Skip to content

Commit ffce5f4

Browse files
Andy-JostAndy-Jost
committed
Merge branch 'main' of github.com:NVIDIA/cuda-python into ajost/deallocation-stream
2 parents 4d2d3c2 + 844124c commit ffce5f4

27 files changed

Lines changed: 4272 additions & 1467 deletions

‎.github/workflows/build-wheel.yml‎

Lines changed: 76 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,19 @@ jobs:
150150
run: |
151151
twine check --strict cuda_pathfinder/*.whl
152152
153+
- name: Constrain builds to the local cuda.pathfinder wheel
154+
run: |
155+
pathfinder_wheels=(cuda_pathfinder/cuda_pathfinder-*.whl)
156+
test "${#pathfinder_wheels[@]}" -eq 1
157+
test -f "${pathfinder_wheels[0]}"
158+
mkdir -p wheel-constraints
159+
if [[ "${{ inputs.host-platform }}" == win* ]]; then
160+
pathfinder_uri="file:///$(cygpath -am "${pathfinder_wheels[0]}")"
161+
else
162+
pathfinder_uri="file:///host$(realpath "${pathfinder_wheels[0]}")"
163+
fi
164+
printf 'cuda-pathfinder @ %s\n' "${pathfinder_uri}" | tee wheel-constraints/cuda-bindings.txt
165+
153166
- name: Upload cuda.pathfinder build artifacts
154167
if: ${{ strategy.job-index == 0 && inputs.host-platform == 'linux-64' }}
155168
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -172,6 +185,8 @@ jobs:
172185
output-dir: ${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }}
173186
env:
174187
CIBW_BUILD: ${{ env.CIBW_BUILD }}
188+
CIBW_BEFORE_BUILD_LINUX: 'python -m pip install --upgrade "pip>=25.3"'
189+
CIBW_BEFORE_BUILD_WINDOWS: 'python -m pip install --upgrade "pip>=25.3" delvewheel'
175190
# TODO: remove cpython-prerelease once 3.15 is officially supported
176191
# Allow CPython pre-release builds (currently 3.15 / 3.15t). This is a
177192
# no-op for stable Python versions because CIBW_BUILD still filters
@@ -181,6 +196,8 @@ jobs:
181196
CIBW_ENVIRONMENT_LINUX: >
182197
CUDA_PATH=/host/${{ env.CUDA_PATH }}
183198
CUDA_PYTHON_PARALLEL_LEVEL=${{ env.CUDA_PYTHON_PARALLEL_LEVEL }}
199+
PIP_BUILD_CONSTRAINT=/host/${{ github.workspace }}/wheel-constraints/cuda-bindings.txt
200+
PIP_CONSTRAINT=/host/${{ github.workspace }}/wheel-constraints/cuda-bindings.txt
184201
CC="/host/${{ env.SCCACHE_PATH }} cc"
185202
CXX="/host/${{ env.SCCACHE_PATH }} c++"
186203
SCCACHE_GHA_ENABLED=true
@@ -194,6 +211,8 @@ jobs:
194211
CIBW_ENVIRONMENT_WINDOWS: >
195212
CUDA_PATH="$(cygpath -w ${{ env.CUDA_PATH }})"
196213
CUDA_PYTHON_PARALLEL_LEVEL=${{ env.CUDA_PYTHON_PARALLEL_LEVEL }}
214+
PIP_BUILD_CONSTRAINT="$(cygpath -w ./wheel-constraints/cuda-bindings.txt)"
215+
PIP_CONSTRAINT="$(cygpath -w ./wheel-constraints/cuda-bindings.txt)"
197216
# check cache stats before leaving cibuildwheel
198217
CIBW_BEFORE_TEST_LINUX: >
199218
"/host/${{ env.SCCACHE_PATH }}" --show-adv-stats &&
@@ -226,6 +245,27 @@ jobs:
226245
run: |
227246
twine check --strict ${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }}/*.whl
228247
248+
- name: Constrain cuda.core to the local cuda.bindings wheel
249+
run: |
250+
pathfinder_wheels=(cuda_pathfinder/cuda_pathfinder-*.whl)
251+
bindings_wheels=("${CUDA_BINDINGS_ARTIFACTS_DIR}"/cuda_bindings-"${BUILD_CUDA_MAJOR}".*.whl)
