal[C1, C2, C3]` is possibly unbound"
     reveal_type(C.x)  # revealed: Unknown | Literal[1, 3]
 
+    # error: [invalid-assignment] "Object of type `Literal[100]` is not assignable to attribute `x` on type `Literal[C1, C2, C3]`"
+    C.x = 100
+
     # error: [possibly-unbound-attribute] "Attribute `x` on type `C1 | C2 | C3` is possibly unbound"
     reveal_type(C().x)  # revealed: Unknown | Literal[1, 3]
+
+    # error: [invalid-assignment] "Object of type `Literal[100]` is not assignable to attribute `x` on type `C1 | C2 | C3`"
+    C().x = 100
 ```
 
 ### Possibly-unbound within a class
@@ -901,10 +942,16 @@ def _(flag: bool, flag1: bool, flag2: bool):
     # error: [possibly-unbound-attribute] "Attribute `x` on type `Literal[C1, C2, C3]` is possibly unbound"
     reveal_type(C.x)  # revealed: Unknown | Literal[1, 2, 3]
 
+    # error: [possibly-unbound-attribute]
+    C.x = 100
+
     # Note: we might want to consider ignoring possibly-unbound diagnostics for instance attributes eventually,
     # see the "Possibly unbound/undeclared instance attribute" section below.
     # error: [possibly-unbound-attribute] "Attribute `x` on type `C1 | C2 | C3` is possibly unbound"
     reveal_type(C().x)  # revealed: Unknown | Literal[1, 2, 3]
+
+    # error: [possibly-unbound-attribute]
+    C().x = 100
 ```
 
 ### Possibly-unbound within gradual types
@@ -922,6 +969,9 @@ def _(flag: bool):
             x: int
 
     reveal_type(Derived().x)  # revealed: int | Any
+
+    Derived().x = 1
+    Derived().x = "a"
 ```
 
 ### Attribute possibly unbound on a subclass but not on a superclass
@@ -936,8 +986,10 @@ def _(flag: bool):
             x = 2
 
     reveal_type(Bar.x)  # revealed: Unknown | Literal[2, 1]
+    Bar.x = 3
 
     reveal_type(Bar().x)  # revealed: Unknown | Literal[2, 1]
+    Bar().x = 3
 ```
 
 ### Attribute possibly unbound on a subclass and on a superclass
@@ -955,8 +1007,14 @@ def _(flag: bool):
     # error: [possibly-unbound-attribute]
     reveal_type(Bar.x)  # revealed: Unknown | Literal[2, 1]
 
+    # error: [possibly-unbound-attribute]
+    Bar.x = 3
+
     # error: [possibly-unbound-attribute]
     reveal_type(Bar().x)  # revealed: Unknown | Literal[2, 1]
+
+    # error: [possibly-unbound-attribute]
+    Bar().x = 3
 ```
 
 ### Possibly unbound/undeclared instance attribute
@@ -975,6 +1033,9 @@ def _(flag: bool):
 
     # error: [possibly-unbound-attribute]
     reveal_type(Foo().x)  # revealed: int | Unknown
+
+    # error: [possibly-unbound-attribute]
+    Foo().x = 1
 ```
 
 #### Possibly unbound
@@ -989,6 +1050,9 @@ def _(flag: bool):
     # Emitting a diagnostic in a case like this is not something we support, and it's unclear
     # if we ever will (or want to)
     reveal_type(Foo().x)  # revealed: Unknown | Literal[1]
+
+    # Same here
+    Foo().x = 2
 ```
 
 ### Unions with all paths unbound
@@ -1003,6 +1067,11 @@ def _(flag: bool):
 
     # error: [unresolved-attribute] "Type `Literal[C1, C2]` has no attribute `x`"
     reveal_type(C.x)  # revealed: Unknown
+
+    # TODO: This should ideally be a `unresolved-attribute` error. We need better union
+    # handling in `validate_attribute_assignment` for this.
+    # error: [invalid-assignment] "Object of type `Literal[1]` is not assignable to attribute `x` on type `Literal[C1, C2]`"
+    C.x = 1
 ```
 
 ## Inherited class attributes
@@ -1017,6 +1086,8 @@ class B(A): ...
 class C(B): ...
 
 reveal_type(C.X)  # revealed: Unknown | Literal["foo"]
+
+C.X = "bar"
 ```
 
 ### Multiple inheritance
@@ -1040,6 +1111,8 @@ reveal_type(A.__mro__)
 
 # `E` is earlier in the MRO than `F`, so we should use the type of `E.X`
 reveal_type(A.X)  # revealed: Unknown | Literal[42]
+
+A.X = 100
 ```
 
 ## Intersections of attributes
@@ -1057,9 +1130,13 @@ class B: ...
 def _(a_and_b: Intersection[A, B]):
     reveal_type(a_and_b.x)  # revealed: int
 
+    a_and_b.x = 2
+
 # Same for class objects
 def _(a_and_b: Intersection[type[A], type[B]]):
     reveal_type(a_and_b.x)  # revealed: int
+
+    a_and_b.x = 2
 ```
 
 ### Attribute available on both elements
@@ -1069,6 +1146,7 @@ from knot_extensions import Intersection
 
 class P: ...
 class Q: ...
+class R(P, Q): ...
 
 class A:
     x: P = P()
@@ -1078,10 +1156,12 @@ class B:
 
 def _(a_and_b: Intersection[A, B]):
     reveal_type(a_and_b.x)  # revealed: P & Q
+    a_and_b.x = R()
 
 # Same for class objects
 def _(a_and_b: Intersection[type[A], type[B]]):
     reveal_type(a_and_b.x)  # revealed: P & Q
+    a_and_b.x = R()
 ```
 
 ### Possible unboundness
@@ -1091,6 +1171,7 @@ from knot_extensions import Intersection
 
 class P: ...
 class Q: ...
+class R(P, Q): ...
 
 def _(flag: bool):
     class A1:
@@ -1102,11 +1183,17 @@ def _(flag: bool):
     def inner1(a_and_b: Intersection[A1, B1]):
         # error: [possibly-unbound-attribute]
         reveal_type(a_and_b.x)  # revealed: P
+
+        # error: [possibly-unbound-attribute]
+        a_and_b.x = R()
     # Same for class objects
     def inner1_class(a_and_b: Intersection[type[A1], type[B1]]):
         # error: [possibly-unbound-attribute]
         reveal_type(a_and_b.x)  # revealed: P
 
+        # error: [possibly-unbound-attribute]
+        a_and_b.x = R()
+
     class A2:
         if flag:
             x: P = P()
@@ -1116,6 +1203,11 @@ def _(flag: bool):
 
     def inner2(a_and_b: Intersection[A2, B1]):
         reveal_type(a_and_b.x)  # revealed: P & Q
+
+        # TODO: this should not be an error, we need better intersection
+        # handling in `validate_attribute_assignment` for this
+        # error: [possibly-unbound-attribute]
+        a_and_b.x = R()
     # Same for class objects
     def inner2_class(a_and_b: Intersection[type[A2], type[B1]]):
         reveal_type(a_and_b.x)  # revealed: P & Q
@@ -1131,21 +1223,33 @@ def _(flag: bool):
     def inner3(a_and_b: Intersection[A3, B3]):
         # error: [possibly-unbound-attribute]
         reveal_type(a_and_b.x)  # revealed: P & Q
+
+        # error: [possibly-unbound-attribute]
+        a_and_b.x = R()
     # Same for class objects
     def inner3_class(a_and_b: Intersection[type[A3], type[B3]]):
         # error: [possibly-unbound-attribute]
         reveal_type(a_and_b.x)  # revealed: P & Q
 
+        # error: [possibly-unbound-attribute]
+        a_and_b.x = R()
+
     class A4: ...
     class B4: ...
 
     def inner4(a_and_b: Intersection[A4, B4]):
         # error: [unresolved-attribute]
         reveal_type(a_and_b.x)  # revealed: Unknown
+
+        # error: [invalid-assignment]
+        a_and_b.x = R()
     # Same for class objects
     def inner4_class(a_and_b: Intersection[type[A4], type[B4]]):
         # error: [unresolved-attribute]
         reveal_type(a_and_b.x)  # revealed: Unknown
+
+        # error: [invalid-assignment]
+        a_and_b.x = R()
 ```
 
 ### Intersection of implicit instance attributes

crates/red_knot_python_semantic/resources/mdtest/binary/instances.md

@@ -363,7 +363,7 @@ reveal_type(X() + Y())  # revealed: int
 
 ```py
 class NotBoolable:
-    __bool__ = 3
+    __bool__: int = 3
 
 a = NotBoolable()
 

crates/red_knot_python_semantic/resources/mdtest/binary/tuples.md

@@ -0,0 +1,22 @@
+# Binary operations on tuples
+
+## Concatenation for heterogeneous tuples
+
+```py
+reveal_type((1, 2) + (3, 4))  # revealed: tuple[Literal[1], Literal[2], Literal[3], Literal[4]]
+reveal_type(() + (1, 2))  # revealed: tuple[Literal[1], Literal[2]]
+reveal_type((1, 2) + ())  # revealed: tuple[Literal[1], Literal[2]]
+reveal_type(() + ())  # revealed: tuple[()]
+
+def _(x: tuple[int, str], y: tuple[None, tuple[int]]):
+    reveal_type(x + y)  # revealed: tuple[int, str, None, tuple[int]]
+    reveal_type(y + x)  # revealed: tuple[None, tuple[int], int, str]
+```
+
+## Concatenation for homogeneous tuples
+
+```py
+def _(x: tuple[int, ...], y: tuple[str, ...]):
+    reveal_type(x + y)  # revealed: @Todo(full tuple[...] support)
+    reveal_type(x + (1, 2))  # revealed: @Todo(full tuple[...] support)
+```

crates/red_knot_python_semantic/resources/mdtest/call/annotation.md

@@ -0,0 +1,43 @@
+# `typing.Callable`
+
+```py
+from typing import Callable
+
+def _(c: Callable[[], int]):
+    reveal_type(c())  # revealed: int
+
+def _(c: Callable[[int, str], int]):
+    reveal_type(c(1, "a"))  # revealed: int
+
+    # error: [invalid-argument-type] "Object of type `Literal["a"]` cannot be assigned to parameter 1; expected type `int`"
+    # error: [invalid-argument-type] "Object of type `Literal[1]` cannot be assigned to parameter 2; expected type `str`"
+    reveal_type(c("a", 1))  # revealed: int
+```
+
+The `Callable` annotation can only be used to describe positional-only parameters.
+
+```py
+def _(c: Callable[[int, str], None]):
+    # error: [unknown-argument] "Argument `a` does not match any known parameter"
+    # error: [unknown-argument] "Argument `b` does not match any known parameter"
+    # error: [missing-argument] "No arguments provided for required parameters 1, 2"
+    reveal_type(c(a=1, b="b"))  # revealed: None
+```
+
+If the annotation uses a gradual form (`...`) for the parameter list, then it can accept any kind of
+parameter with any type.
+
+```py
+def _(c: Callable[..., int]):
+    reveal_type(c())  # revealed: int
+    reveal_type(c(1))  # revealed: int
+    reveal_type(c(1, "str", False, a=[1, 2], b=(3, 4)))  # revealed: int
+```
+
+An invalid `Callable` form can accept any parameters and will return `Unknown`.
+
+```py
+# error: [invalid-type-form]
+def _(c: Callable[42, str]):
+    reveal_type(c())  # revealed: Unknown
+```

crates/red_knot_python_semantic/resources/mdtest/call/callable_instance.md

@@ -71,7 +71,7 @@ def _(flag: bool):
 
     a = NonCallable()
     # error: [call-non-callable] "Object of type `Literal[1]` is not callable"
-    reveal_type(a())  # revealed: int | Unknown
+    reveal_type(a())  # revealed: Unknown | int
 ```
 
 ## Call binding errors

crates/red_knot_python_semantic/resources/mdtest/call/function.md

@@ -37,8 +37,6 @@ def foo() -> int:
     return 42
 
 def decorator(func) -> Callable[[], int]:
-    # TODO: no error
-    # error: [invalid-return-type]
     return foo
 
 @decorator

crates/red_knot_python_semantic/resources/mdtest/call/union.md

@@ -40,7 +40,7 @@ def _(flag: bool):
         def f() -> int:
             return 1
     x = f()  # error: [call-non-callable] "Object of type `Literal[1]` is not callable"
-    reveal_type(x)  # revealed: int | Unknown
+    reveal_type(x)  # revealed: Unknown | int
 ```
 
