[3.14] Forward-port 'check-abi' CI job from 3.13 (GH-133614)

Also add the python3.14.abi file as generated by the new job and remove
the 'main branch only' entry from .gitignore.

The only difference from the 3.13 job is the addition of `with.python-version: 3.x`
to the `setup-python` configuration to pacify a warning.

.github/workflows/build.yml

@@ -43,6 +43,53 @@ jobs:
     if: fromJSON(needs.build-context.outputs.run-docs)
     uses: ./.github/workflows/reusable-docs.yml
 
+  check-abi:
+    name: 'Check if the ABI has changed'
+    runs-on: ubuntu-22.04  # 24.04 causes spurious errors
+    needs: build-context
+    if: needs.build-context.outputs.run-tests == 'true'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.x'
+      - name: Install dependencies
+        run: |
+            sudo ./.github/workflows/posix-deps-apt.sh
+            sudo apt-get install -yq abigail-tools
+      - name: Build CPython
+        env:
+          CFLAGS: -g3 -O0
+        run: |
+          # Build Python with the libpython dynamic library
+          ./configure --enable-shared
+          make -j4
+      - name: Check for changes in the ABI
+        id: check
+        run: |
+          if ! make check-abidump; then
+            echo "Generated ABI file is not up to date."
+            echo "Please add the release manager of this branch as a reviewer of this PR."
+            echo ""
+            echo "The up to date ABI file should be attached to this build as an artifact."
+            echo ""
+            echo "To learn more about this check: https://devguide.python.org/getting-started/setup-building/index.html#regenerate-the-abi-dump"
+            echo ""
+            exit 1
+          fi
+      - name: Generate updated ABI files
+        if: ${{ failure() && steps.check.conclusion == 'failure' }}
+        run: |
+          make regen-abidump
+      - uses: actions/upload-artifact@v4
+        name: Publish updated ABI files
+        if: ${{ failure() && steps.check.conclusion == 'failure' }}
+        with:
+          name: abi-data
+          path: ./Doc/data/*.abi
+
   check-autoconf-regen:
     name: 'Check if Autoconf files are up to date'
     # Don't use ubuntu-latest but a specific version to make the job