From 5bff5d4764e2873bf962a1d30844d9d5681baa03 Mon Sep 17 00:00:00 2001
From: Ludovic Henry <git@ludovic.dev>
Date: Mon, 14 Sep 2026 12:52:39 +0200
Subject: [PATCH] vesin: pin numpy/scipy/matplotlib to riscv64 wheels in CI
 tests

ase (a CIBW_TEST_REQUIRES-only dependency) pulls in numpy/scipy/matplotlib.
PIP_ONLY_BINARY only covered cmake, so pip could resolve a newer PyPI-only
release of one of ase's own deps and fall back to building it from source
(gotcha 291's pattern: a test dependency's own runtime deps are what break,
not the test dependency itself).
---
 .github/workflows/build-vesin.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-vesin.yml b/.github/workflows/build-vesin.yml
index a5129fb43ea..50ba67c31d5 100644
--- a/.github/workflows/build-vesin.yml
+++ b/.github/workflows/build-vesin.yml
@@ -63,7 +63,10 @@ jobs:
           CIBW_BUILD_FRONTEND: build
           CIBW_ENVIRONMENT: >-
             PIP_EXTRA_INDEX_URL=https://pypi.riseproject.dev/simple/
-            PIP_ONLY_BINARY=cmake
+            PIP_ONLY_BINARY=cmake,numpy,scipy,matplotlib
+          # ase (a test-only dep) pulls in numpy/scipy/matplotlib; without pinning
+          # them to our registry's riscv64 wheels too, pip can resolve a newer
+          # PyPI-only release of one and fall back to a from-source build (gotcha 291).
           CIBW_TEST_REQUIRES: pytest pytest-timeout ase
           # {project} is the checkout root, not package-dir, since python/vesin's CMakeLists.txt
           # needs the sibling top-level vesin/ (C++ library) directory.