Merge branch 'main' into autodiff-uncerts

scikit-hep · Sep 24, 2024 · b24b591 · b24b591
2 parents 5d3d3d6 + 3d26434
commit b24b591
Show file tree

Hide file tree

Showing 32 changed files with 321 additions and 285 deletions.
diff --git a/.github/ISSUE_TEMPLATE/~release-checklist.md b/.github/ISSUE_TEMPLATE/~release-checklist.md
@@ -13,7 +13,6 @@ about: Checklist for core developers to complete as part of making a release
 * [ ] Verify that the release notes files correctly summarize all development changes since the last release.
 * [ ] Add any new use citations or published statistical models to the [Use and Citations page][citations_page].
 * [ ] Verify that the citations on the [Use and Citations page][citations_page] are up to date with their current [INSPIRE](https://inspirehep.net/) record. Checking the [Dimensions listing of publication citations](https://app.dimensions.ai/discover/publication?or_subset_publication_citations=pub.1135154020) can be helpful to catch citations that are now journal publications.
-* [ ] Update the ``codemeta.json`` file in the release PR if its requirements have updated.
 * [ ] Update the [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) GitHub Action used for deployment to TestPyPI and PyPI to the latest stable release.
 * [ ] Make a release to [TestPyPI][TestPyPI_pyhf] using the [workflow dispatch event trigger](https://github.com/scikit-hep/pyhf/actions/workflows/publish-package.yml).
 * [ ] Verify that the project README is displaying correctly on [TestPyPI][TestPyPI_pyhf].

diff --git a/.github/release.yml b/.github/release.yml
@@ -0,0 +1,5 @@
+changelog:
+  exclude:
+    authors:
+      - dependabot
+      - pre-commit-ci
diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml
@@ -12,11 +12,9 @@ on:
         - minor
         - major
       release_candidate:
-        type: choice
-        description: 'Release candidate?'
-        options:
-        - false
-        - true
+        type: boolean
+        description: 'Release candidate'
+        default: false
       new_version:
         description: 'New version to bump to'
         required: true
@@ -27,20 +25,21 @@ on:
         required: true
         type: string
       force:
-        type: choice
-        description: 'Force override check?'
-        options:
-        - false
-        - true
+        type: boolean
+        description: 'Force override check'
+        default: false
       dry_run:
-        type: choice
-        description: 'Perform a dry run to check?'
-        options:
-        - true
-        - false
+        type: boolean
+        description: 'Perform a dry run to check'
+        default: true
+
+permissions:
+  contents: read
 
 jobs:
   bump-version:
+    permissions:
+      contents: write  # for Git to git push
     runs-on: ubuntu-latest
     if: github.repository == 'scikit-hep/pyhf'
 
@@ -204,8 +203,8 @@ jobs:
 
     - name: Install Python dependencies
       run: |
-        python -m pip install --upgrade pip setuptools wheel
-        python -m pip install tbump
+        python -m pip install uv
+        uv pip install --system tbump
         python -m pip list
 
     - name: Setup Git user to push new tag

diff --git a/.github/workflows/ci-windows.yml b/.github/workflows/ci-windows.yml
@@ -10,6 +10,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   test:
 
@@ -29,8 +32,8 @@ jobs:
 
     - name: Install dependencies
       run: |
-        python -m pip install --upgrade pip setuptools wheel
-        python -m pip install --upgrade '.[all,test]'
+        python -m pip install uv
+        uv pip install --system --upgrade '.[all,test]'
 
     - name: List installed Python packages
       run: python -m pip list

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -15,6 +15,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   test:
 
@@ -31,8 +34,8 @@ jobs:
         include:
           - os: macos-latest
             python-version: '3.12'
-          # Apple silicon runner
-          - os: macos-14
+          # Intel runner
+          - os: macos-13
             python-version: '3.12'
 
     steps:
@@ -44,8 +47,16 @@ jobs:
         python-version: ${{ matrix.python-version }}
 
     - name: Install dependencies
+      if: matrix.python-version != '3.8'
+      run: |
+        python -m pip install uv
+        uv pip install --system --upgrade ".[all,test]"
+
+      # c.f. https://github.com/astral-sh/uv/issues/2062
+    - name: Install dependencies (Python 3.8)
+      if: matrix.python-version == '3.8'
       run: |
-        python -m pip install --upgrade pip setuptools wheel
+        python -m pip install --upgrade pip
         python -m pip install --upgrade ".[all,test]"
 
