ci: drop redundant release test run + patch bart26g Dependabot vulns

.github/workflows/ci.yml

@@ -23,6 +23,16 @@ concurrency:
   group: ci-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Pin native BLAS/OpenMP thread pools to 1. pytest-xdist (-n auto) already runs
+# one worker per core; without this each worker's numpy/scipy/torch pool spawns
+# more threads and they thrash, which made the suite ~50x slower on CI.
+env:
+  OMP_NUM_THREADS: "1"
+  OPENBLAS_NUM_THREADS: "1"
+  MKL_NUM_THREADS: "1"
+  NUMEXPR_NUM_THREADS: "1"
+  VECLIB_MAXIMUM_THREADS: "1"
+
 jobs:
   # ── Fast required gate: everything except @pytest.mark.slow ────────────────
   test:

.github/workflows/release.yml

@@ -1,12 +1,12 @@
 # =============================================================================
 # .github/workflows/release.yml  —  Semantic Release + PyPI + Docs
 # =============================================================================
-# Triggers on every push to main.
-# 1. Runs tests to gate the pipeline.
-# 2. Semantic-release checks conventional commits — if a releasable change
+# Triggers on every push to main. Tests are NOT run here — they are gated on
+# PRs by ci.yml (the required fast check) and nightly (full suite).
+# 1. Semantic-release checks conventional commits — if a releasable change
 #    is found (feat:, fix:, etc.) it bumps version, publishes to PyPI,
 #    and creates a GitHub release.
-# 3. Builds and deploys quartodoc documentation to GitHub Pages.
+# 2. Builds and deploys quartodoc documentation to GitHub Pages.
 # =============================================================================
 
 name: Release
@@ -53,13 +53,11 @@ jobs:
       - name: Install dependencies
         run: uv sync --extra dev --extra docs
 
-      # ── Tests ─────────────────────────────────────────────────────────
-      # Fast gate only: the full suite (incl. slow) already ran on the PR's
-      # required check and nightly. This is a quick pre-publish sanity check.
-      - name: Run tests (fast — excludes slow)
-        run: uv run pytest tests/ -m "not slow" -n auto --tb=short
-
       # ── Semantic Release ──────────────────────────────────────────────
+      # NOTE: tests are intentionally NOT run here. The fast suite is the
+      # required check on every PR to main (ci.yml) and the full suite runs
+      # nightly, so re-running them on the merge commit only duplicated cost
+      # without adding signal. This pipeline publishes; it does not re-test.
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22

pyproject.toml

@@ -84,6 +84,9 @@ python_classes = ["Test*"]
 python_functions = ["test_*"]
 # Keep slow-test timings visible on every run; the registry lives in tests/conftest.py.
 addopts = ["--durations=15"]
+# Safety net: no single test may hang the suite (e.g. a stuck network call).
+# Provided by pytest-timeout (dev dependency).
+timeout = 300
 markers = [
     "slow: heavy end-to-end test; deselect with -m \"not slow\". Runs in nightly/full CI.",
 ]

src/spotoptim/function/remote.py

@@ -7,10 +7,17 @@
 
 # Default configuration for the server endpoint
 DEFAULT_SERVER_URL = "http://139.6.66.164:8000/compute/"
+# Default (connect, read) timeout in seconds. A bounded connect timeout keeps
+# the call from hanging indefinitely when the server is unreachable — e.g. in
+# CI, where egress to the server may be silently dropped rather than refused.
+DEFAULT_TIMEOUT: tuple[float, float] = (10.0, 120.0)
 
 
 def objective_remote(
-    X: np.ndarray, url: str = DEFAULT_SERVER_URL, **kwargs
+    X: np.ndarray,
+    url: str = DEFAULT_SERVER_URL,
+    timeout: float | tuple[float, float] = DEFAULT_TIMEOUT,
+    **kwargs,
 ) -> np.ndarray:
     """
     Evaluates an objective function remotely via an HTTP POST request.
@@ -19,6 +26,10 @@ def objective_remote(
         X (np.ndarray): Input data of shape (n_samples, n_features).
         url (str, optional): The URL of the remote computation server.
             Defaults to "http://139.6.66.164:8000/compute/".
+        timeout (float | tuple[float, float], optional): Request timeout in
+            seconds as a single value or a ``(connect, read)`` tuple. Defaults
+            to ``(10, 120)``; the bounded connect time prevents the call from
+            hanging when the server is unreachable.
         **kwargs (Any): Additional arguments to include in the request payload (optional).
 
     Returns:
@@ -43,7 +54,7 @@ def objective_remote(
         payload.update(kwargs)
 
     # Perform the request
-    response = requests.post(url, json=payload)
+    response = requests.post(url, json=payload, timeout=timeout)
     response.raise_for_status()
 
     # Parse the response

tests/conftest.py

@@ -23,7 +23,23 @@
 New slow tests may instead be decorated directly with ``@pytest.mark.slow``.
 """
 
-import pytest
+import os
+
+# Pin native thread pools to 1 thread per worker BEFORE numpy/scipy/torch are
+# imported. pytest-xdist runs one worker per core; without this, each worker's
+# BLAS/OpenMP pool spawns more threads and they thrash — on CI this made small
+# linear-algebra tests run ~50-80x slower. setdefault keeps any value the
+# environment already set (e.g. the CI workflow exports the same vars).
+for _thread_var in (
+    "OMP_NUM_THREADS",
+    "OPENBLAS_NUM_THREADS",
+    "MKL_NUM_THREADS",
+    "NUMEXPR_NUM_THREADS",
+    "VECLIB_MAXIMUM_THREADS",
+):
+    os.environ.setdefault(_thread_var, "1")
+
+import pytest  # noqa: E402  — must come after the thread-var setup above
 
 # Heaviest tests (>~8 s each), grouped by file. Class/file entries also cover
 # their faster sibling integration tests, which belong in the full suite too.
@@ -40,6 +56,9 @@
     "tests/test_transformations.py::TestTransformationOptimization",
     "tests/test_reproducibility_comprehensive.py::TestSpotOptimReproducibility",
     "tests/test_optimize_refactored_methods.py::TestOptimizeIntegration",
+    # --- networked integration test: skip from the fast gate (the request
+    #     timeout in remote.py bounds it; the nightly full run still exercises it) ---
+    "tests/test_objective_remote.py::test_objective_remote",
     # --- individual heavy tests ---
     "tests/test_early_stopping.py::test_max_restarts_does_not_trigger_with_improvement",
     "tests/test_parallel_optimization.py::TestParallelOptimization::test_parallel_execution_basic",