mdboom · Oct 26, 2026 · Oct 23, 2026 · Oct 26, 2026
diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
@@ -15,3 +15,14 @@ paths:
   ".github/workflows/ci-workflow-health.yml":
     ignore:
       - 'unexpected key "queue" for "concurrency" section'
+  # GitHub supports self-repository ($/) action references, but the latest
+  # actionlint release does not yet recognize them (rhysd/actionlint#711).
+  ".github/workflows/release-cuda-pathfinder.yml":
+    ignore:
+      - 'specifying action "\$/[^"]+" in invalid format because ref is missing'
+  ".github/workflows/test-wheel-linux.yml":
+    ignore:
+      - 'specifying action "\$/[^"]+" in invalid format because ref is missing'
+  ".github/workflows/test-wheel-windows.yml":
+    ignore:
+      - 'specifying action "\$/[^"]+" in invalid format because ref is missing'
diff --git a/.github/actions/harden-pip/action.yml b/.github/actions/harden-pip/action.yml
@@ -0,0 +1,28 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+name: Harden pip
+description: >-
+  Install the security-fixed pip (26.2.2) from a hash-pinned wheel so that later
+  pip invocations do not fall back on the vendored certifi bundle that trusts the
+  compromised eMudhra/emSign intermediate CAs. The sha256 fragment guarantees the
+  bootstrap download's integrity even if the bootstrapping pip's trust store is
+  compromised. See https://github.com/NVIDIA/cuda-python/issues/3195 and
+  https://discuss.python.org/t/109576.
+
+inputs:
+  python:
+    description: Python interpreter whose pip should be hardened (e.g. a venv's python).
+    default: python
+
+runs:
+  using: composite
+  steps:
+    - name: Install hash-pinned pip 26.2.2
+      shell: bash --noprofile --norc -xeuo pipefail {0}
+      env:
+        HARDEN_PIP_PYTHON: ${{ inputs.python }}
+      run: |
+        "${HARDEN_PIP_PYTHON}" -m pip install \
+          "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
diff --git a/.github/workflows/build-wheel.yml b/.github/workflows/build-wheel.yml
@@ -111,6 +111,9 @@ jobs:
           python-version: "3.12"
           architecture: ${{ ((inputs.host-platform == 'linux-aarch64' || inputs.host-platform == 'win-arm64') && 'arm64') || 'x64' }}
 
+      - name: Harden pip
+        uses: ./.github/actions/harden-pip
+
       - name: Set up MSVC
         if: ${{ startsWith(inputs.host-platform, 'win') && (env.BUILD_BINDINGS == 'true' || env.BUILD_CORE == 'true' || env.TEST_BINDINGS == 'true' || env.TEST_CORE == 'true') }}
         uses: step-security/msvc-dev-cmd@22c98154b708dbd743e6f27a933cf6ceba3305c4  # v1.13.1
@@ -223,7 +226,7 @@ jobs:
 
       - name: Build cuda.bindings wheel
         if: ${{ env.BUILD_BINDINGS == 'true' }}
-        uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
+        uses: pypa/cibuildwheel@b9e566a2b284570af229f6c2a33673410d0389a3  # v4.3.4
         with:
           package-dir: ./cuda_bindings/
           output-dir: ${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }}
@@ -325,7 +328,7 @@ jobs:
 
       - name: Build cuda.core wheel
         if: ${{ env.BUILD_CORE == 'true' }}
-        uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
+        uses: pypa/cibuildwheel@b9e566a2b284570af229f6c2a33673410d0389a3  # v4.3.4
         with:
           package-dir: ./cuda_core/
           output-dir: ${{ env.CUDA_CORE_ARTIFACTS_DIR }}
@@ -450,6 +453,10 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
 
+      - name: Harden pip
+        if: ${{ env.TEST_BINDINGS == 'true' || env.TEST_CORE == 'true' }}
+        uses: ./.github/actions/harden-pip
+
       - name: Enable Scientific Python Nightly Wheels for Python 3.15
         if: ${{ (env.TEST_BINDINGS == 'true' || env.TEST_CORE == 'true') && startsWith(matrix.python-version, '3.15') }}
         run: |
@@ -612,7 +619,7 @@ jobs:
 