     - name: List installed Python packages
@@ -96,11 +107,11 @@ jobs:
 
     - name: Test docstring examples with doctest
       # TODO: Don't currently try to match amd64 and arm64 floating point for docs, but will in the future.
-      if: matrix.python-version == '3.12' && matrix.os != 'macos-14'
+      if: matrix.python-version == '3.12' && matrix.os != 'macos-latest'
       run: coverage run --data-file=.coverage-doctest --module pytest src/ README.rst
 
     - name: Coverage report for doctest only
-      if: matrix.python-version == '3.12' && matrix.os != 'macos-14'
+      if: matrix.python-version == '3.12' && matrix.os != 'macos-latest'
       run: |
         coverage report --data-file=.coverage-doctest
         coverage xml --data-file=.coverage-doctest -o doctest-coverage.xml

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
@@ -15,8 +15,15 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
+    permissions:
+      actions: read  # for github/codeql-action/init to get workflow details
+      contents: read  # for actions/checkout to fetch code
+      security-events: write  # for github/codeql-action/analyze to upload SARIF results
     name: Analyze
     runs-on: ubuntu-latest
 

diff --git a/.github/workflows/dependencies-head.yml b/.github/workflows/dependencies-head.yml
@@ -10,13 +10,16 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   release-candidates:
 
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest]
+        os: [ubuntu-latest, macos-latest, macos-13]
         python-version: ['3.12']
 
     steps:
@@ -29,8 +32,8 @@ jobs:
 
     - name: Install dependencies
       run: |
-        python -m pip install --upgrade pip setuptools wheel
-        python -m pip --no-cache-dir --quiet install --upgrade --pre ".[all,test]"
+        python -m pip install uv
+        uv pip --no-cache --quiet install --system --upgrade --pre ".[all,test]"
         python -m pip list
 
     - name: List release candidates, alpha, and beta releases
@@ -57,14 +60,13 @@ jobs:
       with:
         python-version: ${{ matrix.python-version }}
 
-    # Use nightly SciPy wheels from Anaconda's PyPI
-    # c.f. https://twitter.com/ralfgommers/status/1419917265781334025
     - name: Install dependencies
       run: |
-        python -m pip install --upgrade pip setuptools wheel
-        python -m pip --no-cache-dir --quiet install --upgrade ".[all,test]"
-        python -m pip uninstall --yes scipy
-        python -m pip install --upgrade --index-url https://pypi.anaconda.org/scientific-python-nightly-wheels/simple scipy
+        python -m pip install uv
+        uv pip --no-cache --quiet install --system --upgrade ".[all,test]"
+        uv pip uninstall --system scipy
+        # uv wants to upgrade dependencies (numpy) to a dev release too, so don't --upgrade
+        uv pip install --system --index-url https://pypi.anaconda.org/scientific-python-nightly-wheels/simple scipy
         python -m pip list
 
     - name: Test with pytest
@@ -87,11 +89,11 @@ jobs:
         python-version: ${{ matrix.python-version }}
     - name: Install dependencies
       run: |
-        python -m pip install --upgrade pip setuptools wheel
-        python -m pip --no-cache-dir --quiet install --upgrade ".[all,test]"
-        python -m pip uninstall --yes iminuit
-        python -m pip install --upgrade cython
-        python -m pip install --upgrade git+https://github.com/scikit-hep/iminuit.git
+        python -m pip install uv
+        uv pip --no-cache --quiet install --system --upgrade ".[all,test]"
+        uv pip uninstall --system iminuit
+        uv pip install --system --upgrade cython
+        uv pip install --system --upgrade git+https://github.com/scikit-hep/iminuit.git
         python -m pip list
     - name: Test with pytest
       run: |
@@ -113,10 +115,10 @@ jobs:
         python-version: ${{ matrix.python-version }}
     - name: Install dependencies
       run: |
-        python -m pip install --upgrade pip setuptools wheel
-        python -m pip --no-cache-dir --quiet install --upgrade ".[all,test]"
-        python -m pip uninstall --yes uproot
-        python -m pip install --upgrade git+https://github.com/scikit-hep/uproot5.git
+        python -m pip install uv
+        uv pip --no-cache --quiet install --system --upgrade ".[all,test]"
+        uv pip uninstall --system uproot
+        uv pip install --system --upgrade git+https://github.com/scikit-hep/uproot5.git
         python -m pip list
     - name: Test with pytest
       run: |
@@ -140,16 +142,17 @@ jobs:
 
