orbix 2.0.0__tar.gz → 3.0.0__tar.gz

orbix-3.0.0/.codespellrc

@@ -0,0 +1,4 @@
+[codespell]
+skip = .git,*.ipynb,uv.lock,*/_build,*.fits
+# add domain words only if codespell flags them (clean on the libraries sampled)
+# ignore-words-list =

orbix-3.0.0/.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 4
+
+[*.{yml,yaml,json,toml}]
+indent_size = 2
+
+[Makefile]
+indent_style = tab

orbix-3.0.0/.gitattributes

@@ -0,0 +1,10 @@
+* text=auto eol=lf
+*.ipynb  text eol=lf linguist-documentation
+docs/**  linguist-documentation
+*.fits   binary
+*.npy    binary
+*.npz    binary
+*.png    binary
+*.pdf    binary
+uv.lock  linguist-generated -diff
+CHANGELOG.md linguist-generated

orbix-3.0.0/.github/dependabot.yml

@@ -0,0 +1,30 @@
+# Drop-in for every owned library. One config, low noise: one grouped pull request per month,
+# new releases wait a week (cooldown) so a yanked or compromised release is seen before it lands.
+# Security updates ignore the cooldown and are configured separately in repository settings.
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns: ["*"]
+    commit-message:
+      prefix: "ci"   # conventional commit type that release-please ignores
+
+  # Only for repos with a committed uv.lock or a pre-commit config worth bumping.
+  # The libraries pin no lockfile, so the uv ecosystem is deliberately absent here.
+  - package-ecosystem: "pre-commit"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    cooldown:
+      default-days: 7
+    groups:
+      hooks:
+        patterns: ["*"]
+    commit-message:
+      prefix: "ci"

orbix-3.0.0/.github/scripts/ci_summary.py

@@ -0,0 +1,77 @@
+"""Write a job summary from a pytest junit file and enforce a suite time budget.
+
+Usage: python ci_summary.py junit.xml [--title TITLE] [--budget-seconds N]
+
+Appends markdown to $GITHUB_STEP_SUMMARY (stdout when unset). Exits non-zero when the
+summed test time exceeds the budget, or when any test was skipped (a skip hides a
+missing dependency).
+"""
+
+import argparse
+import os
+import sys
+import xml.etree.ElementTree as ET
+
+
+def main():
+    """Summarize collected tests and check the requested budget and skip policy."""
+    parser = argparse.ArgumentParser()
+    parser.add_argument("junit")
+    parser.add_argument("--title", default="Tests")
+    parser.add_argument("--budget-seconds", type=float, default=0.0)
+    parser.add_argument("--allow-skips", action="store_true")
+    args = parser.parse_args()
+
+    if not os.path.exists(args.junit):
+        print(f"{args.junit} not found: the test step did not run")
+        return 1
+    root = ET.parse(args.junit).getroot()
+    cases = []
+    skipped = []
+    for case in root.iter("testcase"):
+        name = f"{case.get('classname', '')}::{case.get('name', '')}"
+        seconds = float(case.get("time", 0.0))
+        cases.append((seconds, name))
+        # Pytest records expected failures as skipped; pytest enforces strict xfails.
+        skip = case.find("skipped")
+        if skip is not None and skip.get("type") != "pytest.xfail":
+            skipped.append(name)
+    total = sum(s for s, _ in cases)
+    cases.sort(reverse=True)
+
+    lines = [
+        f"### {args.title}",
+        "",
+        f"- tests: {len(cases)}, skipped: {len(skipped)}",
+        f"- summed test time: {total:.1f} s"
+        + (f" (budget {args.budget_seconds:.0f} s)" if args.budget_seconds else ""),
+        "",
+        "| slowest tests | seconds |",
+        "|---|---|",
+    ]
+    lines += [f"| `{name}` | {seconds:.2f} |" for seconds, name in cases[:10]]
+    if skipped:
+        policy = "allowed" if args.allow_skips else "treated as a failure"
+        lines += ["", f"Skipped ({policy}):"]
+        lines += [f"- `{name}`" for name in skipped[:20]]
+
+    text = "\n".join(lines) + "\n"
+    target = os.environ.get("GITHUB_STEP_SUMMARY")
+    if target:
+        with open(target, "a", encoding="utf-8") as handle:
+            handle.write(text)
+    else:
+        print(text)
+
+    failed = False
+    if args.budget_seconds and total > args.budget_seconds:
+        print(f"suite time {total:.1f} s exceeds budget {args.budget_seconds:.0f} s")
+        failed = True
+    if skipped and not args.allow_skips:
+        print(f"{len(skipped)} tests were skipped")
+        failed = True
+    return 1 if failed else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

