chore: Adopt SPEC-0, test on 3.14

.github/workflows/build-test-publish.yml

@@ -43,14 +43,82 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: hynek/build-and-inspect-python-package@v2
+      - uses: hynek/build-and-inspect-python-package@2abe76da66d0a6a4a227101f9348ee855797cfa5 # v3.0.1
+
+  cache-test-data:
+    if: "!contains(github.event.head_commit.message, '[skip ci]' && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name != 'nipreps/sdcflows'))"
+    runs-on: ubuntu-latest
+    env:
+      TEST_DATA_HOME: /home/runner/sdcflows-tests
+
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Git settings (pacify DataLad)
+      run: |
+        git config --global user.name 'NiPreps Bot'
+        git config --global user.email 'nipreps@gmail.com'
+    - name: Install the latest version of uv
+      uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+    - name: Install DataLad
+      run: |
+        uv tool install datalad \
+          --with-executables-from=datalad-next \
+          --with-executables-from=datalad-osf \
+          --with-executables-from=git-annex
+
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ${{ env.TEST_DATA_HOME }}
+        key: data-cache-v3
+    - name: Install test data
+      run: |
+        mkdir -p ${{ env.TEST_DATA_HOME }}
+        cd ${{ env.TEST_DATA_HOME }}
+
+        # ds001600
+        datalad install -r https://github.com/nipreps-data/ds001600.git
+        datalad update -r --merge -d ds001600/
+        datalad get -r -J 2 -d ds001600/ ds001600/sub-1/
+
+        # HCP/sub-101006
+        datalad install -r https://github.com/nipreps-data/HCP101006.git
+        datalad update -r --merge -d HCP101006/
+        datalad get -r -J 2 -d HCP101006 HCP101006/*
+
+        # ds001771
+        datalad install -r https://github.com/nipreps-data/ds001771.git
+        datalad update -r --merge -d ds001771/
+        datalad get -r -J 2 -d ds001771/ ds001771/sub-36/*
+        datalad get -r -J 2 -d ds001771/derivatives ds001771/derivatives/openneuro/sub-36/*
+
+        # ds000054
+        datalad install -r https://github.com/nipreps-data/ds000054.git
+        datalad update --merge -d ds000054/
+        datalad get -r -d ds000054/ ds000054/sub-100185/*
+        datalad get -r -J 2 -d ds000054/ ds000054/derivatives/smriprep-0.6/sub-100185/anat/
+
+        # ds000206
+        datalad install -r https://github.com/nipreps-data/ds000206.git
+        datalad update -r --merge -d ds000206/
+        datalad get -r -J 2 -d ds000206/ ds000206/sub-05/
+
+        # Brain extraction tests
+        datalad install -r https://github.com/nipreps-data/brain-extraction-tests
+        datalad update --merge -d brain-extraction-tests/
+        datalad get -r -J 2 -d brain-extraction-tests brain-extraction-tests/*
+
+        # HCPH pilot
+        datalad install -r https://github.com/nipreps-data/hcph-pilot_fieldmaps.git
+        datalad update -r --merge -d hcph-pilot_fieldmaps/
+        datalad get -r -J 2 -d hcph-pilot_fieldmaps/ hcph-pilot_fieldmaps/*
 
   test:
     if: "!contains(github.event.head_commit.message, '[skip ci]' && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name != 'nipreps/sdcflows'))"
     runs-on: ubuntu-latest
+    needs: [cache-test-data]
     env:
       TEST_DATA_HOME: /home/runner/sdcflows-tests
       FSLOUTPUTTYPE: NIFTI_GZ
@@ -65,28 +133,23 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.10", "3.11", "3.12", "3.13"]
-        dependencies:  ["latest", "pre"]
+        python-version: ["3.12", "3.13", "3.14"]
+        dependencies:  ["latest"] # , "pre"]
         marks: ["fast"]
         include:
-          - python-version: "3.10"
+          - python-version: "3.12"
             dependencies: "min"
             marks: "fast"
-          - python-version: "3.10"
+          - python-version: "3.12"
             dependencies: "latest"
             marks: "slow"
-          - python-version: "3.13"
+          - python-version: "3.14"
             dependencies: "latest"
             marks: "veryslow"
-        exclude:
-          - python-version: "3.10"
-            dependencies: "pre"
-          - python-version: "3.11"
-            dependencies: "pre"
 
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/cache@v4
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: /var/lib/apt
         key: apt-cache-v3
@@ -102,7 +165,7 @@ jobs:
                         libglu1-mesa-dev libglw1-mesa     \
                         libxm4 build-essential
 
-    - uses: actions/cache@v4
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: /opt/afni
         key: afni-v1
@@ -117,20 +180,16 @@ jobs:
         ls -l ${AFNI_HOME}
         echo "PATH=${AFNI_HOME}:$PATH" | tee -a $GITHUB_ENV
 
