Merge branch 'main' into gpu-codecs

Author: d-v-b

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -61,7 +61,7 @@ body:
       value: |
         ```python
         # /// script
-        # requires-python = ">=3.11"
+        # requires-python = ">=3.12"
         # dependencies = [
         #   "zarr@git+https://github.com/zarr-developers/zarr-python.git@main",
         # ]

.github/workflows/check_changelogs.yml

@@ -2,6 +2,10 @@ name: Check changelog entries
 
 on:
   pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
 
 jobs:
   check-changelogs:

.github/workflows/codspeed.yml

@@ -1,13 +1,10 @@
 name: CodSpeed Benchmarks
 
 on:
-  push:
-    branches:
-      - "main"
+  schedule:
+    - cron: '0 9 * * 1'  # Every Monday at 9am UTC
   pull_request:
-    types: [labeled, synchronize]
-  # `workflow_dispatch` allows CodSpeed to trigger backtest
-  # performance analysis in order to generate initial data.
+    types: [labeled]
   workflow_dispatch:
 
 permissions:
@@ -17,23 +14,22 @@ jobs:
   benchmarks:
     name: Run benchmarks
     runs-on: codspeed-macro
-    # Only run benchmarks for: pushes to main, manual triggers, or PRs with 'benchmark' label
     if: |
-      github.event_name == 'push' ||
+      github.event_name == 'schedule' ||
       github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'benchmark'))
     steps:
     - uses: actions/checkout@v6
       with:
-        fetch-depth: 0  # grab all branches and tags
+        fetch-depth: 0
     - name: Set up Python
       uses: actions/setup-python@v6
       with:
         python-version: "3.11"
     - name: Install Hatch
-      run: |
-        python -m pip install --upgrade pip
-        pip install hatch
+      uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc
+      with:
+        version: '1.16.5'
     - name: Run the benchmarks
       uses: CodSpeedHQ/action@v4
       with:

.github/workflows/gpu_test.yml

@@ -13,19 +13,21 @@ on:
 env:
   LD_LIBRARY_PATH: /usr/local/cuda/extras/CUPTI/lib64:/usr/local/cuda/lib64
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   test:
-    name: py=${{ matrix.python-version }}, deps=${{ matrix.dependency-set }}
+    name: py=${{ matrix.python-version }}
 
     runs-on: gpu-runner
     strategy:
       matrix:
-        python-version: ['3.11']
-        dependency-set: ["minimal"]
+        python-version: ['3.12']
 
     steps:
     - uses: actions/checkout@v6
@@ -54,20 +56,21 @@ jobs:
       with:
         python-version: ${{ matrix.python-version }}
         cache: 'pip'
-    - name: Install Hatch and CuPy
-      run: |
-        python -m pip install --upgrade pip
-        pip install hatch
+    - name: Install Hatch
+      uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc
+      with:
+        version: '1.16.5'
     - name: Set Up Hatch Env
       run: |
-        hatch env create gputest.py${{ matrix.python-version }}-${{ matrix.dependency-set }}
-        hatch env run -e gputest.py${{ matrix.python-version }}-${{ matrix.dependency-set }} list-env
+        hatch env create gputest.py${{ matrix.python-version }}
+        hatch env run -e gputest.py${{ matrix.python-version }} list-env
     - name: Run Tests
       run: |
-        hatch env run --env gputest.py${{ matrix.python-version }}-${{ matrix.dependency-set }} run-coverage-gpu
+        hatch env run --env gputest.py${{ matrix.python-version }} run-coverage
 
     - name: Upload coverage
       uses: codecov/codecov-action@13ce06bfc6bbe3ecf90edbbf1bc32fe5978ca1d3  # v5.3.1
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
+        flags: gpu
         verbose: true # optional (default = false)

.github/workflows/hypothesis.yaml

@@ -9,6 +9,9 @@ on:
     - cron: "0 0 * * *" # Daily “At 00:00” UTC
   workflow_dispatch: # allows you to trigger manually
 
+permissions:
+  contents: read
+
 env:
   FORCE_COLOR: 3
 
@@ -41,9 +44,9 @@ jobs:
         python-version: ${{ matrix.python-version }}
         cache: 'pip'
     - name: Install Hatch
-      run: |
-        python -m pip install --upgrade pip
-        pip install hatch
+      uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc
+      with:
+        version: '1.16.5'
     - name: Set Up Hatch Env
       run: |
         hatch env create test.py${{ matrix.python-version }}-${{ matrix.dependency-set }}
@@ -78,6 +81,7 @@ jobs:
       uses: codecov/codecov-action@v5
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
+        flags: tests
         verbose: true # optional (default = false)
 
     - name: Generate and publish the report

.github/workflows/lint.yml

@@ -7,6 +7,9 @@ on:
     branches: [main, 3.1.x]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -17,9 +20,4 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-      - name: Install prek
-        run: uv tool install prek
-      - name: Run prek
-        run: prek run --all-files
+      - uses: j178/prek-action@v1

.github/workflows/needs_release_notes.yml

@@ -1,7 +1,8 @@
 name: "Pull Request Labeler"
 
 on:
-  - pull_request_target
+  pull_request_target:
+    types: [opened, reopened, synchronize]
 
 jobs:
   labeler:

