Fixed numpy version

[digicosmos86]

numba still only supports numpy>=2.4.0, <2.5.0. However, dependency version resolving in CI can install numpy >= 2.5, which causes numba to break, because its source code still uses deprecated numpy functions, which are removed in numpy 2.5. This PR fixes this issue

This PR also updates the devcontainer and docker build workflows, so that they only run on merge to main when relevant files have changed. No need to run them at every push

Summary by CodeRabbit

• Chores
  • Improved repository configuration and local development file handling.
  • Updated maintenance and quality-tooling settings for a more consistent development experience.
  • Refined environment settings to support current runtime and testing workflows.
  • Updated development workflows to validate changes on pushes to the main branch.
  • Enhanced Docker image automation for main-branch builds, releases, and multi-platform publishing.

[coderabbitai]

📝 Walkthrough

Walkthrough

The change updates local ignore rules, package version constraints, and GitHub Actions workflow triggers. Docker builds now select platform and push behavior based on the triggering event.

Changes

Repository configuration

Layer / File(s)	Summary
Local artifact ignore rules .codegraph/.gitignore, .gitignore	The ignore rules exclude local CodeGraph contents and .claude/CLAUDE.local.md.
Dependency constraints pyproject.toml	Runtime requirements update absl-py, numpy, and numpyro. The direct scipy dependency is removed. Ruff and pytest minimum versions are raised.
Automation triggers and build modes .github/workflows/devcontainer.yml, .github/workflows/docker-image.yml	The workflows add main-branch push handling. Docker builds use linux/amd64 for pushes and multi-architecture builds for releases and other supported events.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary change: updating the NumPy version constraint.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 1136-fix-numpy-deprecations

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pyproject.toml`:
- Around line 27-35: Restore SciPy in the [project.dependencies] list because
plotting modules quantile_probability.py and predictive.py import scipy.stats at
runtime. Add a compatible scipy version constraint alongside the existing
numerical dependencies, rather than removing the dependency while those imports
remain.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: dec3f9ec-bf63-4d32-ab13-cb0816dfae87

📥 Commits

Reviewing files that changed from the base of the PR and between 8114267 and 53d2c0b.

📒 Files selected for processing (3)

• .codegraph/.gitignore
• .gitignore
• pyproject.toml

[AlexanderFengler]

I've closed #1145 in favor of this one. While verifying the overlap I dug into the resolution failure in depth — three findings that are worth folding in here, in decreasing order of importance.

1. This PR deletes scipy>=1.10 — I think unintentionally

The diff drops "scipy>=1.10" plus the two explanatory comments above it and above ssm-simulators. I checked whether that was a three-dot-diff artifact from the branch being behind main, and it isn't: the branch is 0 commits behind main (merge-base == origin/main HEAD), and commit 53d2c0bf actively removes the line, which had entered main three days earlier in #1123.

scipy is imported directly in two places, so the declaration should stay:

src/hssm/plotting/predictive.py:13          from scipy.stats import gaussian_kde
src/hssm/plotting/quantile_probability.py:14  from scipy.stats import chi2

Nothing breaks today — pymc, hddm-wfpt and ssm-simulators all pull scipy transitively — so it's latent rather than urgent. The pytest/ruff entries also moved to the end of the dev list, which together suggests the array was regenerated by tooling rather than hand-edited.

2. The numpy>=2.4.0 floor is stricter than anything in the graph requires

The <2.5 upper bound is the load-bearing half and is correct. The floor is the part I'd reconsider: nothing in HSSM or its dependency tree asks for numpy 2.4. The strongest floors anywhere in the resolved graph are pytensor / scipy / ssm-simulators / hddm-wfpt at >=2.0, jax at >=2.1, and pandas at >=2.3.3 (py3.14 only). Since HSSM is a published library, >=2.4.0 propagates a one-minor-version window to every downstream consumer and shrinks their solvable space for no benefit here. numpy>=2.0,<2.5 gives identical protection — I verified both resolve to exactly the same lock (numba 0.66.0, numpy 2.4.6, llvmlite 0.48.0).

3. There's a fix that closes the actual hole without publishing any numpy cap

The precise mechanism turned out to need three conditions, all landing the same week:

• numba's metadata gap. Every stable numba in pytensor's window (numba<=0.66.0,>=0.58) declares numpy>=1.22,<2.5. The sole exception is the pre-release 0.63.0b1, whose metadata is just numpy>=1.22. (So numba's floor is >=1.22, not >=2.4.0 — worth correcting in the PR description.)
• bayesflow 2.0.13, uploaded 2026-08-05 11:47 UTC, raised its floor from numpy>=2.2.6 to numpy>=2.5.1. It lives in the notebook group and is never installed in CI — but uv sync builds one universal lock across all groups, so it set numpy for the installed set anyway. Bisecting the index with uv lock --exclude-newer puts the flip exactly at that upload.
• uv 0.12.0 changed the default pre-release policy to if-necessary. Under uv 0.11.21 the same pyproject resolves to numba 0.66.0 / numpy 2.4.6 (it backtracks bayesflow to 2.0.12 instead); under 0.12.x it reaches for the beta.

So the hole is specifically a beta's missing cap becoming reachable. Closing that directly:

[tool.uv]
prerelease = "disallow"     # or: prerelease-package = ["numba"] (uv >= 0.12.1)

With no numpy pin at all, that resolves under uv 0.12.2 to numba 0.66.0 / numpy 2.4.6 / llvmlite 0.48.0 / bayesflow 2.0.12 — identical to both cap variants and to the last green run. The appeal is that it never reaches requires_dist, so downstream users aren't constrained by a workaround for our own resolution quirk (and pip wouldn't pick a pre-release anyway).

Belt-and-braces would be that setting plus numpy>=2.0,<2.5. Either way, worth writing the removal condition next to the pin so it doesn't calcify: lift when numba 0.67 is stable and pytensor relaxes numba<=0.66.0. numba 0.67.0rc1 already fixes it (numpy<2.6, call site guarded by numpy_version < (2, 5)), but pytensor's ceiling currently excludes it — probably worth an upstream issue with pymc-devs.

Happy to open any of these as a small commit on your branch if that's easier than folding them in yourself.

[AlexanderFengler]

lgtm let's merge this and drop my version of this.