ci: retire legacy branch-based bindings maintenance

.github/RELEASE-bindings.md

@@ -36,15 +36,20 @@ boundary, not a separate long-term home for shared infrastructure.
 ## Move fixes between integration and release branches
 
 Prefer a reviewed fix on `main`, then backport it to the selected release
-branch in a separate PR. Inspect the diff, request CI using the normal PR
-approval procedure, and review it before merging. Conflicts and toolkit-specific
-generated changes require an explicitly reviewed adaptation.
+branch. Run **CI: Backport a merged PR to a release branch** from the Actions
+tab on `main`, supplying the merged PR number and one existing target branch.
+The workflow opens a PR; it does not merge or release the result. Inspect the
+diff, request CI using the normal PR approval procedure, and review it before
+merging. Workflow-file changes require a manual backport with appropriate
+credentials. Conflicts and toolkit-specific generated changes require an
+explicitly reviewed adaptation.
 
 If urgency requires a fix on the release branch first, link a follow-up PR
 reconciling the fix back into `main` before closing the release checklist. In either
 direction, assess both bindings roots and record why a change applies to one
 or both. Regenerate affected generated files from the intended toolkit and
 cybind inputs instead of blindly copying generated output between majors.
+See the [shared maintenance policy](../ci/README.md#maintaining-both-bindings-roots).
 
 ## Validate and publish the selected line
 
@@ -55,8 +60,8 @@ cybind inputs instead of blindly copying generated output between majors.
    branch. Normal development CI includes dependent packages and may cover
    both majors. Resolve failures in affected code before selecting the tag.
 3. Create the approved immutable `vX.Y.Z` tag at the selected source commit.
-   Tag-triggered CI builds both bindings lines and their consumers. The release
-   workflow selects only the requested line's bindings or metapackage artifacts.
+   Tag-triggered CI selects that line's bindings and metapackage, validates them
+   with the published Pathfinder dependency, and builds release artifacts.
    The tag does not have to be on `main`. Wait for this exact tag's CI to pass.
 4. Run **CI: Release** with `release-action=dry-run`, the tag, and
    `component=cuda-bindings`; repeat for `cuda-python`. Leave `run-id` blank

.github/dependabot.yml

@@ -55,25 +55,3 @@ updates:
       time: "09:00"
       timezone: "America/Los_Angeles"
     open-pull-requests-limit: 1
-
-  # GitHub Actions updates targeting the 12.9.x branch
-  - package-ecosystem: github-actions
-    directories:
-      - /
-      - /.github/actions/*
-    target-branch: "12.9.x"  # keep in sync with backport_branch in ci/versions.yml
-    schedule:
-      interval: "monthly"
-      time: "09:00"
-      timezone: "America/Los_Angeles"
-
-    # Keep churn down: only one open PR from this ecosystem at a time
-    open-pull-requests-limit: 1
-
-    groups:
-      actions-monthly:
-        applies-to: version-updates
-        patterns: ["*"]
-        update-types: ["major", "minor", "patch"]
-
-    labels: [CI/CD, dependencies]

.github/workflows/backport.yml

@@ -2,75 +2,84 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-name: "CI: Backport the merged PR"
+name: "CI: Backport a merged PR to a release branch"
 
 on:
-  pull_request_target:
-    types: [closed, labeled]
-    branches:
-      - main
   workflow_dispatch:
     inputs:
       backport-branch:
-        description: "Branch to backport commits onto"
-        required: false
+        description: "Existing release branch to receive the fix"
+        required: true
         type: string
       pull-request:
-        description: "PR to backport"
+        description: "Merged PR to backport"
         required: true
         type: number
 
-
 permissions:
-  contents: write       # so it can comment
-  pull-requests: write  # so it can create pull requests
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: backport-${{ inputs.pull-request }}-${{ inputs.backport-branch }}
+  cancel-in-progress: false
 
 jobs:
-  backport-from-pr:
-    name: Backport directly from a pull request
-    if: ${{ github.repository_owner == 'nvidia' &&
-            github.event.pull_request.merged == true &&
-            contains( github.event.pull_request.labels.*.name, 'to-be-backported')
-         }}
+  backport:
+    if: github.repository == 'NVIDIA/cuda-python'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - name: Checkout workflow source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          ref: ${{ github.sha }}
 