252+
test "${#pathfinder_wheels[@]}" -eq 1
253+
test "${#bindings_wheels[@]}" -eq 1
254+
test -f "${pathfinder_wheels[0]}"
255+
test -f "${bindings_wheels[0]}"
256+
mkdir -p wheel-constraints
257+
if [[ "${{ inputs.host-platform }}" == win* ]]; then
258+
pathfinder_uri="file:///$(cygpath -am "${pathfinder_wheels[0]}")"
259+
bindings_uri="file:///$(cygpath -am "${bindings_wheels[0]}")"
260+
else
261+
pathfinder_uri="file:///host$(realpath "${pathfinder_wheels[0]}")"
262+
bindings_uri="file:///host$(realpath "${bindings_wheels[0]}")"
263+
fi
264+
{
265+
printf 'cuda-pathfinder @ %s\n' "${pathfinder_uri}"
266+
printf 'cuda-bindings @ %s\n' "${bindings_uri}"
267+
} | tee wheel-constraints/cuda-core.txt
268+
229269
- name: Upload cuda.bindings build artifacts
230270
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
231271
with:
@@ -240,6 +280,8 @@ jobs:
240280
output-dir: ${{ env.CUDA_CORE_ARTIFACTS_DIR }}
241281
env:
242282
CIBW_BUILD: ${{ env.CIBW_BUILD }}
283+
CIBW_BEFORE_BUILD_LINUX: 'python -m pip install --upgrade "pip>=25.3"'
284+
CIBW_BEFORE_BUILD_WINDOWS: 'python -m pip install --upgrade "pip>=25.3" delvewheel'
243285
# TODO: remove cpython-prerelease once 3.15 is officially supported
244286
# Allow CPython pre-release builds (currently 3.15 / 3.15t). This is a
245287
# no-op for stable Python versions because CIBW_BUILD still filters
@@ -250,7 +292,8 @@ jobs:
250292
CUDA_PATH=/host/${{ env.CUDA_PATH }}
251293
CUDA_PYTHON_PARALLEL_LEVEL=${{ env.CUDA_PYTHON_PARALLEL_LEVEL }}
252294
CUDA_CORE_BUILD_MAJOR=${{ env.BUILD_CUDA_MAJOR }}
253-
PIP_FIND_LINKS=/host/${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }}
295+
PIP_BUILD_CONSTRAINT=/host/${{ github.workspace }}/wheel-constraints/cuda-core.txt
296+
PIP_CONSTRAINT=/host/${{ github.workspace }}/wheel-constraints/cuda-core.txt
254297
CC="/host/${{ env.SCCACHE_PATH }} cc"
255298
CXX="/host/${{ env.SCCACHE_PATH }} c++"
256299
SCCACHE_GHA_ENABLED=true
@@ -265,7 +308,8 @@ jobs:
265308
CUDA_PATH="$(cygpath -w ${{ env.CUDA_PATH }})"
266309
CUDA_PYTHON_PARALLEL_LEVEL=${{ env.CUDA_PYTHON_PARALLEL_LEVEL }}
267310
CUDA_CORE_BUILD_MAJOR=${{ env.BUILD_CUDA_MAJOR }}
268-
PIP_FIND_LINKS="$(cygpath -w ${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }})"
311+
PIP_BUILD_CONSTRAINT="$(cygpath -w ./wheel-constraints/cuda-core.txt)"
312+
PIP_CONSTRAINT="$(cygpath -w ./wheel-constraints/cuda-core.txt)"
269313
# check cache stats before leaving cibuildwheel
270314
CIBW_BEFORE_TEST_LINUX: >
271315
"/host${{ env.SCCACHE_PATH }}" --show-adv-stats &&
@@ -444,21 +488,45 @@ jobs:
444488
OLD_BRANCH=$(yq '.backport_branch' ci/versions.yml)
445489
OLD_BASENAME="cuda-bindings-python${PYTHON_VERSION_FORMATTED}-cuda*-${{ inputs.host-platform }}*"
446490
LATEST_PRIOR_RUN_ID=$(./ci/tools/lookup-run-id --branch "${OLD_BRANCH}" NVIDIA/cuda-python "CI")
491+
PREV_BINDINGS_DIR="cuda_bindings/dist-prev"
447492
448493
gh run download $LATEST_PRIOR_RUN_ID -p ${OLD_BASENAME} -R NVIDIA/cuda-python
449494
rm -rf ${OLD_BASENAME}-tests # exclude cython test artifacts
450495
ls -al $OLD_BASENAME
451-
