Merge remote-tracking branch 'upstream/main' into release-13.4.2

Author: mdboom

.github/ISSUE_TEMPLATE/release_checklist.yml

@@ -24,11 +24,11 @@ body:
         - label: "Finalize the doc update, including release notes (\"Note: Touching docstrings/type annotations in code is OK during code freeze, apply your best judgement!\")"
         - label: Update the docs for the new version
         - label: Create a public release tag
-        - label: Wait for the tag-triggered CI run to complete, and use that run ID for release workflows
-        - label: If any code change happens, rebuild the wheels from the new tag
-        - label: Upload wheels to PyPI
-        - label: Update the conda recipe & release conda packages
+        - label: Wait for the tag-triggered CI run to complete, and use that run ID for release workflows (this will upload the release to PyPI)
+        - label: Publish the release at https://github.com/NVIDIA/cuda-python/releases (this will trigger the conda package update)
+        - label: Approve the conda-package update PR
         - label: Post-release QA
         - label: Finalize the announcement update
-        - label: Send out the announcement internally
+        - label: Send out the announcement internally (on `#swcuda-python`)
         - label: Send out the announcement externally (GitHub Release -> Announcement)
+        - label: For a `cuda-bindings` release, make sure MAJOR and MAJOR-1 releases are made, as well as releases of `cuda-python` for MAJOR and MAJOR-1

.github/actions/setup-pixi/action.yml

@@ -0,0 +1,33 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+name: Setup pinned pixi
+description: Install the repository's canonical pixi version without installing an environment
+
+outputs:
+  pixi-version:
+    description: The canonical pixi version installed by this action
+    value: ${{ steps.version.outputs.pixi-version }}
+
+runs:
+  using: composite
+  steps:
+    - name: Read canonical pixi version
+      id: version
+      shell: bash --noprofile --norc -euo pipefail {0}
+      run: |
+        source "${GITHUB_WORKSPACE}/ci/pixi-version.env"
+        if [[ ! "${PIXI_VERSION:-}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+          echo "::error::ci/pixi-version.env must set PIXI_VERSION in vMAJOR.MINOR.PATCH form"
+          exit 1
+        fi
+        echo "pixi-version=${PIXI_VERSION}" >> "${GITHUB_OUTPUT}"
+
+    - name: Setup pixi ${{ steps.version.outputs.pixi-version }}
+      # Pinned to a commit SHA; install logic lives in the action and is
+      # auditable/pinned (vs. a curl|bash of an unverified installer).
+      uses: prefix-dev/setup-pixi@5185adfbffb4bd703da3010310260805d89ebb11 # v0.9.6
+      with:
+        pixi-version: ${{ steps.version.outputs.pixi-version }}
+        run-install: false

.github/workflows/build-wheel.yml

@@ -223,19 +223,14 @@ jobs:
 
       - name: Build cuda.bindings wheel
         if: ${{ env.BUILD_BINDINGS == 'true' }}
-        uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
+        uses: pypa/cibuildwheel@e090b81e30c4d855ea63bf4b6e59204c09a101ae  # v4.2.1
         with:
           package-dir: ./cuda_bindings/
           output-dir: ${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }}
         env:
           CIBW_BUILD: ${{ env.CIBW_BUILD }}
           CIBW_BEFORE_BUILD_LINUX: 'python -m pip install --upgrade "pip>=25.3"'
           CIBW_BEFORE_BUILD_WINDOWS: 'python -m pip install --upgrade "pip>=25.3" delvewheel'
-          # TODO: remove cpython-prerelease once 3.15 is officially supported
-          # Allow CPython pre-release builds (currently 3.15 / 3.15t). This is a
-          # no-op for stable Python versions because CIBW_BUILD still filters
-          # the target version.
-          CIBW_ENABLE: cpython-prerelease
           # CIBW mounts the host filesystem under /host
           CIBW_ENVIRONMENT_LINUX: >
             CUDA_PATH=/host/${{ env.CUDA_PATH }}
@@ -250,8 +245,6 @@ jobs:
             ACTIONS_RESULTS_URL=${{ env.ACTIONS_RESULTS_URL }}
             ACTIONS_CACHE_URL=${{ env.ACTIONS_CACHE_URL }}
             ACTIONS_CACHE_SERVICE_V2=${{ env.ACTIONS_CACHE_SERVICE_V2 }}
-            SCCACHE_DIR=/host/${{ env.SCCACHE_DIR }}
-            SCCACHE_CACHE_SIZE=${{ env.SCCACHE_CACHE_SIZE }}
           CIBW_ENVIRONMENT_WINDOWS: >
             CUDA_PATH="$(cygpath -w ${{ env.CUDA_PATH }})"
             CUDA_PYTHON_PARALLEL_LEVEL=${{ env.CUDA_PYTHON_PARALLEL_LEVEL }}
@@ -330,19 +323,14 @@ jobs:
 
