Merge branch 'main' into nvbug-5880275

Author: mdboom

.coveragerc

@@ -1,5 +1,5 @@
 # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
-# SPDX-License-Identifier: LicenseRef-NVIDIA-SOFTWARE-LICENSE
+# SPDX-License-Identifier: Apache-2.0
 
 [paths]
 source =

.gitattributes

@@ -5,6 +5,7 @@
 *.h binary
 *.hpp binary
 # Exception: headers we own
+benchmarks/cuda_bindings/benchmarks/cpp/*.hpp -binary text diff
 cuda_bindings/cuda/bindings/_bindings/*.h -binary text diff
 cuda_bindings/cuda/bindings/_lib/*.h -binary text diff
 cuda_core/cuda/core/_cpp/*.h -binary text diff

.github/actionlint.yaml

@@ -0,0 +1,9 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# Self-hosted runner labels used in CI workflows.
+# Without this config, actionlint rejects non-GitHub-hosted labels.
+self-hosted-runner:
+  labels:
+    - linux-amd64-cpu8

.github/actions/doc_preview/action.yml

@@ -22,7 +22,7 @@ runs:
     # Note: the PR previews will be removed once merged to main or release/* (see below)
     - name: Deploy doc preview
       if: ${{ github.ref_name != 'main' && !startsWith(github.ref_name, 'release/') }}
-      uses: JamesIves/github-pages-deploy-action@6c2d9db40f9296374acc17b90404b6e8864128c8  # v4.7.3
+      uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f  # v4.8.0
       with:
         git-config-name: cuda-python-bot
         git-config-email: cuda-python-bot@users.noreply.github.com
@@ -32,7 +32,7 @@ runs:
 
     - name: Leave a comment after deployment
       if: ${{ github.ref_name != 'main' && !startsWith(github.ref_name, 'release/') }}
-      uses: marocchino/sticky-pull-request-comment@67d0dec7b07ed060a405f9b2a64b8ab319fdd7db  # v2.9.2
+      uses: marocchino/sticky-pull-request-comment@d4d6b0936434b21bc8345ad45a440c5f7d2c40ff  # v3.0.3
       with:
         header: pr-preview
         number: ${{ inputs.pr-number }}
@@ -49,7 +49,7 @@ runs:
     # The steps below are executed only when building on main or release/*.
     - name: Remove doc preview
       if: ${{ github.ref_name == 'main' || startsWith(github.ref_name, 'release/') }}
-      uses: JamesIves/github-pages-deploy-action@6c2d9db40f9296374acc17b90404b6e8864128c8  # v4.7.3
+      uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f  # v4.8.0
       with:
         git-config-name: cuda-python-bot
         git-config-email: cuda-python-bot@users.noreply.github.com
@@ -59,7 +59,7 @@ runs:
 
     - name: Leave a comment after removal
       if: ${{ github.ref_name == 'main' || startsWith(github.ref_name, 'release/') }}
-      uses: marocchino/sticky-pull-request-comment@67d0dec7b07ed060a405f9b2a64b8ab319fdd7db  # v2.9.2
+      uses: marocchino/sticky-pull-request-comment@d4d6b0936434b21bc8345ad45a440c5f7d2c40ff  # v3.0.3
       with:
         header: pr-preview
         number: ${{ inputs.pr-number }}

.github/actions/fetch_ctk/action.yml

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2024-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2024-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 #
 # SPDX-License-Identifier: Apache-2.0
 