mkdir -p "${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }}"
452-
mv $OLD_BASENAME/*.whl "${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }}"
496+
mkdir -p "${PREV_BINDINGS_DIR}"
497+
mv $OLD_BASENAME/*.whl "${PREV_BINDINGS_DIR}"
453498
rmdir $OLD_BASENAME
454499
500+
- name: Constrain previous cuda.core to the downloaded cuda.bindings wheel
501+
run: |
502+
pathfinder_wheels=(cuda_pathfinder/cuda_pathfinder-*.whl)
503+
bindings_wheels=(cuda_bindings/dist-prev/cuda_bindings-"${BUILD_PREV_CUDA_MAJOR}".*.whl)
504+
test "${#pathfinder_wheels[@]}" -eq 1
505+
test "${#bindings_wheels[@]}" -eq 1
506+
test -f "${pathfinder_wheels[0]}"
507+
test -f "${bindings_wheels[0]}"
508+
mkdir -p wheel-constraints
509+
if [[ "${{ inputs.host-platform }}" == win* ]]; then
510+
pathfinder_uri="file:///$(cygpath -am "${pathfinder_wheels[0]}")"
511+
bindings_uri="file:///$(cygpath -am "${bindings_wheels[0]}")"
512+
else
513+
pathfinder_uri="file:///host$(realpath "${pathfinder_wheels[0]}")"
514+
bindings_uri="file:///host$(realpath "${bindings_wheels[0]}")"
515+
fi
516+
{
517+
printf 'cuda-pathfinder @ %s\n' "${pathfinder_uri}"
518+
printf 'cuda-bindings @ %s\n' "${bindings_uri}"
519+
} | tee wheel-constraints/cuda-core-prev.txt
520+
455521
- name: Build cuda.core wheel
456522
uses: pypa/cibuildwheel@4726cd35bb13f7bde50cf2761f2499ac7b3aa32c # v4.1.1
457523
with:
458524
package-dir: ./cuda_core/
459525
output-dir: ${{ env.CUDA_CORE_ARTIFACTS_DIR }}
460526
env:
461527
CIBW_BUILD: ${{ env.CIBW_BUILD }}
528+
CIBW_BEFORE_BUILD_LINUX: 'python -m pip install --upgrade "pip>=25.3"'
529+
CIBW_BEFORE_BUILD_WINDOWS: 'python -m pip install --upgrade "pip>=25.3" delvewheel'
462530
# TODO: remove cpython-prerelease once 3.15 is officially supported
463531
# Allow CPython pre-release builds (currently 3.15 / 3.15t). This is a
464532
# no-op for stable Python versions because CIBW_BUILD still filters
@@ -469,7 +537,8 @@ jobs:
469537
CUDA_PATH=/host/${{ env.CUDA_PATH }}
470538
CUDA_PYTHON_PARALLEL_LEVEL=${{ env.CUDA_PYTHON_PARALLEL_LEVEL }}
471539
CUDA_CORE_BUILD_MAJOR=${{ env.BUILD_PREV_CUDA_MAJOR }}
472-
PIP_FIND_LINKS=/host/${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }}
540+
PIP_BUILD_CONSTRAINT=/host/${{ github.workspace }}/wheel-constraints/cuda-core-prev.txt
541+
PIP_CONSTRAINT=/host/${{ github.workspace }}/wheel-constraints/cuda-core-prev.txt
473542
CC="/host/${{ env.SCCACHE_PATH }} cc"
474543
CXX="/host/${{ env.SCCACHE_PATH }} c++"
475544
SCCACHE_GHA_ENABLED=true
@@ -484,7 +553,8 @@ jobs:
484553
CUDA_PATH="$(cygpath -w ${{ env.CUDA_PATH }})"
485554
CUDA_PYTHON_PARALLEL_LEVEL=${{ env.CUDA_PYTHON_PARALLEL_LEVEL }}
486555
CUDA_CORE_BUILD_MAJOR=${{ env.BUILD_PREV_CUDA_MAJOR }}
487-
PIP_FIND_LINKS="$(cygpath -w ${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }})"
556+
PIP_BUILD_CONSTRAINT="$(cygpath -w ./wheel-constraints/cuda-core-prev.txt)"
557+
PIP_CONSTRAINT="$(cygpath -w ./wheel-constraints/cuda-core-prev.txt)"
488558
# check cache stats before leaving cibuildwheel
489559
CIBW_BEFORE_TEST_LINUX: >
490560
"/host${{ env.SCCACHE_PATH }}" --show-adv-stats &&