       - name: Build cuda.core wheel
         if: ${{ env.BUILD_CORE == 'true' }}
-        uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
+        uses: pypa/cibuildwheel@e090b81e30c4d855ea63bf4b6e59204c09a101ae  # v4.2.1
         with:
           package-dir: ./cuda_core/
           output-dir: ${{ env.CUDA_CORE_ARTIFACTS_DIR }}
         env:
           CIBW_BUILD: ${{ env.CIBW_BUILD }}
           CIBW_BEFORE_BUILD_LINUX: 'python -m pip install --upgrade "pip>=25.3"'
           CIBW_BEFORE_BUILD_WINDOWS: 'python -m pip install --upgrade "pip>=25.3" delvewheel'
-          # TODO: remove cpython-prerelease once 3.15 is officially supported
-          # Allow CPython pre-release builds (currently 3.15 / 3.15t). This is a
-          # no-op for stable Python versions because CIBW_BUILD still filters
-          # the target version.
-          CIBW_ENABLE: cpython-prerelease
           # CIBW mounts the host filesystem under /host
           CIBW_ENVIRONMENT_LINUX: >
             CUDA_PATH=/host/${{ env.CUDA_PATH }}
@@ -358,8 +346,6 @@ jobs:
             ACTIONS_RESULTS_URL=${{ env.ACTIONS_RESULTS_URL }}
             ACTIONS_CACHE_URL=${{ env.ACTIONS_CACHE_URL }}
             ACTIONS_CACHE_SERVICE_V2=${{ env.ACTIONS_CACHE_SERVICE_V2 }}
-            SCCACHE_DIR=/host/${{ env.SCCACHE_DIR }}
-            SCCACHE_CACHE_SIZE=${{ env.SCCACHE_CACHE_SIZE }}
           CIBW_ENVIRONMENT_WINDOWS: >
             CUDA_PATH="$(cygpath -w ${{ env.CUDA_PATH }})"
             CUDA_PYTHON_PARALLEL_LEVEL=${{ env.CUDA_PYTHON_PARALLEL_LEVEL }}
@@ -624,19 +610,14 @@ jobs:
 
       - name: Build cuda.core wheel
         if: ${{ !inputs.single-cuda-major && env.BUILD_CORE == 'true' }}
-        uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
+        uses: pypa/cibuildwheel@e090b81e30c4d855ea63bf4b6e59204c09a101ae  # v4.2.1
         with:
           package-dir: ./cuda_core/
           output-dir: ${{ env.CUDA_CORE_ARTIFACTS_DIR }}
         env:
           CIBW_BUILD: ${{ env.CIBW_BUILD }}
           CIBW_BEFORE_BUILD_LINUX: 'python -m pip install --upgrade "pip>=25.3"'
           CIBW_BEFORE_BUILD_WINDOWS: 'python -m pip install --upgrade "pip>=25.3" delvewheel'
-          # TODO: remove cpython-prerelease once 3.15 is officially supported
-          # Allow CPython pre-release builds (currently 3.15 / 3.15t). This is a
-          # no-op for stable Python versions because CIBW_BUILD still filters
-          # the target version.
-          CIBW_ENABLE: cpython-prerelease
           # CIBW mounts the host filesystem under /host
           CIBW_ENVIRONMENT_LINUX: >
             CUDA_PATH=/host/${{ env.CUDA_PATH }}
@@ -652,8 +633,6 @@ jobs:
             ACTIONS_RESULTS_URL=${{ env.ACTIONS_RESULTS_URL }}
             ACTIONS_CACHE_URL=${{ env.ACTIONS_CACHE_URL }}
             ACTIONS_CACHE_SERVICE_V2=${{ env.ACTIONS_CACHE_SERVICE_V2 }}
-            SCCACHE_DIR=/host/${{ env.SCCACHE_DIR }}
-            SCCACHE_CACHE_SIZE=${{ env.SCCACHE_CACHE_SIZE }}
           CIBW_ENVIRONMENT_WINDOWS: >
             CUDA_PATH="$(cygpath -w ${{ env.CUDA_PATH }})"
             CUDA_PYTHON_PARALLEL_LEVEL=${{ env.CUDA_PYTHON_PARALLEL_LEVEL }}

