draft the 0.15.2 release (#686)

* draft a 0.15.2 release

* fix dockerr

* fix docker build

Author: Intron7

.github/workflows/docker.yml

@@ -98,7 +98,7 @@ jobs:
         shell: bash
 
       - name: Check out the repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ github.event_name == 'issue_comment' && format('refs/pull/{0}/head', github.event.issue.number) || '' }}
 
@@ -114,15 +114,15 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata (tags, labels) for Docker base image
         id: meta-base
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             ghcr.io/scverse/rapids-singlecell-deps-${{ matrix.CUDA_SUFFIX.pkg }}
@@ -134,7 +134,7 @@ jobs:
 
       - name: Build and push Docker base images
         id: push-base
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: ./docker/
           file: ./docker/Dockerfile.deps
@@ -148,22 +148,22 @@ jobs:
 
       - name: Generate artifact attestation for base image
         if: github.event_name == 'release'
-        uses: actions/attest-build-provenance@v1
+        uses: actions/attest-build-provenance@v4
         with:
           subject-name: ghcr.io/scverse/rapids-singlecell-deps-${{ matrix.CUDA_SUFFIX.pkg }}
           subject-digest: ${{ steps.push-base.outputs.digest }}
           push-to-registry: true
 
       - name: Extract metadata (tags, labels) for main Docker image
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             ghcr.io/scverse/rapids-singlecell-${{ matrix.CUDA_SUFFIX.pkg }}
 
       - name: Build and push main Docker images
         id: push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: ./docker/
           file: ./docker/Dockerfile
@@ -179,7 +179,7 @@ jobs:
 
       - name: Generate artifact attestation for main image
         if: github.event_name == 'release'
-        uses: actions/attest-build-provenance@v1
+        uses: actions/attest-build-provenance@v4
         with:
           subject-name: ghcr.io/scverse/rapids-singlecell-${{ matrix.CUDA_SUFFIX.pkg }}
           subject-digest: ${{ steps.push.outputs.digest }}

.github/workflows/publish.yml

@@ -103,7 +103,7 @@ jobs:
           docker build -t "${{ matrix.cibw_image }}" -f "${{ matrix.dockerfile }}" docker
 
       - name: Build wheels
-        uses: pypa/cibuildwheel@v3.1.4
+        uses: pypa/cibuildwheel@v3.4.1
         env:
           SETUPTOOLS_SCM_PRETEND_VERSION: ${{ steps.version.outputs.version }}
           CIBW_BUILD: 'cp312-*'
@@ -123,7 +123,7 @@ jobs:
           CIBW_REPAIR_WHEEL_COMMAND: "auditwheel repair --exclude libcublas.so.${{ matrix.cuda_major }} --exclude libcublasLt.so.${{ matrix.cuda_major }} --exclude libcudart.so.${{ matrix.cuda_major }} -w {dest_dir} {wheel}"
           CIBW_BUILD_VERBOSITY: "1"
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: cibw-wheels-${{ matrix.os }}-cu${{ matrix.cuda_major }}-${{ strategy.job-index }}
           path: ./wheelhouse/*.whl
@@ -135,7 +135,7 @@ jobs:
       - uses: actions/checkout@v5
       - name: Build sdist
         run: pipx run build --sdist
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: cibw-sdist
           path: dist/*.tar.gz
@@ -151,7 +151,7 @@ jobs:
       matrix:
         cuda_major: ["12", "13"]
     steps:
-      - uses: actions/download-artifact@v5
+      - uses: actions/download-artifact@v8
         with:
           pattern: cibw-wheels-*-cu${{ matrix.cuda_major }}-*
           path: dist
@@ -167,7 +167,7 @@ jobs:
       id-token: write
     if: github.event_name == 'release' && github.event.action == 'published'
     steps:
-      - uses: actions/download-artifact@v5
+      - uses: actions/download-artifact@v8
         with:
           name: cibw-sdist
           path: dist

.github/workflows/test-gpu.yml

@@ -17,9 +17,11 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: flying-sheep/check@v1
-        with:
-          success: ${{ github.event_name == 'push' || contains(github.event.pull_request.labels.*.name, 'run-gpu-ci') }}
+      - name: Require push to main or 'run-gpu-ci' label
+        if: ${{ !(github.event_name == 'push' || contains(github.event.pull_request.labels.*.name, 'run-gpu-ci')) }}
+        run: |
+          echo "::error::GPU CI requires a push to main or the 'run-gpu-ci' label on the PR."
+          exit 1
 
   get-envs:
     runs-on: ubuntu-latest
@@ -32,7 +34,7 @@ jobs:
         with:
           filter: blob:none
           fetch-depth: 0
-      - uses: astral-sh/setup-uv@v6
+      - uses: astral-sh/setup-uv@v8.1.0
         with:
           enable-cache: false
       - id: get-envs
@@ -80,7 +82,7 @@ jobs:
           fetch-depth: 0
           filter: blob:none
 
-      - uses: astral-sh/setup-uv@v6
+      - uses: astral-sh/setup-uv@v8.1.0
         with:
           python-version: ${{ matrix.env.python }}
 
@@ -143,7 +145,7 @@ jobs:
           fetch-depth: 0
           filter: blob:none
 
-      - uses: astral-sh/setup-uv@v6
+      - uses: astral-sh/setup-uv@v8.1.0
         with:
           python-version: ${{ matrix.env.python }}
 
