Release 3.0.0: merge develop → main

.git-blame-ignore-revs

@@ -0,0 +1,13 @@
+# Commits listed here are skipped by `git blame` so that large, purely mechanical
+# changes (whitespace, indentation, reformatting) do not obscure the real authorship
+# of each line.  GitHub honours this file automatically.  Locally, run once:
+#
+#     git config blame.ignoreRevsFile .git-blame-ignore-revs
+#
+# RULES:
+#   * Only add commits that are PURELY formatting -- no behavioural or semantic
+#     change, no documentation-content change.  Keep such passes in their own
+#     isolated commit so the whole commit can be safely ignored.
+#   * Add the full 40-character commit SHA, with a comment naming what it did.
+#
+# (No revisions yet -- add the whitespace/indentation pass SHA here when it lands.)

.github/ci-deps-versions.env

@@ -0,0 +1,10 @@
+# Single source of truth for the C++ dependency versions pinned across CI: the wheel/test
+# workflow (build_and_test.yml), the Linux deps image (build-ci-image.yml), and the macOS
+# deps tarballs (build-macos-deps.yml) all read this file.  Bumping a version here is what
+# triggers a rebuild of the prebuilt Linux image (this path is in build-ci-image.yml's filter).
+#
+# Plain KEY=VALUE so it can be `. sourced` in bash and mirrored into $GITHUB_ENV / job outputs.
+# Bump deliberately: an ABI change must be matched by rebuilt image + tarballs (ADR-0006).
+BOOST_VERSION=1.90.0
+EIGEN_VERSION=3.4.0
+EIGENPY_VERSION=3.13.0

.github/workflows/build-ci-image.yml

@@ -0,0 +1,101 @@
+name: Build CI deps image 🐳
+
+# Builds the manylinux + prebuilt Boost/Boost.Python + eigenpy image consumed by the wheel matrix.
+# The expensive per-CPython Boost builds run in PARALLEL (one matrix runner each, inside the
+# manylinux container via docker run); a final job assembles them into the image and pushes it to
+# ghcr.io/bertiniteam/b2-manylinux-deps, tagged by TOOLCHAIN KEY.  Rare: only on docker/ changes or
+# dispatch.
+#
+# OWNER: the package lands under whichever org runs this; it MUST run in bertiniteam/b2 (its token
+# can only push to that org's GHCR).
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [develop]
+    paths:
+      - 'docker/manylinux-deps/**'
+      - '.github/workflows/build-ci-image.yml'
+      - '.github/ci-deps-versions.env'   # a version bump here rebuilds the image
+
+concurrency:
+  group: ci-image-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  # BOOST_VERSION / EIGEN_VERSION / EIGENPY_VERSION are single-sourced in
+  # .github/ci-deps-versions.env and loaded per-job (see the "Load dep versions" steps).
+  MANYLINUX_TAG: "mlx2_34"
+  MANYLINUX_IMAGE: "quay.io/pypa/manylinux_2_34_x86_64"
+  IMAGE: "ghcr.io/bertiniteam/b2-manylinux-deps"
+
+jobs:
+  build-deps:
+    name: Boost+eigenpy ${{ matrix.pytag }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        pytag: [cp310-cp310, cp311-cp311, cp312-cp312, cp313-cp313, cp314-cp314]
+    steps:
+      - uses: actions/checkout@v5
+      - name: Load dep versions
+        run: cat .github/ci-deps-versions.env >> "$GITHUB_ENV"
+      - name: Build Boost+eigenpy for ${{ matrix.pytag }} (manylinux)
+        run: |
+          docker run --rm -v "$PWD:/work" -w /work \
+            -e BOOST_VERSION -e EIGEN_VERSION -e EIGENPY_VERSION \
+            "$MANYLINUX_IMAGE" \
+            bash docker/manylinux-deps/build-python-deps.sh "${{ matrix.pytag }}"
+      - uses: actions/upload-artifact@v5
+        with:
+          name: deps-${{ matrix.pytag }}
+          path: deps-${{ matrix.pytag }}.tar.gz
+          if-no-files-found: error
+
+  assemble-and-push:
+    name: Assemble & push image
+    needs: build-deps
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Load dep versions
+        run: cat .github/ci-deps-versions.env >> "$GITHUB_ENV"
+
+      - name: Collect prebuilt deps into the build context
+        uses: actions/download-artifact@v5
+        with:
+          pattern: deps-*
+          merge-multiple: true
+          path: docker/manylinux-deps/deps
+
+      - name: Compute toolchain tag
+        id: tag
+        run: |
+          echo "key=boost${BOOST_VERSION}-eigen${EIGEN_VERSION}-eigenpy${EIGENPY_VERSION}-${MANYLINUX_TAG}" >> "$GITHUB_OUTPUT"
+          echo "Image: $IMAGE:boost${BOOST_VERSION}-eigen${EIGEN_VERSION}-eigenpy${EIGENPY_VERSION}-${MANYLINUX_TAG}"
+          ls -lh docker/manylinux-deps/deps
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build & push (assembly only -- fast)
+        uses: docker/build-push-action@v6
+        with:
+          context: docker/manylinux-deps
+          push: true
+          tags: |
+            ${{ env.IMAGE }}:${{ steps.tag.outputs.key }}
+            ${{ env.IMAGE }}:latest
+          build-args: |
+            BOOST_VERSION=${{ env.BOOST_VERSION }}
+            EIGEN_VERSION=${{ env.EIGEN_VERSION }}
+            EIGENPY_VERSION=${{ env.EIGENPY_VERSION }}