orbix-3.0.0/.github/sibling-pins.txt

@@ -0,0 +1,5 @@
+# Unreleased sibling libraries, applied as uv overrides so each is installed at a pinned main
+# commit whatever version bounds other packages declare (a breaking change waiting for its
+# release tag reports the old major version). Move a pin deliberately; drop it once PyPI covers it.
+hwoutils @ git+https://github.com/CoreySpohn/hwoutils@20f6973e39954321feba7efcf781fc217016a46f
+eyepiece @ git+https://github.com/CoreySpohn/eyepiece@c7a4bea5a34b8751b4791bf74ea35bcd9da54cb1

orbix-3.0.0/.github/workflows/ci.yml

@@ -0,0 +1,208 @@
+name: CI
+
+# Replaces tests.yml. Quick tier on every push and pull request, docs with executed
+# examples, and the slow tier on a nightly schedule. No secrets are used: the default
+# GITHUB_TOKEN with read access is enough because every sibling library is public.
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  schedule:
+    - cron: "17 7 * * *"   # nightly, 07:17 UTC (default branch only)
+  workflow_dispatch:
+    inputs:
+      tier:
+        description: "Test selection for a manual run"
+        default: "not slow"
+        type: choice
+        options: [ "not slow", "slow", "all" ]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'schedule' }}
+
+env:
+  JAX_PLATFORMS: cpu
+  EYEPIECE_REQUIRE_MANIM: "1"
+  # Batched programs can stall on 2-vCPU runners with the default Eigen threading.
+  XLA_FLAGS: --xla_cpu_multi_thread_eigen=false intra_op_parallelism_threads=1
+  JAX_COMPILATION_CACHE_DIR: ${{ github.workspace }}/.jax_cache
+  JAX_PERSISTENT_CACHE_MIN_COMPILE_TIME_SECS: "1"
+  PYTHONHASHSEED: "0"
+
+jobs:
+  quick:
+    name: Quick tier (py${{ matrix.python-version }})
+    if: github.event_name != 'schedule' && (github.event_name != 'workflow_dispatch' || inputs.tier != 'slow')
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.12"]
+    steps:
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@eb1897b8dc4b5d5bfe39a428a8f2304605e0983c # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          enable-cache: true
+          cache-dependency-glob: "pyproject.toml"
+
+      - name: Restore the JAX compile cache
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: .jax_cache
+          key: jax-${{ runner.os }}-py${{ matrix.python-version }}-${{ hashFiles('pyproject.toml') }}-${{ github.sha }}
+          restore-keys: |
+            jax-${{ runner.os }}-py${{ matrix.python-version }}-${{ hashFiles('pyproject.toml') }}-
+            jax-${{ runner.os }}-py${{ matrix.python-version }}-
+
+      # Manim's Python extensions need Cairo and Pango headers at install time.
+      - name: Install renderer build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends -y libcairo2-dev libpango1.0-dev pkg-config
+
+      - name: Install the package and test tools
+        run: |
+          uv venv .venv --python ${{ matrix.python-version }}
+          echo "VIRTUAL_ENV=$PWD/.venv" >> "$GITHUB_ENV"
+          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
+          # One resolve, so pinned siblings satisfy the package floors.
+          uv pip install --python .venv/bin/python -e ".[test]" --override .github/sibling-pins.txt ruff==0.15.18 deptry ty==0.0.96
+
+      - name: Lint and formatting
+        run: |
+          ruff check src/orbix tests
+          ruff format --check src/orbix tests
+
+      - name: Check dependencies
+        run: deptry src/orbix
+
+      - name: Check types (advisory)
+        continue-on-error: true
+        run: ty check src/orbix
+
+      - name: Quick tier
+        run: |
+          pytest tests/ -m "not slow" -ra --tb=short \
+            --timeout=300 --fail-slow=30s \
+            --durations=15 --durations-min=1.0 \
+            --junitxml=junit-quick.xml
+
+      - name: Job summary
+        if: always()
+        run: python .github/scripts/ci_summary.py junit-quick.xml --title "Quick tier" --budget-seconds 600
+
+  docs:
+    name: Docs with executed examples
+    if: github.event_name != 'schedule' && (github.event_name != 'workflow_dispatch' || inputs.tier != 'slow')
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
+          fetch-depth: 0   # hatch-vcs needs tags for the docs version
+
+      - uses: astral-sh/setup-uv@eb1897b8dc4b5d5bfe39a428a8f2304605e0983c # v7.0.0