@@ -168,11 +170,13 @@ jobs:
     name: Remove 'run-gpu-ci' Label
     runs-on: ubuntu-latest
     if: ${{ always() && github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'run-gpu-ci') }}
+    permissions:
+      pull-requests: write
     steps:
-      - uses: actions-ecosystem/action-remove-labels@v1
-        with:
-          labels: 'run-gpu-ci'
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Remove 'run-gpu-ci' label
+        run: gh api -X DELETE "repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels/run-gpu-ci" || true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   stable-dev-green:
     name: CI-Pass
@@ -182,9 +186,12 @@ jobs:
       - test-stable-dev
     runs-on: ubuntu-latest
     steps:
-      - uses: re-actors/alls-green@release/v1
-        with:
-          jobs: ${{ toJSON(needs) }}
+      - name: Check required jobs succeeded
+        run: |
+          if [[ "${{ needs.get-envs.result }}" != "success" || "${{ needs.test-stable-dev.result }}" != "success" ]]; then
+            echo "::error::Required jobs did not succeed (get-envs=${{ needs.get-envs.result }}, test-stable-dev=${{ needs.test-stable-dev.result }})."
+            exit 1
+          fi
 
   all-green:
     name: All Tests Green
@@ -195,7 +202,9 @@ jobs:
       - test-prerelease
     runs-on: ubuntu-latest
     steps:
-      - uses: re-actors/alls-green@release/v1
-        with:
-          allowed-failures: test-prerelease
-          jobs: ${{ toJSON(needs) }}
+      - name: Check required jobs succeeded (test-prerelease allowed to fail)
+        run: |
+          if [[ "${{ needs.get-envs.result }}" != "success" || "${{ needs.test-stable-dev.result }}" != "success" ]]; then
+            echo "::error::Required jobs did not succeed (get-envs=${{ needs.get-envs.result }}, test-stable-dev=${{ needs.test-stable-dev.result }})."
+            exit 1
+          fi

conda/rsc_rapids_26.04_cuda12.yml

@@ -7,7 +7,7 @@ channels:
 dependencies:
  - rapids=26.04
  - python=3.14
- - cuda-version=12.9
+ - cuda-version=12.8
  - cudnn
  - cutensor
  - cusparselt

docker/Dockerfile.deps

@@ -6,6 +6,8 @@ FROM nvidia/cuda:${CUDA_VER}-devel-${LINUX_VER}
 SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
 
 ARG PYTHON_VER=3.13
+# Re-declare after FROM so it is available to RUN steps (passed by docker.yml build-args)
+ARG CUDA_VER=13.0.2
 
 ENV PATH=/opt/conda/bin:$PATH
 ENV PYTHON_VERSION=${PYTHON_VER}
@@ -35,6 +37,41 @@ mamba install -y -n base pytest -c conda-forge
 mamba clean --all -y
 EOF
 
+RUN <<EOF
+# Guard against cu12/cu13 package mixing (see issue #677): fail the build if any
+# installed CUDA Python package's major version does not match the image's CUDA major.
+set -x
+CUDA_MAJOR="${CUDA_VER%%.*}"
+echo "Verifying all CUDA packages match CUDA major ${CUDA_MAJOR}"
+/opt/conda/bin/python - "${CUDA_MAJOR}" <<'PY'
+import sys
+import importlib.metadata as md
+
+target = sys.argv[1]
+bad = []
+# cuda-bindings and cuda-python track the CUDA major in their version.
+# (cuda-core is intentionally excluded: it uses its own 0.x versioning.)
+for name in ("cuda-bindings", "cuda-python"):
+    try:
+        version = md.version(name)
+    except md.PackageNotFoundError:
+        continue
+    if version.split(".")[0] != target:
+        bad.append(f"{name}=={version} (expected CUDA {target}.x)")
+# cupy wheels encode the CUDA major in the project name
+for name in ("cupy-cuda12x", "cupy-cuda13x"):
+    try:
+        md.version(name)
+    except md.PackageNotFoundError:
+        continue
+    if name != f"cupy-cuda{target}x":
+        bad.append(f"{name} installed (expected cupy-cuda{target}x)")
+if bad:
+    sys.exit("ERROR: CUDA major mismatch in cu%s image:\n  - %s" % (target, "\n  - ".join(bad)))
+print(f"OK: all CUDA packages match CUDA {target}.x")
+PY
+EOF
+
 RUN <<EOF
 # install rapids_singlecell pip dependencies (without building the package)
 set -x

docs/release-notes/0.15.2.md

@@ -1,4 +1,4 @@
-### 0.15.2 {small}`the-future`
+### 0.15.2 {small}`2026-06-03`
 
 ```{rubric} Features
 ```
@@ -16,3 +16,4 @@
 ```
 * Fixes per-batch clip threshold in `pp.highly_variable_genes(flavor="pearson_residuals", batch_key=...)`: each batch now uses its own `sqrt(n_cells_in_batch)` instead of silently reusing the first batch's value {pr}`674` {smaller}`A Mikaeili`
 * {class}`~rapids_singlecell.ptg.Distance` drops unused (zero-cell) ``groupby`` categories for all metrics; ``edistance`` previously returned ``NaN`` for empty categories {pr}`683` {smaller}`S Dicks`
+* The ``rapids-singlecell-cu12`` Docker image is pinned back to ``cuda-version=12.8`` so it no longer pulls CUDA 13 RAPIDS binaries (``cuda-bindings`` 13.x) and works on driver 535+ again; the image build now fails fast if CUDA 12/13 packages are mixed {pr}`686` {smaller}`S Dicks`