NNPDF · cschwan · Jul 6, 2024 · Jul 5, 2024 · Jul 5, 2024 · Jul 5, 2024
diff --git a/.github/workflows/capi.yaml b/.github/workflows/capi.yaml
@@ -5,18 +5,13 @@ on:
     branches-ignore:
       - pycli
 
-env:
-  # our GLIBC version is too old to support Node 20:
-  # https://github.blog/changelog/2024-03-07-github-actions-all-actions-will-run-on-node20-instead-of-node16-by-default/
-  ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
-
 jobs:
   capi:
     runs-on: ubuntu-latest
     container: ghcr.io/nnpdf/pineappl-ci:latest
     steps:
       # checkout@v4 uses a newer version of Node that's incompatible with our container's GLIBC
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Install PineAPPL's C API
         run: |
@@ -61,8 +56,7 @@ jobs:
           grep SF lcov.info | sort -u | sed 's/SF://'
 
       - name: Upload to codecov.io
-        # version 3.1.5 upgrades to Node 20 (https://github.com/codecov/codecov-action/issues/1230), which breaks inside our container
-        uses: codecov/codecov-action@v3.1.4
+        uses: codecov/codecov-action@v4
         with:
-          token: ${{secrets.CODECOV_TOKEN}}
+          token: ${{ secrets.CODECOV_TOKEN }}
           flags: capi
diff --git a/.github/workflows/msrv.yml b/.github/workflows/msrv.yml
@@ -7,17 +7,13 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
-  # our GLIBC version is too old to support Node 20:
-  # https://github.blog/changelog/2024-03-07-github-actions-all-actions-will-run-on-node20-instead-of-node16-by-default/
-  ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
 
 jobs:
   build:
     runs-on: ubuntu-latest
     container: ghcr.io/nnpdf/pineappl-ci:latest
     steps:
-      # checkout@v4 uses a newer version of Node that's incompatible with our container's GLIBC
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Run check
         run: |

diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
@@ -14,9 +14,9 @@ jobs:
         python-version: ["3.7", "3.8", "3.9", "3.10", "3.11", "3.12"]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Test
@@ -28,8 +28,8 @@ jobs:
           maturin develop --extras test
           pytest
       - name: Upload to codecov.io
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v4
         with:
-          token: ${{secrets.CODECOV_TOKEN}}
+          token: ${{ secrets.CODECOV_TOKEN }}
           files: pineappl_py/coverage.xml
           flags: python
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -9,9 +9,6 @@ on:
 env:
   # this is make the `gh` binary work
   GH_TOKEN: ${{ github.token }}
-  # our GLIBC version is too old to support Node 20:
-  # https://github.blog/changelog/2024-03-07-github-actions-all-actions-will-run-on-node20-instead-of-node16-by-default/
-  ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
 
