matscipy: write the ase constraint inside the cibuildwheel container

CIBW_TEST_COMMAND runs matscipy's whole build+test lifecycle inside the
manylinux Docker container; neither github.workspace nor runner.temp is a
path that container ever sees; a host-side step writing to either one is
invisible to it, which is why both prior attempts hit the same "Could not
open constraint file" error. before-build/build/repair/test all run in
that same container instance per identifier, so writing the constraint
file from CIBW_BEFORE_BUILD instead puts it on a path the container
actually has.

Author: luhenry

.github/workflows/build-matscipy.yml

@@ -63,35 +63,34 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      # ase 3.28.0 removed the whole ase.constraints module (UnitCellFilter and friends)
-      # that this v1.2.0 tag's own tests/ still imports from; matscipy's pyproject.toml
-      # floor (ase>=3.26.0) doesn't cap the other end, so an unconstrained resolve picks
-      # today's ase and breaks 29 tests / errors on 12 modules. A PIP_CONSTRAINT file
-      # (below, via CIBW_TEST_ENVIRONMENT) caps it for every pip invocation in the test
-      # phase, however cibuildwheel orders installs -- unlike a version spec embedded
-      # directly in CIBW_TEST_REQUIRES, which a prior commit tried and which silently did
-      # nothing (the quoted token was a literal string, not a parsed requirement).
-      # runner.temp, not github.workspace: cibuildwheel's manylinux test phase runs pip
-      # inside the same docker container as the build, and github.workspace's host path
-      # isn't what's mounted there on this self-hosted runner (confirmed by a failed
-      # rerun); runner.temp is (build-kivy.yml's own PIP_CONSTRAINT fix proved it visible
-      # in that same test-phase environment).
-      - name: Constrain ase for the test run
-        run: echo 'ase<3.28' > "${{ runner.temp }}/ase-constraint.txt"
-
       - name: Build wheels
         uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
         with:
           only: ${{ matrix.python }}-manylinux_riscv64
         env:
           CIBW_BUILD_FRONTEND: build
-          CIBW_BEFORE_BUILD: pip install meson meson-python ninja
+          # ase 3.28.0 removed the whole ase.constraints module (UnitCellFilter and
+          # friends) that this v1.2.0 tag's own tests/ still imports from; matscipy's
+          # pyproject.toml floor (ase>=3.26.0) doesn't cap the other end, so an
+          # unconstrained resolve picks today's ase and breaks 29 tests / errors on 12
+          # modules. A version spec embedded directly in CIBW_TEST_REQUIRES silently
+          # does nothing (the quoted token is a literal string, not a parsed
+          # requirement), so this pins it via a PIP_CONSTRAINT file instead.
+          # CIBW_TEST_COMMAND runs matscipy's whole build+test lifecycle inside the
+          # manylinux Docker container, and neither github.workspace nor runner.temp
+          # -- both host paths -- is visible there (two prior attempts confirmed
+          # each one the hard way). before-build/build/repair/test share one container
+          # instance per identifier, so write the file here, from inside that
+          # container, instead of from a host-side step.
+          CIBW_BEFORE_BUILD: |
+            pip install meson meson-python ninja
+            echo 'ase<3.28' > /tmp/ase-constraint.txt
           CIBW_ENVIRONMENT: >-
             PIP_EXTRA_INDEX_URL=https://pypi.riseproject.dev/simple/
             PIP_ONLY_BINARY=numpy,scipy,matplotlib,contourpy,kiwisolver,pillow
           # Upstream's wheel job only imports the extension; run its tests.yml suite instead.
           CIBW_TEST_REQUIRES: pytest pytest-subtests pytest-timeout pytest-xdist sympy
-          CIBW_TEST_ENVIRONMENT: PIP_CONSTRAINT=${{ runner.temp }}/ase-constraint.txt
+          CIBW_TEST_ENVIRONMENT: PIP_CONSTRAINT=/tmp/ase-constraint.txt
           CIBW_TEST_COMMAND: cd {project}/tests && pytest -v --durations=20 --timeout=600 -n auto
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1