       - name: Build cuda.core wheel
         if: ${{ !inputs.single-cuda-major && env.BUILD_CORE == 'true' }}
-        uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
+        uses: pypa/cibuildwheel@b9e566a2b284570af229f6c2a33673410d0389a3  # v4.3.4
         with:
           package-dir: ./cuda_core/
           output-dir: ${{ env.CUDA_CORE_ARTIFACTS_DIR }}

diff --git a/.github/workflows/ci-nightly.yml b/.github/workflows/ci-nightly.yml
@@ -42,6 +42,9 @@ jobs:
         with:
           fetch-depth: 1
 
+      - name: Harden pip
+        uses: ./.github/actions/harden-pip
+
       - name: Run CI tools unit tests
         run: |
           python -m pip install pytest

diff --git a/.github/workflows/ci-pixi-source-test.yml b/.github/workflows/ci-pixi-source-test.yml
@@ -61,7 +61,7 @@ env:
   # older pixi re-ran the editable source build on every `pixi run`, recompiling
   # all Cython extensions (#2138). The fix (content-addressed source-build cache,
   # prefix-dev/pixi#6285 + #6123) also bumps the pixi.lock format to v7.
-  PIXI_VERSION: "v0.73.0"
+  PIXI_VERSION: "v0.82.1"
 
 jobs:
   # ── PR guard: CPU-only build + import + placement smoke ──

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -644,11 +644,14 @@ jobs:
         with:
           python-version: '3.13'
 
+      - name: Harden pip
+        uses: ./.github/actions/harden-pip
+
       - name: Install pre-commit
         shell: bash
         run: |
           set -euxo pipefail
-          python -m pip install --upgrade pip pre-commit
+          python -m pip install pre-commit
 
       - name: Run pre-commit
         shell: bash

diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
@@ -119,8 +119,10 @@ jobs:
         run: |
           python -m venv .venv
 
-      - name: Install pip with build-constraint support
-        run: .venv/bin/python -m pip install "pip>=25.3"
+      - name: Harden pip
+        uses: ./.github/actions/harden-pip
+        with:
+          python: .venv/bin/python
 
       - name: Build and install cuda-pathfinder wheel
         run: |
@@ -259,9 +261,14 @@ jobs:
         run: |
           python -m venv .venv
 
+      - name: Harden pip
+        uses: ./.github/actions/harden-pip
+        with:
+          python: .venv/Scripts/python
+
       - name: Build cuda.pathfinder wheel
         run: |
-          .venv/Scripts/python -m pip install "pip>=25.3" wheel setuptools Cython
+          .venv/Scripts/python -m pip install wheel setuptools Cython
           .venv/Scripts/pip wheel -v --no-deps ./cuda_pathfinder -w ./wheels/
 
       - name: Constrain builds to the local cuda.pathfinder wheel
@@ -398,6 +405,11 @@ jobs:
         run: |
           python -m venv .venv
 
+      - name: Harden pip
+        uses: ./.github/actions/harden-pip
+        with:
+          python: .venv/Scripts/python
+
       - name: Install wheels from build job
         run: |
           .venv/Scripts/pip install ./wheels/cuda_pathfinder*.whl
@@ -481,6 +493,9 @@ jobs:
         with:
           python-version: ${{ env.PY_VER }}
 
+      - name: Harden pip
+        uses: ./.github/actions/harden-pip
+
       - name: Install coverage
         run: |
           # .coveragerc enables Cython.Coverage plugin; ensure it's available here too.

diff --git a/.github/workflows/release-cuda-pathfinder.yml b/.github/workflows/release-cuda-pathfinder.yml
@@ -234,7 +234,7 @@ jobs:
           ls -la dist
 
       - name: Publish to TestPyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # v1.14.3
         with:
           repository-url: https://test.pypi.org/legacy/
 
@@ -247,9 +247,17 @@ jobs:
     env:
       VERSION: ${{ needs.prepare.outputs.version }}
     steps:
+      - name: Create verification environment
+        run: python3 -m venv /tmp/verify
+
+      - name: Harden pip
+        # These jobs have no checkout; $/ loads the action from the workflow's commit.
+        uses: $/.github/actions/harden-pip
+        with:
+          python: /tmp/verify/bin/python
+
       - name: Install from TestPyPI and verify
         run: |
-          python3 -m venv /tmp/verify
           source /tmp/verify/bin/activate
           max_attempts=6
           retry_seconds=30
@@ -311,7 +319,7 @@ jobs:
           ls -la dist
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # v1.14.3
 
