You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Layer 7 of 7 of the staged "CUDA 12 bindings on main" stack. Previous: #3321. Stack map at the bottom.
What this PR does
Removes what the previous six layers made obsolete, and writes down how the two roots are maintained from now on.
ci/versions.yml moves to schema 2: cuda.bindings.package_roots with toolkit_version and release_status; backport_branch, cuda.build, and cuda.prev_build are gone. bindings_config.py still reads the old format, because nightly may point at an older artifact source and release dry runs may point at retained CUDA 13 tags.
New pre-commit hook check-bindings-config: each root's setuptools-scm selector must be v<major>.* for its CUDA major, the metapackage selector table must agree, and Core's cu12/cu13 bindings floors must not exceed the pinned toolkits. The old floor hook in toolshed/ is narrowed to extras and docs.
The Pixi pin hook now checks Core's maintenance environment as well as its current environment.
backport.yml becomes manual-only: a merged PR number plus an existing target branch, with validation. No more automatic backports on the to-be-backported label. Dependabot's 12.9.x entry is removed.
ci-nightly.yml extracts only ci/versions.yml from the artifact-source archive: schema-2 sources take the new route, older sources the legacy route (legacy-backport-branch). The legacy artifact aliases (cuda-python-wheel, <core artifact>-tests) are no longer produced.
Docs: CONTRIBUTING.md (selector table, transferring a fix between roots with git format-patch --relative and git am --directory, CUDA-major artifact flow, release branches), ci/README.md (registry, SCM milestones, nightly rollout, how to read CI job names, historical reruns, maintaining both roots, changing the supported lines), AGENTS.md (SYNCED blocks), cuda_bindings_12/MAINTENANCE.md (new), install page driver baseline correction (Linux 525.60.13, Windows 528.33), CI diagram.
After this merges
The 12.9.x branch is frozen except for emergency fixes; routine CUDA 12 work happens in cuda_bindings_12/ on main.
The retained v12.9.11a0 milestone is already on main; both alternatives are restacked onto it and contain no temporary SCM bootstrap.
Remove the legacy nightly route after the first schema-2 main run succeeds.
Not exercised: the manual backport workflow against a live branch, and the nightly workflow against a schema-2 artifact source (there is none until this stack is on main).
374 CI-tool tests passed locally; full pre-commit passed at 126ed74fb5bbfbc91a04e50557cf936efef4da7f.
The Windows 3.14t/A100-MCDM regression job passed on driver 596.36. DeviceMR and PinnedMR pool-trim cases ran serially and passed; ManagedMR had its normal unsupported-device skip.
Stack map: what main can do after each layer merges
carries the schema-2 registry, a manual-only backport workflow, a metadata consistency hook, and the maintenance docs; 12.9.x is frozen
Every layer was designed to be mergeable on its own and had a green full CI run at its pre-rebase head on 2026-10-31. The stack is the "individually mergeable pieces" alternative to #3174-#3182; both stacks reach the same end state except that this one keeps compatibility routes for older artifact sources and retained CUDA 13 tags.
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
Clarified CUDA 12 installation requirements, optional Toolkit components, and the distinction between installing cuda-python and cuda-bindings.
Updated guidance for selecting CUDA 12 or 13 source builds, installing nightly wheels, and building documentation for each release line.
Documented that CUDA 12.9 and CUDA 13 release lines are maintained on the main branch, and clarified CUDA 12 driver compatibility guidance.
Expanded guidance for maintaining and releasing both CUDA bindings lines.
Release and CI
Tag-triggered builds now validate and package the selected CUDA bindings release line.
Backport pull requests are created through manual workflow dispatch with an explicit release branch and pull request number.
Nightly wheel tests now support release-specific configuration and legacy backport branches.
The PR registers CUDA 12 and CUDA 13 bindings roots and updates CI configuration, workflows, release procedures, and package guidance to use them. It adds metadata checks, updates nightly and coverage selection, and changes legacy backport and artifact handling.
The registry identifies CUDA 12 as maintenance and CUDA 13 as current. New checks validate toolkit floors and package selectors. The Core floor hook now checks package declarations and documentation rather than CI toolkit pins.
