fix(security): refresh Pixi certificate trust stores

.github/workflows/mypy.yml

@@ -9,7 +9,7 @@ on:
       - "pytensor_ml/**"
       - "scripts/run_mypy.py"
       - "pyproject.toml"
-      - "conda_envs/**"
+      - "pixi.lock"
 
 # Cancels all previous workflow runs for pull requests that have not completed.
 concurrency:
@@ -20,38 +20,15 @@ jobs:
   mypy:
     runs-on: ubuntu-latest
 
-    defaults:
-      run:
-        shell: bash -l {0}
-
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      env:
-        CACHE_NUMBER: 0
-      with:
-        path: ~/conda_pkgs_dir
-        key: ${{ runner.os }}-py312-conda-${{ env.CACHE_NUMBER }}-${{
-          hashFiles('conda_envs/pytensor_ml.yml') }}
-    - uses: conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 # v4.0.1
+    - uses: prefix-dev/setup-pixi@9dabb60412d3d2d967a8d682f7ce01317af40514 # v0.11.0
       with:
-        miniforge-variant: Miniforge3
-        miniforge-version: latest
-        mamba-version: "*"
-        activate-environment: pytensor_ml
-        channel-priority: strict
-        environment-file: conda_envs/pytensor_ml.yml
-        python-version: 3.12
-        use-mamba: true
-        use-only-tar-bz2: false
-
-    - name: Install current branch
-      run: |
-        conda activate pytensor_ml
-        pip install -e .
-        python --version
+        pixi-version: v0.81.0
+        environments: mypy
+        activate-environment: true
+        locked: true
+        cache: true
 
     - name: Run mypy
-      run: |
-        conda activate pytensor_ml
-        python ./scripts/run_mypy.py
+      run: python ./scripts/run_mypy.py

.github/workflows/pre-commit.yml

@@ -13,4 +13,9 @@ jobs:
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+    # The pixi hooks call pixi directly and need no environment installed.
+    - uses: prefix-dev/setup-pixi@9dabb60412d3d2d967a8d682f7ce01317af40514 # v0.11.0
+      with:
+        pixi-version: v0.81.0
+        run-install: false
     - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1

.github/workflows/run_tests.yml

@@ -14,17 +14,14 @@ concurrency:
 
 jobs:
   unittest:
-    name: unittest (${{ matrix.os }}, ${{ matrix.python-version }}, ${{ matrix.test-subset.name }})
+    name: unittest (${{ matrix.os }}, ${{ matrix.test-subset.name }})
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest]
-        python-version: ["3.12"]
-        # Off by default, flipped to 1 by the per-backend jobs under `include`. A core job installs no
-        # backend at all, which is what proves the library runs without one.
-        install-jax: [0]
-        install-mlx: [0]
-        install-torch: [0]
+        # The per-backend jobs under `include` swap in an environment carrying their one backend. A core
+        # job's environment has no backend at all, which is what proves the library runs without one.
+        pixi-environment: [test]
         # Groups are balanced on measured cold-compile-cache time, which is what a fresh runner pays.
         # tests/test_workflow_groups.py fails if a test file is missing from every group or listed twice.
         test-subset:
@@ -72,25 +69,22 @@ jobs:
         # `test-subset` because a matrix entry cannot change `os`, and mlx needs macOS.
         include:
           - os: ubuntu-latest
-            python-version: "3.12"
-            install-jax: 1
+            pixi-environment: test-jax
             test-subset:
               name: dispatch-jax
               paths: tests/dispatch/jax/
           - os: macos-15
-            python-version: "3.12"
-            install-mlx: 1
+            pixi-environment: test-mlx
             test-subset:
               name: dispatch-mlx
               paths: tests/dispatch/mlx/
           - os: ubuntu-latest
-            python-version: "3.12"
-            install-torch: 1
+            pixi-environment: test-torch
             test-subset:
               name: dispatch-torch
               paths: tests/dispatch/pytorch/
           - os: windows-latest
-            python-version: "3.12"
+            pixi-environment: test
             test-subset:
               name: smoke
               paths: |
@@ -103,73 +97,28 @@ jobs:
     env:
       TEST_SUBSET: ${{ matrix.test-subset.paths }}
 