@@ -14,7 +14,7 @@ inputs:
   cuda-components:
     description: "A list of the CTK components to install as a comma-separated list. e.g. 'cuda_nvcc,cuda_nvrtc,cuda_cudart'"
     required: false
-    default: "cuda_nvcc,cuda_cudart,cuda_crt,libnvvm,cuda_nvrtc,cuda_profiler_api,cuda_cccl,cuda_cupti,libnvjitlink,libcufile,libnvfatbin"
+    default: "cuda_nvcc,cuda_cudart,cuda_crt,libnvvm,cuda_nvrtc,cuda_profiler_api,cuda_cccl,cuda_cupti,libnvjitlink,libcufile,libnvfatbin,libcudla"
   cuda-path:
     description: "where the CTK components will be installed to, relative to $PWD"
     required: false
@@ -27,24 +27,15 @@ runs:
       shell: bash --noprofile --norc -xeuo pipefail {0}
       run: |
         # Pre-process the component list to ensure hash uniqueness
+        # Use the runtime workspace mount so this also works inside container jobs.
+        CTK_REDIST_TOOL="${GITHUB_WORKSPACE}/ci/tools/fetch_ctk_redistrib.py"
         CTK_CACHE_COMPONENTS=${{ inputs.cuda-components }}
-        # Conditionally strip out libnvjitlink for CUDA versions < 12
-        CUDA_MAJOR_VER="$(cut -d '.' -f 1 <<< ${{ inputs.cuda-version }})"
-        if [[ "$CUDA_MAJOR_VER" -lt 12 ]]; then
-          CTK_CACHE_COMPONENTS="${CTK_CACHE_COMPONENTS//libnvjitlink/}"
-        fi
-        # Conditionally strip out cuda_crt and libnvvm for CUDA versions < 13
-        CUDA_MAJOR_VER="$(cut -d '.' -f 1 <<< ${{ inputs.cuda-version }})"
-        if [[ "$CUDA_MAJOR_VER" -lt 13 ]]; then
-          CTK_CACHE_COMPONENTS="${CTK_CACHE_COMPONENTS//cuda_crt/}"
-          CTK_CACHE_COMPONENTS="${CTK_CACHE_COMPONENTS//libnvvm/}"
-        fi
-        # Conditionally strip out libcufile since it does not support Windows
-        if [[ "${{ inputs.host-platform }}" == win-* ]]; then
-          CTK_CACHE_COMPONENTS="${CTK_CACHE_COMPONENTS//libcufile/}"
-        fi
-        # Cleanup stray commas after removing components
-        CTK_CACHE_COMPONENTS="${CTK_CACHE_COMPONENTS//,,/,}"
+        CTK_JSON_URL="https://developer.download.nvidia.com/compute/cuda/redist/redistrib_${{ inputs.cuda-version }}.json"
+        CTK_CACHE_COMPONENTS="$(python "$CTK_REDIST_TOOL" filter-components \
+          --host-platform "${{ inputs.host-platform }}" \
+          --cuda-version "${{ inputs.cuda-version }}" \
+          --components "$CTK_CACHE_COMPONENTS" \
+          --metadata-url "$CTK_JSON_URL")"
 
         HASH=$(echo -n "${CTK_CACHE_COMPONENTS}" | sha256sum | awk '{print $1}')
         echo "CTK_CACHE_KEY=mini-ctk-${{ inputs.cuda-version }}-${{ inputs.host-platform }}-$HASH" >> $GITHUB_ENV
@@ -60,7 +51,7 @@ runs:
 
     - name: Download CTK cache
       id: ctk-get-cache
-      uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684  # v4.2.3
+      uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7  # v5.0.4
       continue-on-error: true
       with:
         key: ${{ env.CTK_CACHE_KEY }}
@@ -78,19 +69,17 @@ runs:
         mkdir $CACHE_TMP_DIR
 