.github/workflows/ci-pixi-lockfile-freshness-check.yml

@@ -0,0 +1,127 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# Fails when a committed pixi.lock is out of date with its pixi.toml, or when
+# its bytes are not what the pinned pixi version generates.
+# Remediation for both: regenerate and commit the lockfile with that pixi
+# version, e.g.
+#   pixi lock --manifest-path <path>
+# Keep this check advisory during its initial rollout. Before making it
+# required, expose a stable aggregate check, account for the path filters, and
+# record the decision in #2804 after the workflow has operational history.
+# See #2298.
+
+name: "CI: pixi lockfile freshness check"
+
+concurrency:
+  # Keyed on the event as well as the ref so a manual dispatch and a push to
+  # the same branch do not cancel each other.
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+  cancel-in-progress: true
+
+on:
+  pull_request:
+    # `pyproject.toml` is a lockfile input too: the manifests consume sibling
+    # packages (including cuda_python_test_helpers) as path dependencies, so
+    # their metadata can stale a lock without any pixi.toml edit. Matched by
+    # glob rather than by name so the filter cannot drift as packages move.
+    paths: &lockfile_inputs
+      - "**/pixi.toml"
+      - "**/pixi.lock"
+      - "**/pyproject.toml"
+      - "ci/tools/list_pixi_workspaces.py"
+      - "ci/pixi-version.env"
+      - ".github/actions/setup-pixi/action.yml"
+      - ".github/workflows/ci-pixi-lockfile-freshness-check.yml"
+  push:
+    # `pull_request` already covers PRs, including those from forks: this check
+    # needs no secrets or GPU runner. Watching copy-pr-bot's `pull-request/N`
+    # mirror too would run the whole check a second time per PR.
+    branches:
+      - "main"
+    paths: *lockfile_inputs
+  workflow_dispatch: {}
+
+defaults:
+  run:
+    shell: bash --noprofile --norc -xeuo pipefail {0}
+
+env:
+  REFRESH_WORKFLOW_URL: "https://github.com/NVIDIA/cuda-python/actions/workflows/ci-pixi-lockfile-refresh.yml"
+
+permissions: {}
+
+jobs:
+  lockfile-fresh:
+    name: pixi lock --check (all workspaces)
+    if: ${{ github.repository_owner == 'nvidia' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 135
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout ${{ github.event.repository.name }}
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Setup pixi
+        id: setup-pixi
+        uses: ./.github/actions/setup-pixi
+
+      # `pixi lock --check` exits 0 on a semantically current lock even when it
+      # rewrites the file into the pinned version's canonical form (lockfile
+      # format upgrades, platform alias renames). Without this guard that drift
+      # is invisible: the check prints "Updated lock file" and still passes,
+      # while every later pixi run keeps rewriting the committed file (#2298).
+      - name: Check all lockfiles
+        env:
+          PIXI_VERSION: ${{ steps.setup-pixi.outputs.pixi-version }}
+          WORKSPACE_TIMEOUT: 20m
+        run: |
+          workspaces="$(python3 ci/tools/list_pixi_workspaces.py)"
+          workspace_rows="$(
+            jq -ce '
+              if type != "array" or length == 0 then
+                error("workspace inventory must be a non-empty array")
+              elif any(.[];
+                type != "object"
+                or (.manifest | type != "string")
+                or (.lockfile | type != "string")
+                or .manifest == ""
+                or .lockfile == ""
+              ) then
+                error("each workspace must have non-empty string manifest and lockfile fields")
+              else
+                .[]
+              end
+            ' <<<"${workspaces}"
+          )"
+          failed=0
+
+          while IFS= read -r workspace; do
+            manifest="$(jq -r '.manifest' <<<"${workspace}")"
+            lockfile="$(jq -r '.lockfile' <<<"${workspace}")"
+            echo "::group::pixi lock --check (${manifest})"
+
+            check_status=0
+            timeout --kill-after=1m "${WORKSPACE_TIMEOUT}" \
+              pixi lock --check --manifest-path "${manifest}" \
+              || check_status=$?
+            if ((check_status == 124 || check_status == 137)); then
+              echo "::error::Timed out after ${WORKSPACE_TIMEOUT} while checking '${manifest}'."
+              failed=1
+            elif ((check_status != 0)); then
+              echo "::error::Lockfile is stale for '${manifest}'. Regenerate with: pixi lock --manifest-path ${manifest}. For default-branch dependency drift, maintainers can run ${REFRESH_WORKFLOW_URL}"
+              failed=1
+            elif ! git diff --exit-code -- "${lockfile}"; then
+              echo "::error::pixi ${PIXI_VERSION} rewrote ${lockfile} during the check, so the committed bytes are not what it generates. Regenerate with pixi ${PIXI_VERSION}: pixi lock --manifest-path ${manifest}. For default-branch dependency drift, maintainers can run ${REFRESH_WORKFLOW_URL}"
+              failed=1
+            fi
+
+            echo "::endgroup::"
+          done <<<"${workspace_rows}"
+
+          exit "${failed}"