merge

Author: rparolin

.coveragerc

@@ -1,9 +1,25 @@
-# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: LicenseRef-NVIDIA-SOFTWARE-LICENSE
 
-[report]
-show_missing = true
+[paths]
+source =
+    cuda\
+    cuda/
 
 [run]
 plugins = Cython.Coverage
 core = ctrace
+branch = False
+relative_files = True
+# Omits specific definition files that causes plugin errors
+omit =
+    */windll.pxd
+    */_lib/windll.pxd
+    */_lib/utils.pxd
+
+[report]
+show_missing = true
+precision = 2
+
+[html]
+show_contexts = True

.github/RELEASE-core.md

@@ -123,41 +123,21 @@ Pushing the tag triggers a CI run automatically. Monitor it in the
 
 ## Upload wheels to PyPI
 
-This is a two-stage process: first publish to TestPyPI, verify, then
-publish to PyPI.
-
-### Stage 1: TestPyPI
+This is a single `CI: Release` workflow run with two sequential stages:
+publish to TestPyPI, then publish the same wheel set to PyPI.
 
 1. Go to **Actions > CI: Release** and run the workflow with:
    - **Component**: `cuda-core`
    - **The release git tag**: `cuda-core-v0.6.0`
-   - **The GHA run ID that generated validated artifacts**: This is the
-     run ID of the successful tag-triggered CI run from the previous step.
-     You can find it in the URL when viewing the run in the Actions tab
-     (e.g. `https://github.com/NVIDIA/cuda-python/actions/runs/123456789`
-     — the run ID is `123456789`).
-   - **build-ctk-ver**: the `cuda.build.version` from
-     [`ci/versions.yml`](../ci/versions.yml) (e.g. `13.1.1`)
-   - **Which wheel index to publish to**: `testpypi`
-
-2. Wait for the workflow to complete.
-
-3. Verify the TestPyPI upload by installing and running tests from a
-   checked-out copy of the repository:
-
-   ```bash
-   pip install -i https://test.pypi.org/simple/ \
-       --extra-index-url https://pypi.org/simple/ \
-       cuda-core==0.6.0
-   cd cuda_core/tests && pytest
-   ```
 
-### Stage 2: PyPI
+   The workflow automatically looks up the successful tag-triggered CI run
+   for the selected release tag.
 
-Once TestPyPI verification passes, rerun the same workflow with:
-- **Which wheel index to publish to**: `pypi`
+2. Wait for the workflow to complete. It will:
+   - publish the selected wheels to TestPyPI
+   - publish the same wheel set to PyPI
 
