ci: stop running on macos-13

[davidhewitt]

As per https://github.blog/changelog/2025-07-11-upcoming-changes-to-macos-hosted-runners-macos-latest-migration-and-xcode-support-policy-updates/#macos-13-is-closing-down

GitHub is retiring x86_64 macos hardware. I think due to rosetta emulation we can still run tests for x64 macos on aarch64 runners.

Both CPython and Rust are downgrading this platform to tier 2

• https://blog.rust-lang.org/2025/08/07/Rust-1.89.0/#demoting-x86-64-apple-darwin-to-tier-2-with-host-tools
• https://discuss.python.org/t/dropping-intel-mac-to-tier-2/102100

Accordingly:

• I changed all macos-13 jobs to run on macos-latest with x64 Python
• I stopped running macos x64 tests on PR, to reduce number of builds
• I also stopped running cross-compilation tests as we now will be testing arm64 -> x86_64 as part of the main build, and macos x86_64 -> arm64 seems like an unusual case we won't need to support (everyone will probably be building from macos arm machines if they're running macos builds now)

[codspeed-hq]

CodSpeed Performance Report

Merging #5316 will not alter performance

_{Comparing davidhewitt:drop-macos-13 (a64bbd9) with main (787fbe8)}

🎉 Hooray! codspeed-rust just leveled up to 3.0.5!

A heads-up, this is a breaking change and it might affect your current performance baseline a bit. But here's the exciting part - it's packed with new, cool features and promises improved result stability 🥳!
Curious about what's new? Visit our releases page to delve into all the awesome details about this new version.

Summary

✅ 92 untouched benchmarks

[davidhewitt]

It looks like github straight up doesn't support x64 Python for some of the older versions: actions/setup-python#875 (comment)

I am not sure we can do anything about 3.7 or 3.8. cc @alex

For 3.9, we might be able to switch to setup-uv; it appears that python-build-standalone does ship x86_64 Python for 3.9 still. I will try that in a separate PR.

[davidhewitt]

The uv build step failed. I've disabled the macos 3.9 build for now however will re-enable if uv install can be fixed.

cc @alex I understand the main reason cryptography needs 3.7 and 3.8 support is for linux usage, so presumably if we lack test coverage for macos 3.7 and 3.8, we're ok?

If no objections, I will merge this; the macos-13 jobs are some of the slowest so it will help with CI performance while also getting us ready ahead of the incoming switchoff.

[alex]

I think it's true that the vast majority of our 3.7/3.8 users are on Linux. We obviously support them on all platforms.

I don't think pyo3 has much code that's specific to these versions and macOS specific, so it's probably fine to just test 3.7 on a different OS.