ci: plan builds and artifact reuse per bindings root

.github/RELEASE-bindings.md

@@ -55,8 +55,8 @@ cybind inputs instead of blindly copying generated output between majors.
    branch. Normal development CI includes dependent packages and may cover
    both majors. Resolve failures in affected code before selecting the tag.
 3. Create the approved immutable `vX.Y.Z` tag at the selected source commit.
-   Tag-triggered CI builds both bindings lines and their consumers. The release
-   workflow selects only the requested line's bindings or metapackage artifacts.
+   Tag-triggered CI selects that line's bindings and metapackage, validates them
+   with the published Pathfinder dependency, and builds release artifacts.
    The tag does not have to be on `main`. Wait for this exact tag's CI to pass.
 4. Run **CI: Release** with `release-action=dry-run`, the tag, and
    `component=cuda-bindings`; repeat for `cuda-python`. Leave `run-id` blank

.github/workflows/test-sdist-linux.yml

@@ -29,14 +29,15 @@ permissions:
 jobs:
   test-sdist:
     name: Test sdist builds
-    if: ${{ inputs.workplan == '' || fromJSON(inputs.workplan).jobs.sdist_tests }}
+    if: ${{ inputs.workplan == '' || fromJSON(inputs.workplan).jobs.sdist_package_roots[fromJSON(inputs.bindings-package).package_root] }}
     env:
       BINDINGS_ROOT: ${{ fromJSON(inputs.bindings-package).package_root }}
       CUDA_PYTHON_BUILD_MAJOR: ${{ fromJSON(inputs.bindings-package).cuda_major }}
       BUILD_PATHFINDER: ${{ fromJSON(inputs.bindings-package).release_status == 'current' && (inputs.workplan == '' || fromJSON(inputs.workplan).modules.pathfinder.needs_build) }}
-      BUILD_BINDINGS: ${{ inputs.workplan == '' || fromJSON(inputs.workplan).modules.bindings.needs_build }}
-      BUILD_CORE: ${{ inputs.workplan == '' || fromJSON(inputs.workplan).modules.core.needs_build }}
-      BUILD_PYTHON: ${{ inputs.workplan == '' || fromJSON(inputs.workplan).modules.python.needs_build }}
+      BUILD_BINDINGS: ${{ inputs.workplan == '' || fromJSON(inputs.workplan).modules.bindings.package_roots[fromJSON(inputs.bindings-package).package_root].needs_build }}
+      BUILD_CORE: ${{ inputs.workplan == '' || fromJSON(inputs.workplan).modules.core.cuda_majors[fromJSON(inputs.bindings-package).cuda_variant].needs_build }}
+      BUILD_PYTHON: ${{ inputs.workplan == '' || fromJSON(inputs.workplan).modules.python.package_roots[fromJSON(inputs.bindings-package).package_root].needs_build }}
+      PATHFINDER_SOURCE: ${{ inputs.workplan == '' && 'artifact' || fromJSON(inputs.workplan).sources.pathfinder }}
       # Back off on repeated local-disk cache I/O errors (#3273).
       SCCACHE_CACHE_RATE_LIMIT_ON_ERROR_COUNT: "5"
       SCCACHE_CACHE_RATE_LIMIT_ON_ERROR_WINDOW_SIZE_SECS: "5"
@@ -80,7 +81,8 @@ jobs:
           pip wheel --no-deps --wheel-dir cuda_python/dist cuda_python/dist/*.tar.gz
 
       - name: Download cuda.pathfinder wheel
-        if: ${{ env.BUILD_PATHFINDER != 'true' && (env.BUILD_BINDINGS == 'true' || env.BUILD_CORE == 'true') }}
+        if: ${{ env.BUILD_PATHFINDER != 'true' && (env.BUILD_BINDINGS == 'true' || env.BUILD_CORE == 'true') &&
+                env.PATHFINDER_SOURCE == 'artifact' }}
         uses: ./.github/actions/download-artifact-retry
         with:
           name: cuda-pathfinder-wheel
@@ -89,12 +91,19 @@ jobs:
       - name: Constrain builds to the local cuda.pathfinder wheel
         if: ${{ env.BUILD_BINDINGS == 'true' }}
         run: |
-          pathfinder_wheels=(cuda_pathfinder/dist/cuda_pathfinder-*.whl)
-          test "${#pathfinder_wheels[@]}" -eq 1
-          test -f "${pathfinder_wheels[0]}"
           mkdir -p wheel-constraints
-          pathfinder_uri="file://$(realpath "${pathfinder_wheels[0]}")"
-          printf 'cuda-pathfinder @ %s\n' "${pathfinder_uri}" | tee wheel-constraints/cuda-bindings.txt
+          if [[ "${PATHFINDER_SOURCE}" == artifact ]]; then
+            pathfinder_wheels=(cuda_pathfinder/dist/cuda_pathfinder-*.whl)
+            test "${#pathfinder_wheels[@]}" -eq 1
+            test -f "${pathfinder_wheels[0]}"
+            pathfinder_uri="file://$(realpath "${pathfinder_wheels[0]}")"
+            printf 'cuda-pathfinder @ %s\n' "${pathfinder_uri}" > wheel-constraints/cuda-bindings.txt
+          elif [[ "${PATHFINDER_SOURCE}" == published ]]; then
+            : > wheel-constraints/cuda-bindings.txt
+          else
+            echo "Error: PATHFINDER_SOURCE must be artifact or published" >&2
+            exit 1
+          fi
 
