Merge remote-tracking branch 'upstream/main' into annotation-typing

Author: mdboom

.coderabbit.yaml

@@ -0,0 +1,144 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+language: en-US
+tone_instructions: |
+  Be direct, technical, brief. No praise, emojis, headings, or collapsible menus.
+  Start each comment with one prefix:
+  - suggestion: optional improvement;
+  - important: must-fix/high-impact risk;
+  - critical: blocking correctness/security/data-loss.
+
+reviews:
+  profile: chill
+
+  high_level_summary: true
+  high_level_summary_in_walkthrough: true
+  poem: false
+  in_progress_fortune: false
+  sequence_diagrams: false
+  estimate_code_review_effort: false
+  collapse_walkthrough: true
+
+  # Reduce noisy status/details sections.
+  request_changes_workflow: false
+  review_status: false
+  review_details: false
+  enable_prompt_for_ai_agents: false
+
+  auto_review:
+    enabled: true
+    drafts: false
+    base_branches:
+      - "^main$"
+    ignore_usernames:
+      - "copy-pr-bot[bot]"
+      - "dependabot[bot]"
+      - "github-actions[bot]"
+
+  tools:
+    gitleaks:
+      enabled: false
+    markdownlint:
+      enabled: false
+    shellcheck:
+      enabled: false
+
+  # Keep Autofix available, but disable the other finishing touch actions.
+  finishing_touches:
+    docstrings:
+      enabled: false
+    unit_tests:
+      enabled: false
+    simplify:
+      enabled: false
+
+  pre_merge_checks:
+    docstrings:
+      mode: "off"
+    title:
+      mode: "off"
+    description:
+      mode: "off"
+    issue_assessment:
+      mode: "off"
+    custom_checks: []
+
+  path_instructions:
+    - path: "cuda_bindings/**/*"
+      instructions: |
+        Focus on Cython binding correctness, API and ABI stability, error-code propagation,
+        resource ownership and reference counting, GIL handling, cross-platform behavior.
+        Avoid style-only comments already covered by pre-commit.
+
+    - path: "cuda_core/**/*"
+      instructions: |
+        Focus on Python API stability, stream ordering, CUDA resource lifetime and ownership, CUDA Array Interface
+        compatibility, host/device memory semantics, error translation, and free-threading correctness. Check that
+        public behavior changes have corresponding tests, documentation and release notes. Avoid style-only comments
+        already covered by pre-commit.
+
+    - path: "cuda_pathfinder/**/*"
+      instructions: |
+        Focus on deterministic path resolution across Linux and Windows, wheel and conda layouts, dynamic-library
+        loading and cache semantics, and explicit behavior when the CUDA Toolkit is missing or partially installed.
+        Check that errors preserve the package's public exception contracts.
+
+    - path: "cuda_python/**/*"
+      instructions: |
+        Focus on metapackage correctness, dependency and version pins, wheel and sdist contents, and documentation
+        aggregation. Keep runtime functionality in the component packages and verify that packaging changes preserve
+        compatibility among cuda-python, cuda-bindings, cuda-core, and cuda-pathfinder.
+
+    - path: "benchmarks/**/*"
+      instructions: |
+        Check that benchmark changes measure meaningful workloads, keep comparison axes and benchmark identifiers
+        comparable, avoid excessive runtime, and preserve useful comparison data.
+
+    - path: "ci/**/*"
+      instructions: |
+        For CI and build scripts, focus on matrix correctness, the GPU-versus-CPU job split, targeted build and test
+        behavior, cache and artifact handling, environment setup, clear failure modes, and avoiding unnecessary
+        expensive jobs.
+
+    - path: ".github/**/*"
+      instructions: |
+        For GitHub workflows and repository automation, focus on least-privilege permissions, event triggers, matrix
+        generation, status and check behavior, security boundaries, and avoiding unnecessary CI fanout.
+
+    - path: "**/*.pyx"
+      instructions: |
+        Focus on typed-memoryview safety, GIL and nogil correctness, exception specifications, fused-type behavior,
+        Python reference ownership, and consistency with related declarations and generated type stubs.
+
+    - path: "**/*.pxd"
+      instructions: |
+        Focus on declaration and implementation consistency, typed-memoryview safety, GIL and nogil correctness,
+        exception specifications, fused-type behavior, and API or ABI impact on Cython consumers.
+
+knowledge_base:
+  opt_out: false
+  code_guidelines:
+    filePatterns:
+      - "AGENTS.md"
+      - "CONTRIBUTING.md"
+      - "cuda_bindings/AGENTS.md"
+      - "cuda_core/AGENTS.md"
+      - "cuda_core/tests/AGENTS.md"
+      - "cuda_pathfinder/AGENTS.md"
+      - "cuda_python/AGENTS.md"
+      - "benchmarks/cuda_bindings/AGENTS.md"
+      - "benchmarks/cuda_core/AGENTS.md"
+      - "cuda_bindings/README.md"
+      - "cuda_core/README.md"
+      - "cuda_pathfinder/DESCRIPTION.rst"
+      - "cuda_python/DESCRIPTION.rst"
+      - "cuda_bindings/docs/source/contribute.rst"
+      - "cuda_core/docs/source/contribute.rst"
+      - "cuda_core/docs/source/concurrency.rst"
+      - "cuda_core/docs/source/error_handling.rst"
+      - "cuda_pathfinder/docs/source/contribute.rst"
+      - "cuda_bindings/docs/source/release.rst"
+      - "cuda_core/docs/source/release.rst"
+      - "cuda_pathfinder/docs/source/release.rst"
+      - "cuda_python/docs/source/release.rst"