         # The binary archives (redist) are guaranteed to be updated as part of the release posting.
+        # Use the runtime workspace mount so this also works inside container jobs.
+        CTK_REDIST_TOOL="${GITHUB_WORKSPACE}/ci/tools/fetch_ctk_redistrib.py"
         CTK_BASE_URL="https://developer.download.nvidia.com/compute/cuda/redist/"
         CTK_JSON_URL="$CTK_BASE_URL/redistrib_${{ inputs.cuda-version }}.json"
+        CTK_JSON_FILE="$CACHE_TMP_DIR/redistrib.json"
+        curl -LSs "$CTK_JSON_URL" -o "$CTK_JSON_FILE"
         if [[ "${{ inputs.host-platform }}" == linux* ]]; then
-          if [[ "${{ inputs.host-platform }}" == "linux-64" ]]; then
-            CTK_SUBDIR="linux-x86_64"
-          elif [[ "${{ inputs.host-platform }}" == "linux-aarch64" ]]; then
-            CTK_SUBDIR="linux-sbsa"
-          fi
           function extract() {
             tar -xvf $1 -C $CACHE_TMP_DIR --strip-components=1
           }
         elif [[ "${{ inputs.host-platform }}" == "win-64" ]]; then
-          CTK_SUBDIR="windows-x86_64"
           function extract() {
             _TEMP_DIR_=$(mktemp -d)
             unzip $1 -d $_TEMP_DIR_
@@ -103,11 +92,13 @@ runs:
         function populate_cuda_path() {
           # take the component name as a argument
           function download() {
-            curl -kLSs $1 -o $2
+            curl -LSs $1 -o $2
           }
           CTK_COMPONENT=$1
-          CTK_COMPONENT_REL_PATH="$(curl -s $CTK_JSON_URL |
-              python -c "import sys, json; print(json.load(sys.stdin)['${CTK_COMPONENT}']['${CTK_SUBDIR}']['relative_path'])")"
+          CTK_COMPONENT_REL_PATH="$(python "$CTK_REDIST_TOOL" component-relative-path \
+            --host-platform "${{ inputs.host-platform }}" \
+            --component "$CTK_COMPONENT" \
+            --metadata-path "$CTK_JSON_FILE")"
           CTK_COMPONENT_URL="${CTK_BASE_URL}/${CTK_COMPONENT_REL_PATH}"
           CTK_COMPONENT_COMPONENT_FILENAME="$(basename $CTK_COMPONENT_REL_PATH)"
           download $CTK_COMPONENT_URL $CTK_COMPONENT_COMPONENT_FILENAME
@@ -142,7 +133,7 @@ runs:
     - name: Upload CTK cache
       if: ${{ !cancelled() &&
               steps.ctk-get-cache.outputs.cache-hit != 'true' }}
-      uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684  # v4.2.3
+      uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7  # v5.0.4
       with:
         key: ${{ env.CTK_CACHE_KEY }}
         path: ./${{ env.CTK_CACHE_FILENAME }}

.github/actions/sccache-summary/action.yml

@@ -0,0 +1,80 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+name: sccache summary
+description: Parse sccache stats JSON and write a summary table to GITHUB_STEP_SUMMARY
+
+# Inspired by NVIDIA/cccl's prepare-execution-summary.py (PR #3621).
+
+inputs:
+  json-file:
+    description: "Path to the sccache stats JSON file (from sccache --show-stats --stats-format=json)"
+    required: true
+  label:
+    description: "Label for the stats row (e.g. cuda.bindings, cuda.core)"
+    required: false
+    default: "sccache"
+  build-step:
+    description: "Name of the cibuildwheel build step (for deep-link in summary)"
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Report sccache stats
+      shell: bash --noprofile --norc -euo pipefail {0}
+      env:
+        SCCACHE_JSON: ${{ inputs.json-file }}
+        SCCACHE_LABEL: ${{ inputs.label }}
+        SCCACHE_BUILD_STEP: ${{ inputs.build-step }}
+      run: |
+        if [ ! -f "$SCCACHE_JSON" ]; then
+          echo "::warning::sccache stats file not found: $SCCACHE_JSON"
+          exit 0
+        fi
+
+        python3 - <<'PYEOF'
+        import json, os, urllib.parse
+
+        json_file = os.environ["SCCACHE_JSON"]
+        label = os.environ["SCCACHE_LABEL"]
+        build_step = os.environ.get("SCCACHE_BUILD_STEP", "")
+
+        with open(json_file) as f:
+            stats = json.load(f)["stats"]
+
+        # compile_requests only counts top-level nvcc invocations, but each
+        # invocation spawns sub-tool compilations (cudafe++, cicc, ptxas) that
+        # sccache tracks under separate language keys.  Count all of them so
+        # the reported rate matches sccache's own "Cache hits rate".
+        counted_languages = {"C/C++", "CUDA", "CUDA (Device code)", "PTX", "CUBIN"}
+        hits = sum(
+            v for k, v in stats.get("cache_hits", {}).get("counts", {}).items()
+            if k in counted_languages
+        )
+        misses = sum(
+            v for k, v in stats.get("cache_misses", {}).get("counts", {}).items()
+            if k in counted_languages
+        )
+        total = hits + misses
+        pct = int(100 * hits / total) if total > 0 else 0
+
+        # Build a deep-link to the cibuildwheel step if step name is provided.
+        # GHA step summary links use the format: #step:N:L but we can't know the
+        # step number here. Instead, link to the job page with a search hint.
+        link_note = ""
+        if build_step:
+            link_note = f"\n\n_Full stats in the **{build_step}** step log._\n"
+
+        summary_file = os.environ.get("GITHUB_STEP_SUMMARY", "")
+        if summary_file:
+            with open(summary_file, "a") as sf:
+                sf.write(f"### 📊 {label} — sccache stats\n")
+                sf.write("| Hit Rate | Hits | Misses | Requests |\n")
+                sf.write("|----------|------|--------|----------|\n")
+                sf.write(f"| {pct}% | {hits} | {misses} | {total} |{link_note}\n")
+
+        print(f"{label}: {pct}% hit rate ({hits}/{total})")
+        PYEOF