-    defaults:
-      run:
-        shell: bash -l {0}
-
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      env:
-        CACHE_NUMBER: 0
-      with:
-        path: ~/conda_pkgs_dir
-        key: ${{ runner.os }}-py${{matrix.python-version}}-conda-${{ env.CACHE_NUMBER }}-${{
-          hashFiles('conda_envs/pytensor_ml.yml') }}
-    - name: Cache multiple paths
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      env:
-        # Increase this value to reset cache if pyproject.toml has not changed
-        CACHE_NUMBER: 0
+    - uses: prefix-dev/setup-pixi@9dabb60412d3d2d967a8d682f7ce01317af40514 # v0.11.0
       with:
-        path: |
-          ~/.cache/pip
-          $RUNNER_TOOL_CACHE/Python/*
-          ~\AppData\Local\pip\Cache
-        key: ${{ runner.os }}-build-${{ matrix.python-version }}-${{ env.CACHE_NUMBER }}-${{
-          hashFiles('pyproject.toml') }}
+        pixi-version: v0.81.0
+        environments: ${{ matrix.pixi-environment }}
+        activate-environment: true
+        locked: true
+        cache: true
     - name: Cache the pytensor compile directory
       uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       env:
         CACHE_NUMBER: 0
       with:
         path: ~/.pytensor
-        key: ${{ runner.os }}-py${{ matrix.python-version }}-pytensor-${{ env.CACHE_NUMBER }}-${{
-          matrix.test-subset.name }}-${{ hashFiles('conda_envs/pytensor_ml.yml') }}
+        key: ${{ runner.os }}-pytensor-${{ env.CACHE_NUMBER }}-${{
+          matrix.test-subset.name }}-${{ hashFiles('pixi.lock') }}
         restore-keys: |
-          ${{ runner.os }}-py${{ matrix.python-version }}-pytensor-${{ env.CACHE_NUMBER }}-${{ matrix.test-subset.name }}-
-    - uses: conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 # v4.0.1
-      with:
-        miniforge-variant: Miniforge3
-        miniforge-version: latest
-        mamba-version: "*"
-        activate-environment: pytensor_ml
-        channel-priority: strict
-        environment-file: conda_envs/pytensor_ml.yml
-        python-version: 3.12
-        use-mamba: true
-
-        # IMPORTANT: This may break caching of conda packages! See https://github.com/conda-incubator/setup-miniconda/issues/267
-        use-only-tar-bz2: false
-
-    - name: Install the backend this job tests
-      run: |
-        conda activate pytensor_ml
-        if [[ $INSTALL_JAX == "1" ]]; then pip install "jax>=0.8,<0.9.1" jaxlib; fi
-        if [[ $INSTALL_MLX == "1" ]]; then pip install "mlx>=0.32.2,<0.33"; fi
-        if [[ $INSTALL_TORCH == "1" ]]; then pip install torch --index-url https://download.pytorch.org/whl/cpu; fi
-      env:
-        INSTALL_JAX: ${{ matrix.install-jax }}
-        INSTALL_MLX: ${{ matrix.install-mlx }}
-        INSTALL_TORCH: ${{ matrix.install-torch }}
-
-    - name: Install current branch
-      run: |
-        conda activate pytensor_ml
-        pip install -e .
-        python --version
+          ${{ runner.os }}-pytensor-${{ env.CACHE_NUMBER }}-${{ matrix.test-subset.name }}-
 
     - name: Run tests
+      shell: bash
       run: |
         python -m pytest -vv --durations=25 --cov=pytensor_ml --cov-report=xml --no-cov-on-fail --cov-report term $TEST_SUBSET
     - name: Upload coverage to Codecov

.pre-commit-config.yaml

@@ -32,6 +32,31 @@ repos:
 
 - repo: local
   hooks:
+    - id: pixi-lock-check
+      name: pixi.lock is in sync with pyproject.toml
+      entry: pixi lock --check
+      language: system
+      files: ^(pyproject\.toml|pixi\.lock)$
+      pass_filenames: false
+
+    - id: pixi-export-dev
+      name: conda_envs/pytensor_ml.yml is exported from the pixi dev environment
+      # Called directly rather than through a pixi task so the hook reads the manifest only; `pixi run`
+      # would re-solve the lock file and install the environment first. --no-pypi drops the editable
+      # install, because conda runs pip from the env file's directory, where `-e .` names conda_envs/.
+      # -p pins the export to one platform, so it does not depend on the machine running the hook.
+      entry: pixi workspace export conda-environment -e dev -n pytensor_ml -p linux-64 --no-pypi conda_envs/pytensor_ml.yml
+      language: system
+      files: ^(pyproject\.toml|pixi\.lock|conda_envs/pytensor_ml\.yml)$
+      pass_filenames: false
+
+    - id: pixi-export-docs
+      name: conda_envs/environment-docs.yml is exported from the pixi docs environment
+      entry: pixi workspace export conda-environment -e docs -n pytensor_ml-docs -p linux-64 --no-pypi conda_envs/environment-docs.yml
+      language: system
+      files: ^(pyproject\.toml|pixi\.lock|conda_envs/environment-docs\.yml)$
+      pass_filenames: false
+
     - id: notebook_name
       entry: '\(notebook_name\)='
       language: pygrep

