Prepare for cuda_bindings 3.15 release

.github/actionlint.yaml

@@ -6,8 +6,15 @@
 # Without this config, actionlint rejects non-GitHub-hosted labels.
 self-hosted-runner:
   labels:
+    - linux-amd64-cpu16-internal
     - linux-amd64-cpu8
     - linux-amd64-gpu-l4-latest-1
+    - linux-amd64-gpu-l4-latest-1-internal
+    - linux-arm64-gpu-l4-latest-1-internal
+    - linux-riscv64-1xrtx6000
+    - linux-riscv64-4cpu-1gpu
+    - windows-arm64-1xgb10
+    - windows-arm64-gpu-gb300-latest-1-internal
 
 # GitHub supports queued concurrency runs, but the latest actionlint release
 # does not yet recognize the concurrency.queue key.
@@ -47,3 +54,6 @@ paths:
   ".github/workflows/coverage.yml":
     ignore:
       - 'specifying action "\$/[^"]+" in invalid format because ref is missing'
+  ".github/workflows/ctk-next-woa-validation.yml":
+    ignore:
+      - 'specifying action "\$/[^"]+" in invalid format because ref is missing'

.github/actions/resolve-ctk-next/action.yml

@@ -0,0 +1,44 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Resolve ctk-next toolkit
+description: Read the checked-out CTK kitpick configuration and export its version fields
+
+inputs:
+  ctk-kitpick:
+    description: Optional major.minor.patch/NNN override for the checked-out configuration
+    default: ''
+
+outputs:
+  ctk-kitpick:
+    description: Combined full CUDA version and three-digit kitpick
+    value: ${{ steps.resolve.outputs.ctk-kitpick }}
+  cuda-version:
+    description: CUDA major.minor version
+    value: ${{ steps.resolve.outputs.cuda-version }}
+  cuda-kitpick-version:
+    description: CUDA major.minor.patch version
+    value: ${{ steps.resolve.outputs.cuda-kitpick-version }}
+  cuda-kitpick:
+    description: Three-digit kitpick number
+    value: ${{ steps.resolve.outputs.cuda-kitpick }}
+
+runs:
+  using: composite
+  steps:
+    - name: Read CTK kitpick configuration
+      id: resolve
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
+      env:
+        CTK_NEXT_KITPICK_OVERRIDE: ${{ inputs.ctk-kitpick }}
+      with:
+        script: |
+          const fs = require('node:fs');
+          const path = require('node:path');
+          const workspace = process.env.GITHUB_WORKSPACE;
+          const { resolveActionValues } = require(path.join(workspace, 'ci/tools/ctk_next_config.cjs'));
+          const configText = fs.readFileSync(path.join(workspace, 'ci/ctk-next.json'), 'utf8');
+          const { outputs, environment } = resolveActionValues(configText, process.env.CTK_NEXT_KITPICK_OVERRIDE);
+          for (const [name, value] of Object.entries(outputs)) core.setOutput(name, value);
+          for (const [name, value] of Object.entries(environment)) core.exportVariable(name, value);
+          core.info(`CTK kitpick: ${outputs['ctk-kitpick']}`);