.github/RELEASE-core.md

@@ -62,9 +62,14 @@ platforms as appropriate for each release.
 ## Check (or update if needed) the dependency requirements
 
 Review `cuda_core/pyproject.toml` and verify that all dependency
-requirements are current.
-
-Update the cuda_core dependency in `cuda_python/setup.py`.
+requirements are current. The `cu12`/`cu13` extras declare the
+`cuda-bindings` floors; see "Bumping the cuda-bindings floor" in
+`cuda_core/AGENTS.md`.
+
+Update the `cuda-core` pin in `cuda_python/setup.py` to the new minor
+series (`cuda-core~=X.Y.0`), and plan a `cuda-python` release right after
+this one. Until that release, `pip install cuda-python` resolves to the
+previous `cuda-core`.
 
 ---
 

.github/actionlint.yaml

@@ -12,6 +12,12 @@ self-hosted-runner:
 # GitHub supports queued concurrency runs, but the latest actionlint release
 # does not yet recognize the concurrency.queue key.
 paths:
+  ".github/workflows/build-docs.yml":
+    ignore:
+      - 'unexpected key "queue" for "concurrency" section'
+  ".github/workflows/cleanup-pr-previews.yml":
+    ignore:
+      - 'unexpected key "queue" for "concurrency" section'
   ".github/workflows/ci-workflow-health.yml":
     ignore:
       - 'unexpected key "queue" for "concurrency" section'

.github/actions/doc_preview/action.yml

@@ -1,9 +1,9 @@
-# SPDX-FileCopyrightText: Copyright (c) 2024-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2024-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 #
 # SPDX-License-Identifier: Apache-2.0
 
 name: Docs in PRs
-description: Preview or clean up docs built from PRs
+description: Preview docs built from PRs
 
 # A re-implementation based on the logic of https://github.com/rossjrw/pr-preview-action/blob/41a957c44a456a34718e9bcf825363194db5e6d5/README.md, due to limitations illustrated in NVIDIA/cuda-python#380.
 