 jobs:
   # create a release on github
@@ -41,8 +38,7 @@ jobs:
           cd prefix
           tar czf ../../pineappl_capi-${{ matrix.target }}.tar.gz .
       - name: Upload artifact
-        # as long as we need v3 in `capi-linux` we also must use it here
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: pineappl_capi-${{ matrix.target }}
           path: pineappl_capi-${{ matrix.target }}.tar.gz
@@ -91,8 +87,7 @@ jobs:
           cd prefix
           tar czf ../pineappl_cli-${{ matrix.target }}.tar.gz .
       - name: Upload artifact
-        # as long as we need v3 in `cli-linux` we also must use it here
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: pineappl_cli-${{ matrix.target }}
           path: pineappl_cli-${{ matrix.target }}.tar.gz
@@ -164,8 +159,7 @@ jobs:
       matrix:
         target: [x86_64-unknown-linux-gnu]
     steps:
-      # checkout@v4 uses a newer version of Node that's incompatible with our container's GLIBC
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Compile library
         run: |
           cd pineappl_capi
@@ -175,8 +169,7 @@ jobs:
           # print the glibc version requirement
           objdump -T lib/libpineappl_capi.so | grep GLIBC | sed 's/.*GLIBC_\([.0-9]*\).*/\1/g' | sort -Vu | tail -1
       - name: Upload artifact
-        # upload-artifact@v4 uses a newer version of Node that's incompatible with our container's GLIBC
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: pineappl_capi-${{ matrix.target }}
           path: pineappl_capi-${{ matrix.target }}.tar.gz
@@ -188,8 +181,7 @@ jobs:
       matrix:
         target: [x86_64-unknown-linux-gnu]
     steps:
-      # checkout@v4 uses a newer version of Node that's incompatible with our container's GLIBC
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Compile binary
         run: |
           cargo install --all-features --locked --path pineappl_cli --root=prefix --target=${{ matrix.target }} -vv
@@ -201,8 +193,7 @@ jobs:
           # print the dynamically linked libraries
           ldd bin/pineappl
       - name: Upload artifact
-        # upload-artifact@v4 uses a newer version of Node that's incompatible with our container's GLIBC
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: pineappl_cli-${{ matrix.target }}
           path: pineappl_cli-${{ matrix.target }}.tar.gz
@@ -218,11 +209,71 @@ jobs:
         uses: PyO3/maturin-action@v1
         with:
           target: ${{ matrix.target }}
-          container: ghcr.io/nnpdf/pineappl-ci:latest
           # `--find-interpreter` is needed to generate wheels for *all* Python versions
           args: --release --out dist --find-interpreter --manifest-path pineappl_cli/Cargo.toml
           sccache: "true"
           manylinux: auto
+          before-script-linux: |
+            export APPLGRID_V=1.6.36
+            export FASTNLO_V=2.5.0-2826
+            export LHAPDF_V=6.5.4
+            export ZLIB_V=1.3.1
+            export APPL_IGRID_DIR="/usr/local/src/applgrid-${APPLGRID_V}/src"
+            # install LHAPDF
+            curl -L "https://lhapdf.hepforge.org/downloads/?f=LHAPDF-${LHAPDF_V}.tar.gz" | tar xzf -
+            cd LHAPDF-${LHAPDF_V}
+            # compile static libraries with PIC to make statically linking PineAPPL's CLI work
+            # see also https://users.rust-lang.org/t/why-does-crelocation-model-dynamic-no-pic-help-although-it-shouldnt/109012
+            ./configure --disable-python --disable-shared --with-pic=yes
+            make -j V=1
+            make install
+            ldconfig
+            cd ..
+            # install zlib; we need to link against it statically
+            curl "https://www.zlib.net/zlib-${ZLIB_V}.tar.gz" | tar xzf -
+            cd zlib-${ZLIB_V}
+            CFLAGS=-fPIC ./configure --static --prefix=/usr/local
+            make -j
+            make install
+            ldconfig
+            cd ..
+            # install APPLgrid
+            curl -L "https://applgrid.hepforge.org/downloads?f=applgrid-${APPLGRID_V}.tgz" | tar xzf -
+            cd applgrid-${APPLGRID_V}
+            patch -p0 <<EOF
+            --- src/combine.cxx	2024-04-23 16:35:27.000000000 +0200
+            +++ src/combine.cxx.new	2024-07-06 12:29:12.813303074 +0200
+            @@ -56,12 +56,6 @@
+             } 
+
+
+            -double integral( appl::TH1D* h ) { 
+            -  double d = 0;
+            -  for ( int i=0 ; i<h->GetNbinsX() ; i++ ) d += h->GetBinContent(i+1);
+            -  return d;
+            -}
+            -
+
+             void print( appl::TH1D* h ) { 
+               for ( int i=1 ; i<=h->GetNbinsX() ; i++ ) std::cout << h->GetBinContent(i) << " ";
+            EOF
+            # compile static libraries with PIC to make statically linking PineAPPL's CLI work
+            ./configure --without-root --disable-shared --with-pic=yes
+            make -j
+            make install
+            ldconfig
+            mkdir -p ${APPL_IGRID_DIR}
+            cp src/*.h ${APPL_IGRID_DIR}
+            cd ..
+            # install fastNLO
+            curl "https://fastnlo.hepforge.org/code/v25/fastnlo_toolkit-${FASTNLO_V}.tar.gz" | tar xzf -
+            cd fastnlo_toolkit-${FASTNLO_V}
+            # compile static libraries with PIC to make statically linking PineAPPL's CLI work
+            ./configure --prefix=/usr/local/ --disable-shared --with-pic=yes
+            make -j V=1
+            make install
+            ldconfig
+            cd ..
       - name: Upload wheels
         uses: actions/upload-artifact@v4
         with:
@@ -237,7 +288,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       # version must match the one used in `actions/upload-artifact`
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
         with:
           path: artifacts
       - name: Create new release
@@ -264,8 +315,7 @@ jobs:
     if: "startsWith(github.ref, 'refs/tags/')"
     container: ghcr.io/nnpdf/pineappl-ci:latest
     steps:
-      # checkout@v4 uses a newer version of Node that's incompatible with our container's GLIBC
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Publish all crates
         env:

diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
@@ -11,21 +11,17 @@ defaults:
 
 env:
   CARGO_TERM_COLOR: always
-  # our GLIBC version is too old to support Node 20:
-  # https://github.blog/changelog/2024-03-07-github-actions-all-actions-will-run-on-node20-instead-of-node16-by-default/
-  ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
 
 jobs:
   build:
     runs-on: ubuntu-latest
     container: ghcr.io/nnpdf/pineappl-ci:latest
     steps:
-      # checkout@v4 uses a newer version of Node that's incompatible with our container's GLIBC
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Get test data
         id: cache-test-data
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: test-data
           key: test-data-v11
@@ -94,7 +90,7 @@ jobs:
 
       - name: Upload to codecov.io
         # version 3.1.5 upgrades to Node 20 (https://github.com/codecov/codecov-action/issues/1230), which breaks inside our container
-        uses: codecov/codecov-action@v3.1.4
+        uses: codecov/codecov-action@v4
         with:
           token: ${{secrets.CODECOV_TOKEN}}
           flags: rust
diff --git a/maintainer/pineappl-ci/Containerfile b/maintainer/pineappl-ci/Containerfile
@@ -1,8 +1,10 @@
-FROM quay.io/pypa/manylinux2014_x86_64
+# with debian:10 Rust has linking problems, see this description:
+# https://github.com/rust-lang/rust/issues/79946#issuecomment-1693289299
+FROM debian:11-slim
 
 ARG APPLGRID_V=1.6.36
-# must be at least 0.9.16, see https://github.com/NNPDF/pineappl/pull/242#issuecomment-1705371291
-ARG CARGOC_V=0.9.24+cargo-0.73.0
+# `0.9.27+cargo-0.74.0` is the last version that support Rust 1.70
+ARG CARGOC_V=0.9.27+cargo-0.74.0
 ARG FASTNLO_V=2.5.0-2826
 ARG LHAPDF_V=6.5.4
 ARG ZLIB_V=1.3.1

diff --git a/maintainer/pineappl-ci/script.sh b/maintainer/pineappl-ci/script.sh
@@ -2,47 +2,40 @@
 
 set -euo pipefail
 
-# print this so we can see whether the compiler/linker has `--enable-default-pie` enabled; if it's
-# not enabled we need to build our dependencies with `--with-pic=yes` (see below)
-echo "--- COMPILER/LINKER INFORMATION"
-echo "int main() {}" > test.c
-cc -Q -v test.c
-echo "---"
+pkgs=(
+    build-essential
+    curl
+    gfortran
+    git
+    libssl-dev
+    openssl
+    pkg-config
+)
+
+apt update
+apt install -y ${pkgs[@]}
 