-      - name: Load branch name
-        id: get-branch
+      - name: Validate source PR and target branch
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          BACKPORT_BRANCH: ${{ inputs.backport-branch }}
+          PR_NUMBER: ${{ inputs.pull-request }}
         run: |
-          OLD_BRANCH=$(yq '.backport_branch' ci/versions.yml)
-          echo "OLD_BRANCH=${OLD_BRANCH}" >> $GITHUB_ENV
+          set -euo pipefail
+          if [[ ! "$PR_NUMBER" =~ ^[1-9][0-9]*$ ]]; then
+            echo "::error::The source PR must be a positive integer."
+            exit 1
+          fi
+          if ! git check-ref-format "refs/heads/$BACKPORT_BRANCH"; then
+            echo "::error::Provide one exact target branch name."
+            exit 1
+          fi
+          if [[ "$BACKPORT_BRANCH" == "$DEFAULT_BRANCH" ]]; then
+            echo "::error::Choose a release branch, not the default branch."
+            exit 1
+          fi
+          if ! git ls-remote --exit-code --heads origin "refs/heads/$BACKPORT_BRANCH"; then
+            echo "::error::The target branch must already exist in this repository."
+            exit 1
+          fi
+          if [[ "$(gh pr view "$PR_NUMBER" --repo "$GH_REPO" --json state --jq .state)" != MERGED ]]; then
+            echo "::error::The source PR must already be merged in this repository."
+            exit 1
+          fi
 
-      - name: Create backport pull requests
+      # Workflow-file changes need a manual backport because GITHUB_TOKEN
+      # cannot push them. Generated changes need target-specific regeneration.
+      - name: Create backport pull request
+        id: backport
         uses: korthout/backport-action@8560fb503c275d433c56f05a2f64850093baa9f7  # v4.7.0
         with:
+          source_pr_number: ${{ inputs.pull-request }}
+          target_branches: ${{ inputs.backport-branch }}
+          # The explicit target must not be combined with source PR labels.
+          label_pattern: ''
           copy_assignees: true
-          copy_labels_pattern: true
+          copy_labels_pattern: '^(?!to-be-backported$|backport ).*'
           copy_requested_reviewers: true
-          target_branches: ${{ env.OLD_BRANCH }}
-  backport-to-branch:
-    name: Backport a specific PR against a specific branch
-    if: github.repository_owner == 'nvidia' && github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - name: Load branch from environment name
-        if: inputs.backport-branch == null
+      - name: Require successful backport
+        if: steps.backport.outputs.was_successful != 'true'
         run: |
-          BACKPORT_BRANCH=$(yq '.backport_branch' ci/versions.yml)
-          echo "BACKPORT_BRANCH=${BRANCH}" >> $GITHUB_ENV
-
-      - name: Load branch name from input
-        if: inputs.backport-branch != null
-        run: echo "BACKPORT_BRANCH=${{ inputs.backport-branch }}" >> $GITHUB_ENV
-
-      - name: Create backport pull requests
-        uses: korthout/backport-action@8560fb503c275d433c56f05a2f64850093baa9f7  # v4.7.0
-        with:
-          copy_assignees: true
-          copy_labels_pattern: true
-          copy_requested_reviewers: true
-          target_branches: ${{ env.BACKPORT_BRANCH }}
-          source_pr_number: ${{ inputs.pull-request }}
+          echo "::error::Backport failed; resolve the conflict or prepare the target-specific fix manually."
+          exit 1

.github/workflows/build-wheel.yml

@@ -510,14 +510,6 @@ jobs:
           path: cuda_python/dist/${{ env.CURRENT_CUDA_VARIANT }}/*.whl
           if-no-files-found: error
 
-      - name: Upload legacy CUDA13 metapackage alias
-        if: ${{ (env.BUILD_CUDA_PYTHON_CURRENT == 'true' || env.BASELINE_RUN_ID != '') && strategy.job-index == 0 && inputs.host-platform == 'linux-64' }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
-        with:
-          name: cuda-python-wheel
-          path: cuda_python/dist/${{ env.CURRENT_CUDA_VARIANT }}/*.whl
-          if-no-files-found: error
-
       - name: List the cuda-python artifacts directories
         if: ${{ (env.BUILD_CUDA_PYTHON == 'true' || env.BASELINE_RUN_ID != '') && strategy.job-index == 0 && inputs.host-platform == 'linux-64' }}
         run: |
@@ -625,14 +617,6 @@ jobs:
           path: ${{ env.CUDA_CORE_CYTHON_TESTS_DIR }}/test_*${{ env.PY_EXT_SUFFIX }}
           if-no-files-found: error
 
-      - name: Upload legacy CUDA13 Core Cython alias
-        if: ${{ env.TEST_CORE_CURRENT == 'true' }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
-        with:
-          name: ${{ env.CUDA_CORE_ARTIFACT_NAME }}-tests
-          path: ${{ env.CUDA_CORE_CYTHON_TESTS_DIR }}/test_*${{ env.PY_EXT_SUFFIX }}
-          if-no-files-found: error
-
       # Note: This overwrites CUDA_PATH etc.
       - name: Set up maintenance mini CTK
         if: ${{ !inputs.single-cuda-major && (env.BUILD_BINDINGS_MAINTENANCE == 'true' || env.BUILD_CORE == 'true' || env.TEST_BINDINGS_MAINTENANCE == 'true' || env.TEST_CORE_MAINTENANCE == 'true') }}