-    - name: Git settings (pacify DataLad)
-      run: |
-        git config --global user.name 'NiPreps Bot'
-        git config --global user.email 'nipreps@gmail.com'
     - name: Install the latest version of uv
-      uses: astral-sh/setup-uv@v6
+      uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
     - name: Set up Python ${{ matrix.python-version }}
-      uses: conda-incubator/setup-miniconda@v3
+      uses: conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 # v4.0.1
       with:
         auto-update-conda: true
         auto-activate-base: true
         python-version: ${{ matrix.python-version }}
         channels: https://fsl.fmrib.ox.ac.uk/fsldownloads/fslconda/public/,conda-forge,defaults
-    - uses: actions/cache@v4
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       id: conda
       env:
         CACHE_NUM: v5
@@ -139,16 +198,10 @@ jobs:
           ~/conda_pkgs_dir
           /home/runner/.cache/pip
         key: python-${{ matrix.python-version }}-${{ env.CACHE_NUM }}
-    - name: Install DataLad
-      run: |
-        conda install git-annex=*=alldep*
-        uv tool install datalad --with=datalad-next --with=datalad-osf
-        uv tool install datalad-osf --with=datalad-next
     - name: Install fsl and ANTs
       run: |
-        # libitk 5.4.1+ segfaults with ants 2.5.4
-        conda install fsl-fugue fsl-topup ants 'libitk=5.4.0'
-    - uses: actions/cache@v4
+        conda install fsl-fugue fsl-topup ants
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.cache/templateflow
         key: tf-cache-v1
@@ -158,53 +211,10 @@ jobs:
       run: |
         uv run tools/cache_templateflow.py
 
-    - uses: actions/cache@v4
+    - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ env.TEST_DATA_HOME }}
-        key: data-cache-v2
-        restore-keys: |
-          data-cache-
-    - name: Install test data
-      run: |
-        mkdir -p ${{ env.TEST_DATA_HOME }}
-        cd ${{ env.TEST_DATA_HOME }}
-
-        # ds001600
-        datalad install -r https://github.com/nipreps-data/ds001600.git
-        datalad update -r --merge -d ds001600/
-        datalad get -r -J 2 -d ds001600/ ds001600/sub-1/
-
-        # HCP/sub-101006
-        datalad install -r https://github.com/nipreps-data/HCP101006.git
-        datalad update -r --merge -d HCP101006/
-        datalad get -r -J 2 -d HCP101006 HCP101006/*
-
-        # ds001771
-        datalad install -r https://github.com/nipreps-data/ds001771.git
-        datalad update -r --merge -d ds001771/
-        datalad get -r -J 2 -d ds001771/ ds001771/sub-36/*
-        datalad get -r -J 2 -d ds001771/derivatives ds001771/derivatives/openneuro/sub-36/*
-
-        # ds000054
-        datalad install -r https://github.com/nipreps-data/ds000054.git
-        datalad update --merge -d ds000054/
-        datalad get -r -d ds000054/ ds000054/sub-100185/*
-        datalad get -r -J 2 -d ds000054/ ds000054/derivatives/smriprep-0.6/sub-100185/anat/
-
-        # ds000206
-        datalad install -r https://github.com/nipreps-data/ds000206.git
-        datalad update -r --merge -d ds000206/
-        datalad get -r -J 2 -d ds000206/ ds000206/sub-05/
-
-        # Brain extraction tests
-        datalad install -r https://gin.g-node.org/nipreps-data/brain-extraction-tests
-        datalad update --merge -d brain-extraction-tests/
-        datalad get -r -J 2 -d brain-extraction-tests brain-extraction-tests/*
-
-        # HCPH pilot
-        datalad install -r https://github.com/nipreps-data/hcph-pilot_fieldmaps.git
-        datalad update -r --merge -d hcph-pilot_fieldmaps/
-        datalad get -r -J 2 -d hcph-pilot_fieldmaps/ hcph-pilot_fieldmaps/*
+        key: data-cache-v3
 
     - name: Set FreeSurfer variables
       run: |
@@ -228,7 +238,7 @@ jobs:
     - name: Run tox
       run: tox -v --exit-and-dump-after 1200
 
-    - uses: codecov/codecov-action@v5
+    - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
       if: ${{ always() }}
@@ -245,10 +255,10 @@ jobs:
 
     steps:
       - name: Download packages built by build-and-inspect-python-package
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: Packages
           path: dist
 
       - name: Upload package to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

.github/workflows/docs-build-update.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ssh-key: "${{ secrets.NIPREPS_DEPLOY }}"
         fetch-depth: 0
@@ -49,7 +49,7 @@ jobs:
         sudo apt-get install -y --no-install-recommends graphviz pandoc texlive
 
     - name: Set up Python 3
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: 3
 

.pre-commit-config.yaml

@@ -15,6 +15,6 @@ repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: v0.15.15
     hooks:
-      - id: ruff
+      - id: ruff-check
         args: [ --fix ]
       - id: ruff-format