+        with:
+          python-version: "3.12"
+          enable-cache: true
+          cache-dependency-glob: "pyproject.toml"
+
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: .jax_cache
+          key: jax-docs-${{ hashFiles('pyproject.toml') }}-${{ github.sha }}
+          restore-keys: jax-docs-${{ hashFiles('pyproject.toml') }}-
+
+      # Manim's Python extensions need Cairo and Pango headers at install time.
+      - name: Install renderer build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends -y libcairo2-dev libpango1.0-dev pkg-config
+
+      - name: Install docs dependencies
+        run: |
+          uv venv .venv --python 3.12
+          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
+          # One resolve, so pinned siblings satisfy the package floors.
+          uv pip install --python .venv/bin/python -e ".[docs,test]" --override .github/sibling-pins.txt
+
+      # Every Python fence in README.md and docs runs as a test. A block that cannot run on a
+      # runner carries the info string `python notest` and a one-line reason above it.
+      - name: Execute fenced code blocks
+        run: |
+          pytest README.md docs --markdown-docs --markdown-docs-syntax=superfences \
+            -p no:cacheprovider --timeout=120 -ra --tb=short \
+            --junitxml=junit-docs.xml
+
+      # Executes {code-cell} blocks and notebooks, and fails on any Sphinx warning.
+      - name: Build docs with execution forced
+        run: |
+          sphinx-build -W --keep-going -b html \
+            -D nb_execution_mode=force -D nb_execution_raise_on_error=1 \
+            docs docs/_build/html
+
+      - name: Job summary
+        if: always()
+        run: python .github/scripts/ci_summary.py junit-docs.xml --title "Docs examples" --budget-seconds 300 --allow-skips
+
+  slow:
+    name: Slow tier
+    if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.tier != 'not slow')
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@eb1897b8dc4b5d5bfe39a428a8f2304605e0983c # v7.0.0
+        with:
+          python-version: "3.12"
+          enable-cache: true
+          cache-dependency-glob: "pyproject.toml"
+
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: .jax_cache
+          key: jax-slow-${{ hashFiles('pyproject.toml') }}-${{ github.sha }}
+          restore-keys: jax-slow-${{ hashFiles('pyproject.toml') }}-
+
+      # Manim's Python extensions need Cairo and Pango headers at install time.
+      - name: Install renderer build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends -y libcairo2-dev libpango1.0-dev pkg-config
+
+      - name: Install the package and test tools
+        run: |
+          uv venv .venv --python 3.12
+          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
+          # One resolve, so pinned siblings satisfy the package floors.
+          uv pip install --python .venv/bin/python -e ".[test]" --override .github/sibling-pins.txt
+
+      - name: Slow tier (hypothesis nightly profile)
+        env:
+          HYPOTHESIS_PROFILE: nightly
+        run: |
+          status=0
+          pytest tests/ -m slow -ra --tb=short --timeout=900 \
+            --durations=25 --junitxml=junit-slow.xml || status=$?
+          if [ "$status" -ne 0 ] && [ "$status" -ne 5 ]; then
+            exit "$status"
+          fi
+
+      - name: Job summary
+        if: always()
+        run: python .github/scripts/ci_summary.py junit-slow.xml --title "Slow tier" --allow-skips

{orbix-2.0.0 → orbix-3.0.0}/.github/workflows/docs.yml

@@ -7,15 +7,22 @@ on:
     branches: [ main ]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   docs:
     name: Build docs
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      with:
+        persist-credentials: false
+        fetch-depth: 0
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v7
+      uses: astral-sh/setup-uv@eb1897b8dc4b5d5bfe39a428a8f2304605e0983c # v7.0.0
       with:
         enable-cache: true
 
@@ -23,7 +30,7 @@ jobs:
       run: uv venv .venv --python 3.12
 
     - name: Install package with docs dependencies
-      run: uv pip install -e ".[docs]"
+      run: uv pip install --python .venv/bin/python -e ".[docs]" --override .github/sibling-pins.txt
       env:
         VIRTUAL_ENV: ${{ github.workspace }}/.venv
 
