Fix build workflow (#17)

.github/workflows/codeql.yml

@@ -46,6 +46,8 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/release.yaml

@@ -15,11 +15,16 @@ on:
 
 jobs:
   sdist:
+    permissions:
+      contents: read
+
     runs-on: ubuntu-latest
+
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
+          persist-credentials: false
           submodules: 'recursive'
 
       - name: Build source distribution (sdist)
@@ -33,65 +38,64 @@ jobs:
 
   wheel:
     runs-on: ubuntu-latest
-    container: condaforge/linux-anvil-cos7-x86_64
     strategy:
       fail-fast: false
       matrix:
         python: ['3.8', '3.9', '3.10', '3.11', '3.12']
 
+    permissions:
+      contents: read
+
     defaults:
       run:
         shell: ${{ matrix.shell || 'bash -l {0}' }}
 
-    env:
-      # https://github.com/actions/checkout/issues/1809
-      ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
-
     steps:
-      # Check latest git version at https://github.com/search?q=org%3Aiusrepo+topic%3Arpm+git&s=updated&type=repositories
       - name: Install Latest Git
         run: |
-          sudo yum install -y https://repo.ius.io/ius-release-el7.rpm
-          sudo yum remove git -y
-          sudo yum install -y git236
+          sudo add-apt-repository ppa:git-core/ppa -y
+          sudo apt-get update
+          sudo apt-get install git -y
 
       - name: Check Git version
         run: git --version
 
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
+          persist-credentials: false
           submodules: 'recursive'
 
-      - name: Create environment
-        run: >-
-          mamba create -n wheel-${{ matrix.python }}
-          --yes
-          python=${{ matrix.python }}
-          auditwheel
-          c-compiler
-          cxx-compiler
-          fortran-compiler
-          cffi
-          cmake
-          make
-          meson
-          ninja
-          numpy
-          pip
-          python-build
-          pkgconfig
-          patchelf
-          unzip
-          wheel
+      - name: Setup Python
+        uses: mamba-org/setup-micromamba@v2
+        with:
+          init-shell: bash
+          environment-name: py${{ matrix.python }}
+          create-args: >-
+            python=${{ matrix.python }}
+            auditwheel
+            c-compiler
+            cxx-compiler
+            fortran-compiler
+            cffi
+            cmake
+            make
+            meson
+            ninja
+            numpy
+            pip
+            python-build
+            pkgconfig
+            patchelf
+            unzip
+            wheel
 
       - name: Build wheel (bdist)
         run: |
-          conda activate wheel-${{ matrix.python }}
           set -ex
           python -m build --wheel
           auditwheel show dist/*.whl
-          auditwheel repair -w wheels --plat ${{ env.plat }} dist/*.whl
+          auditwheel repair -w wheels --plat $plat dist/*.whl
         env:
           plat: manylinux2014_x86_64
 
@@ -102,9 +106,17 @@ jobs:
           path: wheels/*.whl
 
 
-  upload_pypi:
-    needs: [wheel, sdist]
+  upload_test_pypi:
+    needs: [sdist, wheel]
+
     runs-on: ubuntu-latest
+
+    environment: release
+
+    permissions:
+      contents: read
+      id-token: write
+
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
     steps:
       - name: Download build artifacts
@@ -115,12 +127,25 @@ jobs:
       - name: Publish to Test PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          user: __token__
-          password: ${{ secrets.TEST_PYPI_TOKEN }}
           repository-url: https://test.pypi.org/legacy/
 
+  upload_pypi:
+    needs: [sdist, wheel, upload_test_pypi]
+
+    runs-on: ubuntu-latest
+
+    environment: release
+
+    permissions:
+      contents: read
+      id-token: write
+
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    steps:
+      - name: Download build artifacts
+        uses: actions/[email protected]
+        with:
+          path: dist
+
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_TOKEN }}

.github/workflows/ubuntu.yaml

@@ -60,7 +60,9 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Checkout submodules
         run: git submodule update --init --recursive
@@ -77,20 +79,26 @@ jobs:
 
       - name: Install dependencies
         run: |
+          sudo apt update
+          sudo apt install -y libblas-dev
           python3 -m pip install --upgrade pip
           python3 -m pip install tox
 
       - name: Determine TOXENV
         run: echo "TOXENV=py$(echo ${{ matrix.python-version }} | tr -d '.')-torch$(echo ${{ matrix.torch-version }} | tr -d '.')" >> $GITHUB_ENV
 
       - name: Print TOXENV
-        run: echo "TOXENV is set to '${{ env.TOXENV }}'."
+        run: echo "TOXENV is set to '${TOXENV}'."
+        env:
+          TOXENV: ${{ env.TOXENV }}
 
       - name: Unittests with tox
-        run: tox -e ${{ env.TOXENV }}
+        run: tox -e $TOXENV
+        env:
+          TOXENV: ${{ env.TOXENV }}
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@7f8b4b4bde536c465e797be725718b88c5d95e0e # 5.1.1
         if: >
           matrix.python-version == '3.11' &&
           matrix.torch-version == '2.2.2' &&

.pre-commit-config.yaml

@@ -37,7 +37,7 @@ repos:
             --min-py-version,
             "3.8",
             --max-py-version,
-            "3.11",
+            "3.12",
           ]
 
   - repo: https://github.com/asottile/pyupgrade
@@ -58,3 +58,8 @@ repos:
     hooks:
       - id: black
         stages: [pre-commit]
+
+  - repo: https://github.com/woodruffw/zizmor-pre-commit
+    rev: v1.1.1
+    hooks:
+      - id: zizmor

setup.cfg

@@ -43,7 +43,7 @@ packages = find:
 install_requires =
     numpy<2
     tad-mctc
-    torch>=1.11,<2.4
+    torch>=1.11,<3
 python_requires = >=3.8, <3.13
 package_dir =
     =src