ci: constrain internal builds to exact local wheels

rwgk · rwgk · commit a571b644352e · 2026-08-05T00:51:57.000-07:00
diff --git a/.github/workflows/build-wheel.yml b/.github/workflows/build-wheel.yml
@@ -150,6 +150,18 @@ jobs:
         run: |
           twine check --strict cuda_pathfinder/*.whl
 
+      - name: Resolve cuda.bindings build dependencies
+        run: |
+          container_args=()
+          if [[ "${{ inputs.host-platform }}" == linux* ]]; then
+            container_args+=(--container-mount /host)
+          fi
+          mkdir -p wheel-constraints
+          python ci/tools/write_wheel_constraints.py \
+            --output wheel-constraints/cuda-bindings.txt \
+            "${container_args[@]}" \
+            --wheel cuda-pathfinder cuda_pathfinder
+
       - name: Upload cuda.pathfinder build artifacts
         if: ${{ strategy.job-index == 0 && inputs.host-platform == 'linux-64' }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
@@ -172,6 +184,8 @@ jobs:
           output-dir: ${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }}
         env:
           CIBW_BUILD: ${{ env.CIBW_BUILD }}
+          CIBW_BEFORE_BUILD_LINUX: 'python -m pip install --upgrade "pip>=25.3"'
+          CIBW_BEFORE_BUILD_WINDOWS: 'python -m pip install --upgrade "pip>=25.3" delvewheel'
           # TODO: remove cpython-prerelease once 3.15 is officially supported
           # Allow CPython pre-release builds (currently 3.15 / 3.15t). This is a
           # no-op for stable Python versions because CIBW_BUILD still filters
@@ -181,6 +195,8 @@ jobs:
           CIBW_ENVIRONMENT_LINUX: >
             CUDA_PATH=/host/${{ env.CUDA_PATH }}
             CUDA_PYTHON_PARALLEL_LEVEL=${{ env.CUDA_PYTHON_PARALLEL_LEVEL }}
+            PIP_BUILD_CONSTRAINT=/host/${{ github.workspace }}/wheel-constraints/cuda-bindings.txt
+            PIP_CONSTRAINT=/host/${{ github.workspace }}/wheel-constraints/cuda-bindings.txt
             CC="/host/${{ env.SCCACHE_PATH }} cc"
             CXX="/host/${{ env.SCCACHE_PATH }} c++"
             SCCACHE_GHA_ENABLED=true
@@ -194,6 +210,8 @@ jobs:
           CIBW_ENVIRONMENT_WINDOWS: >
             CUDA_PATH="$(cygpath -w ${{ env.CUDA_PATH }})"
             CUDA_PYTHON_PARALLEL_LEVEL=${{ env.CUDA_PYTHON_PARALLEL_LEVEL }}
+            PIP_BUILD_CONSTRAINT="$(cygpath -w ./wheel-constraints/cuda-bindings.txt)"
+            PIP_CONSTRAINT="$(cygpath -w ./wheel-constraints/cuda-bindings.txt)"
           # check cache stats before leaving cibuildwheel
           CIBW_BEFORE_TEST_LINUX: >
             "/host/${{ env.SCCACHE_PATH }}" --show-adv-stats &&
@@ -226,6 +244,20 @@ jobs:
         run: |
           twine check --strict ${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }}/*.whl
 
