CI: update certificate-related packages for the eMudhra/emSign CA incident

.github/actionlint.yaml

@@ -21,3 +21,11 @@ paths:
   ".github/workflows/ci-workflow-health.yml":
     ignore:
       - 'unexpected key "queue" for "concurrency" section'
+  # GitHub supports self-repository ($/) action references, but the latest
+  # actionlint release does not yet recognize them (rhysd/actionlint#711).
+  ".github/workflows/test-wheel-linux.yml":
+    ignore:
+      - 'specifying action "\$/[^"]+" in invalid format because ref is missing'
+  ".github/workflows/test-wheel-windows.yml":
+    ignore:
+      - 'specifying action "\$/[^"]+" in invalid format because ref is missing'

.github/actions/harden-pip/action.yml

@@ -0,0 +1,28 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+name: Harden pip
+description: >-
+  Install the security-fixed pip (26.2.2) from a hash-pinned wheel so that later
+  pip invocations do not fall back on the vendored certifi bundle that trusts the
+  compromised eMudhra/emSign intermediate CAs. The sha256 fragment guarantees the
+  bootstrap download's integrity even if the bootstrapping pip's trust store is
+  compromised. See https://github.com/NVIDIA/cuda-python/issues/3195 and
+  https://discuss.python.org/t/109576.
+
+inputs:
+  python:
+    description: Python interpreter whose pip should be hardened (e.g. a venv's python).
+    default: python
+
+runs:
+  using: composite
+  steps:
+    - name: Install hash-pinned pip 26.2.2
+      shell: bash --noprofile --norc -xeuo pipefail {0}
+      env:
+        HARDEN_PIP_PYTHON: ${{ inputs.python }}
+      run: |
+        "${HARDEN_PIP_PYTHON}" -m pip install \
+          "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"

.github/actions/lychee-links/action.yml

@@ -113,6 +113,9 @@ runs:
           printf '[Open the cache refresh workflow](%s).\n' "$WORKFLOW_URL"
         } >> "$GITHUB_STEP_SUMMARY"
 
+    - name: Harden pip
+      uses: ./.github/actions/harden-pip
+
     - name: Check links through the configured pre-commit hook
       shell: bash --noprofile --norc -euo pipefail {0}
       env:

.github/workflows/build-wheel.yml

@@ -115,6 +115,9 @@ jobs:
           python-version: "3.12"
           architecture: ${{ ((inputs.host-platform == 'linux-aarch64' || inputs.host-platform == 'win-arm64') && 'arm64') || 'x64' }}
 
+      - name: Harden pip
+        uses: ./.github/actions/harden-pip
+
       - name: Set up MSVC
         if: ${{ startsWith(inputs.host-platform, 'win') && (env.BUILD_BINDINGS == 'true' || env.BUILD_CORE == 'true' || env.TEST_BINDINGS == 'true' || env.TEST_CORE == 'true') }}
         uses: step-security/msvc-dev-cmd@22c98154b708dbd743e6f27a933cf6ceba3305c4  # v1.13.1
@@ -227,7 +230,7 @@ jobs:
 
       - name: Build cuda.bindings wheel
         if: ${{ env.BUILD_BINDINGS == 'true' }}
-        uses: pypa/cibuildwheel@b3395e271a35f73dad77f21802abe9b986dfe299  # v4.3.1
+        uses: pypa/cibuildwheel@b9e566a2b284570af229f6c2a33673410d0389a3  # v4.3.4
         with:
           package-dir: ./cuda_bindings_13/
           output-dir: ${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }}
@@ -324,7 +327,7 @@ jobs:
 
       - name: Build cuda.core wheel
         if: ${{ env.BUILD_CORE == 'true' }}
-        uses: pypa/cibuildwheel@b3395e271a35f73dad77f21802abe9b986dfe299  # v4.3.1
+        uses: pypa/cibuildwheel@b9e566a2b284570af229f6c2a33673410d0389a3  # v4.3.4
         with:
           package-dir: ./cuda_core/
           output-dir: ${{ env.CUDA_CORE_ARTIFACTS_DIR }}
@@ -446,6 +449,10 @@ jobs:
           python-version: ${{ matrix.python-version }}
           allow-prereleases: ${{ startsWith(matrix.python-version, '3.16') }}
 
+      - name: Harden pip
+        if: ${{ env.TEST_BINDINGS == 'true' || env.TEST_CORE == 'true' }}
+        uses: ./.github/actions/harden-pip
+
       - name: verify free-threaded build
         if: ${{ (env.TEST_BINDINGS == 'true' || env.TEST_CORE == 'true') && endsWith(matrix.python-version, 't') }}
         run: python -c 'import sys; assert not sys._is_gil_enabled()'
@@ -602,7 +609,7 @@ jobs:
 
       - name: Build cuda.core wheel
         if: ${{ !inputs.single-cuda-major && env.BUILD_CORE == 'true' }}
-        uses: pypa/cibuildwheel@b3395e271a35f73dad77f21802abe9b986dfe299  # v4.3.1
+        uses: pypa/cibuildwheel@b9e566a2b284570af229f6c2a33673410d0389a3  # v4.3.4
         with:
           package-dir: ./cuda_core/
           output-dir: ${{ env.CUDA_CORE_ARTIFACTS_DIR }}

.github/workflows/ci-nightly.yml

@@ -58,6 +58,9 @@ jobs:
         with:
           fetch-depth: 1
 
+      - name: Harden pip
+        uses: ./.github/actions/harden-pip
+
       - name: Run CI tools unit tests
         run: |
           python -m pip install pytest pyyaml==6.0.3

