Release: 3.15 Wheels

.github/workflows/push.yml

@@ -2,15 +2,20 @@ name: Build Pull Requests
 
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   formatting:
     name: Check Formatting
     runs-on: ubuntu-latest
     steps:
       - name: Check out source repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Set up Python environment
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
       - name: ruff
@@ -26,10 +31,12 @@ jobs:
       matrix:
         platform: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest, macos-15-intel]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Build wheels
-        uses: pypa/cibuildwheel@v3.2.1
-      - uses: actions/upload-artifact@v4
+        uses: pypa/cibuildwheel@8c2dcd2e96041a619f5ff03c9638d7941e2553a4 # v4.3.3
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           path: ./wheelhouse/*.whl
           name: wheels-${{ matrix.platform }}

.github/workflows/release.yml

@@ -5,6 +5,9 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   build_wheels:
     name: Build wheel on ${{matrix.platform}}
@@ -13,10 +16,12 @@ jobs:
       matrix:
         platform: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest, macos-15-intel]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Build wheels
-        uses: pypa/cibuildwheel@v3.2.1
-      - uses: actions/upload-artifact@v4
+        uses: pypa/cibuildwheel@8c2dcd2e96041a619f5ff03c9638d7941e2553a4 # v4.3.3
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           path: ./wheelhouse/*.whl
           name: wheels-${{ matrix.platform }}
@@ -28,38 +33,41 @@ jobs:
     permissions:
       id-token: write
     steps:
-    - uses: actions/setup-python@v4
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: "3.12"
 
-    - uses: actions/download-artifact@v4
+    - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
       with:
         path: dist
         pattern: wheels-*
         merge-multiple: true
-    - uses: pypa/gh-action-pypi-publish@v1.13.0
+    - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
       with:
         password: ${{ secrets.PYPI_API_TOKEN }}
   create_release:
     name: Create GitHub Release
     runs-on: ubuntu-latest
     needs: [build_wheels, upload_pypi]
+    permissions:
+      contents: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 2
+          persist-credentials: false
       - name: Tag Version
         id: set_tag
         run: |
           export VER=v$(python -c "exec(open('src/fcl/version.py','r').read());print(__version__)")
           echo "tag_name=${VER}" >> $GITHUB_OUTPUT
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: dist
           pattern: wheels-*
           merge-multiple: true
-      - uses: ncipollo/release-action@v1.14.0
+      - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
         with:
           artifacts: "dist/*"
           tag: ${{ steps.set_tag.outputs.tag_name }}

build_dependencies/install_linux.sh

@@ -8,20 +8,23 @@ export CMAKE="$(dirname $(which python))/cmake"
 
 $CMAKE --version
 
+# clone a tag and refuse to build if it doesn't point at the expected commit
+clone_pinned() {
+  rm -rf "$4"
+  git clone --depth 1 --branch "$2" "$1" "$4"
+  test "$(git -C "$4" rev-parse HEAD)" = "$3"
+}
+
 mkdir -p deps
 cd deps
 
-curl -OL https://gitlab.com/libeigen/eigen/-/archive/3.3.9/eigen-3.3.9.tar.gz
+curl -fsSLO https://gitlab.com/libeigen/eigen/-/archive/3.3.9/eigen-3.3.9.tar.gz
+echo "7985975b787340124786f092b3a07d594b2e9cd53bbfe5f3d9b1daee7d55f56f  eigen-3.3.9.tar.gz" | sha256sum -c -
 tar -zxf eigen-3.3.9.tar.gz
 
-rm -rf libccd
-git clone --depth 1 --branch v2.1 https://github.com/danfis/libccd.git
-
-rm -rf octomap
-git clone --depth 1 --branch v1.9.8 https://github.com/OctoMap/octomap.git
-
-rm -rf fcl
-git clone --depth 1 --branch v0.7.0 https://github.com/ambi-robotics/fcl.git
+clone_pinned https://github.com/danfis/libccd.git v2.1 7931e764a19ef6b21b443376c699bbc9c6d4fba8 libccd
+clone_pinned https://github.com/OctoMap/octomap.git v1.9.8 d417c181868be79931ec94fd1a407c323e9f0fd3 octomap
+clone_pinned https://github.com/ambi-robotics/fcl.git v0.7.0 06d38ed83d7bf33a0eeb7acb8e1d8edf13b12fb9 fcl
 
 # Install eigen
 $CMAKE -B build -S eigen-3.3.9 

build_dependencies/install_macos.sh

@@ -7,21 +7,24 @@ export CMAKE="$(dirname $(which python))/cmake"
 
 $CMAKE --version
 
+# clone a tag and refuse to build if it doesn't point at the expected commit
+clone_pinned() {
+  rm -rf "$4"
+  git clone --depth 1 --branch "$2" "$1" "$4"
+  test "$(git -C "$4" rev-parse HEAD)" = "$3"
+}
+
 mkdir -p deps
 cd deps
 