 ## Multiple non-callable elements in a union
@@ -58,7 +58,7 @@ def _(flag: bool, flag2: bool):
             return 1
     # TODO we should mention all non-callable elements of the union
     # error: [call-non-callable] "Object of type `Literal[1]` is not callable"
-    # revealed: int | Unknown
+    # revealed: Unknown | int
     reveal_type(f())
 ```
 
@@ -148,3 +148,30 @@ def _(flag: bool):
     x = f(3)
     reveal_type(x)  # revealed: Unknown
 ```
+
+## Union including a special-cased function
+
+```py
+def _(flag: bool):
+    if flag:
+        f = str
+    else:
+        f = repr
+    reveal_type(str("string"))  # revealed: Literal["string"]
+    reveal_type(repr("string"))  # revealed: Literal["'string'"]
+    reveal_type(f("string"))  # revealed: Literal["string", "'string'"]
+```
+
+## Cannot use an argument as both a value and a type form
+
+```py
+from knot_extensions import is_fully_static
+
+def _(flag: bool):
+    if flag:
+        f = repr
+    else:
+        f = is_fully_static
+    # error: [conflicting-argument-forms] "Argument is used as both a value and a type form in call"
+    reveal_type(f(int))  # revealed: str | Literal[True]
+```

crates/red_knot_python_semantic/resources/mdtest/comparison/instances/membership_test.md

@@ -191,7 +191,7 @@ It may also be more appropriate to use `unsupported-operator` as the error code.
 
 ```py
 class NotBoolable:
-    __bool__ = 3
+    __bool__: int = 3
 
 class WithContains:
     def __contains__(self, item) -> NotBoolable:

crates/red_knot_python_semantic/resources/mdtest/comparison/instances/rich_comparison.md

@@ -355,7 +355,7 @@ element) of a chained comparison.
 
 ```py
 class NotBoolable:
-    __bool__ = 3
+    __bool__: int = 3
 
 class Comparable:
     def __lt__(self, item) -> NotBoolable:

crates/red_knot_python_semantic/resources/mdtest/comparison/tuples.md

@@ -355,7 +355,7 @@ def compute_chained_comparison():
 
 ```py
 class NotBoolable:
-    __bool__ = 5
+    __bool__: int = 5
 
 class Comparable:
     def __lt__(self, other) -> NotBoolable:
@@ -387,7 +387,7 @@ class A:
         return NotBoolable()
 
 class NotBoolable:
-    __bool__ = None
+    __bool__: None = None
 
 # error: [unsupported-bool-conversion]
 (A(),) == (A(),)

crates/red_knot_python_semantic/resources/mdtest/conditional/if_expression.md

@@ -40,7 +40,7 @@ def _(flag: bool):
 
 ```py
 class NotBoolable:
-    __bool__ = 3
+    __bool__: int = 3
 
 # error: [unsupported-bool-conversion] "Boolean conversion is unsupported for type `NotBoolable`; its `__bool__` method isn't callable"
 3 if NotBoolable() else 4

crates/red_knot_python_semantic/resources/mdtest/conditional/if_statement.md

@@ -152,7 +152,7 @@ def _(flag: bool):
 
 ```py
 class NotBoolable:
-    __bool__ = 3
+    __bool__: int = 3
 
 # error: [unsupported-bool-conversion] "Boolean conversion is unsupported for type `NotBoolable`; its `__bool__` method isn't callable"
 if NotBoolable():

crates/red_knot_python_semantic/resources/mdtest/conditional/match.md

@@ -48,7 +48,7 @@ def _(target: int):
 
 ```py
 class NotBoolable:
-    __bool__ = 3
+    __bool__: int = 3
 
 def _(target: int, flag: NotBoolable):
     y = 1

crates/red_knot_python_semantic/resources/mdtest/descriptor_protocol.md

@@ -32,14 +32,22 @@ reveal_type(c.ten)  # revealed: Literal[10]
 
 reveal_type(C.ten)  # revealed: Literal[10]
 
-# These are fine:
+# This is fine:
 c.ten = 10
-C.ten = 10
 
-# error: [invalid-assignment] "Object of type `Literal[11]` is not assignable to attribute `ten` of type `Literal[10]`"
+# error: [invalid-assignment] "Invalid assignment to data descriptor attribute `ten` on type `C` with custom `__set__` method"
 c.ten = 11
+```
 
-# error: [invalid-assignment] "Object of type `Literal[11]` is not assignable to attribute `ten` of type `Literal[10]`"
+When assigning to the `ten` attribute from the class object, we get an error. The descriptor
+protocol is *not* triggered in this case. Since the attribute is declared as `Ten` in the class
+body, we do not allow these assignments, preventing users from accidentally overwriting the data
+descriptor, which is what would happen at runtime:
+
+```py
+# error: [invalid-assignment] "Object of type `Literal[10]` is not assignable to attribute `ten` of type `Ten`"
+C.ten = 10
+# error: [invalid-assignment] "Object of type `Literal[11]` is not assignable to attribute `ten` of type `Ten`"
 C.ten = 11
 ```
 
@@ -66,13 +74,11 @@ c = C()
 reveal_type(c.flexible_int)  # revealed: int | None
 
 c.flexible_int = 42  # okay
-# TODO: This should not be an error
-# error: [invalid-assignment]
 c.flexible_int = "42"  # also okay!
 
 reveal_type(c.flexible_int)  # revealed: int | None
 
-# TODO: This should be an error
+# error: [invalid-assignment] "Invalid assignment to data descriptor attribute `flexible_int` on type `C` with custom `__set__` method"
 c.flexible_int = None  # not okay
 
 reveal_type(c.flexible_int)  # revealed: int | None
@@ -167,19 +173,24 @@ def f1(flag: bool):
             self.attr = "normal"
 
     reveal_type(C1().attr)  # revealed: Unknown | Literal["data", "normal"]
+
+    # Assigning to the attribute also causes no `possibly-unbound` diagnostic:
+    C1().attr = 1
 ```
 
 We never treat implicit instance attributes as definitely bound, so we fall back to the non-data
 descriptor here:
 
 ```py
-def f2(flag: bool):
-    class C2:
-        def f(self):
-            self.attr = "normal"
-        attr = NonDataDescriptor()
+class C2:
+    def f(self):
+        self.attr = "normal"
+    attr = NonDataDescriptor()
 
-    reveal_type(C2().attr)  # revealed: Unknown | Literal["non-data", "normal"]
+reveal_type(C2().attr)  # revealed: Unknown | Literal["non-data", "normal"]
+
+# Assignments always go to the instance attribute in this case
+C2().attr = 1
 ```
 
 ### Descriptors only work when used as class variables
@@ -198,6 +209,12 @@ class C:
         self.ten: Ten = Ten()
 
 reveal_type(C().ten)  # revealed: Ten
+
+C().ten = Ten()
+
+# The instance attribute is declared as `Ten`, so this is an
+# error: [invalid-assignment] "Object of type `Literal[10]` is not assignable to attribute `ten` of type `Ten`"
+C().ten = 10
 ```
 
 ## Descriptor protocol for class objects
@@ -219,7 +236,7 @@ class DataDescriptor:
     def __get__(self, instance: object, owner: type | None = None) -> Literal["data"]:
         return "data"
 
-    def __set__(self, instance: object, value: str) -> None:
+    def __set__(self, instance: object, value: int) -> None:
         pass
 
 class NonDataDescriptor:
@@ -246,7 +263,28 @@ reveal_type(C1.class_data_descriptor)  # revealed: Literal["data"]
 reveal_type(C1.class_non_data_descriptor)  # revealed: Literal["non-data"]
 ```
 
-Next, we demonstrate that a *metaclass data descriptor* takes precedence over all class-level
+Assignments to class object attribute only trigger the descriptor protocol if the data descriptor is
+on the metaclass:
+
+```py
+C1.meta_data_descriptor = 1
+
+# error: [invalid-assignment] "Invalid assignment to data descriptor attribute `meta_data_descriptor` on type `Literal[C1]` with custom `__set__` method"
+C1.meta_data_descriptor = "invalid"
+```
+
+When writing to a class-level data descriptor from the class object itself, the descriptor protocol
+is *not* triggered (this is in contrast to what happens when you read class-level descriptor
+attributes!). So the following assignment does not call `__set__`. At runtime, the assignment would
+overwrite the data descriptor, but the attribute is declared as `DataDescriptor` in the class body,
+so we do not allow this:
+
+```py
+# error: [invalid-assignment] "Object of type `Literal[1]` is not assignable to attribute `class_data_descriptor` of type `DataDescriptor`"
+C1.class_data_descriptor = 1
+```
+
+We now demonstrate that a *metaclass data descriptor* takes precedence over all class-level
 attributes:
 
 ```py
@@ -267,6 +305,14 @@ class C2(metaclass=Meta2):
 
 reveal_type(C2.meta_data_descriptor1)  # revealed: Literal["data"]
 reveal_type(C2.meta_data_descriptor2)  # revealed: Literal["data"]
+
+C2.meta_data_descriptor1 = 1
+C2.meta_data_descriptor2 = 1
+
+# error: [invalid-assignment]
+C2.meta_data_descriptor1 = "invalid"
+# error: [invalid-assignment]
+C2.meta_data_descriptor2 = "invalid"
 ```
 