‎.github/workflows/codeql.yml‎

Lines changed: 0 additions & 46 deletions
This file was deleted.

‎.github/workflows/coverage.yml‎

Lines changed: 77 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -118,18 +118,51 @@ jobs:
118118
run: |
119119
python -m venv .venv
120120
121-
- name: Build cuda-pathfinder
122-
run: |
123-
cd cuda_pathfinder
124-
../.venv/bin/pip install -v . --group test
125-
126-
- name: Build cuda-bindings
127-
run: |
128-
cd cuda_bindings
129-
../.venv/bin/pip install -v . --group test
130-
131-
- name: Build cuda-core
132-
run: |
121+
- name: Install pip with build-constraint support
122+
run: .venv/bin/python -m pip install "pip>=25.3"
123+
124+
- name: Build and install cuda-pathfinder wheel
125+
run: |
126+
.venv/bin/pip wheel -v --no-deps ./cuda_pathfinder -w ./wheels/
127+
.venv/bin/pip install -v ./wheels/cuda_pathfinder*.whl --group ./cuda_pathfinder/pyproject.toml:test
128+
129+
- name: Constrain builds to the local cuda-pathfinder wheel
130+
run: |
131+
pathfinder_wheels=(wheels/cuda_pathfinder-*.whl)
132+
test "${#pathfinder_wheels[@]}" -eq 1
133+
test -f "${pathfinder_wheels[0]}"
134+
mkdir -p wheel-constraints
135+
pathfinder_uri="file://$(realpath "${pathfinder_wheels[0]}")"
136+
printf 'cuda-pathfinder @ %s\n' "${pathfinder_uri}" | tee wheel-constraints/cuda-bindings.txt
137+
138+
- name: Build and install cuda-bindings wheel
139+
run: |
140+
export PIP_BUILD_CONSTRAINT="$(pwd)/wheel-constraints/cuda-bindings.txt"
141+
export PIP_CONSTRAINT="${PIP_BUILD_CONSTRAINT}"
142+
.venv/bin/pip wheel -v --no-deps ./cuda_bindings -w ./wheels/
143+
.venv/bin/pip install -v ./wheels/cuda_bindings*.whl --group ./cuda_bindings/pyproject.toml:test
144+
145+
- name: Constrain cuda-core to the local cuda-bindings wheel
146+
run: |
147+
CUDA_MAJOR="${CUDA_VER%%.*}"
148+
pathfinder_wheels=(wheels/cuda_pathfinder-*.whl)
149+
bindings_wheels=(wheels/cuda_bindings-"${CUDA_MAJOR}".*.whl)
150+
test "${#pathfinder_wheels[@]}" -eq 1
151+
test "${#bindings_wheels[@]}" -eq 1
152+
test -f "${pathfinder_wheels[0]}"
153+
test -f "${bindings_wheels[0]}"
154+
mkdir -p wheel-constraints
155+
pathfinder_uri="file://$(realpath "${pathfinder_wheels[0]}")"
156+
bindings_uri="file://$(realpath "${bindings_wheels[0]}")"
157+
{
158+
printf 'cuda-pathfinder @ %s\n' "${pathfinder_uri}"
159+
printf 'cuda-bindings @ %s\n' "${bindings_uri}"
160+
} | tee wheel-constraints/cuda-core.txt
161+
162+
- name: Build and install cuda-core
163+
run: |
164+
export PIP_BUILD_CONSTRAINT="$(pwd)/wheel-constraints/cuda-core.txt"
165+
export PIP_CONSTRAINT="${PIP_BUILD_CONSTRAINT}"
133166
cd cuda_core
134167
../.venv/bin/pip install -v . --group test
135168
@@ -225,27 +258,48 @@ jobs:
225258
run: |
226259
python -m venv .venv
227260
228-
- name: Build and install cuda.pathfinder
261+
- name: Build cuda.pathfinder wheel
229262
run: |
230-
.venv/Scripts/pip install wheel setuptools Cython
263+
.venv/Scripts/python -m pip install "pip>=25.3" wheel setuptools Cython
231264
.venv/Scripts/pip wheel -v --no-deps ./cuda_pathfinder -w ./wheels/
232265
266+
- name: Constrain builds to the local cuda.pathfinder wheel
267+
run: |
268+
pathfinder_wheels=(wheels/cuda_pathfinder-*.whl)
269+
test "${#pathfinder_wheels[@]}" -eq 1
270+
test -f "${pathfinder_wheels[0]}"
271+
mkdir -p wheel-constraints
272+
pathfinder_uri="file:///$(cygpath -am "${pathfinder_wheels[0]}")"
273+
printf 'cuda-pathfinder @ %s\n' "${pathfinder_uri}" | tee wheel-constraints/cuda-bindings.txt
274+
233275
- name: Build cuda.bindings wheel
234276
run: |
277+
export PIP_BUILD_CONSTRAINT="$(cygpath -w "$(pwd)/wheel-constraints/cuda-bindings.txt")"
278+
export PIP_CONSTRAINT="${PIP_BUILD_CONSTRAINT}"
235279
cd cuda_bindings
236280
../.venv/Scripts/pip wheel -v --no-deps . -w ../wheels/
237281
238-
# Pin cuda-bindings to the wheel built above; PIP_PRE, which is what makes
239-
# that .devN wheel visible, would otherwise let a PyPI pre-release win.
282+
- name: Constrain cuda.core to the local cuda.bindings wheel
283+
run: |
284+
CUDA_MAJOR="${CUDA_VER%%.*}"
285+
pathfinder_wheels=(wheels/cuda_pathfinder-*.whl)
286+
bindings_wheels=(wheels/cuda_bindings-"${CUDA_MAJOR}".*.whl)
287+
test "${#pathfinder_wheels[@]}" -eq 1
288+
test "${#bindings_wheels[@]}" -eq 1
289+
test -f "${pathfinder_wheels[0]}"
290+
test -f "${bindings_wheels[0]}"
291+
mkdir -p wheel-constraints
292+
pathfinder_uri="file:///$(cygpath -am "${pathfinder_wheels[0]}")"
293+
bindings_uri="file:///$(cygpath -am "${bindings_wheels[0]}")"
294+
{
295+
printf 'cuda-pathfinder @ %s\n' "${pathfinder_uri}"
296+
printf 'cuda-bindings @ %s\n' "${bindings_uri}"
297+
} | tee wheel-constraints/cuda-core.txt
298+
240299
- name: Build cuda.core wheel
241300
run: |
242-
export PIP_FIND_LINKS="$(pwd)/wheels"
243-
export PIP_PRE=1
244-
bindings_whl="$(ls ./wheels/cuda_bindings-*.whl | head -1)"
245-
bindings_ver="$(basename "$bindings_whl" | cut -d- -f2)"
246-
echo "cuda-bindings==${bindings_ver%%+*}" > "$GITHUB_WORKSPACE/constraints.txt"
247-
cat "$GITHUB_WORKSPACE/constraints.txt"
248-
export PIP_CONSTRAINT="$GITHUB_WORKSPACE/constraints.txt"
301+
export PIP_BUILD_CONSTRAINT="$(cygpath -w "$(pwd)/wheel-constraints/cuda-core.txt")"
302+
export PIP_CONSTRAINT="${PIP_BUILD_CONSTRAINT}"
249303
cd cuda_core
250304
../.venv/Scripts/pip wheel -v --no-deps . -w ../wheels/
251305