.github/labeler.yml

@@ -0,0 +1,24 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# Configuration for https://github.com/actions/labeler
+# Auto-applies labels based on which files a PR changes.
+
+cuda.bindings:
+  - changed-files:
+    - any-glob-to-any-file: 'cuda_bindings/**'
+
+cuda.core:
+  - changed-files:
+    - any-glob-to-any-file: 'cuda_core/**'
+
+cuda.pathfinder:
+  - changed-files:
+    - any-glob-to-any-file: 'cuda_pathfinder/**'
+
+CI/CD:
+  - changed-files:
+    - any-glob-to-any-file:
+      - '.github/**'
+      - 'ci/**'

.github/workflows/backport.yml

@@ -43,7 +43,7 @@ jobs:
           echo "OLD_BRANCH=${OLD_BRANCH}" >> $GITHUB_ENV
 
       - name: Create backport pull requests
-        uses: korthout/backport-action@3c06f323a58619da1e8522229ebc8d5de2633e46  # v4.3.0
+        uses: korthout/backport-action@7c3f6cd5843cac11bc59a04a1b7699af93261670  # v4.5.0
         with:
           copy_assignees: true
           copy_labels_pattern: true
@@ -67,7 +67,7 @@ jobs:
         run: echo "BACKPORT_BRANCH=${{ inputs.backport-branch }}" >> $GITHUB_ENV
 
       - name: Create backport pull requests
-        uses: korthout/backport-action@3c06f323a58619da1e8522229ebc8d5de2633e46  # v4.3.0
+        uses: korthout/backport-action@7c3f6cd5843cac11bc59a04a1b7699af93261670  # v4.5.0
         with:
           copy_assignees: true
           copy_labels_pattern: true

.github/workflows/bandit.yml

@@ -23,7 +23,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           enable-cache: false
 
@@ -38,10 +38,10 @@ jobs:
 
           echo "codes=$(uvx toml2json ./ruff.toml | jq -r '.lint.ignore | map(select(test("^S\\d+"))) | join(",")')" >> "$GITHUB_OUTPUT"
       - name: Perform Bandit Analysis using Ruff
-        uses: astral-sh/ruff-action@4919ec5cf1f49eff0871dbcea0da843445b837e6  # v3.6.1
+        uses: astral-sh/ruff-action@0ce1b0bf8b818ef400413f810f8a11cdbda0034b  # v4.0.0
         with:
           args: "check --select S --ignore ${{ steps.ignore-codes.outputs.codes }} --output-format sarif --output-file results.sarif"
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@v4.35.1
+        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7  # v4.35.3
         with:
           sarif_file: results.sarif

.github/workflows/build-docs.yml

@@ -62,7 +62,7 @@ jobs:
       # TODO: This workflow runs on GH-hosted runner and cannot use the proxy cache
 
       - name: Set up miniforge
-        uses: conda-incubator/setup-miniconda@fc2d68f6413eb2d87b895e92f8584b5b94a10167  # v3.3.0
+        uses: conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5  # v4.0.1
         with:
           activate-environment: cuda-python-docs
           environment-file: ./cuda_python/docs/environment-docs.yml
@@ -244,7 +244,7 @@ jobs:
 
       # TODO: Consider removing this step?
       - name: Upload doc artifacts
-        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b  # v4.0.0
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9  # v5.0.0
         with:
           path: artifacts/
           retention-days: 3