Merge branch 'main' into auto

.github/workflows/autofix.yml

@@ -13,6 +13,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: '3.12'

.github/workflows/codeql-analysis.yml

@@ -39,6 +39,8 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
@@ -48,11 +50,11 @@ jobs:
         # If you wish to specify custom queries, you can do so here or in a config file.
         # By default, queries listed here will override any specified in a config file.
         # Prefix the list here with "+" to use these queries and those in the config file.
-        
+
         # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
         # queries: security-extended,security-and-quality
 
-        
+
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
@@ -61,7 +63,7 @@ jobs:
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
 
-    #   If the Autobuild fails above, remove it and uncomment the following three lines. 
+    #   If the Autobuild fails above, remove it and uncomment the following three lines.
     #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
 
     # - run: |

.github/workflows/credit.yml

@@ -6,19 +6,20 @@ on:  # yamllint disable-line rule:truthy
     - cron: '0 0 1 * *'  # At 00:00 on day-of-month 1
   workflow_dispatch:
 
-permissions:
-  contents: write
-  pull-requests: write
-
 jobs:
   update_credit:
+    permissions:
+      contents: write
+      pull-requests: write
     name: Update
     runs-on: ubuntu-latest
     env:
       GH_TOKEN: ${{ github.token }}
       GITHUB_TOKEN: ${{ github.token }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: '3.12'
@@ -39,6 +40,6 @@ jobs:
           git checkout -b credit
           git commit -am "MAINT: Update code credit [ci skip]"
           git push origin credit
-          PR_NUM=$(gh pr create --base main --head credit --title "MAINT: Update code credit" --body "Created by \"${{ github.workflow }}\" GitHub action." --label "no-changelog-entry-needed")
+          PR_NUM=$(gh pr create --base main --head credit --title "MAINT: Update code credit" --body "Created by credit GitHub action." --label "no-changelog-entry-needed")
           echo "Opened https://github.com/mne-tools/mne-python/pull/${PR_NUM}" >> $GITHUB_STEP_SUMMARY
         if: steps.status.outputs.dirty == 'true'

.github/workflows/release.yml

@@ -17,6 +17,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: '3.10'

.github/workflows/tests.yml

@@ -18,6 +18,8 @@ jobs:
     timeout-minutes: 3
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: '3.12'
@@ -56,6 +58,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
+          - os: ubuntu-latest
+            python: '3.13'
+            kind: pip
           - os: ubuntu-latest
             python: '3.12'
             kind: pip-pre
@@ -81,6 +86,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
       - run: ./tools/github_actions_env_vars.sh
       # Xvfb/OpenGL
       - uses: pyvista/setup-headless-display-action@v3

.pre-commit-config.yaml

@@ -1,7 +1,7 @@
 repos:
   # Ruff mne
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.8.1
+    rev: v0.8.2
     hooks:
       - id: ruff
         name: ruff lint mne
@@ -80,6 +80,11 @@ repos:
         files: pyproject.toml
         additional_dependencies: ["mne"]
 
+  # zizmor
+  - repo: https://github.com/woodruffw/zizmor-pre-commit
+    rev: v0.8.0
+    hooks:
+      - id: zizmor
 
 # these should *not* be run on CIs:
 ci:

azure-pipelines.yml

@@ -171,7 +171,8 @@ stages:
               python -m pip install --progress-bar off --upgrade pip
               python -m pip install --progress-bar off --upgrade --pre --only-binary=\"numpy,scipy,matplotlib,vtk\" numpy scipy matplotlib vtk
               python -c "import vtk"
-              python -m pip install --progress-bar off --upgrade -ve .[full,test_extra]
+              # Bug on 2.5.13 https://github.com/openmeeg/openmeeg/issues/700
+              python -m pip install --progress-bar off --upgrade -ve .[full,test_extra] "openmeeg==2.5.12"
             displayName: 'Install dependencies with pip'
           - bash: |
               set -e

doc/changes/devel/13011.other.rst

@@ -0,0 +1 @@
+Repository CI security is now audited using `zizmor <https://woodruffw.github.io/zizmor>`__, by `Eric Larson`_.

doc/changes/devel/13021.dependency.rst

@@ -0,0 +1 @@
+Compatibility improved for Python 3.13, by `Eric Larson`_.

doc/development/contributing.rst

@@ -860,7 +860,7 @@ data with a meaningful middle (zero-point) and ``Reds`` otherwise. This applies
 to both visualization functions and tutorials/examples.
 
 
-.. _run_tests:
+.. _run-tests:
 