     - name: Install dependencies
       run: |
-        python -m pip install --upgrade pip setuptools wheel
-        python -m pip --no-cache-dir --quiet install --upgrade ".[all,test]"
-        python -m pip uninstall --yes matplotlib
-        # Need to use --extra-index-url as dependencies aren't on scientific-python-nightly-wheels package index.
+        python -m pip install uv
+        uv pip --no-cache --quiet install --system --upgrade ".[all,test]"
+        uv pip uninstall --system matplotlib
+        # Need to use --extra-index-url as all dependencies aren't on scientific-python-nightly-wheels package index.
         # Need to use --pre as dev releases will need priority over stable releases.
-        python -m pip install \
-          --upgrade \
+        # Note that uv and pip differ on --extra-index-url priority
+        # c.f. https://github.com/scientific-python/upload-nightly-action/issues/76
+        uv pip install --system \
           --pre \
-          --index-url https://pypi.anaconda.org/scientific-python-nightly-wheels/simple \
-          --extra-index-url https://pypi.org/simple/ \
+          --index-url https://pypi.org/simple/ \
+          --extra-index-url https://pypi.anaconda.org/scientific-python-nightly-wheels/simple \
           matplotlib
 
     - name: List installed Python packages
@@ -175,10 +178,10 @@ jobs:
         python-version: ${{ matrix.python-version }}
     - name: Install dependencies
       run: |
-        python -m pip install --upgrade pip setuptools wheel
-        python -m pip --no-cache-dir --quiet install --upgrade ".[all,test]"
-        python -m pip uninstall --yes pytest
-        python -m pip install --upgrade git+https://github.com/pytest-dev/pytest.git
+        python -m pip install uv
+        uv pip --no-cache --quiet install --system --upgrade ".[all,test]"
+        uv pip uninstall --system pytest
+        uv pip install --system --upgrade git+https://github.com/pytest-dev/pytest.git
         python -m pip list
     - name: Test with pytest
       run: |

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
@@ -19,9 +19,15 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   docker:
     name: Build, test, and publish Docker images to Docker Hub
+    permissions:
+      contents: read
+      packages: write  # for docker to push to registry
     runs-on: ubuntu-latest
 
     steps:
@@ -75,7 +81,7 @@ jobs:
 
       - name: Test build
         id: docker_build_test
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: docker/Dockerfile
@@ -113,7 +119,7 @@ jobs:
         # every PR will trigger a push event on main, so check the push event is actually coming from main
         if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'scikit-hep/pyhf'
         id: docker_build_latest
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: docker/Dockerfile
@@ -130,7 +136,7 @@ jobs:
       - name: Build and publish to registry with release tag
         if: github.event_name == 'release' && github.event.action == 'published' && github.repository == 'scikit-hep/pyhf'
         id: docker_build_release
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: docker/Dockerfile

diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -11,6 +11,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build docs
@@ -28,9 +31,9 @@ jobs:
 
     - name: Install Python dependencies
       run: |
-        python -m pip install --upgrade pip setuptools wheel
-        python -m pip --quiet install --upgrade .[docs,test]
-        python -m pip install yq
+        python -m pip install uv
+        uv pip --quiet install --system --upgrade ".[docs,test]"
+        uv pip install --system yq
         python -m pip list
 
     - name: Install apt-get dependencies

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -8,6 +8,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   lint:
 

diff --git a/.github/workflows/lower-bound-requirements.yml b/.github/workflows/lower-bound-requirements.yml
@@ -6,6 +6,9 @@ on:
   - cron:  '1 0 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test:
 
@@ -26,8 +29,9 @@ jobs:
 
     - name: Install dependencies and force lowest bound
       run: |
-        python -m pip install --upgrade pip setuptools wheel
-        python -m pip --no-cache-dir install --constraint tests/constraints.txt ".[all,test]"
+        python -m pip install uv
+        uv pip install --system --upgrade 'setuptools<70.0.0'
+        uv pip --no-cache install --system --constraint tests/constraints.txt ".[all,test]"
 
     - name: List installed Python packages
       run: python -m pip list

diff --git a/.github/workflows/merged.yml b/.github/workflows/merged.yml
@@ -5,6 +5,9 @@ on:
     types: [closed]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   binder:
     name: Trigger Binder build