use a lockfile for "old" CI job (#13490)

Co-authored-by: Carina Forster <carinaforster0611@gmail.com>
Co-authored-by: Thomas S. Binns <t.s.binns@outlook.com>
Co-authored-by: Scott Huberty <52462026+scott-huberty@users.noreply.github.com>
Co-authored-by: Erica Peterson <nordme@uw.edu>
Co-authored-by: Eric Larson <larson.eric.d@gmail.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

Author: 7 people

.github/workflows/spec_zero.yml

@@ -37,24 +37,32 @@ jobs:
           fi
       - name: Setup Remote SSH Connection
         if: env.ENABLE_SSH == 'true'
-        uses: mxschmitt/action-tmate@v3
+        uses: Warpbuilds/action-debugger@v1.3
         timeout-minutes: 10
         with:
           detached: true
-      - uses: actions/setup-python@v6
+      - uses: astral-sh/setup-uv@v7
         with:
-          python-version: '3.12'
-      - run: pip install packaging requests tomlkit
-      - run: python tools/dev/spec_zero_update_versions.py
-      - run: |
+          version: ">=0.9"
+          activate-environment: true
+          python-version: 3.12
+      - run: uv pip install packaging requests tomlkit
+      - run: python ./tools/dev/spec_zero_update_versions.py
+      - name: Create lockfile for old CI
+        # uv pip compile requires setting the python version explicitly in the command :(
+        run: |
+          uv pip compile pyproject.toml --python "3.10" --python-platform "x86_64-unknown-linux-gnu" --group test --extra ver-auto-bumped --resolution lowest-direct --format pylock.toml --output-file tools/pylock.ci-old.toml
+          python tools/github_actions_check_old_lockfile.py
+      - name: check if files changed
+        run: |
           git diff && git status --porcelain
           if [[ $(git status --porcelain) ]]; then
             echo "dirty=true" >> $GITHUB_OUTPUT
           fi
         id: status
       - name: Run pre-commit hooks to update other files
         run: |
-          pip install pre-commit
+          uv pip install pre-commit
           pre-commit run --all || true
         if: steps.status.outputs.dirty == 'true'
       - name: Create PR

.github/workflows/tests.yml

@@ -107,7 +107,7 @@ jobs:
           fi
       - name: Setup Remote SSH Connection
         if: env.ENABLE_SSH == 'true'
-        uses: mxschmitt/action-tmate@v3
+        uses: Warpbuilds/action-debugger@v1.3
         timeout-minutes: 80
         with:
           detached: true
@@ -151,10 +151,19 @@ jobs:
           create-args: >-
             python=${{ env.PYTHON_VERSION }}
             -v
-        if: ${{ !startswith(matrix.kind, 'pip') }}
+        if: matrix.kind == 'conda' || matrix.kind == 'mamba'
         timeout-minutes: 20
+      # Python (if old)
+      - uses: astral-sh/setup-uv@v7
+        with:
+          version: ">=0.9"
+          activate-environment: true
+          cache-dependency-glob: |
+            **/pylock.ci-old.toml
+          python-version: ${{ matrix.python }}
+        if: matrix.kind == 'old'
       - run: bash ./tools/github_actions_dependencies.sh
-      - run: python ./tools/github_actions_check_old.py
+      - run: python ./tools/github_actions_check_old_env.py
         if: matrix.kind == 'old'
       # Minimal commands on Linux (macOS stalls)
       - run: bash ./tools/get_minimal_commands.sh

environment.yml

@@ -7,32 +7,32 @@ dependencies:
   - antio >=0.5.0
   - curryreader >=0.1.2
   - darkdetect
-  - decorator
+  - decorator >=5.1
   - defusedxml
-  - dipy
+  - dipy >=0.8
   - edfio >=0.4.10
   - eeglabio
   - filelock >=3.18.0
   - h5io >=0.2.4
-  - h5py
+  - h5py >=2.4
   - imageio >=2.6.1
   - imageio-ffmpeg >=0.4.1
   - ipyevents
   - ipympl
-  - ipython !=8.7.0
+  - ipython >=2.0,!=8.7.0
   - ipywidgets
-  - jinja2
-  - joblib
+  - jinja2 >=3.1
+  - joblib >=0.8
   - jupyter
   - lazy_loader >=0.3
   - mamba
   - matplotlib >=3.8
   - mffpy >=0.5.7
   - mne-qt-browser
-  - nibabel
+  - nibabel >=2.0
   - nilearn
   - nomkl
-  - numba
+  - numba >=0.35
   - numpy >=1.26,<3
   - openmeeg >=2.5.7
   - packaging
@@ -45,7 +45,7 @@ dependencies:
   - pymatreader
   - PySide6 !=6.9.1
   - python-neo
-  - python-picard
+  - python-picard >=0.4
   - pyvista >=0.43
   - pyvistaqt >=0.11
   - qdarkstyle !=3.2.2
@@ -54,9 +54,9 @@ dependencies:
   - scipy >=1.12
   - sip
   - snirf
-  - statsmodels
+  - statsmodels >=0.6
   - threadpoolctl
-  - tqdm
+  - tqdm >=4.66
   - traitlets
   - trame
   - trame-vtk

pyproject.toml

@@ -1,57 +1,64 @@
 [build-system]
 build-backend = "hatchling.build"
-requires = ["hatch-vcs", "hatchling"]
+requires = ["hatch-vcs", "hatchling >= 1.27"]
 
