groupoid 0.1.0.dev5__tar.gz → 0.1.0.dev7__tar.gz

{groupoid-0.1.0.dev5 → groupoid-0.1.0.dev7}/.github/dependabot.yml

@@ -42,7 +42,6 @@ updates:
       # of one PR per package.
       runtime:
         patterns:
-          - "torch"
           - "geomstats"
           - "pymanopt"
           - "ripser"

groupoid-0.1.0.dev7/.github/workflows/artifact-transfer.yml

@@ -0,0 +1,46 @@
+name: Artifact transfer integrity
+
+on:
+  push:
+    branches: [main]
+    paths: [".github/workflows/**"]
+  pull_request:
+    branches: [main]
+    paths: [".github/workflows/**"]
+
+permissions:
+  contents: read
+
+jobs:
+  round-trip:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Create fixture and independent expected checksum
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p payload/nested
+          printf '%s\n' "$GITHUB_SHA" > payload/nested/fixture.txt
+          (cd payload && sha256sum nested/fixture.txt) > expected.sha256
+      - name: Upload fixture
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: artifact-transfer-proof
+          path: payload/
+          if-no-files-found: error
+          retention-days: 1
+      - name: Remove original fixture before downloading
+        run: rm -r payload
+      - name: Download fixture
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: artifact-transfer-proof
+          path: restored/
+      - name: Verify restored bytes and directory layout
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd restored
+          test "$(find . -type f | wc -l)" -eq 1
+          sha256sum --check ../expected.sha256

{groupoid-0.1.0.dev5 → groupoid-0.1.0.dev7}/.github/workflows/auto-tag-release.yml

@@ -23,17 +23,23 @@ name: Auto Tag Release
 # missing, so a pre-existing manual tag always takes precedence and this
 # workflow becomes a no-op for that version.
 
+# Tag only a main commit whose CI run succeeded. The tag-exists check below
+# keeps this idempotent for CI runs on commits that did not bump the version.
 on:
-  push:
-    branches: [main]
-    paths:
-      - pyproject.toml
+  workflow_run:
+    workflows: ["CI"]
+    types: [completed]
 
 permissions:
   contents: read
 
 jobs:
   tag:
+    if: >-
+      ${{ github.event.workflow_run.conclusion == 'success' &&
+          github.event.workflow_run.event == 'push' &&
+          github.event.workflow_run.head_branch == 'main' &&
+          github.event.workflow_run.head_repository.full_name == github.repository }}
     runs-on: ubuntu-latest
     permissions:
       contents: write   # push the tag
@@ -41,14 +47,26 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
+          ref: ${{ github.event.workflow_run.head_sha }}
           fetch-depth: 0   # need full tag history to check for an existing tag
 
       - name: Create the release tag if this version doesn't have one yet, and dispatch the release
         env:
           GH_TOKEN: ${{ github.token }}
+          CI_SHA: ${{ github.event.workflow_run.head_sha }}
         run: |
           set -euo pipefail
 
+          # Tag only the exact commit that passed CI, and only while it is
+          # still the head of main.
+          ci_sha="${CI_SHA}"
+          [ "$(git rev-parse HEAD)" = "${ci_sha}" ]
+          main_sha="$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/heads/main" --jq .object.sha)"
+          if [ "${main_sha}" != "${ci_sha}" ]; then
+            echo "main advanced past ${ci_sha}; the newer head's CI run decides."
+            exit 0
+          fi
+
           version=$(grep -m1 '^version = "' pyproject.toml | sed -E 's/version = "(.*)"/\1/')
           if [ -z "${version}" ]; then
             echo "::error::could not extract a version from pyproject.toml"
@@ -60,7 +78,7 @@ jobs:
           # anything else. A version that doesn't match this is presumably
           # intentional and unusual enough to want a human tagging it by
           # hand rather than this automation guessing.
-          if ! echo "${version}" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(\.dev[0-9]+|a[0-9]+|b[0-9]+|rc[0-9]+)?$'; then
+          if ! echo "${version}" | grep -Eq '^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(\.dev(0|[1-9][0-9]*)|a(0|[1-9][0-9]*)|b(0|[1-9][0-9]*)|rc(0|[1-9][0-9]*))?$'; then
             echo "::error::version '${version}' is not a recognized release format (expected X.Y.Z, optionally with .devN/aN/bN/rcN, no local metadata); refusing to tag automatically. Tag it manually if this is intentional."
             exit 1
           fi

