ci(backport): Update GitHub Actions

.github/workflows/bump-version.yml

@@ -190,11 +190,11 @@ jobs:
         echo "steps.script.outputs.old_tag=v${current_tag}"
         echo "old_tag=v${current_tag}" >> $GITHUB_OUTPUT
 
-    - name: Set up Python 3.11
+    - name: Set up Python 3.12
       if: success()
       uses: actions/setup-python@v5
       with:
-        python-version: '3.11'
+        python-version: '3.12'
 
     - name: Install Python dependencies
       run: |

.github/workflows/ci.yml

@@ -27,10 +27,13 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest]
-        python-version: ['3.7', '3.8', '3.9', '3.10', '3.11']
+        python-version: ['3.7', '3.8', '3.9', '3.10', '3.11', '3.12']
         include:
           - os: macos-latest
-            python-version: '3.11'
+            python-version: '3.12'
+          # Intel runner
+          - os: macos-13
+            python-version: '3.12'
 
     steps:
     - uses: actions/checkout@v4
@@ -68,34 +71,47 @@ jobs:
       if: >-
         github.event_name != 'schedule' &&
         matrix.os == 'ubuntu-latest'
-      uses: codecov/codecov-action@v3
+      uses: codecov/codecov-action@v4
       with:
+        fail_ci_if_error: true
         files: ./coverage.xml
         flags: unittests-${{ matrix.python-version }}
+        token: ${{ secrets.CODECOV_TOKEN }}
 
     - name: Test Contrib module with pytest
       run: |
         pytest tests/contrib --mpl --mpl-baseline-path tests/contrib/baseline
 
     - name: Report contrib coverage with Codecov
-      if: github.event_name != 'schedule' && matrix.python-version == '3.11' && matrix.os == 'ubuntu-latest'
-      uses: codecov/codecov-action@v3
+      if: github.event_name != 'schedule' && matrix.python-version == '3.12' && matrix.os == 'ubuntu-latest'
+      uses: codecov/codecov-action@v4
       with:
+        fail_ci_if_error: true
         files: ./coverage.xml
         flags: contrib
+        token: ${{ secrets.CODECOV_TOKEN }}
 
     - name: Test docstring examples with doctest
-      if: matrix.python-version == '3.11'
-      run: pytest src/ README.rst
+      # TODO: Don't currently try to match amd64 and arm64 floating point for docs, but will in the future.
+      if: matrix.python-version == '3.12' && matrix.os != 'macos-latest'
+      run: coverage run --data-file=.coverage-doctest --module pytest src/ README.rst
+
+    - name: Coverage report for doctest only
+      if: matrix.python-version == '3.12' && matrix.os != 'macos-latest'
+      run: |
+        coverage report --data-file=.coverage-doctest
+        coverage xml --data-file=.coverage-doctest -o doctest-coverage.xml
 
     - name: Report doctest coverage with Codecov
-      if: github.event_name != 'schedule' && matrix.python-version == '3.11' && matrix.os == 'ubuntu-latest'
-      uses: codecov/codecov-action@v3
+      if: github.event_name != 'schedule' && matrix.python-version == '3.12' && matrix.os == 'ubuntu-latest'
+      uses: codecov/codecov-action@v4
       with:
-        files: ./coverage.xml
+        fail_ci_if_error: true
+        files: doctest-coverage.xml
         flags: doctest
+        token: ${{ secrets.CODECOV_TOKEN }}
 
     - name: Run benchmarks
-      if: github.event_name == 'schedule' && matrix.python-version == '3.11'
+      if: github.event_name == 'schedule' && matrix.python-version == '3.12'
       run: |
         pytest --benchmark-sort=mean tests/benchmarks/test_benchmark.py

.github/workflows/dependencies-head.yml

@@ -16,8 +16,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest]
-        python-version: ['3.10']
+        os: [ubuntu-latest, macos-latest, macos-13]
+        python-version: ['3.12']
 
     steps:
     - uses: actions/checkout@v4
@@ -43,7 +43,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest]
-        python-version: ['3.10']
+        python-version: ['3.12']
 
     steps:
     - uses: actions/checkout@v4
@@ -73,7 +73,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest]
-        python-version: ['3.10']
+        python-version: ['3.12']
 
     steps:
     - uses: actions/checkout@v4
@@ -93,13 +93,13 @@ jobs:
       run: |
         pytest --ignore tests/benchmarks/ --ignore tests/contrib --ignore tests/test_notebooks.py
 
-  uproot4:
+  uproot5:
 