-After completion, verify:
+3. After completion, verify the final PyPI upload:
 
 ```bash
 pip install cuda-core==0.6.0

.github/actions/fetch_ctk/action.yml

@@ -14,7 +14,7 @@ inputs:
   cuda-components:
     description: "A list of the CTK components to install as a comma-separated list. e.g. 'cuda_nvcc,cuda_nvrtc,cuda_cudart'"
     required: false
-    default: "cuda_nvcc,cuda_cudart,cuda_crt,libnvvm,cuda_nvrtc,cuda_profiler_api,cuda_cccl,libnvjitlink,libcufile,libnvfatbin"
+    default: "cuda_nvcc,cuda_cudart,cuda_crt,libnvvm,cuda_nvrtc,cuda_profiler_api,cuda_cccl,cuda_cupti,libnvjitlink,libcufile,libnvfatbin"
   cuda-path:
     description: "where the CTK components will be installed to, relative to $PWD"
     required: false

.github/copy-pr-bot.yaml

@@ -5,6 +5,6 @@
 # https://docs.gha-runners.nvidia.com/apps/copy-pr-bot/
 
 enabled: true
-# always require manual CI triggering, ignoring signed commits
+# auto-sync ready PRs so CI starts immediately; keep draft PRs manual
 auto_sync_draft: false
-auto_sync_ready: false
+auto_sync_ready: true

.github/dependabot.yml

@@ -4,6 +4,7 @@
 
 version: 2
 updates:
+  # GitHub Actions updates targeting the default branch (main)
   - package-ecosystem: github-actions
     directory: /
     schedule:
@@ -19,3 +20,21 @@ updates:
         applies-to: version-updates
         patterns: ["*"]
         update-types: ["major", "minor", "patch"]
+
+  # GitHub Actions updates targeting the 12.9.x branch
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: "12.9.x"  # keep in sync with backport_branch in ci/versions.yml
+    schedule:
+      interval: "monthly"
+      time: "09:00"
+      timezone: "America/Los_Angeles"
+
+    # Keep churn down: only one open PR from this ecosystem at a time
+    open-pull-requests-limit: 1
+
+    groups:
+      actions-monthly:
+        applies-to: version-updates
+        patterns: ["*"]
+        update-types: ["major", "minor", "patch"]

.github/workflows/bandit.yml

@@ -42,6 +42,6 @@ jobs:
         with:
           args: "check --select S --ignore ${{ steps.ignore-codes.outputs.codes }} --output-format sarif --output-file results.sarif"
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@v4.32.4
+        uses: github/codeql-action/upload-sarif@v4.32.5
         with:
           sarif_file: results.sarif

.github/workflows/build-docs.yml

@@ -7,9 +7,6 @@ name: "CI: Build and update docs"
 on:
   workflow_call:
     inputs:
-      build-ctk-ver:
-        type: string
-        required: true
       component:
         description: "Component(s) to build docs for"
         required: false
@@ -47,18 +44,21 @@ jobs:
       run:
         shell: bash -el {0}
     steps:
-      - name: validate build-ctk
-        run: |
-          if [ ! "${{ inputs.build-ctk-ver }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]; then
-            echo "error: `build-ctk-ver` ${{ inputs.build-ctk-ver }} version does not match MAJOR.MINOR.MICRO" >&2
-            exit 1
-          fi
       - name: Checkout ${{ github.event.repository.name }}
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 0
           ref: ${{ inputs.git-tag }}
 
+      - name: Read build CTK version
+        run: |
+          BUILD_CTK_VER=$(yq '.cuda.build.version' ci/versions.yml)
+          if [[ ! "${BUILD_CTK_VER}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "error: derived CTK build version ${BUILD_CTK_VER} does not match MAJOR.MINOR.MICRO" >&2
+            exit 1
+          fi
+          echo "BUILD_CTK_VER=${BUILD_CTK_VER}" >> "$GITHUB_ENV"
+
       # TODO: This workflow runs on GH-hosted runner and cannot use the proxy cache
 
       - name: Set up miniforge
@@ -82,7 +82,7 @@ jobs:
         uses: ./.github/actions/fetch_ctk
         with:
           host-platform: linux-64
-          cuda-version: ${{ inputs.build-ctk-ver }}
+          cuda-version: ${{ env.BUILD_CTK_VER }}
 
       - name: Set environment variables
         run: |
@@ -103,7 +103,7 @@ jobs:
           echo "CUDA_CORE_ARTIFACT_BASENAME=${CUDA_CORE_ARTIFACT_BASENAME}" >> $GITHUB_ENV
           echo "CUDA_CORE_ARTIFACT_NAME=${CUDA_CORE_ARTIFACT_BASENAME}-${FILE_HASH}" >> $GITHUB_ENV
           echo "CUDA_CORE_ARTIFACTS_DIR=$(realpath "$REPO_DIR/cuda_core/dist")" >> $GITHUB_ENV
-          CUDA_BINDINGS_ARTIFACT_BASENAME="cuda-bindings-python${PYTHON_VERSION_FORMATTED}-cuda${{ inputs.build-ctk-ver }}-linux-64"
+          CUDA_BINDINGS_ARTIFACT_BASENAME="cuda-bindings-python${PYTHON_VERSION_FORMATTED}-cuda${BUILD_CTK_VER}-linux-64"
           echo "CUDA_BINDINGS_ARTIFACT_BASENAME=${CUDA_BINDINGS_ARTIFACT_BASENAME}" >> $GITHUB_ENV
           echo "CUDA_BINDINGS_ARTIFACT_NAME=${CUDA_BINDINGS_ARTIFACT_BASENAME}-${FILE_HASH}" >> $GITHUB_ENV
           echo "CUDA_BINDINGS_ARTIFACTS_DIR=$(realpath "$REPO_DIR/cuda_bindings/dist")" >> $GITHUB_ENV

.github/workflows/build-wheel.yml

@@ -369,7 +369,7 @@ jobs:
 
           OLD_BRANCH=$(yq '.backport_branch' ci/versions.yml)
           OLD_BASENAME="cuda-bindings-python${PYTHON_VERSION_FORMATTED}-cuda*-${{ inputs.host-platform }}*"
-          LATEST_PRIOR_RUN_ID=$(gh run list -b ${OLD_BRANCH} -L 1 -w "ci.yml" -s completed -R NVIDIA/cuda-python --json databaseId | jq '.[]| .databaseId')
+          LATEST_PRIOR_RUN_ID=$(gh run list -b ${OLD_BRANCH} -L 1 -w "ci.yml" -s success -R NVIDIA/cuda-python --json databaseId | jq '.[]| .databaseId')
           if [[ "$LATEST_PRIOR_RUN_ID" == "" ]]; then
             echo "LATEST_PRIOR_RUN_ID not found!"
             exit 1

.github/workflows/ci.yml

@@ -220,7 +220,6 @@ jobs:
     secrets: inherit
     uses: ./.github/workflows/build-docs.yml
     with:
-      build-ctk-ver: ${{ needs.ci-vars.outputs.CUDA_BUILD_VER }}
       is-release: ${{ github.ref_type == 'tag' }}
 
   checks:

.github/workflows/codeql.yml

@@ -31,13 +31,13 @@ jobs:
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@0ec47d036c68ae0cf94c629009b1029407111281  # v3.31.8
+      uses: github/codeql-action/init@40f0fa95c41fede7b43f035cb47aac899ee0ba0a  # v3.31.8
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
         queries: security-extended
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@0ec47d036c68ae0cf94c629009b1029407111281  # v3.31.8
+      uses: github/codeql-action/analyze@40f0fa95c41fede7b43f035cb47aac899ee0ba0a  # v3.31.8
       with:
         category: "/language:${{matrix.language}}"