Merge branch 'main' into copilot/fix-888

Author: leofang

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -113,4 +113,3 @@ body:
         +-------------------------------+----------------------+----------------------+
     validations:
       required: false
-

.github/ISSUE_TEMPLATE/doc_request.yml

@@ -41,4 +41,3 @@ body:
       label: If this is a correction, please provide a link to the incorrect documentation. If this is a new documentation request, please link to where you have looked.
       placeholder: |
        https://nvidia.github.io/cuda-python/latest/
-

.github/PULL_REQUEST_TEMPLATE.md

@@ -11,4 +11,3 @@ closes <!-- Link issue here -->
 <!-- TODO: - [ ] I am familiar with the [Contributing Guidelines](). -->
 - [ ] New or existing tests cover these changes.
 - [ ] The documentation is up to date with these changes.
-

.github/actions/doc_preview/action.yml

@@ -18,7 +18,7 @@ runs:
   using: composite
   steps:
     # The steps below are executed only when testing in a PR.
-    # Note: the PR previews will be removed once merged to main (see below) 
+    # Note: the PR previews will be removed once merged to main (see below)
     - name: Deploy doc preview
       if: ${{ github.ref_name != 'main' }}
       uses: JamesIves/github-pages-deploy-action@6c2d9db40f9296374acc17b90404b6e8864128c8  # v4.7.3
@@ -28,7 +28,7 @@ runs:
         folder: ${{ inputs.source-folder }}
         target-folder: docs/pr-preview/pr-${{ inputs.pr-number }}/
         commit-message: "Deploy doc preview for PR ${{ inputs.pr-number }} (${{ github.sha }})"
-    
+
     - name: Leave a comment after deployment
       if: ${{ github.ref_name != 'main' }}
       uses: marocchino/sticky-pull-request-comment@67d0dec7b07ed060a405f9b2a64b8ab319fdd7db  # v2.9.2
@@ -41,10 +41,11 @@ runs:
           :---:
           | <p></p> :rocket: View preview at <br> https://nvidia.github.io/cuda-python/pr-preview/pr-${{ inputs.pr-number }}/ <br>
           | <br> https://nvidia.github.io/cuda-python/pr-preview/pr-${{ inputs.pr-number }}/cuda-core/ <br>
-          | <br> https://nvidia.github.io/cuda-python/pr-preview/pr-${{ inputs.pr-number }}/cuda-bindings/ <br><br>
+          | <br> https://nvidia.github.io/cuda-python/pr-preview/pr-${{ inputs.pr-number }}/cuda-bindings/ <br>
+          | <br> https://nvidia.github.io/cuda-python/pr-preview/pr-${{ inputs.pr-number }}/cuda-pathfinder/ <br><br>
           | <h6><br> Preview will be ready when the GitHub Pages deployment is complete. <br><br></h6>
-    
-    # The steps below are executed only when building on main.    
+
+    # The steps below are executed only when building on main.
     - name: Remove doc preview
       if: ${{ github.ref_name == 'main' }}
       uses: JamesIves/github-pages-deploy-action@6c2d9db40f9296374acc17b90404b6e8864128c8  # v4.7.3
@@ -54,7 +55,7 @@ runs:
         folder: ${{ inputs.source-folder }}
         target-folder: docs/pr-preview/pr-${{ inputs.pr-number }}/
         commit-message: "Clean up doc preview for PR ${{ inputs.pr-number }} (${{ github.sha }})"
-    
+
     - name: Leave a comment after removal
       if: ${{ github.ref_name == 'main' }}
       uses: marocchino/sticky-pull-request-comment@67d0dec7b07ed060a405f9b2a64b8ab319fdd7db  # v2.9.2

.github/actions/install_unix_deps/action.yml

@@ -10,7 +10,7 @@ inputs:
   dependencies:
     required: true
     type: string
-  dependent_exes:  
+  dependent_exes:
     required: true
     type: string
 

.github/dependabot.yml

@@ -7,4 +7,15 @@ updates:
   - package-ecosystem: github-actions
     directory: /
     schedule:
-      interval: weekly
+      interval: "monthly"
+      time: "09:00"
+      timezone: "America/Los_Angeles"
+
+    # Keep churn down: only one open PR from this ecosystem at a time
+    open-pull-requests-limit: 1
+
+    groups:
+      actions-monthly:
+        applies-to: version-updates
+        patterns: ["*"]
+        update-types: ["minor", "patch"]

