Merge branch 'main' into add-context7

Author: rwgk

.github/RELEASE-core.md

@@ -123,38 +123,21 @@ Pushing the tag triggers a CI run automatically. Monitor it in the
 
 ## Upload wheels to PyPI
 
-This is a two-stage process: first publish to TestPyPI, verify, then
-publish to PyPI.
-
-### Stage 1: TestPyPI
+This is a single `CI: Release` workflow run with two sequential stages:
+publish to TestPyPI, then publish the same wheel set to PyPI.
 
 1. Go to **Actions > CI: Release** and run the workflow with:
    - **Component**: `cuda-core`
    - **The release git tag**: `cuda-core-v0.6.0`
-   - **build-ctk-ver**: the `cuda.build.version` from
-     [`ci/versions.yml`](../ci/versions.yml) (e.g. `13.1.1`)
-   - **Which wheel index to publish to**: `testpypi`
+
    The workflow automatically looks up the successful tag-triggered CI run
    for the selected release tag.
 
-2. Wait for the workflow to complete.
-
-3. Verify the TestPyPI upload by installing and running tests from a
-   checked-out copy of the repository:
-
-   ```bash
-   pip install -i https://test.pypi.org/simple/ \
-       --extra-index-url https://pypi.org/simple/ \
-       cuda-core==0.6.0
-   cd cuda_core/tests && pytest
-   ```
-
-### Stage 2: PyPI
-
-Once TestPyPI verification passes, rerun the same workflow with:
-- **Which wheel index to publish to**: `pypi`
+2. Wait for the workflow to complete. It will:
+   - publish the selected wheels to TestPyPI
+   - publish the same wheel set to PyPI
 