 On the other hand, normal metaclass attributes and metaclass non-data descriptors are shadowed by
@@ -321,6 +367,16 @@ def _(flag: bool):
     reveal_type(C5.meta_data_descriptor1)  # revealed: Literal["data", "value on class"]
     # error: [possibly-unbound-attribute]
     reveal_type(C5.meta_data_descriptor2)  # revealed: Literal["data"]
+
+    # TODO: We currently emit two diagnostics here, corresponding to the two states of `flag`. The diagnostics are not
+    # wrong, but they could be subsumed under a higher-level diagnostic.
+
+    # error: [invalid-assignment] "Invalid assignment to data descriptor attribute `meta_data_descriptor1` on type `Literal[C5]` with custom `__set__` method"
+    # error: [invalid-assignment] "Object of type `None` is not assignable to attribute `meta_data_descriptor1` of type `Literal["value on class"]`"
+    C5.meta_data_descriptor1 = None
+
+    # error: [possibly-unbound-attribute]
+    C5.meta_data_descriptor2 = 1
 ```
 
 When a class-level attribute is possibly unbound, we union its (descriptor protocol) type with the
@@ -373,6 +429,11 @@ def _(flag: bool):
     reveal_type(C7.union_of_metaclass_data_descriptor_and_attribute)  # revealed: Literal["data", 2]
     reveal_type(C7.union_of_class_attributes)  # revealed: Literal[1, 2]
     reveal_type(C7.union_of_class_data_descriptor_and_attribute)  # revealed: Literal["data", 2]
+
+    C7.union_of_metaclass_attributes = 2 if flag else 1
+    C7.union_of_metaclass_data_descriptor_and_attribute = 2 if flag else 100
+    C7.union_of_class_attributes = 2 if flag else 1
+    C7.union_of_class_data_descriptor_and_attribute = 2 if flag else DataDescriptor()
 ```
 
 ## Descriptors distinguishing between class and instance access
@@ -469,7 +530,7 @@ c.name = "new"
 c.name = None
 
 # TODO: this should be an error, but with a proper error message
-# error: [invalid-assignment] "Object of type `Literal[42]` is not assignable to attribute `name` of type `<bound method `name` of `C`>`"
+# error: [invalid-assignment] "Implicit shadowing of function `name`; annotate to make it explicit if this is intentional"
 c.name = 42
 ```
 

crates/red_knot_python_semantic/resources/mdtest/diagnostics/attribute_assignment.md

@@ -0,0 +1,149 @@
+# Attribute assignment
+
+<!-- snapshot-diagnostics -->
+
+This test suite demonstrates various kinds of diagnostics that can be emitted in a
+`obj.attr = value` assignment.
+
+## Instance attributes with class-level defaults
+
+These can be set on instances and on class objects.
+
+```py
+class C:
+    attr: int = 0
+
+instance = C()
+instance.attr = 1  # fine
+instance.attr = "wrong"  # error: [invalid-assignment]
+
+C.attr = 1  # fine
+C.attr = "wrong"  # error: [invalid-assignment]
+```
+
+## Pure instance attributes
+
+These can only be set on instances. When trying to set them on class objects, we generate a useful
+diagnostic that mentions that the attribute is only available on instances.
+
+```py
+class C:
+    def __init__(self):
+        self.attr: int = 0
+
+instance = C()
+instance.attr = 1  # fine
+instance.attr = "wrong"  # error: [invalid-assignment]
+
+C.attr = 1  # error: [invalid-attribute-access]
+```
+
+## `ClassVar`s
+
+These can only be set on class objects. When trying to set them on instances, we generate a useful
+diagnostic that mentions that the attribute is only available on class objects.
+
+```py
+from typing import ClassVar
+
+class C:
+    attr: ClassVar[int] = 0
+
+C.attr = 1  # fine
+C.attr = "wrong"  # error: [invalid-assignment]
+
+instance = C()
+instance.attr = 1  # error: [invalid-attribute-access]
+```
+
+## Unknown attributes
+
+When trying to set an attribute that is not defined, we also emit errors:
+
+```py
+class C: ...
+
+C.non_existent = 1  # error: [unresolved-attribute]
+
+instance = C()
+instance.non_existent = 1  # error: [unresolved-attribute]
+```
+
+## Possibly-unbound attributes
+
+When trying to set an attribute that is not defined in all branches, we emit errors:
+
+```py
+def _(flag: bool) -> None:
+    class C:
+        if flag:
+            attr: int = 0
+
+    C.attr = 1  # error: [possibly-unbound-attribute]
+
+    instance = C()
+    instance.attr = 1  # error: [possibly-unbound-attribute]
+```
+
+## Data descriptors
+
+When assigning to a data descriptor attribute, we implicitly call the descriptor's `__set__` method.
+This can lead to various kinds of diagnostics.
+
+### Invalid argument type
+
+```py
+class Descriptor:
+    def __set__(self, instance: object, value: int) -> None:
+        pass
+
+class C:
+    attr: Descriptor = Descriptor()
+
+instance = C()
+instance.attr = 1  # fine
+
+# TODO: ideally, we would mention why this is an invalid assignment (wrong argument type for `value` parameter)
+instance.attr = "wrong"  # error: [invalid-assignment]
+```
+
+### Invalid `__set__` method signature
+
+```py
+class WrongDescriptor:
+    def __set__(self, instance: object, value: int, extra: int) -> None:
+        pass
+
+class C:
+    attr: WrongDescriptor = WrongDescriptor()
+
+instance = C()
+
+# TODO: ideally, we would mention why this is an invalid assignment (wrong number of arguments for `__set__`)
+instance.attr = 1  # error: [invalid-assignment]
+```
+
+## Setting attributes on union types
+
+```py
+def _(flag: bool) -> None:
+    if flag:
+        class C1:
+            attr: int = 0
+
+    else:
+        class C1:
+            attr: str = ""
+
+    # TODO: The error message here could be improved to explain why the assignment fails.
+    C1.attr = 1  # error: [invalid-assignment]
+
+    class C2:
+        if flag:
+            attr: int = 0
+        else:
+            attr: str = ""
+
+    # TODO: This should be an error
+    C2.attr = 1
+```

crates/red_knot_python_semantic/resources/mdtest/directives/cast.md

@@ -13,15 +13,16 @@ reveal_type(cast("str", True))  # revealed: str
 
 reveal_type(cast(int | str, 1))  # revealed: int | str
 
+reveal_type(cast(val="foo", typ=int))  # revealed: int
+
 # error: [invalid-type-form]
 reveal_type(cast(Literal, True))  # revealed: Unknown
 
-# TODO: These should be errors
-cast(1)
-cast(str)
-cast(str, b"ar", "foo")
+# error: [invalid-type-form]
+reveal_type(cast(1, True))  # revealed: Unknown
 
-# TODO: Either support keyword arguments properly,
-# or give a comprehensible error message saying they're unsupported
-cast(val="foo", typ=int)  # error: [unresolved-reference] "Name `foo` used when not defined"
+# error: [missing-argument] "No argument provided for required parameter `val` of function `cast`"
+cast(str)
+# error: [too-many-positional-arguments] "Too many positional arguments to function `cast`: expected 2, got 3"
+cast(str, b"ar", "foo")
 ```

crates/red_knot_python_semantic/resources/mdtest/exception/except_star.md

@@ -24,7 +24,7 @@ try:
     help()
 except* OSError as e:
     # TODO: more precise would be `ExceptionGroup[OSError]` --Alex
-    # (needs homogenous tuples + generics)
+    # (needs homogeneous tuples + generics)
     reveal_type(e)  # revealed: BaseExceptionGroup
 ```
 
@@ -35,7 +35,7 @@ try:
     help()
 except* (TypeError, AttributeError) as e:
     # TODO: more precise would be `ExceptionGroup[TypeError | AttributeError]` --Alex
-    # (needs homogenous tuples + generics)
+    # (needs homogeneous tuples + generics)
     reveal_type(e)  # revealed: BaseExceptionGroup
 ```
 

crates/red_knot_python_semantic/resources/mdtest/expression/assert.md

@@ -2,7 +2,7 @@
 
 ```py
 class NotBoolable:
-    __bool__ = 3
+    __bool__: int = 3
 
 # error: [unsupported-bool-conversion] "Boolean conversion is unsupported for type `NotBoolable`; its `__bool__` method isn't callable"
 assert NotBoolable()

crates/red_knot_python_semantic/resources/mdtest/expression/boolean.md

@@ -121,7 +121,7 @@ if NotBoolable():
 
 ```py
 class NotBoolable:
-    __bool__ = None
+    __bool__: None = None
 
 # error: [unsupported-bool-conversion] "Boolean conversion is unsupported for type `NotBoolable`; its `__bool__` method isn't callable"
 if NotBoolable():
@@ -133,9 +133,9 @@ if NotBoolable():
 ```py
 def test(cond: bool):
     class NotBoolable:
-        __bool__ = None if cond else 3
+        __bool__: int | None = None if cond else 3
 
-    # error: [unsupported-bool-conversion] "Boolean conversion is unsupported for type `NotBoolable`; it incorrectly implements `__bool__`"
+    # error: [unsupported-bool-conversion] "Boolean conversion is unsupported for type `NotBoolable`; its `__bool__` method isn't callable"
     if NotBoolable():
         ...
 ```
@@ -145,7 +145,7 @@ def test(cond: bool):
 ```py
 def test(cond: bool):
     class NotBoolable:
-        __bool__ = None
+        __bool__: None = None
 
     a = 10 if cond else NotBoolable()
 

crates/red_knot_python_semantic/resources/mdtest/expression/lambda.md

@@ -5,10 +5,10 @@
 `lambda` expressions can be defined without any parameters.
 
 ```py
-reveal_type(lambda: 1)  # revealed: () -> @Todo(lambda return type)
+reveal_type(lambda: 1)  # revealed: () -> Unknown
 
 # error: [unresolved-reference]
-reveal_type(lambda: a)  # revealed: () -> @Todo(lambda return type)
+reveal_type(lambda: a)  # revealed: () -> Unknown
 ```
 
 ## With parameters
@@ -17,45 +17,45 @@ Unlike parameters in function definition, the parameters in a `lambda` expressio
 annotated.
 
 ```py
-reveal_type(lambda a: a)  # revealed: (a) -> @Todo(lambda return type)
-reveal_type(lambda a, b: a + b)  # revealed: (a, b) -> @Todo(lambda return type)
+reveal_type(lambda a: a)  # revealed: (a) -> Unknown
+reveal_type(lambda a, b: a + b)  # revealed: (a, b) -> Unknown
 ```
 
 But, it can have default values:
 
 ```py
-reveal_type(lambda a=1: a)  # revealed: (a=Literal[1]) -> @Todo(lambda return type)
-reveal_type(lambda a, b=2: a)  # revealed: (a, b=Literal[2]) -> @Todo(lambda return type)
+reveal_type(lambda a=1: a)  # revealed: (a=Literal[1]) -> Unknown
+reveal_type(lambda a, b=2: a)  # revealed: (a, b=Literal[2]) -> Unknown
 ```
 
 And, positional-only parameters:
 
 ```py
-reveal_type(lambda a, b, /, c: c)  # revealed: (a, b, /, c) -> @Todo(lambda return type)
+reveal_type(lambda a, b, /, c: c)  # revealed: (a, b, /, c) -> Unknown
 ```
 
 And, keyword-only parameters:
 
 ```py
-reveal_type(lambda a, *, b=2, c: b)  # revealed: (a, *, b=Literal[2], c) -> @Todo(lambda return type)
+reveal_type(lambda a, *, b=2, c: b)  # revealed: (a, *, b=Literal[2], c) -> Unknown
 ```
 
 And, variadic parameter:
 
 ```py
-reveal_type(lambda *args: args)  # revealed: (*args) -> @Todo(lambda return type)
+reveal_type(lambda *args: args)  # revealed: (*args) -> Unknown
 ```
 
 And, keyword-varidic parameter:
 
 ```py
-reveal_type(lambda **kwargs: kwargs)  # revealed: (**kwargs) -> @Todo(lambda return type)
+reveal_type(lambda **kwargs: kwargs)  # revealed: (**kwargs) -> Unknown
 ```
 
 Mixing all of them together:
 
 ```py
-# revealed: (a, b, /, c=Literal[True], *args, *, d=Literal["default"], e=Literal[5], **kwargs) -> @Todo(lambda return type)
+# revealed: (a, b, /, c=Literal[True], *args, *, d=Literal["default"], e=Literal[5], **kwargs) -> Unknown
 reveal_type(lambda a, b, /, c=True, *args, d="default", e=5, **kwargs: None)
 ```
 
@@ -76,7 +76,7 @@ Using a parameter with default value:
 lambda x=1: reveal_type(x)  # revealed: Unknown | Literal[1]
 ```
 
-Using a variadic paramter:
+Using a variadic parameter:
 
 ```py
 # TODO: should be `tuple[Unknown, ...]` (needs generics)
@@ -96,5 +96,24 @@ Here, a `lambda` expression is used as the default value for a parameter in anot
 expression.
 