.github/workflows/coverage.yml

@@ -121,8 +121,10 @@ jobs:
         run: |
           python -m venv .venv
 
-      - name: Install pip with build-constraint support
-        run: .venv/bin/python -m pip install "pip>=25.3"
+      - name: Harden pip
+        uses: ./.github/actions/harden-pip
+        with:
+          python: .venv/bin/python
 
       - name: Build and install cuda-pathfinder wheel
         run: |
@@ -266,9 +268,14 @@ jobs:
         run: |
           python -m venv .venv
 
+      - name: Harden pip
+        uses: ./.github/actions/harden-pip
+        with:
+          python: .venv/Scripts/python
+
       - name: Build cuda.pathfinder wheel
         run: |
-          .venv/Scripts/python -m pip install "pip>=25.3" wheel setuptools Cython
+          .venv/Scripts/python -m pip install wheel setuptools Cython
           .venv/Scripts/pip wheel -v --no-deps ./cuda_pathfinder -w ./wheels/
 
       - name: Constrain builds to the local cuda.pathfinder wheel
@@ -408,6 +415,11 @@ jobs:
         run: |
           python -m venv .venv
 
+      - name: Harden pip
+        uses: ./.github/actions/harden-pip
+        with:
+          python: .venv/Scripts/python
+
       - name: Install wheels from build job
         run: |
           .venv/Scripts/pip install ./wheels/cuda_pathfinder*.whl
@@ -491,6 +503,9 @@ jobs:
         with:
           python-version: ${{ env.PY_VER }}
 
+      - name: Harden pip
+        uses: ./.github/actions/harden-pip
+
       - name: Install coverage
         run: |
           # .coveragerc enables Cython.Coverage plugin; ensure it's available here too.

.github/workflows/pre-commit.yml

@@ -85,8 +85,11 @@ jobs:
           restore-keys: |
             pre-commit-${{ runner.os }}-py${{ env.PYTHON_VERSION }}
 
+      - name: Harden pip
+        uses: ./.github/actions/harden-pip
+
       - name: Install pre-commit
-        run: python -m pip install --upgrade pip pre-commit
+        run: python -m pip install pre-commit
 
       # Keep this offline hook smoke check before network-dependent Lychee steps,
       # so hook setup and invocation failures surface before link-check retries.

.github/workflows/release-cuda-pathfinder.yml

@@ -234,7 +234,7 @@ jobs:
           ls -la dist
 
       - name: Publish to TestPyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # v1.14.3
         with:
           repository-url: https://test.pypi.org/legacy/
 
@@ -311,7 +311,7 @@ jobs:
           ls -la dist
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # v1.14.3
 
   # --------------------------------------------------------------------------
   # Verify the PyPI package installs and imports correctly.

.github/workflows/release.yml

@@ -328,7 +328,7 @@ jobs:
           ./ci/tools/validate-release-wheels "${{ inputs.git-tag }}" "${{ inputs.component }}" "dist"
 
       - name: Publish package distributions to TestPyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # v1.14.3
         with:
           repository-url: https://test.pypi.org/legacy/
 
@@ -405,7 +405,7 @@ jobs:
           ./ci/tools/validate-release-wheels "${{ inputs.git-tag }}" "${{ inputs.component }}" "dist"
 
       - name: Publish package distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # v1.14.3
 
   verify-pypi:
     name: Verify Pathfinder on PyPI

.github/workflows/test-sdist-linux.yml

@@ -51,8 +51,11 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Harden pip
+        uses: ./.github/actions/harden-pip
+
       - name: Install build tools
-        run: python -m pip install "pip>=25.3" build
+        run: python -m pip install build
 
       # Pure Python packages -- no CTK needed.
       - name: Build cuda.pathfinder sdist and wheel-from-sdist

.github/workflows/test-sdist-windows.yml

@@ -60,12 +60,15 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Harden pip
+        uses: ./.github/actions/harden-pip
+
       - name: Set up MSVC
         if: ${{ env.BUILD_BINDINGS == 'true' || env.BUILD_CORE == 'true' }}
         uses: step-security/msvc-dev-cmd@22c98154b708dbd743e6f27a933cf6ceba3305c4  # v1.13.1
 
       - name: Install build tools
-        run: python -m pip install "pip>=25.3" build
+        run: python -m pip install build
 
       # Pure Python packages -- no CTK needed.
       - name: Build cuda.pathfinder sdist and wheel-from-sdist

.github/workflows/test-wheel-linux.yml

@@ -332,6 +332,11 @@ jobs:
           # we use self-hosted runners on which setup-python behaves weirdly (Python include can't be found)...
           AGENT_TOOLSDIRECTORY: "/opt/hostedtoolcache"
 
+      - name: Harden pip
+        # $/ resolves at the workflow's commit. ./ would resolve against the
+        # inputs.sha checkout, which can predate this action.
+        uses: $/.github/actions/harden-pip
+
       - name: Set up mini CTK
         if: ${{ matrix.LOCAL_CTK == '1' }}
         uses: ./.github/actions/fetch_ctk

.github/workflows/test-wheel-windows.yml

@@ -311,6 +311,11 @@ jobs:
           python-version: ${{ matrix.PY_VER }}
           allow-prereleases: ${{ startsWith(matrix.PY_VER, '3.16') }}
 
+      - name: Harden pip
+        # $/ resolves at the workflow's commit. ./ would resolve against the
+        # inputs.sha checkout, which can predate this action.
+        uses: $/.github/actions/harden-pip
+
       - name: Verify LongPathsEnabled
         run: |
           $val = (Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem' -Name 'LongPathsEnabled').LongPathsEnabled