{groupoid-0.1.0.dev5 → groupoid-0.1.0.dev7}/.github/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.11"
       - name: Install dependencies
@@ -24,8 +24,8 @@ jobs:
           # numpy / pydantic stubs (NDArray dtype args, the BaseModel base class).
           # Linting only against `ruff black mypy` left numpy/pydantic uninstalled,
           # so --strict raised disallow_subclassing_any on the BaseModel subclass.
-          # Consistent with the test / security / docs jobs. CPU torch keeps it lean.
-          .github/scripts/install_torch_cpu.sh
+          # All jobs now install the declared runtime dependencies, without
+          # the unused optional PyTorch backend.
           pip install -e ".[dev]"
       - name: Run ruff
         run: ruff check .
@@ -41,13 +41,12 @@ jobs:
         python-version: ["3.10", "3.11", "3.12"]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          .github/scripts/install_torch_cpu.sh
           pip install -e ".[dev]"
       - name: Run tests with coverage gate
         run: >-
@@ -59,7 +58,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.11"
       - name: Install dependencies
@@ -68,42 +67,25 @@ jobs:
           # Install the project's real runtime closure so pip-audit scans the
           # packages GROUPOID actually depends on. The previous `safety` step
           # installed only the tools and never the project, so it audited the
-          # wrong environment. CPU torch keeps the install lean.
-          .github/scripts/install_torch_cpu.sh
+          # wrong environment. No unused PyTorch install is injected.
           pip install -e .
           pip install bandit pip-audit
-          # Pin setuptools LAST. torch requires setuptools<82 and pulls in a
-          # runner-bundled setuptools that can predate the PYSEC-2025-49 fix
-          # (78.1.1); upgrading before `pip install -e .` is simply undone by torch.
-          # The window >=78.1.1,<82 clears the advisory while staying
-          # dependency-consistent with torch (verified: pip check clean).
-          python -m pip install --upgrade "setuptools>=78.1.1,<82"
+          # Setuptools is build tooling, but remains in the audited CI environment.
+          # No torch<82 constraint remains; require the patched release.
+          python -m pip install --upgrade "setuptools>=84.1.0"
+          python -m pip check
       - name: Run bandit
         run: bandit -r groupoid/ -c pyproject.toml
       - name: Audit dependencies for known vulnerabilities (pip-audit)
-        # pip-audit (OSV-backed, maintained) replaces the deprecated `safety check`
-        # (deprecated in safety 3.x in favour of the account-gated `safety scan`).
-        # HARD gate: any advisory with a fix version fails the job. Two documented
-        # exceptions, both disclosed in SECURITY.md:
-        # - CVE-2025-3000 (torch): no fixed release exists upstream, and OSV
-        #   expresses the affected range (listed versions up to v2.6.0) as a
-        #   Git/commit boundary pip-audit cannot version-resolve, so it
-        #   conservatively flags the installed torch. The torch.load / JIT
-        #   deserialization path is not exercised by GROUPOID. Revisit the ignore
-        #   once upstream publishes a fixed release.
-        # - PYSEC-2026-3447 (CVE-2026-59890, setuptools <83): the fix (83.0.0) is
-        #   unreachable while torch requires setuptools<82 (see the install step
-        #   above). The flaw is a macOS-only (APFS/HFS+) Unicode-normalization
-        #   bypass of MANIFEST.in exclude rules when building sdists; all CI and
-        #   release builds run on ubuntu-latest. Drop the ignore once torch
-        #   permits setuptools>=83.
-        run: pip-audit --ignore-vuln CVE-2025-3000 --ignore-vuln PYSEC-2026-3447
+        # Hard gate on the installed runtime and audit-tool closure.
+        # No CVE/PYSEC ignore flags or waived vulnerable packages.
+        run: pip-audit
 
   pre-commit:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.11"
       - name: Install pre-commit
@@ -115,13 +97,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.11"
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          .github/scripts/install_torch_cpu.sh
           pip install -e ".[dev]"
       # Benchmarks run for information only. There is no regression gate:
       # timing baselines recorded on one machine are not comparable to a
@@ -135,7 +116,7 @@ jobs:
           pytest benchmarks/ -v --benchmark-json=benchmark_results.json || true
       - name: Upload benchmark results
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: benchmark-results
           path: benchmark_results.json
@@ -145,13 +126,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.11"
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          .github/scripts/install_torch_cpu.sh
           pip install -e ".[docs]"
       - name: Build docs
         run: mkdocs build --strict

{groupoid-0.1.0.dev5 → groupoid-0.1.0.dev7}/.github/workflows/docs-deploy.yml

@@ -17,13 +17,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.11"
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          .github/scripts/install_torch_cpu.sh
           pip install -e ".[docs]"
       - name: Build docs
         run: mkdocs build --strict
@@ -42,4 +41,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5