Nightly, coverage, and wheel-test selection .github/workflows/ci-nightly.yml, .github/workflows/coverage.yml, .github/workflows/test-wheel-linux.yml, .github/workflows/test-wheel-windows.yml, .github/workflows/build-wheel.yml
Nightly jobs read configuration from the resolved source revision and pass bindings settings to test jobs. Coverage jobs resolve the active bindings root. Legacy wheel tests take an explicit backport branch, and legacy artifact aliases are removed.
Release and backport workflow .github/RELEASE-bindings.md, .github/workflows/backport.yml, .github/dependabot.yml
Backports now use manual dispatch with validated PR and target-branch inputs. Release guidance describes tag-specific bindings selection. The 12.9.x Actions Dependabot configuration is removed.
Guidance covers transferring handwritten fixes, checking synchronized snippets, and maintaining both roots. Routine CUDA 12 work is directed to main; the historical 12.9.x branch is reserved for emergency fixes.
Bindings installation and documentation guides cuda_bindings_12/README.md, cuda_bindings_12/docs/*, cuda_bindings_13/README.md, cuda_bindings_13/docs/*
The package guides distinguish the CUDA 12 and CUDA 13 source roots and documentation environments. CUDA 12 installation guidance updates driver baselines and lists optional Toolkit components.
CI planning and release documentation ci/README.md, ci/ci-pipeline.mmd, CONTRIBUTING.md
The CI documentation and diagram describe registry-based package selection, nightly artifact paths, workplans, release reruns, and release-line changes. The contribution guide updates Pixi lockfile and CI workflow guidance.
Possibly related issues
[FEA]: enforce co-dependent values to stay in sync via blockwatch #3221 — The new metadata checks validate package selectors and toolkit floors against the registry. The PR does not explicitly add synchronization checks for every toolkit version and backport branch value described in the issue.
Possibly related PRs
NVIDIA/cuda-python#3176 — Adds registry-based testing for both bindings majors. This PR continues that transition with schema-2 configuration and legacy nightly artifact compatibility.
NVIDIA/cuda-python#3275 — Introduces setup-hardened-python, which this PR uses to set up Python for bindings configuration in coverage CI.
Suggested labels:github_actions, documentation
Suggested reviewers:mdboom
Change: Feature
Merge Risk: Low · previous review bf9b3
The sample-test instructions still omit the NVRTC requirement, so those tests can fail in an environment without NVRTC. Two CI jobs also install tooling while checkout credentials are available. These are localized risks; merge with them understood.
Security architecture risk: Low · up to bf9b3
The inspected workflows preserve package identity and strengthen backport validation. No introduced security concern was established, but private downstream compatibility and recovery after partial backport failure remain unverified.
Retained concerns
No architecture-level concerns identified.
Security review details
Security Blast Radius
observed — The relevant authority includes repository writes through backport automation and execution of selected test sources on GPU runners. Linux test containers run as root with seccomp unconfined; custom-driver rows additionally use privileged mode and the host PID namespace. That runner configuration and SHA-selected source checkout already existed at the PR base.
Security Findings and Attack Paths
observed — An explicit nightly run override still resolves its SHA without checking workflow identity, successful conclusion, or main-branch provenance in that override path. This behavior predates the PR; the head adds positive-integer validation and removes direct shell interpolation of the input. It is an existing trust assumption, not an established introduced vulnerability.
Trust Boundaries and Controls
observed — Nightly configuration parsing uses safe YAML loading, rejects unsupported schema versions, validates the emitted current toolkit format, and validates historical branch refs before writing routing outputs. The shared parser also requires exactly one current and one maintenance package with distinct CUDA majors.
Resilience and Maintainability Implications
observed — Backports with the same source PR and target branch are serialized without canceling an active run, and a non-successful action result fails the workflow with manual recovery guidance. Those controls do not establish idempotent repetition or cleanup of partially created branches or PRs; the unchanged external action's implementation was not verified.
- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Tip
🎯 Customize your risk assessments
Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.
✅ Automatic approvals, with your rules
Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.
The reason will be displayed to describe this comment to others. Learn more.