 ```py
-reveal_type(lambda a=lambda x, y: 0: 2)  # revealed: (a=(x, y) -> @Todo(lambda return type)) -> @Todo(lambda return type)
+reveal_type(lambda a=lambda x, y: 0: 2)  # revealed: (a=(x, y) -> Unknown) -> Unknown
+```
+
+## Assignment
+
+This does not enumerate all combinations of parameter kinds as that should be covered by the
+[subtype tests for callable types](./../type_properties/is_subtype_of.md#callable).
+
+```py
+from typing import Callable
+
+a1: Callable[[], None] = lambda: None
+a2: Callable[[int], None] = lambda x: None
+a3: Callable[[int, int], None] = lambda x, y, z=1: None
+a4: Callable[[int, int], None] = lambda *args: None
+
+# error: [invalid-assignment]
+a5: Callable[[], None] = lambda x: None
+# error: [invalid-assignment]
+a6: Callable[[int], None] = lambda: None
 ```

crates/red_knot_python_semantic/resources/mdtest/expression/len.md

@@ -229,6 +229,6 @@ reveal_type(len(SecondRequiredArgument()))  # revealed: Literal[1]
 ```py
 class NoDunderLen: ...
 
-# TODO: Emit a diagnostic
+# error: [invalid-argument-type]
 reveal_type(len(NoDunderLen()))  # revealed: int
 ```

crates/red_knot_python_semantic/resources/mdtest/function/return_type.md

@@ -57,12 +57,30 @@ def f() -> int:
 ### In Protocol
 
 ```py
-from typing import Protocol
+from typing import Protocol, TypeVar
 
 class Bar(Protocol):
+    def f(self) -> int: ...
+
+class Baz(Bar):
+    # error: [invalid-return-type]
+    def f(self) -> int: ...
+
+T = TypeVar("T")
+
+class Qux(Protocol[T]):
     # TODO: no error
     # error: [invalid-return-type]
     def f(self) -> int: ...
+
+class Foo(Protocol):
+    def f[T](self, v: T) -> T: ...
+
+t = (Protocol, int)
+reveal_type(t[0])  # revealed: typing.Protocol
+
+class Lorem(t[0]):
+    def f(self) -> int: ...
 ```
 
 ### In abstract method
@@ -72,12 +90,20 @@ from abc import ABC, abstractmethod
 
 class Foo(ABC):
     @abstractmethod
-    # TODO: no error
-    # error: [invalid-return-type]
     def f(self) -> int: ...
     @abstractmethod
-    # error: [invalid-return-type]
     def g[T](self, x: T) -> T: ...
+
+class Bar[T](ABC):
+    @abstractmethod
+    def f(self) -> int: ...
+    @abstractmethod
+    def g[T](self, x: T) -> T: ...
+
+# error: [invalid-return-type]
+def f() -> int: ...
+@abstractmethod  # Semantically meaningless, accepted nevertheless
+def g() -> int: ...
 ```
 
 ### In overload

crates/red_knot_python_semantic/resources/mdtest/generics/classes.md

@@ -183,8 +183,9 @@ In a non-stub file, without stringified forward references, this raises a `NameE
 ```py
 class Base[T]: ...
 
-# TODO: error: [unresolved-reference]
+# TODO: the unresolved-reference error is correct, the non-subscriptable is not
 # error: [non-subscriptable]
+# error: [unresolved-reference]
 class Sub(Base[Sub]): ...
 ```
 

crates/red_knot_python_semantic/resources/mdtest/generics/scoping.md

@@ -113,7 +113,7 @@ class Legacy(Generic[T]):
 
 legacy: Legacy[int] = Legacy()
 # TODO: revealed: str
-reveal_type(legacy.m(1, "string"))  # revealed: @Todo(Invalid or unsupported `Instance` in `Type::to_type_expression`)
+reveal_type(legacy.m(1, "string"))  # revealed: @Todo(Support for `typing.TypeVar` instances in type expressions)
 ```
 
 With PEP 695 syntax, it is clearer that the method uses a separate typevar:

crates/red_knot_python_semantic/resources/mdtest/import/basic.md

@@ -140,3 +140,27 @@ import b.foo  # error: [unresolved-import] "Cannot resolve import `b.foo`"
 
 ```py
 ```
+
+## Long paths
+
+It's unlikely that a single module component is as long as in this example, but Windows treats paths
+that are longer than 200 and something specially. This test ensures that Red Knot can handle those
+paths gracefully.
+
+```toml
+system = "os"
+```
+
+`AveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPath/__init__.py`:
+
+```py
+class Foo: ...
+```
+
+```py
+from AveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPathAveryLongPath import (
+    Foo,
+)
+
+reveal_type(Foo())  # revealed: Foo
+```

crates/red_knot_python_semantic/resources/mdtest/import/case_sensitive.md

@@ -1,10 +1,7 @@
 # Case Sensitive Imports
 