.github/workflows/bandit.yml

@@ -20,4 +20,9 @@ jobs:
       security-events: write
     steps:
       - name: Perform Bandit Analysis
-        uses: PyCQA/bandit-action@67a458d90fa11fb1463e91e7f4c8f068b5863c7f  # v1.0.1
+        # KEEP IN SYNC WITH bandit rev in .pre-commit-config.yaml
+        # Current runner uses Python 3.8, so the action installs bandit==1.7.10
+        # via `pip install bandit[sarif]`. If runner Python moves to >=3.9,
+        # the action will resolve to 1.8.x and you'll need to bump pre-commit.
+        # (Bandit >=1.8.0 dropped Python 3.8 via Requires-Python metadata.)
+        uses: PyCQA/bandit-action@8a1b30610f61f3f792fe7556e888c9d7dffa52de  # v1.0.0

.github/workflows/build-docs.yml

@@ -19,6 +19,7 @@ on:
         #   - cuda-core
         #   - cuda-bindings
         #   - cuda-python
+        #   - cuda-pathfinder
         #   - all
       git-tag:
         description: "Target git tag to build docs for"

.github/workflows/build-wheel.yml

@@ -96,7 +96,7 @@ jobs:
       - name: Check cuda.pathfinder wheel
         if: ${{ strategy.job-index == 0 && inputs.host-platform == 'linux-64' }}
         run: |
-          twine check cuda_pathfinder/*.whl
+          twine check --strict cuda_pathfinder/*.whl
 
       - name: Upload cuda.pathfinder build artifacts
         if: ${{ strategy.job-index == 0 && inputs.host-platform == 'linux-64' }}
@@ -107,7 +107,7 @@ jobs:
           if-no-files-found: error
 
       - name: Build cuda.core wheel
-        uses: pypa/cibuildwheel@352e01339f0a173aa2a3eb57f01492e341e83865  # v3.1.3
+        uses: pypa/cibuildwheel@c923d83ad9c1bc00211c5041d0c3f73294ff88f6  # v3.1.4
         env:
           CIBW_BUILD: ${{ env.CIBW_BUILD }}
           CIBW_ARCHS_LINUX: "native"
@@ -132,7 +132,7 @@ jobs:
 
       - name: Check cuda.core wheel
         run: |
-          twine check ${{ env.CUDA_CORE_ARTIFACTS_DIR }}/*.whl
+          twine check --strict ${{ env.CUDA_CORE_ARTIFACTS_DIR }}/*.whl
 
       - name: Upload cuda.core build artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
@@ -149,7 +149,7 @@ jobs:
           cuda-version: ${{ inputs.cuda-version }}
 
       - name: Build cuda.bindings wheel
-        uses: pypa/cibuildwheel@352e01339f0a173aa2a3eb57f01492e341e83865  # v3.1.3
+        uses: pypa/cibuildwheel@c923d83ad9c1bc00211c5041d0c3f73294ff88f6  # v3.1.4
         env:
           CIBW_BUILD: ${{ env.CIBW_BUILD }}
           CIBW_ARCHS_LINUX: "native"
@@ -179,7 +179,7 @@ jobs:
 
       - name: Check cuda.bindings wheel
         run: |
-          twine check ${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }}/*.whl
+          twine check --strict ${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }}/*.whl
 
       - name: Upload cuda.bindings build artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
@@ -194,7 +194,7 @@ jobs:
         run: |
           pushd cuda_python
           pip wheel -v --no-deps .
-          twine check *.whl
+          twine check --strict *.whl
           popd
 
       - name: List the cuda-python artifacts directory

.github/workflows/codeql.yml

@@ -31,13 +31,13 @@ jobs:
       uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@96f518a34f7a870018057716cc4d7a5c014bd61c  # v3.29.10
+      uses: github/codeql-action/init@2d92b76c45b91eb80fc44c74ce3fce0ee94e8f9d  # v3.30.0
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
         queries: security-extended
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@96f518a34f7a870018057716cc4d7a5c014bd61c  # v3.29.10
+      uses: github/codeql-action/analyze@2d92b76c45b91eb80fc44c74ce3fce0ee94e8f9d  # v3.30.0
       with:
         category: "/language:${{matrix.language}}"