Minor · Security & Privacy · Quick win
important: Remove the persisted checkout credential before installing CI dependencies.
find-wheels now runs pip install -e ./ci after a checkout that retains its credential. A dependency build script can access that credential. Set persist-credentials: false on the checkout and give find-wheels only the contents: read and actions: read permissions it needs. (github.com)
Based on learnings: jobs that run dependency build tooling should use persist-credentials: false and minimal permissions. As per path instructions: “focus on least-privilege permissions” for workflows.
Tools
zizmor (1.30.1)
[warning] 15-468: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
[warning] 72-165: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
The reason will be displayed to describe this comment to others. Learn more.
Minor · Security & Privacy · Quick win
important: Remove the persisted checkout credential from coverage-vars.
coverage-vars now installs CI dependencies after a checkout that retains its credential. A dependency build script can access that credential. Set persist-credentials: false on this checkout and declare contents: read for coverage-vars. (github.com)
Based on learnings: jobs that run dependency build tooling should use persist-credentials: false and minimal permissions. As per path instructions: “focus on least-privilege permissions” for workflows.
Tools
zizmor (1.30.1)
[warning] 5-623: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
[warning] 19-45: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
The reason will be displayed to describe this comment to others. Learn more.
Minor · Functional Correctness · Quick win
important: --group was added in pip 25.1, but this setup command does not require or upgrade pip. With pip 25.0 or older, the command fails before installing the package. Add a pip>=25.1 prerequisite or retain the [test] extra; apply the same correction to cuda_bindings_13/README.md Line 25. (pip.pypa.io)
Reviewing files that changed from the base of the PR and between ea67d84 and bf9b3c2.
Files selected for processing: 5
.github/workflows/build-wheel.yml
.github/workflows/coverage.yml
CONTRIBUTING.md
ci/README.md
cuda_bindings_12/README.md
Files with no reviewable changes: 1
.github/workflows/build-wheel.yml
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.
merge=716fc74291e36079fa95a817150156be066d17b2
printf'%s\n''--- first-parent changed files in selected merge ---'
git diff --name-only "$merge^1""$merge"| sed -n '1,25p'printf'%s\n''--- unfiltered -1 format-patch output ---'
git format-patch -1 --stdout "$merge"| sed -n '1,20p'printf'%s\n''--- tracked root trees at merge ---'
git ls-tree --name-only "$merge"| sed -n '1,50p'
Repository: NVIDIA/cuda-python
Length of output: 1905
Script executed:
merge=716fc74291e36079fa95a817150156be066d17b2
printf'%s\n''--- root-restricted command for merge ---'
git format-patch -1 --stdout --relative=cuda_bindings "$merge" -- cuda_bindings | sed -n '1,32p'printf'%s\n''--- first-parent changes under root ---'
git diff --stat "$merge^1""$merge" -- cuda_bindings
printf'%s\n''--- merge and emitted commit metadata ---'
git show -s --format='%H %P %s'"$merge" 972ee3b15f4f120f0f99e9d698a75f0e19331b0e
Repository: NVIDIA/cuda-python
Length of output: 2544
important: Require a non-merge COMMIT.
git format-patch does not serialize the merge commit itself. With the documented command, a merge commit can produce an unrelated non-merge patch or no patch, so the intended source-root fix may not transfer.
Suggested documentation fix
-`COMMIT` with the reviewed source commit:+`COMMIT` with the reviewed non-merge source commit:
important: Document the NVRTC requirement for samples.
The test group does not install NVRTC. If NVRTC is unavailable, jit_program_test.py can fail at nvrtcCreateProgram. Document that the samples need CUDA 12 NVRTC.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
CI/CDCI/CD infrastructurecuda.bindingsEverything related to the cuda.bindings modulecuda.coreEverything related to the cuda.core moduleenhancementAny code-related improvements
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github-actions
Bot
added
CI/CD
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
— codex GPT-6 on behalf of Ralf —
Layer 7 of 7 of the staged "CUDA 12 bindings on
main" stack. Previous: #3321. Stack map at the bottom.What this PR does
Removes what the previous six layers made obsolete, and writes down how the two roots are maintained from now on.