 ```toml
-# TODO: This test should use the real file system instead of the memory file system.
-# but we can't change the file system yet because the tests would then start failing for 
-# case-insensitive file systems.
-#system = "os"
+system = "os"
 ```
 
 Python's import system is case-sensitive even on case-insensitive file system. This means, importing

crates/red_knot_python_semantic/resources/mdtest/import/star.md

@@ -0,0 +1,951 @@
+# Wildcard (`*`) imports
+
+See the [Python language reference for import statements].
+
+## Basic functionality
+
+### A simple `*` import
+
+`a.py`:
+
+```py
+X: bool = True
+```
+
+`b.py`:
+
+```py
+from a import *
+
+reveal_type(X)  # revealed: bool
+print(Y)  # error: [unresolved-reference]
+```
+
+### Overriding existing definition
+
+`a.py`:
+
+```py
+X: bool = True
+```
+
+`b.py`:
+
+```py
+X = 42
+reveal_type(X)  # revealed: Literal[42]
+
+from a import *
+
+reveal_type(X)  # revealed: bool
+```
+
+### Overridden by later definition
+
+`a.py`:
+
+```py
+X: bool = True
+```
+
+`b.py`:
+
+```py
+from a import *
+
+reveal_type(X)  # revealed: bool
+X = False
+reveal_type(X)  # revealed: Literal[False]
+```
+
+### Reaching across many modules
+
+`a.py`:
+
+```py
+X: bool = True
+```
+
+`b.py`:
+
+```py
+from a import *
+```
+
+`c.py`:
+
+```py
+from b import *
+```
+
+`d.py`:
+
+```py
+from c import *
+
+reveal_type(X)  # revealed: bool
+```
+
+### A wildcard import constitutes a re-export
+
+`a.pyi`:
+
+```pyi
+X: bool = True
+```
+
+`b.pyi`:
+
+```pyi
+Y: bool = False
+```
+
+`c.pyi`:
+
+```pyi
+from a import *
+from b import Y
+```
+
+`d.py`:
+
+```py
+# `X` is accessible because the `*` import in `c` re-exports it from `c`
+from c import X
+
+# but `Y` is not because the `from b import Y` import does *not* constitute a re-export
+from c import Y  # error: [unresolved-import]
+```
+
+### Global-scope symbols defined using walrus expressions
+
+`a.py`:
+
+```py
+X = (Y := 3) + 4
+```
+
+`b.py`:
+
+```py
+from a import *
+
+reveal_type(X)  # revealed: Unknown | Literal[7]
+reveal_type(Y)  # revealed: Unknown | Literal[3]
+```
+
+### Global-scope symbols defined in many other ways
+
+`a.py`:
+
+```py
+import typing
+from collections import OrderedDict
+from collections import OrderedDict as Foo
+
+A, B = 1, (C := 2)
+D: (E := 4) = (F := 5)  # error: [invalid-type-form]
+
+for G in [1]:
+    ...
+
+for (H := 4).whatever in [2]:  # error: [unresolved-attribute]
+    ...
+
+class I: ...
+
+def J(): ...
+
+type K = int
+
+with () as L:  # error: [invalid-context-manager]
+    ...
+
+match 42:
+    case {"something": M}:
+        ...
+    case [*N]:
+        ...
+    case [O]:
+        ...
+    case P | Q:
+        ...
+    case object(foo=R):
+        ...
+    case object(S):
+        ...
+    case T:
+        ...
+```
+
+`b.py`:
+
+```py
+from a import *
+
+# fmt: off
+
+print((
+    A,
+    B,
+    C,
+    D,
+    E,
+    F,
+    G,  # TODO: could emit diagnostic about being possibly unbound
+    H,
+    I,
+    J,
+    K,
+    L,
+    M,  # TODO: could emit diagnostic about being possibly unbound
+    N,  # TODO: could emit diagnostic about being possibly unbound
+    O,  # TODO: could emit diagnostic about being possibly unbound
+    P,  # TODO: could emit diagnostic about being possibly unbound
+    Q,  # TODO: could emit diagnostic about being possibly unbound
+    R,  # TODO: could emit diagnostic about being possibly unbound
+    S,  # TODO: could emit diagnostic about being possibly unbound
+    T,  # TODO: could emit diagnostic about being possibly unbound
+    typing,
+    OrderedDict,
+    Foo,
+))
+```
+
+### Definitions in function-like scopes are not global definitions
+
+Except for some cases involving walrus expressions inside comprehension scopes.
+
+`a.py`:
+
+```py
+class Iterator:
+    def __next__(self) -> int:
+        return 42
+
+class Iterable:
+    def __iter__(self) -> Iterator:
+        return Iterator()
+
+[a for a in Iterable()]
+{b for b in Iterable()}
+{c: c for c in Iterable()}
+(d for d in Iterable())
+lambda e: (f := 42)
+
+# Definitions created by walruses in a comprehension scope are unique;
+# they "leak out" of the scope and are stored in the surrounding scope
+[(g := h * 2) for h in Iterable()]
+[i for j in Iterable() if (i := j - 10) > 0]
+{(k := l * 2): (m := l * 3) for l in Iterable()}
+list(((o := p * 2) for p in Iterable()))
+
+# A walrus expression nested inside several scopes *still* leaks out
+# to the global scope:
+[[[[(q := r) for r in Iterable()]] for _ in range(42)] for _ in range(42)]
+
+# A walrus inside a lambda inside a comprehension does not leak out
+[(lambda s=s: (t := 42))() for s in Iterable()]
+```
+
+`b.py`:
+
+```py
+from a import *
+
+# error: [unresolved-reference]
+reveal_type(a)  # revealed: Unknown
+# error: [unresolved-reference]
+reveal_type(b)  # revealed: Unknown
+# error: [unresolved-reference]
+reveal_type(c)  # revealed: Unknown
+# error: [unresolved-reference]
+reveal_type(d)  # revealed: Unknown
+# error: [unresolved-reference]
+reveal_type(e)  # revealed: Unknown
+# error: [unresolved-reference]
+reveal_type(f)  # revealed: Unknown
+# error: [unresolved-reference]
+reveal_type(h)  # revealed: Unknown
+# error: [unresolved-reference]
+reveal_type(j)  # revealed: Unknown
+# error: [unresolved-reference]
+reveal_type(p)  # revealed: Unknown
+# error: [unresolved-reference]
+reveal_type(r)  # revealed: Unknown
+# error: [unresolved-reference]
+reveal_type(s)  # revealed: Unknown
+# error: [unresolved-reference]
+reveal_type(t)  # revealed: Unknown
+
+# TODO: these should all reveal `Unknown | int`.
+# (We don't generally model elsewhere in red-knot that bindings from walruses
+# "leak" from comprehension scopes into outer scopes, but we should.)
+# See https://github.com/astral-sh/ruff/issues/16954
+reveal_type(g)  # revealed: Unknown
+reveal_type(i)  # revealed: Unknown
+reveal_type(k)  # revealed: Unknown
+reveal_type(m)  # revealed: Unknown
+reveal_type(o)  # revealed: Unknown
+reveal_type(q)  # revealed: Unknown
+```
+
+### An annotation without a value is a definition in a stub but not a `.py` file
+
+`a.pyi`:
+
+```pyi
+X: bool
+```
+
+`b.py`:
+
+```py
+Y: bool
+```
+
+`c.py`:
+
+```py
+from a import *
+from b import *
+
+reveal_type(X)  # revealed: bool
+# error: [unresolved-reference]
+reveal_type(Y)  # revealed: Unknown
+```
+
+### Global-scope names starting with underscores
+
+Global-scope names starting with underscores are not imported from a `*` import (unless the module
+has `__all__` and they are included in `__all__`):
+
+`a.py`:
+
+```py
+_private: bool = False
+__protected: bool = False
+__dunder__: bool = False
+___thunder___: bool = False
+
+Y: bool = True
+```
+
+`b.py`:
+
+```py
+from a import *
+
+# error: [unresolved-reference]
+reveal_type(_private)  # revealed: Unknown
+# error: [unresolved-reference]
+reveal_type(__protected)  # revealed: Unknown
+# error: [unresolved-reference]
+reveal_type(__dunder__)  # revealed: Unknown
+# error: [unresolved-reference]
+reveal_type(___thunder___)  # revealed: Unknown
+
+reveal_type(Y)  # revealed: bool
+```
+
+### All public symbols are considered re-exported from `.py` files
+
+For `.py` files, we should consider all public symbols in the global namespace exported by that
+module when considering which symbols are made available by a `*` import. Here, `b.py` does not use
+the explicit `from a import X as X` syntax to explicitly mark it as publicly re-exported, and `X` is
+not included in `__all__`; whether it should be considered a "public name" in module `b` is
+ambiguous. We could consider an opt-in rule to warn the user when they use `X` in `c.py` that it was
+not included in `__all__` and was not marked as an explicit re-export.
+
+`a.py`:
+
+```py
+X: bool = True
+```
+
+`b.py`:
+
+```py
+from a import X
+```
+
+`c.py`:
+
+```py
+from b import *
+
+# TODO: we could consider an opt-in diagnostic (see prose commentary above)
+reveal_type(X)  # revealed: bool
+```
+
+### Only explicit re-exports are considered re-exported from `.pyi` files
+
+For `.pyi` files, we should consider all imports private to the stub unless they are included in
+`__all__` or use the explicit `from foo import X as X` syntax.
+
+`a.pyi`:
+
+```pyi
+X: bool = True
+Y: bool = True
+```
+
+`b.pyi`:
+
+```pyi
+from a import X, Y as Y
+```
+
+`c.py`:
+
+```py
+from b import *
+
+# This error is correct, as `X` is not considered re-exported from module `b`:
+#
+# error: [unresolved-reference]
+reveal_type(X)  # revealed: Unknown
+
+reveal_type(Y)  # revealed: bool
+```
+
+### Symbols in statically known branches
+
+```toml
+[environment]
+python-version = "3.11"
+```
+
+`a.py`:
+
+```py
+import sys
+
+if sys.version_info >= (3, 11):
+    X: bool = True
+else:
+    Y: bool = False
+    Z: int = 42
+```
+
+`b.py`:
+
+```py
+Z: bool = True
+
+from a import *
+
+reveal_type(X)  # revealed: bool
+
+# TODO: should emit error: [unresolved-reference]
+reveal_type(Y)  # revealed: Unknown
+
+# TODO: The `*` import should not be considered a redefinition
+# of the global variable in this module, as the symbol in
+# the `a` module is in a branch that is statically known
+# to be dead code given the `python-version` configuration.
+# Thus this should reveal `Literal[True]`.
+reveal_type(Z)  # revealed: Unknown
+```
+
+### Relative `*` imports
+
+Relative `*` imports are also supported by Python:
+
+`a/__init__.py`:
+
+```py
+```
+
+`a/foo.py`:
+
+```py
+X: bool = True
+```
+
+`a/bar.py`:
+
+```py
+from .foo import *
+
+reveal_type(X)  # revealed: bool
+```
+
+## Star imports with `__all__`
+
+If a module `x` contains `__all__`, all symbols included in `x.__all__` are imported by
+`from x import *` (but no other symbols are).
+
+### Simple tuple `__all__`
+
+`a.py`:
+
+```py
+__all__ = ("X", "_private", "__protected", "__dunder__", "___thunder___")
+
+X: bool = True
+_private: bool = True
+__protected: bool = True
+__dunder__: bool = True
+___thunder___: bool = True
+
+Y: bool = False
+```
+
+`b.py`:
+
+```py
+from a import *
+
+reveal_type(X)  # revealed: bool
+
+# TODO none of these should error, should all reveal `bool`
+# error: [unresolved-reference]
+reveal_type(_private)  # revealed: Unknown
+# error: [unresolved-reference]
+reveal_type(__protected)  # revealed: Unknown
+# error: [unresolved-reference]
+reveal_type(__dunder__)  # revealed: Unknown
+# error: [unresolved-reference]
+reveal_type(___thunder___)  # revealed: Unknown
+
+# TODO: should emit [unresolved-reference] diagnostic & reveal `Unknown`
+reveal_type(Y)  # revealed: bool
+```
+
+### Simple list `__all__`
+
+`a.py`:
+
+```py
+__all__ = ["X"]
+
+X: bool = True
+Y: bool = False
+```
+
+`b.py`:
+
+```py
+from a import *
+
+reveal_type(X)  # revealed: bool
+
+# TODO: should emit [unresolved-reference] diagnostic & reveal `Unknown`
+reveal_type(Y)  # revealed: bool
+```
+
+### `__all__` with additions later on in the global scope
+
+The [typing spec] lists certain modifications to `__all__` that must be understood by type checkers.
+
+`a.py`:
+
+```py
+FOO: bool = True
+
+__all__ = ["FOO"]
+```
+
+`b.py`:
+
+```py
+import a
+from a import *
+
+__all__ = ["A"]
+__all__ += ["B"]
+__all__.append("C")
+__all__.extend(["D"])
+__all__.extend(("E",))
+__all__.extend(a.__all__)
+
+A: bool = True
+B: bool = True
+C: bool = True
+D: bool = True
+E: bool = True
+F: bool = False
+```
+
+`c.py`:
+
+```py
+from b import *
+
+reveal_type(A)  # revealed: bool
+reveal_type(B)  # revealed: bool
+reveal_type(C)  # revealed: bool
+reveal_type(D)  # revealed: bool
+reveal_type(E)  # revealed: bool
+reveal_type(FOO)  # revealed: bool
+
+# TODO should error with [unresolved-reference] & reveal `Unknown`
+reveal_type(F)  # revealed: bool
+```
+
+### `__all__` with subtractions later on in the global scope
+
+Whereas there are many ways of adding to `__all__` that type checkers must support, there is only
+one way of subtracting from `__all__` that type checkers are required to support:
+
+`a.py`:
+
+```py
+__all__ = ["A", "B"]
+__all__.remove("A")
+
+A: bool = True
+B: bool = True
+```
+
+`b.py`:
+
+```py
+from a import *
+
+reveal_type(A)  # revealed: bool
+
+# TODO should emit an [unresolved-reference] diagnostic & reveal `Unknown`
+reveal_type(B)  # revealed: bool
+```
+
+### Invalid `__all__`
+
+If `a.__all__` contains a member that does not refer to a symbol with bindings in the global scope,
+a wildcard import from module `a` will fail at runtime.
+
+TODO: Should we:
+
+1. Emit a diagnostic at the invalid definition of `__all__` (which will not fail at runtime)?
+1. Emit a diagnostic at the star-import from the module with the invalid `__all__` (which _will_
+    fail at runtime)?
+1. Emit a diagnostic on both?
+
+`a.py`:
+
+```py
+__all__ = ["a", "b"]
+
+a = 42
+```
+
+`b.py`:
+
+```py
+# TODO we should consider emitting a diagnostic here (see prose description above)
+from a import *  # fails with `AttributeError: module 'foo' has no attribute 'b'` at runtime
+```
+
+### Dynamic `__all__`
+
+If `__all__` contains members that are dynamically computed, we should check that all members of
+`__all__` are assignable to `str`. For the purposes of evaluating `*` imports, however, we should
+treat the module as though it has no `__all__` at all: all global-scope members of the module should
+be considered imported by the import statement. We should probably also emit a warning telling the
+user that we cannot statically determine the elements of `__all__`.
+
+`a.py`:
+
+```py
+def f() -> str:
+    return "f"
+
+def g() -> int:
+    return 42
+
+# TODO we should emit a warning here for the dynamically constructed `__all__` member.
+__all__ = [f()]
+```
+
+`b.py`:
+
+```py
+from a import *
+
+# At runtime, `f` is imported but `g` is not; to avoid false positives, however,
+# we treat `a` as though it does not have `__all__` at all,
+# which would imply that both symbols would be present.
+reveal_type(f)  # revealed: Literal[f]
+reveal_type(g)  # revealed: Literal[g]
+```
+
+### `__all__` conditionally defined in a statically known branch
+
+```toml
+[environment]
+python-version = "3.11"
+```
+
+`a.py`:
+
+```py
+import sys
+
+X: bool = True
+
+if sys.version_info >= (3, 11):
+    __all__ = ["X", "Y"]
+    Y: bool = True
+else:
+    __all__ = ("Z",)
+    Z: bool = True
+```
+
+`b.py`:
+
+```py
+from a import *
+
+reveal_type(X)  # revealed: bool
+reveal_type(Y)  # revealed: bool
+
+# TODO: should error with [unresolved-reference]
+reveal_type(Z)  # revealed: Unknown
+```
+
+### `__all__` conditionally mutated in a statically known branch
+
+```toml
+[environment]
+python-version = "3.11"
+```
+
+`a.py`:
+
+```py
+import sys
+
+__all__ = ["X"]
+X: bool = True
+
+if sys.version_info >= (3, 11):
+    __all__.append("Y")
+    Y: bool = True
+else:
+    __all__.append("Z")
+    Z: bool = True
+```
+
+`b.py`:
+
+```py
+from a import *
+
+reveal_type(X)  # revealed: bool
+reveal_type(Y)  # revealed: bool
+
+# TODO should have an [unresolved-reference] diagnostic
+reveal_type(Z)  # revealed: Unknown
+```
+
+### Empty `__all__`
+
+An empty `__all__` is valid, but a `*` import from a module with an empty `__all__` results in 0
+bindings being added from the import:
+
+`a.py`:
+
+```py
+X: bool = True
+
+__all__ = ()
+```
+
+`b.py`:
+
+```py
+Y: bool = True
+
+__all__ = []
+```
+
+`c.py`:
+
+```py
+from a import *
+from b import *
+
+# TODO: both of these should have [unresolved-reference] diagnostics and reveal `Unknown`
+reveal_type(X)  # revealed: bool
+reveal_type(Y)  # revealed: bool
+```
+
+### `__all__` in a stub file
+
+If a name is included in `__all__` in a stub file, it is considered re-exported even if it was only
+defined using an import without the explicit `from foo import X as X` syntax:
+
+`a.py`:
+
+```py
+X: bool = True
+Y: bool = True
+```
+
+`b.py`:
+
+```py
+from a import X, Y
+
+__all__ = ["X"]
+```
+
+`c.py`:
+
+```py
+from b import *
+
+reveal_type(X)  # revealed: bool
+
+# TODO this should have an [unresolved-reference] diagnostic and reveal `Unknown`
+reveal_type(Y)  # revealed: bool
+```
+
+## `global` statements in non-global scopes
+
+A `global` statement in a nested function scope, combined with a definition in the same function
+scope of the name that was declared `global`, can add a symbol to the global namespace.
+
+`a.py`:
+
+```py
+def f():
+    global g, h
+
+    g: bool = True
+
+f()
+```
+
+`b.py`:
+
+```py
+from a import *
+
+reveal_type(f)  # revealed: Literal[f]
+
+# TODO: false positive, should be `bool` with no diagnostic
+# error: [unresolved-reference]
+reveal_type(g)  # revealed: Unknown
+
+# this diagnostic is accurate, though!
+# error: [unresolved-reference]
+reveal_type(h)  # revealed: Unknown
+```
+
+## Cyclic star imports
+
+Believe it or not, this code does _not_ raise an exception at runtime!
+
+`a.py`:
+
+```py
+from b import *
+
+A: bool = True
+```
+
+`b.py`:
+
+```py
+from a import *
+
+B: bool = True
+```
+
+`c.py`:
+
+```py
+from a import *
+
+reveal_type(A)  # revealed: bool
+reveal_type(B)  # revealed: bool
+```
+
+## Integration test: `collections.abc`
+
+The `collections.abc` standard-library module provides a good integration test, as all its symbols
+are present due to `*` imports.
+
+```py
+import typing
+import collections.abc
+
+reveal_type(collections.abc.Sequence)  # revealed: Literal[Sequence]
+reveal_type(collections.abc.Callable)  # revealed: typing.Callable
+```
+
+## Invalid `*` imports
+
+### Unresolved module
+
+If the module is unresolved, we emit a diagnostic just like for any other unresolved import:
+
+```py
+# TODO: not a great error message
+from foo import *  # error: [unresolved-import] "Cannot resolve import `foo`"
+```
+
+### Nested scope
+
+A `*` import in a nested scope are always a syntax error. Red-knot does not infer any bindings from
+them:
+
+`a.py`:
+
+```py
+X: bool = True
+```
+
+`b.py`:
+
+```py
+def f():
+    # TODO: we should emit a syntax errror here (tracked by https://github.com/astral-sh/ruff/issues/11934)
+    from a import *
+
+    # error: [unresolved-reference]
+    reveal_type(X)  # revealed: Unknown
+```
+
+### `*` combined with other aliases in the list
+
+`a.py`:
+
+```py
+X: bool = True
+_Y: bool = False
+_Z: bool = True
+```
+
+`b.py`:
+
+<!-- blacken-docs:off -->
+
+```py
+from a import *, _Y  # error: [invalid-syntax]
+
+# The import statement above is invalid syntax,
+# but it's pretty obvious that the user wanted to do a `*` import,
+# so we import all public names from `a` anyway, to minimize cascading errors
+reveal_type(X)  # revealed: bool
+reveal_type(_Y)  # revealed: bool
+```
+
+These tests are more to assert that we don't panic on these various kinds of invalid syntax than
+anything else:
+
+`c.py`:
+
+```py
+from a import *, _Y  # error: [invalid-syntax]
+from a import _Y, *, _Z  # error: [invalid-syntax]
+from a import *, _Y as fooo  # error: [invalid-syntax]
+from a import *, *, _Y  # error: [invalid-syntax]
+```
+
+<!-- blacken-docs:on -->
+
+[python language reference for import statements]: https://docs.python.org/3/reference/simple_stmts.html#the-import-statement
+[typing spec]: https://typing.python.org/en/latest/spec/distributing.html#library-interface-public-and-private-symbols

crates/red_knot_python_semantic/resources/mdtest/intersection_types.md

@@ -663,6 +663,7 @@ to the fact that `bool` is a `@final` class at runtime that cannot be subclassed
 