@@ -18,20 +18,23 @@ inputs:
 runs:
   using: composite
   steps:
-    # The steps below are executed only when testing in a PR.
-    # Note: the PR previews will be removed once merged to main or release/* (see below)
     - name: Deploy doc preview
-      if: ${{ github.ref_name != 'main' && !startsWith(github.ref_name, 'release/') }}
+      if: ${{ startsWith(github.ref_name, 'pull-request/') }}
       uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f  # v4.8.0
       with:
         git-config-name: cuda-python-bot
         git-config-email: cuda-python-bot@users.noreply.github.com
         folder: ${{ inputs.source-folder }}
         target-folder: docs/pr-preview/pr-${{ inputs.pr-number }}/
         commit-message: "Deploy doc preview for PR ${{ inputs.pr-number }} (${{ github.sha }})"
+        # Every PR preview, the main docs deploy, and the coverage deploy commit to
+        # the shared gh-pages branch. Rebase onto a deployment that landed in the
+        # meantime instead of force-pushing over it, which the branch ruleset
+        # rejects (and which used to discard the other deployment).
+        force: false
 
     - name: Leave a comment after deployment
-      if: ${{ github.ref_name != 'main' && !startsWith(github.ref_name, 'release/') }}
+      if: ${{ startsWith(github.ref_name, 'pull-request/') }}
       uses: marocchino/sticky-pull-request-comment@d4d6b0936434b21bc8345ad45a440c5f7d2c40ff  # v3.0.3
       with:
         header: pr-preview
@@ -45,27 +48,3 @@ runs:
           | <br> https://nvidia.github.io/cuda-python/pr-preview/pr-${{ inputs.pr-number }}/cuda-bindings/ <br>
           | <br> https://nvidia.github.io/cuda-python/pr-preview/pr-${{ inputs.pr-number }}/cuda-pathfinder/ <br><br>
           | <h6><br> Preview will be ready when the GitHub Pages deployment is complete. <br><br></h6>
-
-    # The steps below are executed only when building on main or release/*.
-    - name: Remove doc preview
-      if: ${{ github.ref_name == 'main' || startsWith(github.ref_name, 'release/') }}
-      uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f  # v4.8.0
-      with:
-        git-config-name: cuda-python-bot
-        git-config-email: cuda-python-bot@users.noreply.github.com
-        folder: ${{ inputs.source-folder }}
-        target-folder: docs/pr-preview/pr-${{ inputs.pr-number }}/
-        commit-message: "Clean up doc preview for PR ${{ inputs.pr-number }} (${{ github.sha }})"
-
-    - name: Leave a comment after removal
-      if: ${{ github.ref_name == 'main' || startsWith(github.ref_name, 'release/') }}
-      uses: marocchino/sticky-pull-request-comment@d4d6b0936434b21bc8345ad45a440c5f7d2c40ff  # v3.0.3
-      with:
-        header: pr-preview
-        number: ${{ inputs.pr-number }}
-        hide_and_recreate: true
-        hide_classify: "OUTDATED"
-        message: |
-          Doc Preview CI
-          :---:
-          Preview removed because the pull request was closed or merged.

.github/actions/get_pr_number/action.yml

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2024-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2024-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 #
 # SPDX-License-Identifier: Apache-2.0
 
@@ -9,13 +9,11 @@ description: Get the PR number without relying on the pull_request* event trigge
 runs:
   using: composite
   steps:
-    - name: Get PR info (non-main, non-release branch)
-      if: ${{ github.ref_name != 'main' && !startsWith(github.ref_name, 'release/') }}
+    - name: Get PR info
       uses: nv-gha-runners/get-pr-info@main
       id: get-pr-info
 
