From b0e2b68c9b4ee30828c7174043456339459a8142 Mon Sep 17 00:00:00 2001
From: Francesco Zanetta <francesco.zanetta@meteoswiss.ch>
Date: Sat, 6 Jun 2026 19:55:38 +0200
Subject: [PATCH 1/3] CI: modernize action versions, fold coverage into matrix,
 harden permissions

---
 .github/workflows/ci.yaml | 66 ++++++++++++++++++---------------------
 1 file changed, 30 insertions(+), 36 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 595a6c1..98df9f7 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -7,69 +7,63 @@ on:
     branches: [main]
   workflow_dispatch: {}
 
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   test:
-
     runs-on: ${{ matrix.os }}
 
     strategy:
+      fail-fast: false
       matrix:
         os: [macos-latest, ubuntu-latest]
         python-version: ["3.12", "3.13", "3.14"]
         backend: [numpy, numba, jax, torch]
+        include:
+          # Coverage leg: full suite, all backends, one Python/OS. Folded in
+          # from the former standalone `coverage:` job (spec A8).
+          - os: ubuntu-latest
+            python-version: "3.13"
+            backend: all
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v2
+        uses: astral-sh/setup-uv@v6
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
-
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
-        with:
           python-version: ${{ matrix.python-version }}
 
       - name: Install the project
         run: |
-          if [ "${{ matrix.backend }}" = "numpy" ]; then
+          if [ "${{ matrix.backend }}" = "all" ]; then
+            uv sync --all-extras --dev
+          elif [ "${{ matrix.backend }}" = "numpy" ]; then
             uv sync
           else
             uv sync --extra ${{ matrix.backend }}
           fi
 
       - name: Run tests
-        run: uv run pytest tests/ --backend ${{matrix.backend }}
-
-  coverage:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v2
-        with:
-          enable-cache: true
-          cache-dependency-glob: "uv.lock"
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-
-      - name: Install the project
-        run: uv sync --all-extras --dev
+        if: matrix.backend != 'all'
+        run: uv run pytest tests/ --backend ${{ matrix.backend }}
 
       - name: Run tests with coverage
+        if: matrix.backend == 'all'
         run: |
           uv run pytest --cov=scoringrules tests/
           uv run coverage xml
 
       - name: Upload coverage report to Codecov
-        uses: codecov/codecov-action@v4
+        if: matrix.backend == 'all'
+        uses: codecov/codecov-action@v5
         with:
           file: ./coverage.xml
           flags: unittests
@@ -78,18 +72,18 @@ jobs:
           fail_ci_if_error: false
           token: ${{ secrets.CODECOV_TOKEN }}
 
-
   lint:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v2
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+          python-version: "3.13"
 
       - name: Run pre-commit hooks
         run: uvx pre-commit run --all-files

From fd820911063d333be3b0120d42d87280d4d2ddbc Mon Sep 17 00:00:00 2001
From: Francesco Zanetta <francesco.zanetta@meteoswiss.ch>
Date: Sat, 6 Jun 2026 20:46:31 +0200
Subject: [PATCH 2/3] CI: use codecov-action v5 'files' input instead of
 removed 'file'

---
 .github/workflows/ci.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 98df9f7..61bcf03 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -65,7 +65,7 @@ jobs:
         if: matrix.backend == 'all'
         uses: codecov/codecov-action@v5
         with:
-          file: ./coverage.xml
+          files: ./coverage.xml
           flags: unittests
           env_vars: OS,PYTHON
           name: codecov-umbrella

From dcdc12e23fb94eeb2db81fa12b189ece306abde9 Mon Sep 17 00:00:00 2001
From: Francesco Zanetta <francesco.zanetta@meteoswiss.ch>
Date: Sat, 6 Jun 2026 21:15:41 +0200
Subject: [PATCH 3/3] CI: drop unset env_vars OS,PYTHON from Codecov upload

---
 .github/workflows/ci.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 61bcf03..61b409b 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -67,7 +67,6 @@ jobs:
         with:
           files: ./coverage.xml
           flags: unittests
-          env_vars: OS,PYTHON
           name: codecov-umbrella
           fail_ci_if_error: false
           token: ${{ secrets.CODECOV_TOKEN }}