 [dependency-groups]
-dev = ["pip >= 25.1", "rcssmin", {include-group = "doc"}, {include-group = "test_extra"}]
+dev = ["pip >= 25.1", "rcssmin >= 1.1", {include-group = "doc"}, {include-group = "test_extra"}]
 # Dependencies for building the documentation
 doc = [
   "graphviz",
   "intersphinx_registry >= 0.2405.27",
   "ipython != 8.7.0",  # also in "full-no-qt" and "test"
-  "memory_profiler",
+  "memory_profiler >= 0.16",
   "mne-bids",
   "mne-connectivity",
   "mne-gui-addons",
   "neo",
-  "numpydoc",
-  "openneuro-py",
+  "numpydoc >= 0.5",
+  "openneuro-py >= 2020.1",
   "psutil",
   "pydata_sphinx_theme >= 0.15.2",
   "pygments >= 2.13",
   "pymef",
   "pytest",
-  "pyvistaqt",
+  "pyvistaqt >= 0.11",  # released 2023-06-30, no newer version available
   "pyxdf",
   "pyzmq != 24.0.0",
-  "scikit-learn",
-  "seaborn != 0.11.2",
+  "scikit-learn >= 1.4",  # released 2024-01-18, will become 1.5 on 2026-05-21
+  "seaborn >= 0.5, != 0.11.2",
   "selenium >= 4.27.1",
   "sphinx >= 6",
   "sphinx-design",
   "sphinx-gallery >= 0.16",
   "sphinx_copybutton",
   "sphinxcontrib-bibtex >= 2.5",
-  "sphinxcontrib-towncrier >=0.5.0a0",
+  "sphinxcontrib-towncrier >= 0.5.0a0",
   "sphinxcontrib-youtube",
 ]
+# Dependencies in a separate group for uv lockfile generation, currently only used for
+# the 'old' environment CI test run
+lockfile_extras = [
+  "pandas >= 2.2",  # released 2024-01-20, will become 2.3 on 2027-06-05
+  "scikit-learn >= 1.4",  # released 2024-01-18, will become 1.5 on 2026-05-21
+]
 test = [
   "codespell",
-  "ipython != 8.7.0",  # for testing notebook backend; also in "full-no-qt" and "doc"
-  "mypy",
-  "numpydoc",
+  "ipython >= 8.20",  # for testing notebook backend; also in "full-no-qt" and "doc"
+  "mypy >= 0.14",
+  "numpydoc >= 1.6",
+  "pillow >= 10.2",
   "pre-commit",
   "pytest >= 8.0",
-  "pytest-cov",
-  "pytest-qt",
+  "pytest-cov >= 4.1",
+  "pytest-qt >= 4.3",
   "pytest-rerunfailures",
-  "pytest-timeout",
-  "ruff",
+  "pytest-timeout >= 2.2",
+  "ruff >= 0.1",
   "toml-sort",
-  "tomli; python_version<'3.11'",
+  "tomli; python_version < '3.11'",
   "twine",
   "vulture",
-  "wheel",
+  "wheel >= 0.21",
 ]
 # Dependencies for being able to run additional tests (rare/CIs/advanced devs)
 # Changes here should be reflected in the mne/utils/config.py dev dependencies section
@@ -65,7 +72,7 @@ test_extra = [
   "nbclient",
   "nbformat",
   "neo",
-  "nitime",
+  "nitime >= 0.7",
   "pybv",
   "pymef",
   "snirf",
@@ -92,15 +99,15 @@ classifiers = [
   "Topic :: Software Development",
 ]
 dependencies = [
-  "decorator",
-  "jinja2",
+  "decorator >= 5.1",
+  "jinja2 >= 3.1",
   "lazy_loader >= 0.3",
   "matplotlib >= 3.8",  # released 2023-09-15, will become 3.9 on 2026-05-15
   "numpy >= 1.26, < 3",  # released 2023-09-16, will become 2.0 on 2026-06-16
   "packaging",
   "pooch >= 1.5",
   "scipy >= 1.12",  # released 2024-01-20, will become 1.13 on 2026-04-02
-  "tqdm",
+  "tqdm >= 4.66",
 ]
 description = "MNE-Python project for MEG and EEG data analysis."
 dynamic = ["version"]
@@ -119,6 +126,9 @@ maintainers = [{email = "dan@mccloy.info", name = "Dan McCloy"}]
 name = "mne"
 readme = {content-type = "text/x-rst", file = "README.rst"}
 requires-python = ">= 3.10"
+# ↑↑↑↑↑↑↑↑↑↑↑ when this changes, bump the `--python-version` in the `uv pip compile ...`
+# command in `.github/workflows/spec_zero.yaml` (astral-sh/uv/#16333), and also the
+# `python` version for the `kind: old` matrix entry in `.github/workflows/tests.yaml`
 scripts = {mne = "mne.commands.utils:main"}
 