conda_envs/environment-docs.yml

@@ -1,35 +1,24 @@
-# The environment Read the Docs builds from. `pixi run docs-build` uses the equivalent list under
-# [tool.pixi.feature.docs] in pyproject.toml; the two have to move together.
 name: pytensor_ml-docs
 channels:
-  - conda-forge
-  - nodefaults
-
+- conda-forge
+- nodefaults
 dependencies:
-  - python>=3.12
-  # Runtime deps: autodoc imports pytensor_ml, so the full runtime stack has to be in scope.
-  - pytensor>=3.3.3,<3.4.0
-  - numpy
-  - safetensors
-  # The gallery extension renders notebook thumbnails with matplotlib.
-  - matplotlib
-
-  # Docs build deps.
-  - ipython
-  - jupyter
-  - sphinx>=7
-  - pydata-sphinx-theme
-  - myst-nb
-  - numpydoc
-  - sphinx-copybutton
-  - sphinx-design
-  - sphinx-codeautolink
-  - sphinx-sitemap
-  - sphinx-notfound-page
-  - sphinx-autobuild
-  - jupyter-sphinx
-  - sphinxcontrib-bibtex
-  - pip
-  - pip:
-      # pytensor_ml itself so autodoc resolves the current source tree.
-      - -e ..
+- safetensors *
+- matplotlib *
+- ipython *
+- jupyter *
+- sphinx >=7
+- pydata-sphinx-theme *
+- myst-nb *
+- numpydoc *
+- sphinx-copybutton *
+- sphinx-design *
+- sphinx-codeautolink *
+- sphinx-sitemap *
+- sphinx-notfound-page *
+- sphinx-autobuild *
+- jupyter-sphinx *
+- sphinxcontrib-bibtex *
+- pytensor >=3.3.3,<3.4.0
+- numpy *
+- python >=3.12

conda_envs/pytensor_ml-gpu_jax.yml

@@ -1,42 +1,22 @@
-name: pytensor_ml
+name: pytensor_ml-gpu_jax
 channels:
-  - conda-forge
-  - nvidia
-  - nodefaults
-
+- conda-forge
+- nodefaults
 dependencies:
-  - python>=3.12
-  - pytensor>=3.3.3,<4.0.0
-  - numpy
-  - scikit-learn
-
-  # GPU Stuff
-  - jax
-  - numpyro
-  - blackjax
-  - jaxlib=*=*cuda*
-  - cuda-nvcc
-
-  # For testing
-  - coveralls
-  - diff-cover
-  - pytest
-  - pytest-cov
-  - pytest-xdist
-  - pytest-benchmark
-  - pytest-mock
-
-  # For building docs
-  - sphinx
-  - sphinx_rtd_theme
-  - pygments
-  - pydot
-  - ipython
-
-  # code style
-  - ruff
-
-  # developer tools
-  - pre-commit
-  - packaging
-  - typing_extensions
+- safetensors *
+- scikit-learn *
+- cloudpickle *
+- pytest *
+- pytest-cov *
+- pytest-xdist *
+- pytest-benchmark *
+- pytest-mock *
+- pyyaml *
+- mypy >=2.4.0,<2.5.0
+- pre-commit *
+- jax >=0.12,<0.13
+- jaxlib >=0.12,<0.13 cuda*
+- cuda-nvcc *
+- pytensor >=3.3.3,<3.4.0
+- numpy *
+- python >=3.12

conda_envs/pytensor_ml-gpu_metal.yml

@@ -0,0 +1,20 @@
+name: pytensor_ml-gpu_metal
+channels:
+- conda-forge
+- nodefaults
+dependencies:
+- safetensors *
+- scikit-learn *
+- cloudpickle *
+- pytest *
+- pytest-cov *
+- pytest-xdist *
+- pytest-benchmark *
+- pytest-mock *
+- pyyaml *
+- mypy >=2.4.0,<2.5.0
+- pre-commit *
+- mlx >=0.32.4,<0.33
+- pytensor >=3.3.3,<3.4.0
+- numpy *
+- python >=3.12