@@ -31,4 +38,4 @@ jobs:
     # nb_execution_raise_on_error, so a cell that stops working fails here
     # rather than on the documentation host.
     - name: Build the documentation
-      run: .venv/bin/sphinx-build -b html docs docs/_build/html
+      run: .venv/bin/sphinx-build -W --keep-going -b html -D nb_execution_mode=force -D nb_execution_raise_on_error=1 docs docs/_build/html

orbix-3.0.0/.github/workflows/hygiene.yml

@@ -0,0 +1,40 @@
+name: hygiene
+
+# Checks that do not depend on JAX: workflow security, spelling, and hooks.
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "41 6 * * 1"   # weekly, so the repo has activity and new lint rules are noticed
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: hygiene-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  hygiene:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@eb1897b8dc4b5d5bfe39a428a8f2304605e0983c # v7.0.0
+
+      - name: Lint workflows (zizmor)
+        run: uvx zizmor --format=github --min-severity=medium .github
+
+      - name: Spelling (codespell)
+        run: uvx codespell --check-hidden
+
+      - name: Pre-commit hooks
+        run: uvx pre-commit run --all-files --show-diff-on-failure
+        env:
+          SKIP: conventional-pre-commit   # only runs with a commit message

{orbix-2.0.0 → orbix-3.0.0}/.github/workflows/publish-to-pypi.yml

@@ -1,6 +1,11 @@
 name: Publish to PyPI
 
-on: push
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
 
 jobs:
   build:
@@ -8,9 +13,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      with:
+        persist-credentials: false
     - name: Set up Python
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
       with:
         python-version: "3.x"
     - name: Install pypa/build
@@ -22,7 +29,7 @@ jobs:
     - name: Build a binary wheel and a source tarball
       run: python3 -m build
     - name: Store the distribution packages
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
       with:
         name: python-package-distributions
         path: dist/
@@ -30,7 +37,7 @@ jobs:
   publish-to-pypi:
     name: >-
       Publish Python distribution to PyPI
-    if: startsWith(github.ref, 'refs/tags/')
+    if: startsWith(github.ref, 'refs/tags/v')
     needs:
     - build
     runs-on: ubuntu-latest
@@ -42,9 +49,9 @@ jobs:
 
     steps:
     - name: Download all the dists
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
       with:
         name: python-package-distributions
         path: dist/
     - name: Publish distribution to PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3

{orbix-2.0.0 → orbix-3.0.0}/.github/workflows/release-please.yml

@@ -4,16 +4,18 @@ on:
       - main
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 name: release-please
 
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
-      - uses: googleapis/release-please-action@v5
+      - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
         with:
           # this assumes that you have created a personal access token
           # (PAT) and configured it as a GitHub action secret named