 [project.optional-dependencies]
@@ -135,43 +145,43 @@ full-no-qt = [
   "curryreader >= 0.1.2",
   "darkdetect",
   "defusedxml",
-  "dipy",
+  "dipy >= 0.8",
   "edfio >= 0.4.10",
   "eeglabio",
   "filelock >= 3.18.0",
-  "h5py",
+  "h5py >= 2.4",
   "imageio >= 2.6.1",
   "imageio-ffmpeg >= 0.4.1",
   "ipyevents",
   "ipympl",
-  "ipython != 8.7.0",  # for notebook backend; also in "doc" and "test"
+  "ipython >= 2.0, != 8.7.0",  # for notebook backend; also in "doc" and "test"
   "ipywidgets",
-  "joblib",
+  "joblib >= 0.8",
   "jupyter",
   "mffpy >= 0.5.7",
   "mne-qt-browser",
   "mne[hdf5]",
   "neo",
   "nest-asyncio2",
-  "nibabel",
+  "nibabel >= 2.0",
   "nilearn",
-  "numba",
+  "numba >= 0.35",
   "openmeeg >= 2.5.7",
   "pandas >= 2.2",  # released 2024-01-20, will become 2.3 on 2027-06-05
   "pillow",  # for `Brain.save_image` and `mne.Report`
   "pyarrow",  # only needed to avoid a deprecation warning in pandas
   "pybv",
   "pymef",
   "pyobjc-framework-Cocoa >= 5.2.0; platform_system == 'Darwin'",
-  "python-picard",
+  "python-picard >= 0.4",
   "pyvista >= 0.43",  # released 2023-12-07, will become 0.44 on 2026-07-07
   "pyvistaqt >= 0.11",  # released 2023-06-30, no newer version available
   "qdarkstyle != 3.2.2",
   "qtpy",
   "scikit-learn >= 1.4",  # released 2024-01-18, will become 1.5 on 2026-05-21
   "sip",
   "snirf",
-  "statsmodels",
+  "statsmodels >= 0.6",
   "threadpoolctl",
   "traitlets",
   "trame",

tools/check_pyproject_helpers.py

@@ -0,0 +1,61 @@
+"""Checks for handling version pins for dependencies in `pyproject.toml`."""
+
+# Authors: The MNE-Python contributors.
+# License: BSD-3-Clause
+# Copyright the MNE-Python contributors.
+
+from pathlib import Path
+
+from packaging.requirements import Requirement
+from tomlkit.toml_file import TOMLFile
+
+project_root = Path(__file__).parent.parent
+
+
+def get_deps_to_check():
+    """Get the dependencies whose versions should be checked from `pyproject.toml`."""
+    pyproject = TOMLFile(project_root / "pyproject.toml")
+    pyproject_data = pyproject.read()
+    check_deps = (
+        [f"python {pyproject_data['project']['requires-python']}"]
+        + pyproject_data["project"]["dependencies"]
+        + pyproject_data["dependency-groups"]["lockfile_extras"]
+    )
+    n_want_deps = 12  # update when we add more core deps or auto-bumped pins!
+    assert len(check_deps) == n_want_deps, (
+        f"Number of dependencies being checked ({len(check_deps)=}) is not as "
+        f"expected {n_want_deps=}"
+    )
+
+    return check_deps
+
+
+def get_min_pinned_ver(req):
+    """Get the min pinned version from a dep specification in `pyproject.toml`."""
+    req = Requirement(req)
+    name = req.name
+    spec = req.specifier
+    if len(spec) == 0:
+        return name, None  # no min version specified
+    ge_specs = [this_spec for this_spec in spec if this_spec.operator == ">="]
+    assert len(ge_specs) == 1, (
+        f"Expected exactly 1 '>=' specifier in `pyproject.toml` for module {name} with "
+        f"version specifications, but found {len(ge_specs)}"
+        f"{': ' + ', '.join([str(ge_spec) for ge_spec in ge_specs]) if len(ge_specs) > 0 else ''}."  # noqa: E501
+    )  # can't use \ to break f-string statements until python 3.12
+
+    return name, ge_specs[0].version
+
+
+def get_bad_deps_message(bads, bads_reason):
+    """Format a message about bad deps (e.g., missing, wrong version), if any."""
+    if len(bads) == 0:
+        return ""
+    return f"The following module(s) {bads_reason}:\n" + "\n".join(bads)
+
+
+def raise_bad_deps_messages(bad_messages):
+    """Raise a RuntimeError if there are any bad messages to report."""
+    bad_messages = [message for message in bad_messages if message != ""]
+    if len(bad_messages) > 0:
+        raise RuntimeError("\n\n".join(bad_messages))