   # --------------------------------------------------------------------------
   # Verify the PyPI package installs and imports correctly.
@@ -322,9 +330,17 @@ jobs:
     env:
       VERSION: ${{ needs.prepare.outputs.version }}
     steps:
+      - name: Create verification environment
+        run: python3 -m venv /tmp/verify
+
+      - name: Harden pip
+        # These jobs have no checkout; $/ loads the action from the workflow's commit.
+        uses: $/.github/actions/harden-pip
+        with:
+          python: /tmp/verify/bin/python
+
       - name: Install from PyPI and verify
         run: |
-          python3 -m venv /tmp/verify
           source /tmp/verify/bin/activate
           max_attempts=6
           retry_seconds=30

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -244,7 +244,7 @@ jobs:
           ./ci/tools/validate-release-wheels "${{ inputs.git-tag }}" "${{ inputs.component }}" "dist"
 
       - name: Publish package distributions to TestPyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # v1.14.3
         with:
           repository-url: https://test.pypi.org/legacy/
 
@@ -275,6 +275,6 @@ jobs:
           ./ci/tools/validate-release-wheels "${{ inputs.git-tag }}" "${{ inputs.component }}" "dist"
 
       - name: Publish package distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # v1.14.3
 
   # TODO: add another job to make the release leave the draft state?
diff --git a/.github/workflows/test-sdist-linux.yml b/.github/workflows/test-sdist-linux.yml
@@ -50,8 +50,11 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Harden pip
+        uses: ./.github/actions/harden-pip
+
       - name: Install build tools
-        run: python -m pip install "pip>=25.3" build
+        run: python -m pip install build
 
       # Pure Python packages -- no CTK needed.
       - name: Build cuda.pathfinder sdist and wheel-from-sdist

diff --git a/.github/workflows/test-sdist-windows.yml b/.github/workflows/test-sdist-windows.yml
@@ -56,12 +56,15 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Harden pip
+        uses: ./.github/actions/harden-pip
+
       - name: Set up MSVC
         if: ${{ env.BUILD_BINDINGS == 'true' || env.BUILD_CORE == 'true' }}
         uses: step-security/msvc-dev-cmd@22c98154b708dbd743e6f27a933cf6ceba3305c4  # v1.13.1
 
       - name: Install build tools
-        run: python -m pip install "pip>=25.3" build
+        run: python -m pip install build
 
       # Pure Python packages -- no CTK needed.
       - name: Build cuda.pathfinder sdist and wheel-from-sdist

diff --git a/.github/workflows/test-wheel-linux.yml b/.github/workflows/test-wheel-linux.yml
@@ -328,6 +328,11 @@ jobs:
           # we use self-hosted runners on which setup-python behaves weirdly (Python include can't be found)...
           AGENT_TOOLSDIRECTORY: "/opt/hostedtoolcache"
 
+      - name: Harden pip
+        # $/ resolves at the workflow's commit. ./ would resolve against the
+        # inputs.sha checkout, which can predate this action.
+        uses: $/.github/actions/harden-pip
+
       - name: Enable Scientific Python Nightly Wheels for Python 3.15
         if: ${{ (env.TEST_BINDINGS == 'true' || env.TEST_CORE == 'true' || env.TEST_PYTHON == 'true') &&
                 startsWith(matrix.PY_VER, '3.15') }}

diff --git a/.github/workflows/test-wheel-windows.yml b/.github/workflows/test-wheel-windows.yml
@@ -303,6 +303,11 @@ jobs:
         with:
           python-version: ${{ matrix.PY_VER }}
 
+      - name: Harden pip
+        # $/ resolves at the workflow's commit. ./ would resolve against the
+        # inputs.sha checkout, which can predate this action.
+        uses: $/.github/actions/harden-pip
+
       - name: Enable Scientific Python Nightly Wheels for Python 3.15
         if: ${{ (env.TEST_BINDINGS == 'true' || env.TEST_CORE == 'true' || env.TEST_PYTHON == 'true') &&
                 startsWith(matrix.PY_VER, '3.15') }}