+      - name: Resolve cuda.core build dependencies
+        run: |
+          container_args=()
+          if [[ "${{ inputs.host-platform }}" == linux* ]]; then
+            container_args+=(--container-mount /host)
+          fi
+          mkdir -p wheel-constraints
+          python ci/tools/write_wheel_constraints.py \
+            --output wheel-constraints/cuda-core.txt \
+            "${container_args[@]}" \
+            --wheel cuda-pathfinder cuda_pathfinder \
+            --wheel cuda-bindings "${CUDA_BINDINGS_ARTIFACTS_DIR}" \
+            --expected-major cuda-bindings "${BUILD_CUDA_MAJOR}"
+
       - name: Upload cuda.bindings build artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
@@ -240,6 +272,8 @@ jobs:
           output-dir: ${{ env.CUDA_CORE_ARTIFACTS_DIR }}
         env:
           CIBW_BUILD: ${{ env.CIBW_BUILD }}
+          CIBW_BEFORE_BUILD_LINUX: 'python -m pip install --upgrade "pip>=25.3"'
+          CIBW_BEFORE_BUILD_WINDOWS: 'python -m pip install --upgrade "pip>=25.3" delvewheel'
           # TODO: remove cpython-prerelease once 3.15 is officially supported
           # Allow CPython pre-release builds (currently 3.15 / 3.15t). This is a
           # no-op for stable Python versions because CIBW_BUILD still filters
@@ -250,7 +284,8 @@ jobs:
             CUDA_PATH=/host/${{ env.CUDA_PATH }}
             CUDA_PYTHON_PARALLEL_LEVEL=${{ env.CUDA_PYTHON_PARALLEL_LEVEL }}
             CUDA_CORE_BUILD_MAJOR=${{ env.BUILD_CUDA_MAJOR }}
-            PIP_FIND_LINKS=/host/${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }}
+            PIP_BUILD_CONSTRAINT=/host/${{ github.workspace }}/wheel-constraints/cuda-core.txt
+            PIP_CONSTRAINT=/host/${{ github.workspace }}/wheel-constraints/cuda-core.txt
             CC="/host/${{ env.SCCACHE_PATH }} cc"
             CXX="/host/${{ env.SCCACHE_PATH }} c++"
             SCCACHE_GHA_ENABLED=true
@@ -265,7 +300,8 @@ jobs:
             CUDA_PATH="$(cygpath -w ${{ env.CUDA_PATH }})"
             CUDA_PYTHON_PARALLEL_LEVEL=${{ env.CUDA_PYTHON_PARALLEL_LEVEL }}
             CUDA_CORE_BUILD_MAJOR=${{ env.BUILD_CUDA_MAJOR }}
-            PIP_FIND_LINKS="$(cygpath -w ${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }})"
+            PIP_BUILD_CONSTRAINT="$(cygpath -w ./wheel-constraints/cuda-core.txt)"
+            PIP_CONSTRAINT="$(cygpath -w ./wheel-constraints/cuda-core.txt)"
           # check cache stats before leaving cibuildwheel
           CIBW_BEFORE_TEST_LINUX: >
             "/host${{ env.SCCACHE_PATH }}" --show-adv-stats &&
@@ -444,21 +480,38 @@ jobs:
           OLD_BRANCH=$(yq '.backport_branch' ci/versions.yml)
           OLD_BASENAME="cuda-bindings-python${PYTHON_VERSION_FORMATTED}-cuda*-${{ inputs.host-platform }}*"
           LATEST_PRIOR_RUN_ID=$(./ci/tools/lookup-run-id --branch "${OLD_BRANCH}" NVIDIA/cuda-python "CI")
+          PREV_BINDINGS_DIR="cuda_bindings/dist-prev"
 
           gh run download $LATEST_PRIOR_RUN_ID -p ${OLD_BASENAME} -R NVIDIA/cuda-python
           rm -rf ${OLD_BASENAME}-tests  # exclude cython test artifacts
           ls -al $OLD_BASENAME
-          mkdir -p "${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }}"
-          mv $OLD_BASENAME/*.whl "${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }}"
+          mkdir -p "${PREV_BINDINGS_DIR}"
+          mv $OLD_BASENAME/*.whl "${PREV_BINDINGS_DIR}"
           rmdir $OLD_BASENAME
 
