Release 0.4.6

[Wenbo Gong (WenboGong)]

Summary

Prepares the v0.4.6 release.

• Version bump: pyproject.toml goes from 0.4.5 to 0.4.6. The publish workflow builds from this version.

• Publish workflow fix: .github/workflows/pypi-publish.yml pinned actions/upload-artifact v3.2.1. GitHub has retired v3, and jobs using it fail before reaching the PyPI upload step. It's now v7.0.1, pinned to the full commit SHA like the other actions. v7 takes the same name / path / retention-days inputs. For release events the workflow runs from the tagged commit, so this has to be on main before the release is created.

• CI cache fix: .github/workflows/ci-build.yml now includes the Python version in the virtualenv cache key. A cache saved on a runner with Python 3.10.22 was restored on a runner with 3.10.21. Poetry found the venv broken and recreated it empty, and because the cache "hit", the install step was skipped. Every pre-commit hook then failed with Command not found. This happened on the first CI run of this PR.

Verification

• Publish workflow's build step, done locally: clean python:3.10, latest Poetry (2.5.1), poetry build.
  • It produces causica-0.4.6-py3-none-any.whl and causica-0.4.6.tar.gz.
  • Both pass twine check.
  • Metadata shows Version: 0.4.6, torch>=2.10.0,<3.0.0, pytorch-lightning[extra]>=2.4.0,<3.0.0, tensordict>=0.11.0.
• Installed the way end users get it: pip install of the built wheel into a fresh venv.
  • It resolves to the newest allowed versions: torch 2.14.1, pytorch-lightning 2.6.6, tensordict 0.14.2, urllib3 2.8.0, cryptography 50.0.2.
  • pip check is clean.
  • pytest test against the installed wheel (source tree moved aside): 693 passed.
• poetry check --lock passes, so the lock is unaffected by the version bump.

Next step after merge

Create GitHub release v0.4.6 on main. That triggers pypi-publish.yml and uploads to PyPI via trusted publishing.

Proposed release notes:

Dependency upgrades (#162)

• torch 2.0.0 → >=2.10 (CUDA 12/13 wheels; adds support for Hopper/H100 GPUs)
• pytorch-lightning >=2.4, tensordict >=0.11, jsonargparse >=4.39
• urllib3 2.8.0, cryptography 50.0.2 and pip >=25.3 in the Docker image

Compatibility fixes (#162)

• Checkpoints load with PyTorch's default torch.load(weights_only=True). The causica enums stored in checkpoint hyperparameters are allowlisted.
• Fixes for API and type changes in newer torch and tensordict.

CI (#120, #168, this PR): actions pinned to commit SHAs, the redundant CodeQL workflow removed, and the PyPI publish workflow's artifact upload fixed.

Breaking: causica 0.4.6 needs torch ≥ 2.10. Stay on 0.4.5 if you need torch 2.0.

🤖 Generated with Claude Code