       # Cython packages need CTK + sccache (local disk cache only in this job).
       - name: Install rapidsai/sccache

.github/workflows/test-sdist-windows.yml

@@ -35,14 +35,15 @@ permissions:
 jobs:
   test-sdist:
     name: Test sdist builds
-    if: ${{ inputs.workplan == '' || fromJSON(inputs.workplan).jobs.sdist_tests }}
+    if: ${{ inputs.workplan == '' || fromJSON(inputs.workplan).jobs.sdist_package_roots[fromJSON(inputs.bindings-package).package_root] }}
     env:
       BINDINGS_ROOT: ${{ fromJSON(inputs.bindings-package).package_root }}
       CUDA_PYTHON_BUILD_MAJOR: ${{ fromJSON(inputs.bindings-package).cuda_major }}
       BUILD_PATHFINDER: ${{ fromJSON(inputs.bindings-package).release_status == 'current' && (inputs.workplan == '' || fromJSON(inputs.workplan).modules.pathfinder.needs_build) }}
-      BUILD_BINDINGS: ${{ inputs.workplan == '' || fromJSON(inputs.workplan).modules.bindings.needs_build }}
-      BUILD_CORE: ${{ inputs.workplan == '' || fromJSON(inputs.workplan).modules.core.needs_build }}
-      BUILD_PYTHON: ${{ inputs.workplan == '' || fromJSON(inputs.workplan).modules.python.needs_build }}
+      BUILD_BINDINGS: ${{ inputs.workplan == '' || fromJSON(inputs.workplan).modules.bindings.package_roots[fromJSON(inputs.bindings-package).package_root].needs_build }}
+      BUILD_CORE: ${{ inputs.workplan == '' || fromJSON(inputs.workplan).modules.core.cuda_majors[fromJSON(inputs.bindings-package).cuda_variant].needs_build }}
+      BUILD_PYTHON: ${{ inputs.workplan == '' || fromJSON(inputs.workplan).modules.python.package_roots[fromJSON(inputs.bindings-package).package_root].needs_build }}
+      PATHFINDER_SOURCE: ${{ inputs.workplan == '' && 'artifact' || fromJSON(inputs.workplan).sources.pathfinder }}
     timeout-minutes: 60
     runs-on: windows-2022
     steps:
@@ -93,7 +94,8 @@ jobs:
           pip wheel --no-deps --wheel-dir cuda_python/dist cuda_python/dist/*.tar.gz
 
       - name: Download cuda.pathfinder wheel
-        if: ${{ env.BUILD_PATHFINDER != 'true' && (env.BUILD_BINDINGS == 'true' || env.BUILD_CORE == 'true') }}
+        if: ${{ env.BUILD_PATHFINDER != 'true' && (env.BUILD_BINDINGS == 'true' || env.BUILD_CORE == 'true') &&
+                env.PATHFINDER_SOURCE == 'artifact' }}
         uses: ./.github/actions/download-artifact-retry
         with:
           name: cuda-pathfinder-wheel
@@ -102,12 +104,19 @@ jobs:
       - name: Constrain builds to the local cuda.pathfinder wheel
         if: ${{ env.BUILD_BINDINGS == 'true' }}
         run: |
-          pathfinder_wheels=(cuda_pathfinder/dist/cuda_pathfinder-*.whl)
-          test "${#pathfinder_wheels[@]}" -eq 1
-          test -f "${pathfinder_wheels[0]}"
           mkdir -p wheel-constraints
-          pathfinder_uri="file:///$(cygpath -am "${pathfinder_wheels[0]}")"
-          printf 'cuda-pathfinder @ %s\n' "${pathfinder_uri}" | tee wheel-constraints/cuda-bindings.txt
+          if [[ "${PATHFINDER_SOURCE}" == artifact ]]; then
+            pathfinder_wheels=(cuda_pathfinder/dist/cuda_pathfinder-*.whl)
+            test "${#pathfinder_wheels[@]}" -eq 1
+            test -f "${pathfinder_wheels[0]}"
+            pathfinder_uri="file:///$(cygpath -am "${pathfinder_wheels[0]}")"
+            printf 'cuda-pathfinder @ %s\n' "${pathfinder_uri}" > wheel-constraints/cuda-bindings.txt
+          elif [[ "${PATHFINDER_SOURCE}" == published ]]; then
+            : > wheel-constraints/cuda-bindings.txt
+          else
+            echo "Error: PATHFINDER_SOURCE must be artifact or published" >&2
+            exit 1
+          fi
 
       # Cython packages need CTK. No sccache on Windows (this is a correctness
       # smoke test, not a production build; see build-wheel.yml which also