+      - name: Resolve previous cuda.core build dependencies
+        run: |
+          container_args=()
+          if [[ "${{ inputs.host-platform }}" == linux* ]]; then
+            container_args+=(--container-mount /host)
+          fi
+          mkdir -p wheel-constraints
+          python ci/tools/write_wheel_constraints.py \
+            --output wheel-constraints/cuda-core-prev.txt \
+            "${container_args[@]}" \
+            --wheel cuda-pathfinder cuda_pathfinder \
+            --wheel cuda-bindings cuda_bindings/dist-prev \
+            --expected-major cuda-bindings "${BUILD_PREV_CUDA_MAJOR}"
+
       - name: Build cuda.core wheel
         uses: pypa/cibuildwheel@4726cd35bb13f7bde50cf2761f2499ac7b3aa32c  # v4.1.1
         with:
           package-dir: ./cuda_core/
           output-dir: ${{ env.CUDA_CORE_ARTIFACTS_DIR }}
         env:
           CIBW_BUILD: ${{ env.CIBW_BUILD }}
+          CIBW_BEFORE_BUILD_LINUX: 'python -m pip install --upgrade "pip>=25.3"'
+          CIBW_BEFORE_BUILD_WINDOWS: 'python -m pip install --upgrade "pip>=25.3" delvewheel'
           # TODO: remove cpython-prerelease once 3.15 is officially supported
           # Allow CPython pre-release builds (currently 3.15 / 3.15t). This is a
           # no-op for stable Python versions because CIBW_BUILD still filters
@@ -469,7 +522,8 @@ jobs:
             CUDA_PATH=/host/${{ env.CUDA_PATH }}
             CUDA_PYTHON_PARALLEL_LEVEL=${{ env.CUDA_PYTHON_PARALLEL_LEVEL }}
             CUDA_CORE_BUILD_MAJOR=${{ env.BUILD_PREV_CUDA_MAJOR }}
-            PIP_FIND_LINKS=/host/${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }}
+            PIP_BUILD_CONSTRAINT=/host/${{ github.workspace }}/wheel-constraints/cuda-core-prev.txt
+            PIP_CONSTRAINT=/host/${{ github.workspace }}/wheel-constraints/cuda-core-prev.txt
             CC="/host/${{ env.SCCACHE_PATH }} cc"
             CXX="/host/${{ env.SCCACHE_PATH }} c++"
             SCCACHE_GHA_ENABLED=true
@@ -484,7 +538,8 @@ jobs:
             CUDA_PATH="$(cygpath -w ${{ env.CUDA_PATH }})"
             CUDA_PYTHON_PARALLEL_LEVEL=${{ env.CUDA_PYTHON_PARALLEL_LEVEL }}
             CUDA_CORE_BUILD_MAJOR=${{ env.BUILD_PREV_CUDA_MAJOR }}
-            PIP_FIND_LINKS="$(cygpath -w ${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }})"
+            PIP_BUILD_CONSTRAINT="$(cygpath -w ./wheel-constraints/cuda-core-prev.txt)"
+            PIP_CONSTRAINT="$(cygpath -w ./wheel-constraints/cuda-core-prev.txt)"
           # check cache stats before leaving cibuildwheel
           CIBW_BEFORE_TEST_LINUX: >
             "/host${{ env.SCCACHE_PATH }}" --show-adv-stats &&
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -521,11 +521,18 @@ jobs:
         with:
           python-version: '3.13'
 
-      - name: Install pre-commit
+      - name: Install pre-commit and CI test tools
         shell: bash
         run: |
           set -euxo pipefail
-          python -m pip install --upgrade pip pre-commit
+          python -m pip install --upgrade pip pre-commit pytest
+
+      - name: Run CI tools unit tests
+        shell: bash
+        run: |
+          set -euxo pipefail
+          # Standalone CI tool tests; skip repo-root conftest.py (imports cuda.pathfinder).
+          python -m pytest -v --noconftest ci/tools/tests
 
       - name: Run pre-commit
         shell: bash
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
@@ -118,18 +118,41 @@ jobs:
         run: |
           python -m venv .venv
 