-After completion, verify:
+3. After completion, verify the final PyPI upload:
 
 ```bash
 pip install cuda-core==0.6.0

.github/copy-pr-bot.yaml

@@ -5,6 +5,6 @@
 # https://docs.gha-runners.nvidia.com/apps/copy-pr-bot/
 
 enabled: true
-# always require manual CI triggering, ignoring signed commits
+# auto-sync ready PRs so CI starts immediately; keep draft PRs manual
 auto_sync_draft: false
-auto_sync_ready: false
+auto_sync_ready: true

.github/workflows/backport.yml

@@ -43,7 +43,7 @@ jobs:
           echo "OLD_BRANCH=${OLD_BRANCH}" >> $GITHUB_ENV
 
       - name: Create backport pull requests
-        uses: korthout/backport-action@01619ebc9a6e3f6820274221b9956b3e7365000a  # v4.1.0
+        uses: korthout/backport-action@3c06f323a58619da1e8522229ebc8d5de2633e46  # v4.3.0
         with:
           copy_assignees: true
           copy_labels_pattern: true
@@ -67,7 +67,7 @@ jobs:
         run: echo "BACKPORT_BRANCH=${{ inputs.backport-branch }}" >> $GITHUB_ENV
 
       - name: Create backport pull requests
-        uses: korthout/backport-action@01619ebc9a6e3f6820274221b9956b3e7365000a  # v4.1.0
+        uses: korthout/backport-action@3c06f323a58619da1e8522229ebc8d5de2633e46  # v4.3.0
         with:
           copy_assignees: true
           copy_labels_pattern: true

.github/workflows/bandit.yml

@@ -23,7 +23,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098  # v7.3.1
+        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
         with:
           enable-cache: false
 
@@ -42,6 +42,6 @@ jobs:
         with:
           args: "check --select S --ignore ${{ steps.ignore-codes.outputs.codes }} --output-format sarif --output-file results.sarif"
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@v4.32.5
+        uses: github/codeql-action/upload-sarif@v4.35.1
         with:
           sarif_file: results.sarif

.github/workflows/build-docs.yml

@@ -7,9 +7,6 @@ name: "CI: Build and update docs"
 on:
   workflow_call:
     inputs:
-      build-ctk-ver:
-        type: string
-        required: true
       component:
         description: "Component(s) to build docs for"
         required: false
@@ -47,18 +44,21 @@ jobs:
       run:
         shell: bash -el {0}
     steps:
-      - name: validate build-ctk
-        run: |
-          if [ ! "${{ inputs.build-ctk-ver }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]; then
-            echo "error: `build-ctk-ver` ${{ inputs.build-ctk-ver }} version does not match MAJOR.MINOR.MICRO" >&2
-            exit 1
-          fi
       - name: Checkout ${{ github.event.repository.name }}
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 0
           ref: ${{ inputs.git-tag }}
 
+      - name: Read build CTK version
+        run: |
+          BUILD_CTK_VER=$(yq '.cuda.build.version' ci/versions.yml)
+          if [[ ! "${BUILD_CTK_VER}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "error: derived CTK build version ${BUILD_CTK_VER} does not match MAJOR.MINOR.MICRO" >&2
+            exit 1
+          fi
+          echo "BUILD_CTK_VER=${BUILD_CTK_VER}" >> "$GITHUB_ENV"
+
       # TODO: This workflow runs on GH-hosted runner and cannot use the proxy cache
 
       - name: Set up miniforge
@@ -82,7 +82,7 @@ jobs:
         uses: ./.github/actions/fetch_ctk
         with:
           host-platform: linux-64
-          cuda-version: ${{ inputs.build-ctk-ver }}
+          cuda-version: ${{ env.BUILD_CTK_VER }}
 
       - name: Set environment variables
         run: |
@@ -103,13 +103,13 @@ jobs:
           echo "CUDA_CORE_ARTIFACT_BASENAME=${CUDA_CORE_ARTIFACT_BASENAME}" >> $GITHUB_ENV
           echo "CUDA_CORE_ARTIFACT_NAME=${CUDA_CORE_ARTIFACT_BASENAME}-${FILE_HASH}" >> $GITHUB_ENV
           echo "CUDA_CORE_ARTIFACTS_DIR=$(realpath "$REPO_DIR/cuda_core/dist")" >> $GITHUB_ENV
-          CUDA_BINDINGS_ARTIFACT_BASENAME="cuda-bindings-python${PYTHON_VERSION_FORMATTED}-cuda${{ inputs.build-ctk-ver }}-linux-64"
+          CUDA_BINDINGS_ARTIFACT_BASENAME="cuda-bindings-python${PYTHON_VERSION_FORMATTED}-cuda${BUILD_CTK_VER}-linux-64"
           echo "CUDA_BINDINGS_ARTIFACT_BASENAME=${CUDA_BINDINGS_ARTIFACT_BASENAME}" >> $GITHUB_ENV
           echo "CUDA_BINDINGS_ARTIFACT_NAME=${CUDA_BINDINGS_ARTIFACT_BASENAME}-${FILE_HASH}" >> $GITHUB_ENV
           echo "CUDA_BINDINGS_ARTIFACTS_DIR=$(realpath "$REPO_DIR/cuda_bindings/dist")" >> $GITHUB_ENV
 
       - name: Download cuda-python build artifacts
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: cuda-python-wheel
           path: .
@@ -122,7 +122,7 @@ jobs:
           ls -lahR .
 
       - name: Download cuda-pathfinder build artifacts
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: cuda-pathfinder-wheel
           path: ./cuda_pathfinder
@@ -136,14 +136,14 @@ jobs:
 
       - name: Download cuda.bindings build artifacts
         if: ${{ !inputs.is-release }}
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: ${{ env.CUDA_BINDINGS_ARTIFACT_NAME }}
           path: ${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }}
 
       - name: Download cuda.bindings build artifacts
         if: ${{ inputs.is-release }}
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           pattern: ${{ env.CUDA_BINDINGS_ARTIFACT_NAME }}
           merge-multiple: true
@@ -158,14 +158,14 @@ jobs:
 
       - name: Download cuda.core build artifacts
