pre-commit: enforce co-dependent values to stay in sync via blockwatch - #1

Description

This PR enforces the values that are marked as "keep in sync" in the code to stay in sync via blockwatch intuitive rules that run as a pre-commit hook.
It replaces ci/tools/check_pixi_cuda_version.py (91 lines) and adds checks for two values that were only kept in sync by a comment on each side (in other words: had no checks in place).

A full pre-commit hook run takes about 0.05 s, so the hook has no files filter and runs on every commit. CI already runs pre-commit on Linux and Windows.

The rules can be declared in the source code comments next to the code they guard or in blockwatch.toml

Rules

CUDA Toolkit version check (replaces check_pixi_cuda_version.py)

# ci/versions.yml
cuda:
  build:
    version: "13.4.2"  # ← this

# cuda_bindings_13/pixi.toml and cuda_core/pixi.toml
[workspace.build-variants]
cuda-version = ["12.*", "13.4.*"]  # ← this
...
[feature.cu13.dependencies]
cuda-version = "13.4.*"  # ← and this

A patch bump (13.4.3) passes. A minor bump that misses a pixi file fails:

Block cuda_core/pixi.toml:(unnamed) at line 11 of "blockwatch.toml" disagrees with ci/versions.yml#/cuda/build/version: ["13.4"] != ["13.5"]

"12.*" has no minor, so the rule skips it. cuda_bindings_12/pixi.toml is skipped on purpose, as the script did. After a CUDA major bump, the rule keeps reading cu13 and fails with ["13.4"] != ["14.0"] until someone changes cu13 in blockwatch.toml, so it can't pass by mistake.

Backport branch (new)

Dependabot opens the backport PRs against the backport branch.

# ci/versions.yml
backport_branch: "12.9.x"  # ← this

# .github/dependabot.yml
  - package-ecosystem: github-actions
    directory: /
    target-branch: "12.9.x"  # ← this

gh-pages lock name (new)

Every job that writes to gh-pages must wait in one concurrency queue, and ci/cleanup-pr-previews refuses to push unless the workflow passes the same lock name. All five copies must match.

# .github/workflows/build-docs.yml (deploy), coverage.yml (deploy) and cleanup-pr-previews.yml (cleanup)
    concurrency:
      group: cuda-python-gh-pages-publish  # ←

# .github/workflows/cleanup-pr-previews.yml (the cleanup step)
        env:
          GH_PAGES_PUBLISH_LOCK: cuda-python-gh-pages-publish  # ←

# ci/cleanup-pr-previews
      "${GH_PAGES_PUBLISH_LOCK:-}" != "cuda-python-gh-pages-publish" ]]; then  # ←

The "keep in sync" and "Must match" comments next to these values now say that blockwatch.toml checks them.

Not replaced

toolshed/check_cuda_core_bindings_floor.py stays. It checks that the toolkit is at least the floor and scans the docs; blockwatch compares equal values.

Testing

blockwatch and pre-commit run --all-files pass. For each rule I made a one-sided edit (a minor bump in ci/versions.yml, one pixi pin changed or removed, a different backport branch, each copy of the lock name changed), and blockwatch failed on exactly the files out of sync. I ran these on macOS; the Linux and Windows pre-commit jobs run here in CI.

Checklist

• New or existing tests cover these changes.
• The documentation is up to date with these changes.