.github/workflows/nightly_wheels.yml

@@ -6,6 +6,9 @@ on:
     - cron: '0 2 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build_and_upload_nightly:
     name: Build and upload nightly wheels
@@ -20,12 +23,12 @@ jobs:
       - uses: actions/setup-python@v6
         name: Install Python
         with:
-          python-version: '3.13'
+          python-version: '3.14'
 
-      - name: Install build dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install hatch
+      - name: Install Hatch
+        uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc
+        with:
+          version: '1.16.5'
 
       - name: Build wheel and sdist
         run: hatch build

.github/workflows/releases.yml

@@ -1,6 +1,18 @@
 name: Wheels
 
-on: [push, pull_request]
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
 
@@ -19,15 +31,15 @@ jobs:
       - uses: actions/setup-python@v6
         name: Install Python
         with:
-          python-version: '3.11'
+          python-version: '3.12'
 
-      - name: Install PyBuild
-        run: |
-          python -m pip install --upgrade pip
-          pip install hatch
+      - name: Install Hatch
+        uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc
+        with:
+          version: '1.16.5'
       - name: Build wheel and sdist
         run: hatch build
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: releases
           path: dist
@@ -47,16 +59,24 @@ jobs:
           ls dist
 
   upload_pypi:
-    needs: [build_artifacts]
+    needs: [build_artifacts, test_dist_pypi]
     runs-on: ubuntu-latest
     if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/v')
+    environment:
+      name: releases
+      url: https://pypi.org/p/zarr
+    permissions:
+      id-token: write
+      attestations: write
+      artifact-metadata: write
     steps:
       - uses: actions/download-artifact@v7
         with:
           name: releases
           path: dist
-      - uses: pypa/gh-action-pypi-publish@v1.13.0
+      - name: Generate artifact attestation
+        uses: actions/attest@v4
         with:
-          user: __token__
-          password: ${{ secrets.pypi_password }}
-          # To test: repository_url: https://test.pypi.org/legacy/
+          subject-path: dist/*
+      - name: Publish package to PyPI
+        uses: pypa/gh-action-pypi-publish@v1.13.0

.github/workflows/test.yml

@@ -10,6 +10,9 @@ on:
     branches: [ main, 3.1.x ]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -20,23 +23,23 @@ jobs:
 
     strategy:
       matrix:
-        python-version: ['3.11', '3.12', '3.13']
+        python-version: ['3.12', '3.13', '3.14']
         dependency-set: ["minimal", "optional"]
         os: ["ubuntu-latest"]
         include:
-          - python-version: '3.11'
+          - python-version: '3.12'
             dependency-set: 'optional'
             os: 'macos-latest'
 
-          - python-version: '3.13'
+          - python-version: '3.14'
             dependency-set: 'optional'
             os: 'macos-latest'
 
-          - python-version: '3.11'
+          - python-version: '3.12'
             dependency-set: 'optional'
             os: 'windows-latest'
 
-          - python-version: '3.13'
+          - python-version: '3.14'
             dependency-set: 'optional'
             os: 'windows-latest'
     runs-on: ${{ matrix.os }}
@@ -51,9 +54,9 @@ jobs:
         python-version: ${{ matrix.python-version }}
         cache: 'pip'
     - name: Install Hatch
-      run: |
-        python -m pip install --upgrade pip
-        pip install hatch
+      uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc
+      with:
+        version: '1.16.5'
     - name: Set Up Hatch Env
       run: |
         hatch env create test.py${{ matrix.python-version }}-${{ matrix.dependency-set }}
@@ -68,6 +71,7 @@ jobs:
       uses: codecov/codecov-action@v5
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
+        flags: tests
         verbose: true # optional (default = false)
 
   test-upstream-and-min-deps:
@@ -76,12 +80,12 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ['3.11', "3.13"]
+        python-version: ['3.12', "3.14"]
         dependency-set: ["upstream", "min_deps"]
         exclude:
-          - python-version: "3.13"
+          - python-version: "3.14"
             dependency-set: min_deps
-          - python-version: "3.11"
+          - python-version: "3.12"
             dependency-set: upstream
     steps:
     - uses: actions/checkout@v6
@@ -93,9 +97,9 @@ jobs:
         python-version: ${{ matrix.python-version }}
         cache: 'pip'
     - name: Install Hatch
-      run: |
-        python -m pip install --upgrade pip
-        pip install hatch
+      uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc
+      with:
+        version: '1.16.5'
     - name: Set Up Hatch Env
       run: |
         hatch env create ${{ matrix.dependency-set }}
@@ -107,6 +111,7 @@ jobs:
       uses: codecov/codecov-action@v5
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
+        flags: tests
         verbose: true # optional (default = false)
 
   doctests:
@@ -122,9 +127,9 @@ jobs:
         python-version: '3.13'
         cache: 'pip'
     - name: Install Hatch
-      run: |
-        python -m pip install --upgrade pip
-        pip install hatch
+      uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc
+      with:
+        version: '1.16.5'
     - name: Set Up Hatch Env
       run: |
         hatch run doctest:pip list
@@ -150,4 +155,4 @@ jobs:
           contains(needs.*.result, 'cancelled')
         run: exit 1
       - name: Success
-        run: echo Success!
+        run: echo Success!