‎.github/workflows/security-suite.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
#
3+
# SPDX-License-Identifier: Apache-2.0
4+
#
5+
# CI security scanning via the NVIDIA/security-workflows suite: Pulse secret scan + CodeQL SAST.
6+
# Pulse runs on Linux nv-gha-runners (Docker image + OIDC/Vault) — Linux-only by design.
7+
# The local secret-scan-trufflehog pre-commit hook is cross-platform (Linux/macOS/Windows).
8+
# Pinned to a reviewed commit SHA.
9+
10+
name: Security Suite (Pulse + CodeQL)
11+
12+
on:
13+
push:
14+
branches:
15+
- main
16+
- ctk-next
17+
- "pull-request/[0-9]+"
18+
workflow_dispatch:
19+
20+
concurrency:
21+
group: ${{ github.workflow }}-on-${{ github.event_name }}-from-${{ github.ref_name }}
22+
cancel-in-progress: true
23+
24+
# Caller must grant every permission the reusable workflow declares, including scans it disables.
25+
permissions:
26+
contents: read
27+
id-token: write # OIDC -> Vault -> nvcr.io image pull
28+
security-events: write # publish redacted SARIF to code scanning
29+
actions: read
30+
31+
jobs:
32+
security-suite:
33+
name: Security Suite
34+
# Pulse needs nv-gha-runners + Vault/nvcr vars; skip on forks.
35+
if: github.repository == 'NVIDIA/cuda-python'
36+
uses: NVIDIA/security-workflows/.github/workflows/security-suite.yml@711025b090f2aa728da576700750b195d1e816dc # v0.3.0
37+
with:
38+
enable-secret-scan: true
39+
enable-sast-scan: true
40+
secret-runs-on: linux-amd64-cpu4
41+
# Set failure_policy explicitly so enforcement can't drift with upstream defaults.
42+
# unverified — fail on verified/live secrets (183); warn on unverified (185) [default]
43+
# strict — fail on any finding (verified or unverified)
44+
# all — warn only; never fail the job on findings
45+
secret-failure-policy: unverified
46+
# Same analysis the retired codeql.yml performed: python, build-mode none, security-extended.
47+
sast-languages: '["python"]'

0 commit comments

Comments
 (0)