-      - name: Build cuda-pathfinder
+      - name: Install pip with build-constraint support
+        run: .venv/bin/python -m pip install "pip>=25.3"
+
+      - name: Build and install cuda-pathfinder wheel
         run: |
-          cd cuda_pathfinder
-          ../.venv/bin/pip install -v . --group test
+          .venv/bin/pip wheel -v --no-deps ./cuda_pathfinder -w ./wheels/
+          .venv/bin/pip install -v ./wheels/cuda_pathfinder*.whl --group ./cuda_pathfinder/pyproject.toml:test
 
-      - name: Build cuda-bindings
+      - name: Resolve cuda-bindings build dependencies
         run: |
-          cd cuda_bindings
-          ../.venv/bin/pip install -v . --group test
+          mkdir -p wheel-constraints
+          .venv/bin/python ci/tools/write_wheel_constraints.py \
+            --output wheel-constraints/cuda-bindings.txt \
+            --wheel cuda-pathfinder wheels
+
+      - name: Build and install cuda-bindings wheel
+        run: |
+          export PIP_BUILD_CONSTRAINT="$(pwd)/wheel-constraints/cuda-bindings.txt"
+          export PIP_CONSTRAINT="${PIP_BUILD_CONSTRAINT}"
+          .venv/bin/pip wheel -v --no-deps ./cuda_bindings -w ./wheels/
+          .venv/bin/pip install -v ./wheels/cuda_bindings*.whl --group ./cuda_bindings/pyproject.toml:test
 
-      - name: Build cuda-core
+      - name: Resolve cuda-core build dependencies
         run: |
+          CUDA_MAJOR="${CUDA_VER%%.*}"
+          .venv/bin/python ci/tools/write_wheel_constraints.py \
+            --output wheel-constraints/cuda-core.txt \
+            --wheel cuda-pathfinder wheels \
+            --wheel cuda-bindings wheels \
+            --expected-major cuda-bindings "${CUDA_MAJOR}"
+
+      - name: Build and install cuda-core
+        run: |
+          export PIP_BUILD_CONSTRAINT="$(pwd)/wheel-constraints/cuda-core.txt"
+          export PIP_CONSTRAINT="${PIP_BUILD_CONSTRAINT}"
           cd cuda_core
           ../.venv/bin/pip install -v . --group test
 
@@ -225,20 +248,38 @@ jobs:
         run: |
           python -m venv .venv
 
-      - name: Build and install cuda.pathfinder
+      - name: Build cuda.pathfinder wheel
         run: |
-          .venv/Scripts/pip install wheel setuptools Cython
+          .venv/Scripts/python -m pip install "pip>=25.3" wheel setuptools Cython
           .venv/Scripts/pip wheel -v --no-deps ./cuda_pathfinder -w ./wheels/
 
+      - name: Resolve cuda.bindings build dependencies
+        run: |
+          mkdir -p wheel-constraints
+          .venv/Scripts/python ci/tools/write_wheel_constraints.py \
+            --output wheel-constraints/cuda-bindings.txt \
+            --wheel cuda-pathfinder wheels
+
       - name: Build cuda.bindings wheel
         run: |
+          export PIP_BUILD_CONSTRAINT="$(cygpath -w "$(pwd)/wheel-constraints/cuda-bindings.txt")"
+          export PIP_CONSTRAINT="${PIP_BUILD_CONSTRAINT}"
           cd cuda_bindings
           ../.venv/Scripts/pip wheel -v --no-deps . -w ../wheels/
 
+      - name: Resolve cuda.core build dependencies
+        run: |
+          CUDA_MAJOR="${CUDA_VER%%.*}"
+          .venv/Scripts/python ci/tools/write_wheel_constraints.py \
+            --output wheel-constraints/cuda-core.txt \
+            --wheel cuda-pathfinder wheels \
+            --wheel cuda-bindings wheels \
+            --expected-major cuda-bindings "${CUDA_MAJOR}"
+
       - name: Build cuda.core wheel
         run: |
-          export PIP_FIND_LINKS="$(pwd)/wheels"
-          export PIP_PRE=1
+          export PIP_BUILD_CONSTRAINT="$(cygpath -w "$(pwd)/wheel-constraints/cuda-core.txt")"
+          export PIP_CONSTRAINT="${PIP_BUILD_CONSTRAINT}"
           cd cuda_core
           ../.venv/Scripts/pip wheel -v --no-deps . -w ../wheels/
 
diff --git a/.github/workflows/test-sdist-linux.yml b/.github/workflows/test-sdist-linux.yml
@@ -39,7 +39,7 @@ jobs:
           python-version: "3.12"
 