ci/versions.ymlmoves to schema 2:cuda.bindings.package_rootswithtoolkit_versionandrelease_status;backport_branch,cuda.build, andcuda.prev_buildare gone.bindings_config.pystill reads the old format, because nightly may point at an older artifact source and release dry runs may point at retained CUDA 13 tags.check-bindings-config: each root's setuptools-scm selector must bev<major>.*for its CUDA major, the metapackage selector table must agree, and Core's cu12/cu13 bindings floors must not exceed the pinned toolkits. The old floor hook intoolshed/is narrowed to extras and docs.backport.ymlbecomes manual-only: a merged PR number plus an existing target branch, with validation. No more automatic backports on theto-be-backportedlabel. Dependabot's12.9.xentry is removed.ci-nightly.ymlextracts onlyci/versions.ymlfrom the artifact-source archive: schema-2 sources take the new route, older sources the legacy route (legacy-backport-branch). The legacy artifact aliases (cuda-python-wheel,<core artifact>-tests) are no longer produced.CONTRIBUTING.md(selector table, transferring a fix between roots withgit format-patch --relativeandgit am --directory, CUDA-major artifact flow, release branches),ci/README.md(registry, SCM milestones, nightly rollout, how to read CI job names, historical reruns, maintaining both roots, changing the supported lines),AGENTS.md(SYNCED blocks),cuda_bindings_12/MAINTENANCE.md(new), install page driver baseline correction (Linux 525.60.13, Windows 528.33), CI diagram.After this merges
12.9.xbranch is frozen except for emergency fixes; routine CUDA 12 work happens incuda_bindings_12/onmain.v12.9.11a0milestone is already on main; both alternatives are restacked onto it and contain no temporary SCM bootstrap.mainrun succeeds.Where to look
ci/versions.yml: the final registry, 19 lines.ci/tools/bindings_config.py:check_package_metadata()andcheck_core_toolkit_floors()..github/workflows/backport.ymlandci-nightly.yml.ci/README.md, section "Maintaining Both Bindings Roots": the policy reviewers are really approving.All changes (36 files, +977 / -377)
Config and hooks:
ci/versions.yml,.pre-commit-config.yaml(new hook; floor hook narrowed),ci/tools/bindings_config.py(metadata checks),toolshed/check_cuda_core_bindings_floor.py,cuda_core/cuda/core/_bindings_floor.py(comment),cuda_core/tests/test_bindings_floor.py,ci/tools/tests/test_bindings_metadata.py(new),ci/tools/check_pixi_cuda_version.py,ci/tools/tests/test_bindings_config.py.CI workaround:
cuda_core/tests/test_memory.pyruns supported pool-trim cases serially for the known driver synchronization issue #3350.Workflows:
backport.yml,.github/dependabot.yml,ci-nightly.yml,coverage.yml(registry-driven),build-wheel.yml(aliases removed),test-wheel-linux.yml,test-wheel-windows.yml(legacy-backport-branchinput).Docs:
AGENTS.md,CONTRIBUTING.md,README.md,ci/README.md,ci/ci-pipeline.mmd,.github/RELEASE-bindings.md,cuda_bindings_12/{AGENTS.md,MAINTENANCE.md,README.md,docs/README.md,docs/source/contribute.md,docs/source/install.md,docs/source/release/12.X.Y-notes.rst},cuda_bindings_13/{AGENTS.md,README.md,docs/README.md,docs/source/install.rst,docs/source/support.rst},cuda_core/AGENTS.md.Validation
main).126ed74fb5bbfbc91a04e50557cf936efef4da7f.Stack map: what
maincan do after each layer mergesmain...v12.*tagcuda_bindings_12/; the PR-time CPU source-build smoke covers both roots; three CUDA 12 runtime fixes are incuda.coreand the metapackage still consume12.9.xartifacts12.9.xbranchv12.9.Ntag onmain; CUDA 13 releases are unchanged12.9.xis frozenEvery layer was designed to be mergeable on its own and had a green full CI run at its pre-rebase head on 2026-10-31. The stack is the "individually mergeable pieces" alternative to #3174-#3182; both stacks reach the same end state except that this one keeps compatibility routes for older artifact sources and retained CUDA 13 tags.