orbix-3.0.0/.github/workflows/upstream.yml

@@ -0,0 +1,146 @@
+name: Upstream canary
+
+# Exercise upstream releases before a relock, and the declared dependency floors.
+on:
+  schedule:
+    - cron: "23 5 * * 1,4"   # Monday and Thursday, 05:23 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'schedule' }}
+
+env:
+  JAX_PLATFORMS: cpu
+  EYEPIECE_REQUIRE_MANIM: "1"
+  # Batched programs can stall on 2-vCPU runners with the default Eigen threading.
+  XLA_FLAGS: --xla_cpu_multi_thread_eigen=false intra_op_parallelism_threads=1
+  JAX_COMPILATION_CACHE_DIR: ${{ github.workspace }}/.jax_cache
+  JAX_PERSISTENT_CACHE_MIN_COMPILE_TIME_SECS: "1"
+  PYTHONHASHSEED: "0"
+
+jobs:
+  upstream-dev:
+    name: Upstream pre-releases (py3.12)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@eb1897b8dc4b5d5bfe39a428a8f2304605e0983c # v7.0.0
+        with:
+          python-version: "3.12"
+          enable-cache: true
+          cache-dependency-glob: "pyproject.toml"
+
+      # Manim's Python extensions need Cairo and Pango headers at install time.
+      - name: Install renderer build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends -y libcairo2-dev libpango1.0-dev pkg-config
+
+      - name: Install the package and upstream pre-releases
+        run: |
+          uv venv .venv --python 3.12
+          echo "VIRTUAL_ENV=$PWD/.venv" >> "$GITHUB_ENV"
+          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
+          uv pip install --python .venv/bin/python -e ".[test]" --override .github/sibling-pins.txt
+          uv pip install --python .venv/bin/python --upgrade --prerelease=allow \
+            jax jaxlib numpy scipy astropy --override .github/sibling-pins.txt
+          # Nightly-only index verified against the JAX installation docs:
+          # https://docs.jax.dev/en/latest/installation.html#jax-nightly-installation
+          uv pip install --python .venv/bin/python --upgrade --prerelease=allow \
+            --index https://us-python.pkg.dev/ml-oss-artifacts-published/jax-public-nightly-artifacts-registry/simple/ \
+            jax jaxlib --override .github/sibling-pins.txt
+          uv pip freeze --python .venv/bin/python
+
+      - name: Quick tier with warnings as errors
+        run: |
+          for test_file in tests/test_*.py; do
+            pytest "$test_file" -m "not slow" -q -p no:cacheprovider --timeout=300
+          done
+
+  lowest-direct:
+    name: Lowest direct dependencies (py3.12)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@eb1897b8dc4b5d5bfe39a428a8f2304605e0983c # v7.0.0
+        with:
+          python-version: "3.12"
+          enable-cache: true
+          cache-dependency-glob: "pyproject.toml"
+
+      # Manim's Python extensions need Cairo and Pango headers at install time.
+      - name: Install renderer build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends -y libcairo2-dev libpango1.0-dev pkg-config
+
+      - name: Install the lowest direct dependencies
+        run: |
+          uv venv .venv --python 3.12
+          echo "VIRTUAL_ENV=$PWD/.venv" >> "$GITHUB_ENV"
+          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
+          uv pip install --python .venv/bin/python --resolution lowest-direct -e ".[docs,test]" --override .github/sibling-pins.txt
+          uv pip freeze --python .venv/bin/python
+
+      - name: Quick tier
+        run: |
+          for test_file in tests/test_*.py; do
+            pytest "$test_file" -m "not slow" -q -p no:cacheprovider --timeout=300
+          done
+
+  report:
+    name: Update the tracking issue
+    needs: [upstream-dev, lowest-direct]
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    # Manual runs on other branches share the same tracking issue.
+    concurrency:
+      group: upstream-canary-report
+      cancel-in-progress: false
+    permissions:
+      issues: write # This job alone maintains the canary tracking issue.
+    steps:
+      - name: Open, update or close the tracking issue
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          UPSTREAM_RESULT: ${{ needs.upstream-dev.result }}
+          LOWEST_RESULT: ${{ needs.lowest-direct.result }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          title="Upstream canary failing"
+          # Match the exact title and reuse closed issues on a later regression.
+          issue=$(gh issue list --state all --search "\"$title\" in:title" --limit 100 \
+            --json number,title,state --jq 'map(select(.title == "Upstream canary failing")) | first // empty')
+          number=$(jq -r '.number // empty' <<< "$issue")
+          state=$(jq -r '.state // empty' <<< "$issue")
+          body=$(printf 'Upstream pre-releases: %s\nLowest direct dependencies: %s\n\nLatest run: %s\n' \
+            "$UPSTREAM_RESULT" "$LOWEST_RESULT" "$RUN_URL")
+          if [ "$UPSTREAM_RESULT" = "failure" ] || [ "$LOWEST_RESULT" = "failure" ]; then
+            if [ -n "$number" ]; then
+              gh issue edit "$number" --body "$body"
+              if [ "$state" = "CLOSED" ]; then
+                gh issue reopen "$number"
+              fi
+            else
+              gh issue create --title "$title" --body "$body"
+            fi
+          elif [ "$UPSTREAM_RESULT" = "success" ] && [ "$LOWEST_RESULT" = "success" ]; then
+            if [ -n "$number" ] && [ "$state" = "OPEN" ]; then
+              gh issue edit "$number" --body "$body"
+              gh issue close "$number" --comment "Both canary jobs are passing: $RUN_URL"
+            fi
+          fi

orbix-3.0.0/.github/zizmor.yml

@@ -0,0 +1,6 @@
+# Require immutable action references, including first-party actions.
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "*": hash-pin

{orbix-2.0.0 → orbix-3.0.0}/.gitignore

@@ -164,3 +164,6 @@ cython_debug/
 input/
 output/
 *.png
+.claude/
+.jax_cache/
+.ruff_cache/