       - name: Install build tools
-        run: pip install build
+        run: python -m pip install "pip>=25.3" build
 
       # Pure Python packages -- no CTK needed.
       - name: Build cuda.pathfinder sdist and wheel-from-sdist
@@ -52,6 +52,13 @@ jobs:
           python -m build --sdist cuda_python/
           pip wheel --no-deps --wheel-dir cuda_python/dist cuda_python/dist/*.tar.gz
 
+      - name: Resolve cuda.bindings build dependencies
+        run: |
+          mkdir -p wheel-constraints
+          python ci/tools/write_wheel_constraints.py \
+            --output wheel-constraints/cuda-bindings.txt \
+            --wheel cuda-pathfinder cuda_pathfinder/dist
+
       # Cython packages need CTK + sccache.
       # The env vars ACTIONS_CACHE_SERVICE_V2, ACTIONS_RESULTS_URL, and ACTIONS_RUNTIME_TOKEN
       # are exposed by this action.
@@ -88,10 +95,20 @@ jobs:
           export CUDA_PYTHON_PARALLEL_LEVEL=$(nproc)
           export CC="sccache cc"
           export CXX="sccache c++"
-          export PIP_FIND_LINKS="$(pwd)/cuda_pathfinder/dist"
+          export PIP_BUILD_CONSTRAINT="$(pwd)/wheel-constraints/cuda-bindings.txt"
+          export PIP_CONSTRAINT="${PIP_BUILD_CONSTRAINT}"
           python -m build --sdist cuda_bindings/
           pip wheel --no-deps --wheel-dir cuda_bindings/dist cuda_bindings/dist/*.tar.gz
 
+      - name: Resolve cuda.core build dependencies
+        run: |
+          CUDA_MAJOR="$(echo '${{ inputs.cuda-version }}' | cut -d. -f1)"
+          python ci/tools/write_wheel_constraints.py \
+            --output wheel-constraints/cuda-core.txt \
+            --wheel cuda-pathfinder cuda_pathfinder/dist \
+            --wheel cuda-bindings cuda_bindings/dist \
+            --expected-major cuda-bindings "${CUDA_MAJOR}"
+
       # cuda_core sdist delegates to setuptools (no CTK needed), but
       # wheel-from-sdist needs CTK and cuda-bindings (dynamic build dep via
       # get_requires_for_build_wheel in build_hooks.py).
@@ -101,7 +118,8 @@ jobs:
           export CUDA_CORE_BUILD_MAJOR="$(echo '${{ inputs.cuda-version }}' | cut -d. -f1)"
           export CC="sccache cc"
           export CXX="sccache c++"
-          export PIP_FIND_LINKS="$(pwd)/cuda_bindings/dist $(pwd)/cuda_pathfinder/dist"
+          export PIP_BUILD_CONSTRAINT="$(pwd)/wheel-constraints/cuda-core.txt"
+          export PIP_CONSTRAINT="${PIP_BUILD_CONSTRAINT}"
           python -m build --sdist cuda_core/
           pip wheel --no-deps --wheel-dir cuda_core/dist cuda_core/dist/*.tar.gz
 
diff --git a/.github/workflows/test-sdist-windows.yml b/.github/workflows/test-sdist-windows.yml
@@ -48,7 +48,7 @@ jobs:
         uses: step-security/msvc-dev-cmd@22c98154b708dbd743e6f27a933cf6ceba3305c4  # v1.13.1
 