.github/actions/setup-ctk-next-linux/action.yml

@@ -0,0 +1,120 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+# TODO: Remove or replace this PID-drop-specific action after the CUDA 13.5 PID drop.
+
+name: Set up ctk-next Linux toolkit
+
+description: Restore or install an exact CUDA kitpick on a Linux runner
+
+inputs:
+  host-platform:
+    description: Linux host platform (linux-64 or linux-aarch64)
+    required: true
+  cuda-version:
+    description: CUDA version used in artifact names
+    required: true
+  cuda-kitpick-version:
+    description: Full CUDA kitpick version
+    required: true
+  cuda-kitpick:
+    description: CUDA kitpick number
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Configure Linux architecture
+      shell: bash
+      run: |
+        case "${{ inputs.host-platform }}" in
+          linux-64)
+            expected_machine=x86_64
+            kitpick_architecture=linux-64
+            installer_glob='cuda_*_linux_kitpick*.run'
+            ;;
+          linux-aarch64)
+            expected_machine=aarch64
+            kitpick_architecture=linux-aarch64
+            installer_glob='cuda_*_linux_sbsa_kitpick*.run'
+            ;;
+          *)
+            echo "Unsupported Linux host platform: ${{ inputs.host-platform }}" >&2
+            exit 1
+            ;;
+        esac
+
+        actual_machine="$(uname -m)"
+        if [[ "$actual_machine" != "$expected_machine" ]]; then
+          echo "Expected '$expected_machine', got '$actual_machine'." >&2
+          exit 1
+        fi
+
+        {
+          echo "KITPICK_ARCHITECTURE=$kitpick_architecture"
+          echo "KITPICK_INSTALLER_GLOB=$installer_glob"
+        } >> "$GITHUB_ENV"
+
+    - name: Restore CUDA ${{ inputs.cuda-kitpick-version }}/${{ inputs.cuda-kitpick }} cache
+      id: cuda-cache
+      uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7  # v5.0.4
+      with:
+        path: cuda_toolkit
+        key: ctk-next-linux-wheel-full-toolkit-v1-${{ inputs.cuda-kitpick-version }}-kitpick${{ inputs.cuda-kitpick }}-${{ inputs.host-platform }}
+
+    - name: Download CUDA ${{ inputs.cuda-kitpick-version }}/${{ inputs.cuda-kitpick }} kitpick
+      if: ${{ steps.cuda-cache.outputs.cache-hit != 'true' }}
+      shell: bash
+      run: |
+        download_dir="$RUNNER_TEMP/kitpicks-${{ inputs.host-platform }}"
+        mkdir -p "$download_dir"
+        cd "$download_dir"
+        python "$GITHUB_WORKSPACE/qa/forge/download_from_kitpicks.py" \
+          "${{ inputs.cuda-kitpick-version }}" \
+          "${{ inputs.cuda-kitpick }}" \
+          --arch="$KITPICK_ARCHITECTURE"
+
+        mapfile -t installers < <(find "$download_dir" -maxdepth 1 -type f -name "$KITPICK_INSTALLER_GLOB" -print)
+        if ((${#installers[@]} != 1)); then
+          printf 'Expected exactly one %s kitpick installer, found %d:\n' \
+            "${{ inputs.host-platform }}" "${#installers[@]}" >&2
+          printf '  %s\n' "${installers[@]}" >&2
+          exit 1
+        fi
+
+        chmod +x "${installers[0]}"
+        echo "CUDA_INSTALLER=${installers[0]}" >> "$GITHUB_ENV"
+
+    - name: Install CUDA ${{ inputs.cuda-kitpick-version }}/${{ inputs.cuda-kitpick }}
+      if: ${{ steps.cuda-cache.outputs.cache-hit != 'true' }}
+      shell: bash
+      run: |
+        cuda_root="$GITHUB_WORKSPACE/cuda_toolkit"
+        "$CUDA_INSTALLER" \
+          --toolkit \
+          --toolkitpath="$cuda_root" \
+          --silent \
+          --no-man-page \
+          --override
+        test -x "$cuda_root/bin/nvcc"
+        "$cuda_root/bin/nvcc" --version
+
+    - name: Save CUDA ${{ inputs.cuda-kitpick-version }}/${{ inputs.cuda-kitpick }} cache
+      if: ${{ steps.cuda-cache.outputs.cache-hit != 'true' }}
+      uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7  # v5.0.4
+      with:
+        path: cuda_toolkit
+        key: ctk-next-linux-wheel-full-toolkit-v1-${{ inputs.cuda-kitpick-version }}-kitpick${{ inputs.cuda-kitpick }}-${{ inputs.host-platform }}
+
+    - name: Configure CUDA ${{ inputs.cuda-kitpick-version }}/${{ inputs.cuda-kitpick }}
+      shell: bash
+      run: |
+        cuda_root="$(realpath cuda_toolkit)"
+        test -x "$cuda_root/bin/nvcc"
+        "$cuda_root/bin/nvcc" --version
+        echo "$cuda_root/bin" >> "$GITHUB_PATH"
+        {
+          echo "CUDA_PATH=$cuda_root"
+          echo "CUDA_HOME=$cuda_root"
+          echo "CUDA_PYTHON_PARALLEL_LEVEL=$(nproc)"
+        } >> "$GITHUB_ENV"

.github/actions/setup-ctk-next-windows/README.md

@@ -0,0 +1,46 @@
+# Approved released-CUDA downloads
+
+`fetch_ctk` installs released CUDA using the reviewed manifest hashes in
+`ci/tools/fetch_ctk_redistrib.py` (`KNOWN_REDISTRIB_SHA256`).
+Unknown released CUDA versions emit a warning and proceed without a manifest pin.
+The existing internal-kitpick setup path is unchanged.
+
+## CUDA
+
+The CUDA pin is the SHA256 of the exact public `redistrib_<version>.json` bytes.
+For known versions, verify this before parsing the manifest; a mismatch fails.
+For unknown versions, manifest verification warns and continues. Every component
+archive is checked against its SHA256 in the downloaded manifest before extraction.
+Without a manifest pin, those component hashes have no independent trust anchor.
+The shared action caches the assembled toolkit. Cache keys use the CUDA
+version, platform, and component list; cache restores trust GitHub Actions cache
+integrity.
+
+The initial 13.4.2 manifest was retrieved from:
+
+<https://developer.download.nvidia.com/compute/cuda/redist/redistrib_13.4.2.json>
+
+Its archive records match internal CUDA 13.4.2 kitpick 006; only `release_date`
+differs. This is a checked release mapping, not a rule that the last kitpick is
+the public release. Changing manifest whitespace also changes the pinned hash.
+
+## Python
+
+Python provisioning uses the shared `setup-hardened-python` action for both
+released-CUDA and internal-kitpick jobs. It installs CPython through checksum-verified
+uv distributions, creates a virtual environment, and checks that the interpreter
+rejects the compromised CA keys. See that action for the pinned tool versions
+and interpreter validation policy.
+
+## Updates and scope
+
+Update versions and hashes together in a reviewed PR. Obtain the expected bytes
+through a trusted release process, independently cross-check the release, and
+compute the digest over the actual downloaded file. Do not regenerate or accept
+pins automatically during a test run. Test a supported matrix entry and verify
+that changed bytes are rejected before extraction.
+
+These pins protect these downloads, not the whole runner. Test-package locking,
+MSVC provisioning, internal-kitpick integrity, runner isolation, and protection
+against persistent host modifications are separate controls. GB10 hardware
+validation is still required for toolchain changes.