 ```py
 from knot_extensions import Intersection, Not, AlwaysTruthy, AlwaysFalsy
+from typing_extensions import Literal
 
 class P: ...
 
@@ -686,6 +687,19 @@ def f(
     reveal_type(f)  # revealed: Never
     reveal_type(g)  # revealed: Never
     reveal_type(h)  # revealed: Never
+
+def never(
+    a: Intersection[Intersection[AlwaysFalsy, Not[Literal[False]]], bool],
+    b: Intersection[Intersection[AlwaysTruthy, Not[Literal[True]]], bool],
+    c: Intersection[Intersection[Literal[True], Not[AlwaysTruthy]], bool],
+    d: Intersection[Intersection[Literal[False], Not[AlwaysFalsy]], bool],
+):
+    # TODO: This should be `Never`
+    reveal_type(a)  # revealed: Literal[True]
+    # TODO: This should be `Never`
+    reveal_type(b)  # revealed: Literal[False]
+    reveal_type(c)  # revealed: Never
+    reveal_type(d)  # revealed: Never
 ```
 
 ## Simplification of `LiteralString`, `AlwaysTruthy` and `AlwaysFalsy`
@@ -846,5 +860,19 @@ def mixed(
     reveal_type(i4)  # revealed: Any & Unknown
 ```
 
+## Invalid
+
+```py
+from knot_extensions import Intersection, Not
+
+# error: [invalid-type-form] "`knot_extensions.Intersection` requires at least one argument when used in a type expression"
+def f(x: Intersection) -> None:
+    reveal_type(x)  # revealed: Unknown
+
+# error: [invalid-type-form] "`knot_extensions.Not` requires exactly one argument when used in a type expression"
+def f(x: Not) -> None:
+    reveal_type(x)  # revealed: Unknown
+```
+
 [complement laws]: https://en.wikipedia.org/wiki/Complement_(set_theory)
 [de morgan's laws]: https://en.wikipedia.org/wiki/De_Morgan%27s_laws

crates/red_knot_python_semantic/resources/mdtest/loops/while_loop.md

@@ -121,7 +121,7 @@ def _(flag: bool, flag2: bool):
 
 ```py
 class NotBoolable:
-    __bool__ = 3
+    __bool__: int = 3
 
 # error: [unsupported-bool-conversion] "Boolean conversion is unsupported for type `NotBoolable`; its `__bool__` method isn't callable"
 while NotBoolable():

crates/red_knot_python_semantic/resources/mdtest/protocols.md

@@ -13,3 +13,13 @@ def _(some_int: int, some_literal_int: Literal[1], some_indexable: SupportsIndex
     b: SupportsIndex = some_literal_int
     c: SupportsIndex = some_indexable
 ```
+
+## Invalid
+
+```py
+from typing import Protocol
+
+# error: [invalid-type-form] "`typing.Protocol` is not allowed in type expressions"
+def f(x: Protocol) -> None:
+    reveal_type(x)  # revealed: Unknown
+```

crates/red_knot_python_semantic/resources/mdtest/scopes/eager.md

@@ -1,7 +1,7 @@
 # Eager scopes
 
 Some scopes are executed eagerly: references to variables defined in enclosing scopes are resolved
-_immediately_. This is in constrast to (for instance) function scopes, where those references are
+_immediately_. This is in contrast to (for instance) function scopes, where those references are
 resolved when the function is called.
 
 ## Function definitions

crates/red_knot_python_semantic/resources/mdtest/scopes/moduletype_attrs.md

@@ -12,10 +12,7 @@ reveal_type(__file__)  # revealed: str | None
 reveal_type(__loader__)  # revealed: LoaderProtocol | None
 reveal_type(__package__)  # revealed: str | None
 reveal_type(__doc__)  # revealed: str | None
-
-# TODO: Should be `ModuleSpec | None`
-# (needs support for `*` imports)
-reveal_type(__spec__)  # revealed: Unknown | None
+reveal_type(__spec__)  # revealed: ModuleSpec | None
 
 reveal_type(__path__)  # revealed: @Todo(generics)
 

crates/red_knot_python_semantic/resources/mdtest/slots.md

@@ -113,6 +113,24 @@ class D(B, A): ...  # fine
 class E(B, C, A): ...  # fine
 ```
 
+## Post-hoc modifications
+
+```py
+class A:
+    __slots__ = ()
+    __slots__ += ("a", "b")
+
+reveal_type(A.__slots__)  # revealed: tuple[Literal["a"], Literal["b"]]
+
+class B:
+    __slots__ = ("c", "d")
+
+class C(
+    A,  # error: [incompatible-slots]
+    B,  # error: [incompatible-slots]
+): ...
+```
+
 ## False negatives
 
 ### Possibly unbound
@@ -160,22 +178,6 @@ class B:
 class C(A, B): ...
 ```
 