       - name: Install build tools
-        run: pip install build
+        run: python -m pip install "pip>=25.3" build
 
       # Pure Python packages -- no CTK needed.
       - name: Build cuda.pathfinder sdist and wheel-from-sdist
@@ -61,6 +61,13 @@ jobs:
           python -m build --sdist cuda_python/
           pip wheel --no-deps --wheel-dir cuda_python/dist cuda_python/dist/*.tar.gz
 
+      - name: Resolve cuda.bindings build dependencies
+        run: |
+          mkdir -p wheel-constraints
+          python ci/tools/write_wheel_constraints.py \
+            --output wheel-constraints/cuda-bindings.txt \
+            --wheel cuda-pathfinder cuda_pathfinder/dist
+
       # Cython packages need CTK. No sccache on Windows (this is a correctness
       # smoke test, not a production build; see build-wheel.yml which also
       # limits sccache to Linux).
@@ -73,24 +80,33 @@ jobs:
 
       # cuda_bindings/setup.py parses CUDA headers at import time, so CUDA_PATH
       # (set by fetch_ctk) must be available for both sdist and wheel builds.
-      # PIP_FIND_LINKS is passed as a native Windows path via cygpath because
-      # pip on Windows treats space-separated entries as separators and is
-      # picky about mixed path styles (see build-wheel.yml for the same
-      # convention).
+      # Constraint paths are passed as native Windows paths because the pip
+      # subprocesses run outside Git Bash.
       - name: Build cuda.bindings sdist and wheel-from-sdist
         run: |
           export CUDA_PYTHON_PARALLEL_LEVEL=$(nproc)
-          export PIP_FIND_LINKS="$(cygpath -w "$(pwd)/cuda_pathfinder/dist")"
+          export PIP_BUILD_CONSTRAINT="$(cygpath -w "$(pwd)/wheel-constraints/cuda-bindings.txt")"
+          export PIP_CONSTRAINT="${PIP_BUILD_CONSTRAINT}"
           python -m build --sdist cuda_bindings/
           pip wheel --no-deps --wheel-dir cuda_bindings/dist cuda_bindings/dist/*.tar.gz
 
+      - name: Resolve cuda.core build dependencies
+        run: |
+          CUDA_MAJOR="$(echo '${{ inputs.cuda-version }}' | cut -d. -f1)"
+          python ci/tools/write_wheel_constraints.py \
+            --output wheel-constraints/cuda-core.txt \
+            --wheel cuda-pathfinder cuda_pathfinder/dist \
+            --wheel cuda-bindings cuda_bindings/dist \
+            --expected-major cuda-bindings "${CUDA_MAJOR}"
+
       # cuda_core sdist delegates to setuptools (no CTK needed), but
       # wheel-from-sdist needs CTK and cuda-bindings (dynamic build dep via
       # get_requires_for_build_wheel in build_hooks.py).
       - name: Build cuda.core sdist and wheel-from-sdist
         run: |
           export CUDA_PYTHON_PARALLEL_LEVEL=$(nproc)
           export CUDA_CORE_BUILD_MAJOR="$(echo '${{ inputs.cuda-version }}' | cut -d. -f1)"
-          export PIP_FIND_LINKS="$(cygpath -w "$(pwd)/cuda_bindings/dist") $(cygpath -w "$(pwd)/cuda_pathfinder/dist")"
+          export PIP_BUILD_CONSTRAINT="$(cygpath -w "$(pwd)/wheel-constraints/cuda-core.txt")"
+          export PIP_CONSTRAINT="${PIP_BUILD_CONSTRAINT}"
           python -m build --sdist cuda_core/
           pip wheel --no-deps --wheel-dir cuda_core/dist cuda_core/dist/*.tar.gz
diff --git a/ci/tools/tests/test_write_wheel_constraints.py b/ci/tools/tests/test_write_wheel_constraints.py
diff --git a/ci/tools/write_wheel_constraints.py b/ci/tools/write_wheel_constraints.py