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
         os: [ubuntu-latest]
-        python-version: ['3.10']
+        python-version: ['3.12']
 
     steps:
     - uses: actions/checkout@v4
@@ -124,7 +124,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest]
-        python-version: ['3.10']
+        python-version: ['3.12']
 
     steps:
     - uses: actions/checkout@v4
@@ -160,7 +160,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest]
-        python-version: ['3.10']
+        python-version: ['3.12']
 
     steps:
     - uses: actions/checkout@v4

.github/workflows/docs.yml

@@ -27,7 +27,7 @@ jobs:
     - name: Set up Python
       uses: actions/setup-python@v5
       with:
-        python-version: '3.11'
+        python-version: '3.12'
 
     - name: Install Python dependencies
       run: |
@@ -116,7 +116,7 @@ jobs:
 
     steps:
     - name: Setup Pages
-      uses: actions/configure-pages@v4
+      uses: actions/configure-pages@v5
 
     - name: Deploy to GitHub Pages
       id: deployment

.github/workflows/notebooks.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ['3.10']
+        python-version: ['3.12']
 
     steps:
     - uses: actions/checkout@v4

.github/workflows/publish-package.yml

@@ -34,10 +34,10 @@ jobs:
       with:
         fetch-depth: 0
 
-    - name: Set up Python 3.11
+    - name: Set up Python 3.12
       uses: actions/setup-python@v5
       with:
-        python-version: '3.11'
+        python-version: '3.12'
 
     - name: Install python-build and twine
       run: |
@@ -130,13 +130,13 @@ jobs:
       if: >-
         (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'scikit-hep/pyhf')
         || (github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true' && github.repository == 'scikit-hep/pyhf')
-      uses: pypa/gh-action-pypi-publish@v1.8.11
+      uses: pypa/gh-action-pypi-publish@v1.8.14
       with:
         repository-url: https://test.pypi.org/legacy/
         print-hash: true
 
     - name: Publish distribution 📦 to PyPI
       if: github.event_name == 'release' && github.event.action == 'published' && github.repository == 'scikit-hep/pyhf'
-      uses: pypa/gh-action-pypi-publish@v1.8.11
+      uses: pypa/gh-action-pypi-publish@v1.8.14
       with:
         print-hash: true

.github/workflows/release_tests.yml

@@ -18,10 +18,14 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest]
-        python-version: ['3.7', '3.8', '3.9', '3.10']
+        python-version: ['3.7', '3.8', '3.9', '3.10', '3.11', '3.12']
         include:
           - os: macos-latest
-            python-version: '3.10'
+            python-version: '3.12'
+          # Intel runner
+          - os: macos-13
+            python-version: '3.12'
+      fail-fast: false
 
     steps:
     - uses: actions/checkout@v4

pyproject.toml

@@ -39,6 +39,7 @@ classifiers = [
     "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: Implementation :: CPython",
     "Topic :: Scientific/Engineering",
     "Topic :: Scientific/Engineering :: Physics",
@@ -108,23 +109,23 @@ test = [
     "pytest-mpl",
     "ipympl>=0.3.0",
     "pydocstyle",
-    "papermill~=2.3.4",
-    "scrapbook~=0.5.0",
+    "papermill>=2.3.4",
+    "scrapbook>=0.5.0",
     "jupyter",
     "graphviz",
     "pytest-socket>=0.2.0",  # c.f. PR #1917
 ]
 docs = [
     "pyhf[xmlio,contrib]",
     "sphinx>=7.0.0",  # c.f. https://github.com/scikit-hep/pyhf/pull/2271
-    "sphinxcontrib-bibtex~=2.1",
+    "sphinxcontrib-bibtex>=2.1",
     "sphinx-click",
     "sphinx-rtd-theme>=1.3.0",  # c.f. https://github.com/scikit-hep/pyhf/pull/2271
     "nbsphinx!=0.8.8",  # c.f. https://github.com/spatialaudio/nbsphinx/issues/620
     "ipywidgets",
     "sphinx-issues",
     "sphinx-copybutton>=0.3.2,!=0.5.1",
-    "jupyterlite-sphinx>=0.8.0",
+    "jupyterlite-sphinx>=0.13.1",  # c.f. https://github.com/scikit-hep/pyhf/pull/2458
     "jupyterlite-pyodide-kernel>=0.0.7",
     "jupytext>=1.14.0",
     "ipython!=8.7.0",  # c.f. https://github.com/scikit-hep/pyhf/pull/2068
@@ -236,7 +237,7 @@ filterwarnings = [
 
 [tool.mypy]
 files = "src"
-python_version = "3.11"
+python_version = "3.12"
 warn_unused_configs = true
 strict = true
 enable_error_code = ["ignore-without-code", "redundant-expr", "truthy-bool"]