-### Post-hoc modifications
-
-```py
-class A:
-    __slots__ = ()
-    __slots__ += ("a", "b")
-
-reveal_type(A.__slots__)  # revealed: @Todo(return type of decorated function)
-
-class B:
-    __slots__ = ("c", "d")
-
-# False negative: [incompatible-slots]
-class C(A, B): ...
-```
-
 ### Built-ins with implicit layouts
 
 ```py

crates/red_knot_python_semantic/resources/mdtest/snapshots/attribute_assignment.md_-_Attribute_assignment_-_Data_descriptors_-_Invalid_`__set__`_method_signature.snap

@@ -0,0 +1,39 @@
+---
+source: crates/red_knot_test/src/lib.rs
+expression: snapshot
+---
+---
+mdtest name: attribute_assignment.md - Attribute assignment - Data descriptors - Invalid `__set__` method signature
+mdtest path: crates/red_knot_python_semantic/resources/mdtest/diagnostics/attribute_assignment.md
+---
+
+# Python source files
+
+## mdtest_snippet.py
+
+```
+ 1 | class WrongDescriptor:
+ 2 |     def __set__(self, instance: object, value: int, extra: int) -> None:
+ 3 |         pass
+ 4 | 
+ 5 | class C:
+ 6 |     attr: WrongDescriptor = WrongDescriptor()
+ 7 | 
+ 8 | instance = C()
+ 9 | 
+10 | # TODO: ideally, we would mention why this is an invalid assignment (wrong number of arguments for `__set__`)
+11 | instance.attr = 1  # error: [invalid-assignment]
+```
+
+# Diagnostics
+
+```
+error: lint:invalid-assignment
+  --> /src/mdtest_snippet.py:11:1
+   |
+10 | # TODO: ideally, we would mention why this is an invalid assignment (wrong number of arguments for `__set__`)
+11 | instance.attr = 1  # error: [invalid-assignment]
+   | ^^^^^^^^^^^^^ Invalid assignment to data descriptor attribute `attr` on type `C` with custom `__set__` method
+   |
+
+```

crates/red_knot_python_semantic/resources/mdtest/snapshots/attribute_assignment.md_-_Attribute_assignment_-_Data_descriptors_-_Invalid_argument_type.snap

@@ -0,0 +1,40 @@
+---
+source: crates/red_knot_test/src/lib.rs
+expression: snapshot
+---
+---
+mdtest name: attribute_assignment.md - Attribute assignment - Data descriptors - Invalid argument type
+mdtest path: crates/red_knot_python_semantic/resources/mdtest/diagnostics/attribute_assignment.md
+---
+
+# Python source files
+
+## mdtest_snippet.py
+
+```
+ 1 | class Descriptor:
+ 2 |     def __set__(self, instance: object, value: int) -> None:
+ 3 |         pass
+ 4 | 
+ 5 | class C:
+ 6 |     attr: Descriptor = Descriptor()
+ 7 | 
+ 8 | instance = C()
+ 9 | instance.attr = 1  # fine
+10 | 
+11 | # TODO: ideally, we would mention why this is an invalid assignment (wrong argument type for `value` parameter)
+12 | instance.attr = "wrong"  # error: [invalid-assignment]
+```
+
+# Diagnostics
+
+```
+error: lint:invalid-assignment
+  --> /src/mdtest_snippet.py:12:1
+   |
+11 | # TODO: ideally, we would mention why this is an invalid assignment (wrong argument type for `value` parameter)
+12 | instance.attr = "wrong"  # error: [invalid-assignment]
+   | ^^^^^^^^^^^^^ Invalid assignment to data descriptor attribute `attr` on type `C` with custom `__set__` method
+   |
+
+```

crates/red_knot_python_semantic/resources/mdtest/snapshots/attribute_assignment.md_-_Attribute_assignment_-_Instance_attributes_with_class-level_defaults.snap

@@ -0,0 +1,51 @@
+---
+source: crates/red_knot_test/src/lib.rs
+expression: snapshot
+---
+---
+mdtest name: attribute_assignment.md - Attribute assignment - Instance attributes with class-level defaults
+mdtest path: crates/red_knot_python_semantic/resources/mdtest/diagnostics/attribute_assignment.md
+---
+
+# Python source files
+
+## mdtest_snippet.py
+
+```
+1 | class C:
+2 |     attr: int = 0
+3 | 
+4 | instance = C()
+5 | instance.attr = 1  # fine
+6 | instance.attr = "wrong"  # error: [invalid-assignment]
+7 | 
+8 | C.attr = 1  # fine
+9 | C.attr = "wrong"  # error: [invalid-assignment]
+```
+
+# Diagnostics
+
+```
+error: lint:invalid-assignment
+ --> /src/mdtest_snippet.py:6:1
+  |
+4 | instance = C()
+5 | instance.attr = 1  # fine
+6 | instance.attr = "wrong"  # error: [invalid-assignment]
+  | ^^^^^^^^^^^^^ Object of type `Literal["wrong"]` is not assignable to attribute `attr` of type `int`
+7 |
+8 | C.attr = 1  # fine
+  |
+
+```
+
+```
+error: lint:invalid-assignment
+ --> /src/mdtest_snippet.py:9:1
+  |
+8 | C.attr = 1  # fine
+9 | C.attr = "wrong"  # error: [invalid-assignment]
+  | ^^^^^^ Object of type `Literal["wrong"]` is not assignable to attribute `attr` of type `int`
+  |
+
+```

crates/red_knot_python_semantic/resources/mdtest/snapshots/attribute_assignment.md_-_Attribute_assignment_-_Possibly-unbound_attributes.snap

@@ -0,0 +1,51 @@
+---
+source: crates/red_knot_test/src/lib.rs
+expression: snapshot
+---
+---
+mdtest name: attribute_assignment.md - Attribute assignment - Possibly-unbound attributes
+mdtest path: crates/red_knot_python_semantic/resources/mdtest/diagnostics/attribute_assignment.md
+---
+
+# Python source files
+
+## mdtest_snippet.py
+
+```
+1 | def _(flag: bool) -> None:
+2 |     class C:
+3 |         if flag:
+4 |             attr: int = 0
+5 | 
+6 |     C.attr = 1  # error: [possibly-unbound-attribute]
+7 | 
+8 |     instance = C()
+9 |     instance.attr = 1  # error: [possibly-unbound-attribute]
+```
+
+# Diagnostics
+
+```
+warning: lint:possibly-unbound-attribute
+ --> /src/mdtest_snippet.py:6:5
+  |
+4 |             attr: int = 0
+5 |
+6 |     C.attr = 1  # error: [possibly-unbound-attribute]
+  |     ^^^^^^ Attribute `attr` on type `Literal[C]` is possibly unbound
+7 |
+8 |     instance = C()
+  |
+
+```
+
+```
+warning: lint:possibly-unbound-attribute
+ --> /src/mdtest_snippet.py:9:5
+  |
+8 |     instance = C()
+9 |     instance.attr = 1  # error: [possibly-unbound-attribute]
+  |     ^^^^^^^^^^^^^ Attribute `attr` on type `C` is possibly unbound
+  |
+
+```

crates/red_knot_python_semantic/resources/mdtest/snapshots/attribute_assignment.md_-_Attribute_assignment_-_Pure_instance_attributes.snap

@@ -0,0 +1,52 @@
+---
+source: crates/red_knot_test/src/lib.rs
+expression: snapshot
+---
+---
+mdtest name: attribute_assignment.md - Attribute assignment - Pure instance attributes
+mdtest path: crates/red_knot_python_semantic/resources/mdtest/diagnostics/attribute_assignment.md
+---
+
+# Python source files
+
+## mdtest_snippet.py
+
+```
+1 | class C:
+2 |     def __init__(self):
+3 |         self.attr: int = 0
+4 | 
+5 | instance = C()
+6 | instance.attr = 1  # fine
+7 | instance.attr = "wrong"  # error: [invalid-assignment]
+8 | 
+9 | C.attr = 1  # error: [invalid-attribute-access]
+```
+
+# Diagnostics
+
+```
+error: lint:invalid-assignment
+ --> /src/mdtest_snippet.py:7:1
+  |
+5 | instance = C()
+6 | instance.attr = 1  # fine
+7 | instance.attr = "wrong"  # error: [invalid-assignment]
+  | ^^^^^^^^^^^^^ Object of type `Literal["wrong"]` is not assignable to attribute `attr` of type `int`
+8 |
+9 | C.attr = 1  # error: [invalid-attribute-access]
+  |
+
+```
+
+```
+error: lint:invalid-attribute-access
+ --> /src/mdtest_snippet.py:9:1
+  |
+7 | instance.attr = "wrong"  # error: [invalid-assignment]
+8 |
+9 | C.attr = 1  # error: [invalid-attribute-access]
+  | ^^^^^^ Cannot assign to instance attribute `attr` from the class object `Literal[C]`
+  |
+
+```

crates/red_knot_python_semantic/resources/mdtest/snapshots/attribute_assignment.md_-_Attribute_assignment_-_Setting_attributes_on_union_types.snap

@@ -0,0 +1,50 @@
+---
+source: crates/red_knot_test/src/lib.rs
+expression: snapshot
+---
+---
+mdtest name: attribute_assignment.md - Attribute assignment - Setting attributes on union types
+mdtest path: crates/red_knot_python_semantic/resources/mdtest/diagnostics/attribute_assignment.md
+---
+
+# Python source files
+
+## mdtest_snippet.py
+
+```
+ 1 | def _(flag: bool) -> None:
+ 2 |     if flag:
+ 3 |         class C1:
+ 4 |             attr: int = 0
+ 5 | 
+ 6 |     else:
+ 7 |         class C1:
+ 8 |             attr: str = ""
+ 9 | 
+10 |     # TODO: The error message here could be improved to explain why the assignment fails.
+11 |     C1.attr = 1  # error: [invalid-assignment]
+12 | 
+13 |     class C2:
+14 |         if flag:
+15 |             attr: int = 0
+16 |         else:
+17 |             attr: str = ""
+18 | 
+19 |     # TODO: This should be an error
+20 |     C2.attr = 1
+```
+
+# Diagnostics
+
+```
+error: lint:invalid-assignment
+  --> /src/mdtest_snippet.py:11:5
+   |
+10 |     # TODO: The error message here could be improved to explain why the assignment fails.
+11 |     C1.attr = 1  # error: [invalid-assignment]
+   |     ^^^^^^^ Object of type `Literal[1]` is not assignable to attribute `attr` on type `Literal[C1, C1]`
+12 |
+13 |     class C2:
+   |
+
+```

crates/red_knot_python_semantic/resources/mdtest/snapshots/attribute_assignment.md_-_Attribute_assignment_-_Unknown_attributes.snap

@@ -0,0 +1,48 @@
+---
+source: crates/red_knot_test/src/lib.rs
+expression: snapshot
+---
+---
+mdtest name: attribute_assignment.md - Attribute assignment - Unknown attributes
+mdtest path: crates/red_knot_python_semantic/resources/mdtest/diagnostics/attribute_assignment.md
+---
+
+# Python source files
+
+## mdtest_snippet.py
+
+```
+1 | class C: ...
+2 | 
+3 | C.non_existent = 1  # error: [unresolved-attribute]
+4 | 
+5 | instance = C()
+6 | instance.non_existent = 1  # error: [unresolved-attribute]
+```
+
+# Diagnostics
+
+```
+error: lint:unresolved-attribute
+ --> /src/mdtest_snippet.py:3:1
+  |
+1 | class C: ...
+2 |
+3 | C.non_existent = 1  # error: [unresolved-attribute]
+  | ^^^^^^^^^^^^^^ Unresolved attribute `non_existent` on type `Literal[C]`.
+4 |
+5 | instance = C()
+  |
+
+```
+
+```
+error: lint:unresolved-attribute
+ --> /src/mdtest_snippet.py:6:1
+  |
+5 | instance = C()
+6 | instance.non_existent = 1  # error: [unresolved-attribute]
+  | ^^^^^^^^^^^^^^^^^^^^^ Unresolved attribute `non_existent` on type `C`.
+  |
+
+```

crates/red_knot_python_semantic/resources/mdtest/snapshots/attribute_assignment.md_-_Attribute_assignment_-_`ClassVar`s.snap

@@ -0,0 +1,51 @@
+---
+source: crates/red_knot_test/src/lib.rs
+expression: snapshot
+---
+---
+mdtest name: attribute_assignment.md - Attribute assignment - `ClassVar`s
+mdtest path: crates/red_knot_python_semantic/resources/mdtest/diagnostics/attribute_assignment.md
+---
+
+# Python source files
+
+## mdtest_snippet.py
+
+```
+ 1 | from typing import ClassVar
+ 2 | 
+ 3 | class C:
+ 4 |     attr: ClassVar[int] = 0
+ 5 | 
+ 6 | C.attr = 1  # fine
+ 7 | C.attr = "wrong"  # error: [invalid-assignment]
+ 8 | 
+ 9 | instance = C()
+10 | instance.attr = 1  # error: [invalid-attribute-access]
+```
+
+# Diagnostics
+
+```
+error: lint:invalid-assignment
+ --> /src/mdtest_snippet.py:7:1
+  |
+6 | C.attr = 1  # fine
+7 | C.attr = "wrong"  # error: [invalid-assignment]
+  | ^^^^^^ Object of type `Literal["wrong"]` is not assignable to attribute `attr` of type `int`
+8 |
+9 | instance = C()
+  |
+
+```
+
+```
+error: lint:invalid-attribute-access
+  --> /src/mdtest_snippet.py:10:1
+   |
+ 9 | instance = C()
+10 | instance.attr = 1  # error: [invalid-attribute-access]
+   | ^^^^^^^^^^^^^ Cannot assign to ClassVar `attr` from an instance of type `C`
+   |
+
+```

crates/red_knot_python_semantic/resources/mdtest/snapshots/for.md_-_For_loops_-_Bad_`__getitem__`_method.snap

@@ -46,7 +46,7 @@ info: revealed-type
  9 | # error: [not-iterable]
 10 | for x in Iterable():
 11 |     reveal_type(x)  # revealed: int
-   |     -------------- info: Revealed type is `int`
+   |     ^^^^^^^^^^^^^^ Revealed type is `int`
    |
 