-curl -OL https://gitlab.com/libeigen/eigen/-/archive/3.3.9/eigen-3.3.9.tar.gz
+curl -fsSLO https://gitlab.com/libeigen/eigen/-/archive/3.3.9/eigen-3.3.9.tar.gz
+echo "7985975b787340124786f092b3a07d594b2e9cd53bbfe5f3d9b1daee7d55f56f  eigen-3.3.9.tar.gz" | shasum -a 256 -c -
 tar -zxf eigen-3.3.9.tar.gz
 mv eigen-3.3.9 eigen
 
-rm -rf libccd
-git clone --depth 1 --branch v2.1 https://github.com/danfis/libccd.git
-
-rm -rf octomap
-git clone --depth 1 --branch v1.9.8 https://github.com/OctoMap/octomap.git
-
-rm -rf fcl
-git clone --depth 1 --branch v0.7.0 https://github.com/ambi-robotics/fcl.git
+clone_pinned https://github.com/danfis/libccd.git v2.1 7931e764a19ef6b21b443376c699bbc9c6d4fba8 libccd
+clone_pinned https://github.com/OctoMap/octomap.git v1.9.8 d417c181868be79931ec94fd1a407c323e9f0fd3 octomap
+clone_pinned https://github.com/ambi-robotics/fcl.git v0.7.0 06d38ed83d7bf33a0eeb7acb8e1d8edf13b12fb9 fcl
 
 # Install eigen
 $CMAKE -B build -S eigen

build_dependencies/install_windows.ps1

@@ -23,12 +23,21 @@ $generator = "Visual Studio 17 2022"
 # All compiled dependencies will be installed in following folder
 $install_dir = "$base_dir\deps\install"
 
+# Clone a tag and refuse to build if it doesn't point at the expected commit
+function Get-PinnedRepo($url, $tag, $sha, $dir) {
+    git clone --depth 1 --branch $tag $url $dir
+    $head = git -C $dir rev-parse HEAD
+    if ($head -ne $sha) { throw "$dir is at $head, expected $sha" }
+}
+
 
 #------------------------------------------------------------------------------
 # Eigen
 Write-Host "Building Eigen"
 $eigen_ver = "3.3.9"
 Invoke-WebRequest -Uri https://gitlab.com/libeigen/eigen/-/archive/$eigen_ver/eigen-$eigen_ver.tar.gz -Outfile eigen-$eigen_ver.tar.gz
+$eigen_sha256 = "7985975b787340124786f092b3a07d594b2e9cd53bbfe5f3d9b1daee7d55f56f"
+if ((Get-FileHash "eigen-$eigen_ver.tar.gz" -Algorithm SHA256).Hash -ne $eigen_sha256) { throw "eigen-$eigen_ver.tar.gz checksum mismatch" }
 tar -zxf "eigen-$eigen_ver.tar.gz"
 Set-Location "eigen-$eigen_ver"
 
@@ -45,7 +54,7 @@ Set-Location ..
 # ------------------------------------------------------------------------------
 # LibCCD
 Write-Host "Building LibCCD"
-git clone --depth 1 --branch v2.1 https://github.com/danfis/libccd
+Get-PinnedRepo https://github.com/danfis/libccd v2.1 7931e764a19ef6b21b443376c699bbc9c6d4fba8 libccd
 Set-Location libccd
 
 cmake -B build `
@@ -62,7 +71,7 @@ Set-Location ..
 # ------------------------------------------------------------------------------
 # Octomap
 Write-Host "Building Octomap"
-git clone --depth 1 --branch v1.9.8 https://github.com/OctoMap/octomap
+Get-PinnedRepo https://github.com/OctoMap/octomap v1.9.8 d417c181868be79931ec94fd1a407c323e9f0fd3 octomap
 Set-Location octomap
 
 cmake -B build `
@@ -81,7 +90,7 @@ Set-Location ..
 # ------------------------------------------------------------------------------
 # FCL
 Write-Host "Building FCL"
-git clone --depth 1 --branch v0.7.0 https://github.com/ambi-robotics/fcl.git
+Get-PinnedRepo https://github.com/ambi-robotics/fcl.git v0.7.0 06d38ed83d7bf33a0eeb7acb8e1d8edf13b12fb9 fcl
 Set-Location fcl
 
 cmake -B build `

pyproject.toml

@@ -26,12 +26,13 @@ classifiers = [
     "Operating System :: MacOS",
     "Operating System :: Microsoft :: Windows",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.7",
-    "Programming Language :: Python :: 3.8",
     "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Programming Language :: Python :: 3.15",
     "Programming Language :: Python :: Implementation :: CPython",
 ]
 keywords = ["fcl collision distance"]
@@ -111,3 +112,6 @@ repair-wheel-command = "delocate-wheel -w {dest_dir} -v {wheel}"
 [tool.cibuildwheel.windows]
 before-all = "powershell build_dependencies\\install_windows.ps1"
 archs = ["AMD64"]
+# cibuildwheel 4 defaults to delvewheel, but the dependency DLLs
+# are already copied into the package by install_windows.ps1
+repair-wheel-command = ""

src/fcl/version.py

@@ -1 +1 @@
-__version__ = "0.7.0.11"
+__version__ = "0.7.0.12"