 # install rustup
-curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- --default-toolchain none -y
 
 for version in ${RUST_V}; do
     # the last command will be the default
+    rustup install ${version} --profile minimal
     rustup default ${version}
     # install LLVM tools needed for code coverage
-    # this is now called `llvm-tools`, but for 1.64 it's still called `llvm-tools-preview`
-    rustup component add llvm-tools-preview
+    rustup component add llvm-tools
 done
 
-# # install Fortran compiler
-# apt update
-# apt install gfortran -y
-
-# needed by the vendored OpenSSL used by `cargo-c`
-yum -y install perl-IPC-Cmd
-
-# needed by `pineappl_applgrid` with `--features=static`
-yum -y install zlib-static
-
 # install cargo-c needed for the CAPI
-cargo install --locked cargo-c --version ${CARGOC_V} --features=vendored-openssl
+cargo install --locked cargo-c --version ${CARGOC_V}
 
 # remove files generated by cargo
 rm -r /usr/local/cargo/registry
 
-# install LHAPDF - use Wayback Machine as a mirror if hepforge is offline
-( curl "https://lhapdf.hepforge.org/downloads/?f=LHAPDF-${LHAPDF_V}.tar.gz" || \
-    curl "https://web.archive.org/web/20211018095814/https://lhapdf.hepforge.org/downloads/?f=LHAPDF-6.4.0.tar.gz" ) | tar xzf -
+# install LHAPDF
+curl -L "https://lhapdf.hepforge.org/downloads/?f=LHAPDF-${LHAPDF_V}.tar.gz" | tar xzf -
 cd LHAPDF-${LHAPDF_V}
-# compile static libraries with PIC to make statically linking PineAPPL's CLI work
-# see also https://users.rust-lang.org/t/why-does-crelocation-model-dynamic-no-pic-help-although-it-shouldnt/109012
-./configure --disable-python --with-pic=yes
+./configure --disable-python
 make -j V=1
 make install
 ldconfig
@@ -53,20 +46,22 @@ for pdf in NNPDF31_nlo_as_0118_luxqed NNPDF40_nnlo_as_01180 NNPDF40_nlo_as_01180
     curl "https://lhapdfsets.web.cern.ch/current/${pdf}.tar.gz" | tar xzf - -C /usr/local/share/LHAPDF
 done
 
-# install zlib compiled with `-fPIC`
+# install Tanjona's polarized PDF set
+curl "https://data.nnpdf.science/pineappl/pdfs/240608-tr-pol-nlo-100.tar.gz" | tar xzf - -C /usr/local/share/LHAPDF
+
+# install zlib; we need to link against it statically
 curl "https://www.zlib.net/zlib-${ZLIB_V}.tar.gz" | tar xzf -
 cd zlib-${ZLIB_V}
-CFLAGS=-fPIC ./configure --prefix=/usr/local
+./configure --prefix=/usr/local
 make -j
 make install
 ldconfig
 cd ..
 
 # install APPLgrid
-curl "https://applgrid.hepforge.org/downloads?f=applgrid-${APPLGRID_V}.tgz" | tar xzf -
+curl -L "https://applgrid.hepforge.org/downloads?f=applgrid-${APPLGRID_V}.tgz" | tar xzf -
 cd applgrid-${APPLGRID_V}
-# compile static libraries with PIC to make statically linking PineAPPL's CLI work
-./configure --without-root --with-pic=yes
+./configure --without-root
 make -j
 make install
 ldconfig
@@ -77,8 +72,7 @@ cd ..
 # install fastNLO
 curl "https://fastnlo.hepforge.org/code/v25/fastnlo_toolkit-${FASTNLO_V}.tar.gz" | tar xzf -
 cd fastnlo_toolkit-${FASTNLO_V}
-# compile static libraries with PIC to make statically linking PineAPPL's CLI work
-./configure --prefix=/usr/local/ --with-pic=yes
+./configure --prefix=/usr/local/
 make -j V=1
 make install
 ldconfig