.github/workflows/build-macos-deps.yml

@@ -0,0 +1,97 @@
+name: Build macOS deps tarballs 🍏
+
+# macOS has no container, so the Linux image trick doesn't apply.  The analog: build Boost
+# (incl. per-CPython Boost.Python) + eigenpy ONCE per toolchain and publish them as GitHub
+# Release assets, which the wheel job downloads instead of recompiling every run.  Release
+# storage is a separate quota, so this sidesteps the 10 GB Actions-cache ceiling too.
+#
+# Runs rarely -- only when the Dockerfile-equivalent recipe or the pinned versions change,
+# or on demand.  Assets are attached to the `ci-deps` prerelease and named by TOOLCHAIN KEY
+# + arch + CPython, so the wheel job pins an exact match (never a silent ABI swap; ADR-0006).
+#
+# The build steps MIRROR build_and_test.yml's CIBW_BEFORE_BUILD_MACOS exactly (same prefix
+# /tmp/deps-py and hardcode-dll-paths, so a downloaded tarball extracts back to /tmp/deps-py
+# and delocate is happy).
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [develop]
+    paths:
+      - '.github/workflows/build-macos-deps.yml'
+      - '.github/ci-deps-versions.env'   # a version bump here rebuilds the macOS tarballs
+
+concurrency:
+  group: macos-deps-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  # BOOST_VERSION / EIGENPY_VERSION are single-sourced in .github/ci-deps-versions.env
+  # and loaded by the "Load dep versions" step below.
+  RELEASE_TAG: "ci-deps"          # a permanent prerelease that just holds CI dep bundles
+
+jobs:
+  build-macos-deps:
+    name: macOS deps py${{ matrix.python-version }}
+    runs-on: macos-14   # arm64
+    permissions:
+      contents: write   # create/upload the ci-deps release assets
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
+    steps:
+      - uses: actions/checkout@v5
+      - name: Load dep versions
+        run: cat .github/ci-deps-versions.env >> "$GITHUB_ENV"
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install host libs (CPython-independent)
+        run: brew install gmp mpfr libmpc eigen@3
+
+      - name: Build Boost + eigenpy into /tmp/deps-py
+        run: |
+          set -euo pipefail
+          PY="$(which python)"
+          "$PY" -m pip install -q scikit-build-core numpy scipy
+          rm -rf /tmp/deps-py && mkdir -p /tmp/deps-py
+          PY_VER="$("$PY" -c 'import sys;print(f"{sys.version_info.major}.{sys.version_info.minor}")')"
+          PY_INC="$("$PY" -c 'import sysconfig;print(sysconfig.get_path("include"))')"
+          PY_LIB="$("$PY" -c 'import sysconfig;print(sysconfig.get_config_var("LIBDIR") or "")')"
+          cd /tmp
+          BU="boost_$(echo "${BOOST_VERSION}" | tr . _)"
+          curl -fsSL -o "$BU.tar.bz2" "https://archives.boost.io/release/${BOOST_VERSION}/source/$BU.tar.bz2"
+          rm -rf "$BU" && tar xjf "$BU.tar.bz2"
+          cd "$BU"
+          ./bootstrap.sh --with-python="$PY" --prefix=/tmp/deps-py
+          printf 'using python : %s : %s : %s : %s ;\n' "$PY_VER" "$PY" "$PY_INC" "$PY_LIB" > user-config.jam
+          ./b2 install -j"$(sysctl -n hw.ncpu)" --user-config=user-config.jam python="$PY_VER" \
+            --without-mpi hardcode-dll-paths=true dll-path=/tmp/deps-py/lib
+          cd /tmp
+          rm -rf "eigenpy-${EIGENPY_VERSION}" && tar zxf "eigenpy-${EIGENPY_VERSION}.tar.gz" 2>/dev/null || \
+            { curl -fsSL -o "eigenpy-${EIGENPY_VERSION}.tar.gz" "https://github.com/stack-of-tasks/eigenpy/releases/download/v${EIGENPY_VERSION}/eigenpy-${EIGENPY_VERSION}.tar.gz"; tar zxf "eigenpy-${EIGENPY_VERSION}.tar.gz"; }
+          cd "eigenpy-${EIGENPY_VERSION}" && mkdir -p bld && cd bld
+          cmake .. -DCMAKE_PREFIX_PATH="/tmp/deps-py;/opt/homebrew" -DCMAKE_INSTALL_PREFIX=/tmp/deps-py \
+            -DCMAKE_BUILD_TYPE=Release -DPython3_EXECUTABLE="$PY" \
+            -DPython3_NumPy_INCLUDE_DIR="$("$PY" -c 'import numpy;print(numpy.get_include())')" \
+            -DBUILD_TESTING=OFF
+          make -j2 install
+
+      - name: Package + publish the tarball
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          PY_TAG="cp$(echo '${{ matrix.python-version }}' | tr -d .)"
+          KEY="boost${BOOST_VERSION}-eigenpy${EIGENPY_VERSION}"
+          ASSET="deps-macos14-arm64-${PY_TAG}-${KEY}.tar.gz"
+          tar czf "$ASSET" -C /tmp deps-py
+          ls -lh "$ASSET"
+          # Ensure the holder release exists (idempotent), then upload/replace this asset.
+          gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1 \
+            || gh release create "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --prerelease \
+                 --title "CI dependency bundles" \
+                 --notes "Prebuilt Boost + eigenpy bundles consumed by the wheel matrix. Not a software release."
+          gh release upload "$RELEASE_TAG" "$ASSET" --repo "$GITHUB_REPOSITORY" --clobber