 ```

crates/red_knot_python_semantic/resources/mdtest/snapshots/for.md_-_For_loops_-_No_`__iter__`_method_and_`__getitem__`_is_not_callable.snap

@@ -43,7 +43,7 @@ info: revealed-type
 6 | # error: [not-iterable]
 7 | for x in Bad():
 8 |     reveal_type(x)  # revealed: Unknown
-  |     -------------- info: Revealed type is `Unknown`
+  |     ^^^^^^^^^^^^^^ Revealed type is `Unknown`
   |
 
 ```

crates/red_knot_python_semantic/resources/mdtest/snapshots/for.md_-_For_loops_-_Possibly-not-callable_`__getitem__`_method.snap

@@ -65,7 +65,7 @@ info: revealed-type
 22 |     for x in Iterable1():
 23 |         # TODO... `int` might be ideal here?
 24 |         reveal_type(x)  # revealed: int | Unknown
-   |         -------------- info: Revealed type is `int | Unknown`
+   |         ^^^^^^^^^^^^^^ Revealed type is `int | Unknown`
 25 |
 26 |     # error: [not-iterable]
    |
@@ -92,7 +92,7 @@ info: revealed-type
 27 |     for y in Iterable2():
 28 |         # TODO... `int` might be ideal here?
 29 |         reveal_type(y)  # revealed: int | Unknown
-   |         -------------- info: Revealed type is `int | Unknown`
+   |         ^^^^^^^^^^^^^^ Revealed type is `int | Unknown`
    |
 
 ```

crates/red_knot_python_semantic/resources/mdtest/snapshots/for.md_-_For_loops_-_Possibly_invalid_`__getitem__`_methods.snap

@@ -62,7 +62,7 @@ info: revealed-type
 20 |     for x in Iterable1():
 21 |         # TODO: `str` might be better
 22 |         reveal_type(x)  # revealed: str | Unknown
-   |         -------------- info: Revealed type is `str | Unknown`
+   |         ^^^^^^^^^^^^^^ Revealed type is `str | Unknown`
 23 |
 24 |     # error: [not-iterable]
    |
@@ -88,7 +88,7 @@ info: revealed-type
 24 |     # error: [not-iterable]
 25 |     for y in Iterable2():
 26 |         reveal_type(y)  # revealed: str | int
-   |         -------------- info: Revealed type is `str | int`
+   |         ^^^^^^^^^^^^^^ Revealed type is `str | int`
    |
 
 ```

crates/red_knot_python_semantic/resources/mdtest/snapshots/for.md_-_For_loops_-_Possibly_invalid_`__iter__`_methods.snap

@@ -65,7 +65,7 @@ info: revealed-type
 16 |     # error: [not-iterable]
 17 |     for x in Iterable1():
 18 |         reveal_type(x)  # revealed: int
-   |         -------------- info: Revealed type is `int`
+   |         ^^^^^^^^^^^^^^ Revealed type is `int`
 19 |
 20 |     class Iterable2:
    |
@@ -92,7 +92,7 @@ info: revealed-type
 28 |     for x in Iterable2():
 29 |         # TODO: `int` would probably be better here:
 30 |         reveal_type(x)  # revealed: int | Unknown
-   |         -------------- info: Revealed type is `int | Unknown`
+   |         ^^^^^^^^^^^^^^ Revealed type is `int | Unknown`
    |
 
 ```

crates/red_knot_python_semantic/resources/mdtest/snapshots/for.md_-_For_loops_-_Possibly_invalid_`__next__`_method.snap

@@ -69,7 +69,7 @@ info: revealed-type
 27 |     # error: [not-iterable]
 28 |     for x in Iterable1():
 29 |         reveal_type(x)  # revealed: int | str
-   |         -------------- info: Revealed type is `int | str`
+   |         ^^^^^^^^^^^^^^ Revealed type is `int | str`
 30 |
 31 |     # error: [not-iterable]
    |
@@ -96,7 +96,7 @@ info: revealed-type
 32 |     for y in Iterable2():
 33 |         # TODO: `int` would probably be better here:
 34 |         reveal_type(y)  # revealed: int | Unknown
-   |         -------------- info: Revealed type is `int | Unknown`
+   |         ^^^^^^^^^^^^^^ Revealed type is `int | Unknown`
    |
 
 ```

crates/red_knot_python_semantic/resources/mdtest/snapshots/for.md_-_For_loops_-_Possibly_unbound_`__iter__`_and_bad_`__getitem__`_method.snap

@@ -54,7 +54,7 @@ info: revealed-type
 17 |     # error: [not-iterable]
 18 |     for x in Iterable():
 19 |         reveal_type(x)  # revealed: int | bytes
-   |         -------------- info: Revealed type is `int | bytes`
+   |         ^^^^^^^^^^^^^^ Revealed type is `int | bytes`
    |
 
 ```

crates/red_knot_python_semantic/resources/mdtest/snapshots/for.md_-_For_loops_-_Possibly_unbound_`__iter__`_and_possibly_invalid_`__getitem__`.snap

@@ -73,7 +73,7 @@ info: revealed-type
 31 |     for x in Iterable1():
 32 |         # TODO: `bytes | str` might be better
 33 |         reveal_type(x)  # revealed: bytes | str | Unknown
-   |         -------------- info: Revealed type is `bytes | str | Unknown`
+   |         ^^^^^^^^^^^^^^ Revealed type is `bytes | str | Unknown`
 34 |
 35 |     # error: [not-iterable]
    |
@@ -86,8 +86,7 @@ error: lint:not-iterable
    |
 35 |     # error: [not-iterable]
 36 |     for y in Iterable2():
-   |              ^^^^^^^^^^^ Object of type `Iterable2` may not be iterable because it may not have an `__iter__` method and its `__getitem__` method (with type `<bound method `__getitem__` of `Iterable2`> | <bound method `__getitem__` of `Iterable2`>`)
-                            may have an incorrect signature for the old-style iteration protocol (expected a signature at least as permissive as `def __getitem__(self, key: int): ...`)
+   |              ^^^^^^^^^^^ Object of type `Iterable2` may not be iterable because it may not have an `__iter__` method and its `__getitem__` method (with type `<bound method `__getitem__` of `Iterable2`> | <bound method `__getitem__` of `Iterable2`>`) may have an incorrect signature for the old-style iteration protocol (expected a signature at least as permissive as `def __getitem__(self, key: int): ...`)
 37 |         reveal_type(y)  # revealed: bytes | str | int
    |
 
@@ -100,7 +99,7 @@ info: revealed-type
 35 |     # error: [not-iterable]
 36 |     for y in Iterable2():
 37 |         reveal_type(y)  # revealed: bytes | str | int
-   |         -------------- info: Revealed type is `bytes | str | int`
+   |         ^^^^^^^^^^^^^^ Revealed type is `bytes | str | int`
    |
 
 ```

crates/red_knot_python_semantic/resources/mdtest/snapshots/for.md_-_For_loops_-_Possibly_unbound_`__iter__`_and_possibly_unbound_`__getitem__`.snap

@@ -53,7 +53,7 @@ info: revealed-type
 16 |     # error: [not-iterable]
 17 |     for x in Iterable():
 18 |         reveal_type(x)  # revealed: int | bytes
-   |         -------------- info: Revealed type is `int | bytes`
+   |         ^^^^^^^^^^^^^^ Revealed type is `int | bytes`
    |
 
 ```

crates/red_knot_python_semantic/resources/mdtest/snapshots/for.md_-_For_loops_-_Union_type_as_iterable_where_one_union_element_has_invalid_`__iter__`_method.snap

@@ -55,7 +55,7 @@ info: revealed-type
 17 |     # error: [not-iterable]
 18 |     for x in Test() if flag else Test2():
 19 |         reveal_type(x)  # revealed: int
-   |         -------------- info: Revealed type is `int`
+   |         ^^^^^^^^^^^^^^ Revealed type is `int`
    |
 
 ```

crates/red_knot_python_semantic/resources/mdtest/snapshots/for.md_-_For_loops_-_Union_type_as_iterable_where_one_union_element_has_no_`__iter__`_method.snap

@@ -50,7 +50,7 @@ info: revealed-type
 12 |     # error: [not-iterable]
 13 |     for x in Test() if flag else 42:
 14 |         reveal_type(x)  # revealed: int
-   |         -------------- info: Revealed type is `int`
+   |         ^^^^^^^^^^^^^^ Revealed type is `int`
    |
 
 ```

crates/red_knot_python_semantic/resources/mdtest/snapshots/for.md_-_For_loops_-_With_non-callable_iterator.snap

@@ -51,7 +51,7 @@ warning: lint:possibly-unresolved-reference
 14 |     # revealed: Unknown
 15 |     # error: [possibly-unresolved-reference]
 16 |     reveal_type(x)
-   |                 - Name `x` used when possibly not defined
+   |                 ^ Name `x` used when possibly not defined
    |
 
 ```
@@ -63,7 +63,7 @@ info: revealed-type
 14 |     # revealed: Unknown
 15 |     # error: [possibly-unresolved-reference]
 16 |     reveal_type(x)
-   |     -------------- info: Revealed type is `Unknown`
+   |     ^^^^^^^^^^^^^^ Revealed type is `Unknown`
    |
 
 ```