-    - name: Extract PR number (non-main, non-release branch)
-      if: ${{ github.ref_name != 'main' && !startsWith(github.ref_name, 'release/') }}
+    - name: Extract PR number
       shell: bash --noprofile --norc -xeuo pipefail {0}
       run: |
         trap 'echo "Error at line $LINENO"; exit 1' ERR
@@ -26,33 +24,3 @@ runs:
         fi
         echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
         echo "BUILD_PREVIEW=1" >> $GITHUB_ENV
-
-    - name: Get PR data (main or release/* branch)
-      if: ${{ github.ref_name == 'main' || startsWith(github.ref_name, 'release/') }}
-      uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea  # v7.0.1
-      id: get-pr-data
-      with:
-        script: |
-          const prs = await github.rest.repos.listPullRequestsAssociatedWithCommit({
-            commit_sha: context.sha,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-          });
-          if (!prs.data.length) {
-            core.setFailed("No PR associated with this commit on 'main' or 'release/*'.");
-          } else {
-            return prs.data[0];
-          }
-
-    - name: Extract PR number (main or release/* branch)
-      if: ${{ github.ref_name == 'main' || startsWith(github.ref_name, 'release/') }}
-      shell: bash --noprofile --norc -xeuo pipefail {0}
-      run: |
-        trap 'echo "Error at line $LINENO"; exit 1' ERR
-        PR_NUMBER="${{ fromJSON(steps.get-pr-data.outputs.result).number }}"
-        if [[ -z "$PR_NUMBER" ]]; then
-          echo "No associated PR found for the commit in 'main' or 'release/*'."
-          exit 1
-        fi
-        echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
-        echo "BUILD_LATEST=1" >> $GITHUB_ENV

.github/dependabot.yml

@@ -21,6 +21,33 @@ updates:
         patterns: ["*"]
         update-types: ["major", "minor", "patch"]
 
+    labels: [CI/CD, dependencies]
+
+  # Group monthly hook revision updates, preserving SHA pins and frozen comments.
+  - package-ecosystem: pre-commit
+    directory: /
+    schedule:
+      interval: "monthly"
+      time: "09:00"
+      timezone: "America/Los_Angeles"
+
+    open-pull-requests-limit: 1
+
+    # Match hook repositories, leaving additional_dependencies pins unchanged.
+    allow:
+      - dependency-name: "https://github.com/*"
+    # Lychee's hook revision, LYCHEE_VERSION argument, and CI binary pin must
+    # be upgraded together in a coordinated manual update.
+    ignore:
+      - dependency-name: "https://github.com/lycheeverse/lychee"
+
+    groups:
+      pre-commit-monthly:
+        applies-to: version-updates
+        patterns: ["*"]
+
+    labels: [CI/CD, dependencies]
+
   # GitHub Actions updates targeting the 12.9.x branch
   - package-ecosystem: github-actions
     directory: /
@@ -38,3 +65,5 @@ updates:
         applies-to: version-updates
         patterns: ["*"]
         update-types: ["major", "minor", "patch"]
+
+    labels: [CI/CD, dependencies]

.github/matchers/compiler.json

@@ -0,0 +1,43 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "gcc-error",
+      "severity": "error",
+      "pattern": [
+        {
+          "regexp": "^(.+?):(\\d+):(\\d+): (?:fatal )?error: (.+)$",
+          "file": 1,
+          "line": 2,
+          "column": 3,
+          "message": 4
+        }
+      ]
+    },
+    {
+      "owner": "msvc-error",
+      "severity": "error",
+      "pattern": [
+        {
+          "regexp": "^(.+?)\\((\\d+)(?:,\\d+)?\\): error (C\\d+): (.+)$",
+          "file": 1,
+          "line": 2,
+          "code": 3,
+          "message": 4
+        }
+      ]
+    },
+    {
+      "owner": "cython-error",
+      "severity": "error",
+      "pattern": [
+        {
+          "regexp": "^(\\S+\\.(?:pyx|pxd|pxi)):(\\d+):(\\d+): (.+)$",
+          "file": 1,
+          "line": 2,
+          "column": 3,
+          "message": 4
+        }
+      ]
+    }
+  ]
+}