         if: ${{ !inputs.is-release }}
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: ${{ env.CUDA_CORE_ARTIFACT_NAME }}
           path: ${{ env.CUDA_CORE_ARTIFACTS_DIR }}
 
       - name: Download cuda.core build artifacts
         if: ${{ inputs.is-release }}
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           pattern: ${{ env.CUDA_CORE_ARTIFACT_NAME }}
           merge-multiple: true

.github/workflows/build-wheel.yml

@@ -150,7 +150,7 @@ jobs:
           cuda-version: ${{ inputs.cuda-version }}
 
       - name: Build cuda.bindings wheel
-        uses: pypa/cibuildwheel@298ed2fb2c105540f5ed055e8a6ad78d82dd3a7e  # v3.3.1
+        uses: pypa/cibuildwheel@ee02a1537ce3071a004a6b08c41e72f0fdc42d9a  # v3.4.0
         with:
           package-dir: ./cuda_bindings/
           output-dir: ${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }}
@@ -204,7 +204,7 @@ jobs:
           if-no-files-found: error
 
       - name: Build cuda.core wheel
-        uses: pypa/cibuildwheel@298ed2fb2c105540f5ed055e8a6ad78d82dd3a7e  # v3.3.1
+        uses: pypa/cibuildwheel@ee02a1537ce3071a004a6b08c41e72f0fdc42d9a  # v3.4.0
         with:
           package-dir: ./cuda_core/
           output-dir: ${{ env.CUDA_CORE_ARTIFACTS_DIR }}
@@ -383,7 +383,7 @@ jobs:
           rmdir $OLD_BASENAME
 
       - name: Build cuda.core wheel
-        uses: pypa/cibuildwheel@298ed2fb2c105540f5ed055e8a6ad78d82dd3a7e  # v3.3.1
+        uses: pypa/cibuildwheel@ee02a1537ce3071a004a6b08c41e72f0fdc42d9a  # v3.4.0
         with:
           package-dir: ./cuda_core/
           output-dir: ${{ env.CUDA_CORE_ARTIFACTS_DIR }}

.github/workflows/ci.yml

@@ -220,7 +220,6 @@ jobs:
     secrets: inherit
     uses: ./.github/workflows/build-docs.yml
     with:
-      build-ctk-ver: ${{ needs.ci-vars.outputs.CUDA_BUILD_VER }}
       is-release: ${{ github.ref_type == 'tag' }}
 
   checks:

.github/workflows/codeql.yml

@@ -31,13 +31,13 @@ jobs:
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@40f0fa95c41fede7b43f035cb47aac899ee0ba0a  # v3.31.8
+      uses: github/codeql-action/init@34950e1b113b30df4edee1a6d3a605242df0c40b  # v3.31.8
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
         queries: security-extended
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@40f0fa95c41fede7b43f035cb47aac899ee0ba0a  # v3.31.8
+      uses: github/codeql-action/analyze@34950e1b113b30df4edee1a6d3a605242df0c40b  # v3.31.8
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/coverage.yml

@@ -11,14 +11,27 @@ on:
 
 env:
   PY_VER: "3.14"
-  CUDA_VER: "13.1.0"
   LOCAL_CTK: "1"
   GPU: "a100"
   DRIVER: "latest"
 
 jobs:
+  coverage-vars:
+    runs-on: ubuntu-latest
+    outputs:
+      CUDA_VER: ${{ steps.get-vars.outputs.cuda_ver }}
+    steps:
+      - name: Checkout ${{ github.event.repository.name }}
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - name: Get CUDA version
+        id: get-vars
+        run: |
+          cuda_ver=$(yq '.cuda.build.version' ci/versions.yml)
+          echo "cuda_ver=$cuda_ver" >> $GITHUB_OUTPUT
+
   coverage-linux:
     name: Coverage (Linux)
+    needs: [coverage-vars]
     runs-on: "linux-amd64-gpu-a100-latest-1"
     permissions:
       id-token: write
@@ -29,6 +42,7 @@ jobs:
     env:
       HOST_PLATFORM: "linux-64"
       ARCH: "x86_64"
+      CUDA_VER: ${{ needs.coverage-vars.outputs.CUDA_VER }}
     # Our self-hosted runners require a container
     # TODO: use a different (nvidia?) container
     container:
@@ -164,6 +178,7 @@ jobs:
   # Build Windows wheels on GitHub-hosted runner (has VS, no GPU)
   build-wheel-windows:
     name: Build Wheels (Windows)
+    needs: [coverage-vars]
     runs-on: windows-2022
     permissions:
       contents: read
@@ -173,6 +188,7 @@ jobs:
     env:
       HOST_PLATFORM: "win-64"
       CUDA_PYTHON_COVERAGE: "1"
+      CUDA_VER: ${{ needs.coverage-vars.outputs.CUDA_VER }}
     steps:
       - name: Checkout ${{ github.event.repository.name }}
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
@@ -231,7 +247,7 @@ jobs:
   # Run coverage tests on self-hosted GPU runner (no VS needed, installs pre-built wheels)
   coverage-windows:
     name: Coverage (Windows)
-    needs: [build-wheel-windows]
+    needs: [coverage-vars, build-wheel-windows]
     runs-on: "windows-amd64-gpu-a100-latest-1"
     permissions:
       id-token: write
@@ -240,6 +256,7 @@ jobs:
       HOST_PLATFORM: "win-64"
       ARCH: "amd64"
       CUDA_PYTHON_COVERAGE: "1"
+      CUDA_VER: ${{ needs.coverage-vars.outputs.CUDA_VER }}
     defaults:
       run:
         shell: bash --noprofile --norc -xeuo pipefail {0}
@@ -278,7 +295,7 @@ jobs:
           cuda-version: ${{ env.CUDA_VER }}
 
       - name: Download Windows wheel artifacts
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: coverage-windows-wheels
           path: ./wheels/
@@ -403,19 +420,19 @@ jobs:
           pip install coverage[toml] Cython
 
       - name: Download Linux coverage data
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: coverage-data-linux
           path: ./
 
       - name: Download cuda source code
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: cuda-source-linux
           path: ./cuda/
 
       - name: Download Windows coverage data
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: coverage-data-windows
           path: ./