 Running the test suite
 ~~~~~~~~~~~~~~~~~~~~~~

mne/evoked.py

@@ -615,7 +615,8 @@ def plot_topo(
         exclude="bads",
         show=True,
     ):
-        """
+        """.
+
         Notes
         -----
         .. versionadded:: 0.10.0

mne/tests/test_docstring_parameters.py

@@ -76,6 +76,7 @@ def _func_name(func, cls=None):
 error_ignores = {
     # These we do not live by:
     "GL01",  # Docstring should start in the line immediately after the quotes
+    "GL02",  # Closing quotes on own line (doesn't work on Python 3.13 anyway)
     "EX01",
     "EX02",  # examples failed (we test them separately)
     "ES01",  # no extended summary

mne/utils/docs.py

@@ -5109,6 +5109,8 @@ def copy_doc(source):
     This is useful when inheriting from a class and overloading a method. This
     decorator can be used to copy the docstring of the original method.
 
+    Docstrings are processed by :func:`python:inspect.cleandoc` before being used.
+
     Parameters
     ----------
     source : function
@@ -5131,15 +5133,16 @@ def copy_doc(source):
     ...         ''' this gets appended'''
     ...         pass
     >>> print(B.m1.__doc__)
-    Docstring for m1 this gets appended
+    Docstring for m1
+    this gets appended
     """
 
     def wrapper(func):
         if source.__doc__ is None or len(source.__doc__) == 0:
             raise ValueError("Cannot copy docstring: docstring was empty.")
         doc = source.__doc__
         if func.__doc__ is not None:
-            doc += func.__doc__
+            doc += f"\n{inspect.cleandoc(func.__doc__)}"
         func.__doc__ = doc
         return func
 
@@ -5158,6 +5161,10 @@ def copy_function_doc_to_method_doc(source):
     function.  This pattern is prevalent in for example the plotting functions
     of MNE.
 
+    Docstrings are parsed by :func:`python:inspect.cleandoc` before being used.
+    If indentation and newlines are important, make the first line ``.``, and the dot
+    will be removed and all following lines dedented jointly.
+
     Parameters
     ----------
     source : function
@@ -5193,7 +5200,8 @@ def copy_function_doc_to_method_doc(source):
     >>> class A:
     ...     @copy_function_doc_to_method_doc(plot_function)
     ...     def plot(self, a, b):
-    ...         '''
+    ...         '''.
+    ...
     ...         Notes
     ...         -----
     ...         .. versionadded:: 0.13.0
@@ -5202,26 +5210,31 @@ def copy_function_doc_to_method_doc(source):
     >>> print(A.plot.__doc__)
     Docstring for plotting function.
     <BLANKLINE>
-        Parameters
-        ----------
-        a : int
-            Some parameter
-        b : int
-            Some parameter
-    <BLANKLINE>
-            Notes
-            -----
-            .. versionadded:: 0.13.0
+    Parameters
+    ----------
+    a : int
+        Some parameter
+    b : int
+        Some parameter
     <BLANKLINE>
+    Notes
+    -----
+    .. versionadded:: 0.13.0
     """  # noqa: D410, D411, D214, D215
 
     def wrapper(func):
-        doc = source.__doc__.split("\n")
+        # Work with cleandoc'ed sources (py3.13-compat)
+        doc = inspect.cleandoc(source.__doc__).split("\n")
+        if func.__doc__ is not None:
+            func_doc = inspect.cleandoc(func.__doc__)
+            if func_doc[:2] == ".\n":
+                func_doc = func_doc[2:]
+            func_doc = f"\n{func_doc}"
+        else:
+            func_doc = ""
+
         if len(doc) == 1:
-            doc = doc[0]
-            if func.__doc__ is not None:
-                doc += func.__doc__
-            func.__doc__ = doc
+            func.__doc__ = f"{doc[0]}{func_doc}"
             return func
 
         # Find parameter block
@@ -5269,7 +5282,7 @@ def wrapper(func):
                 break
         else:
             # End of docstring reached
-            first_parameter_end = line
+            first_parameter_end = line + 1
             first_parameter = parameter_block
 
         # Copy the docstring, but remove the first parameter
@@ -5278,9 +5291,7 @@ def wrapper(func):
             + "\n"
             + "\n".join(doc[first_parameter_end:])
         )
-        if func.__doc__ is not None:
-            doc += func.__doc__
-        func.__doc__ = doc
+        func.__doc__ = f"{doc}{func_doc}"
         return func
 
     return wrapper

mne/utils/tests/test_config.py

@@ -129,7 +129,7 @@ def test_sys_info_complete():
     pyproject = tomllib.loads(pyproject.read_text("utf-8"))
     deps = pyproject["project"]["optional-dependencies"]["test_extra"]
     for dep in deps:
-        dep = dep.split("[")[0].split(">")[0]
+        dep = dep.split("[")[0].split(">")[0].strip()
         assert f" {dep}" in out, f"Missing in dev config: {dep}"
 
 

mne/utils/tests/test_docs.py

@@ -195,28 +195,29 @@ def method_f3(self):
 
     assert (
         A.method_f1.__doc__
-        == """Docstring for f1.
-
-        Parameters
-        ----------
-        a : int
-            Parameter a
-        b : int
-            Parameter b
-        """
+        == """\
+Docstring for f1.
+
+Parameters
+----------
+a : int
+    Parameter a
+b : int
+    Parameter b"""
     )
 
     assert (
         A.method_f2.__doc__
-        == """Docstring for f2.
+        == """\
+Docstring for f2.
 
-        Returns
-        -------
-        nothing.
-        method_f3 own docstring"""
+Returns
+-------
+nothing.
+method_f3 own docstring"""
     )
 
-    assert A.method_f3.__doc__ == "Docstring for f3.\n\n        "
+    assert A.method_f3.__doc__ == "Docstring for f3.\n\n"
     pytest.raises(ValueError, copy_function_doc_to_method_doc(f5), A.method_f1)
 
 

tools/azure_dependencies.sh

@@ -5,7 +5,7 @@ SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 STD_ARGS="--progress-bar off --upgrade"
 python -m pip install $STD_ARGS pip setuptools wheel
 if [ "${TEST_MODE}" == "pip" ]; then
-	python -m pip install $STD_ARGS --only-binary="numba,llvmlite,numpy,scipy,vtk,dipy" -e .[test,full]
+	python -m pip install $STD_ARGS --only-binary="numba,llvmlite,numpy,scipy,vtk,dipy,openmeeg" -e .[test,full] "openmeeg==2.5.12"
 elif [ "${TEST_MODE}" == "pip-pre" ]; then
 	${SCRIPT_DIR}/install_pre_requirements.sh
 	python -m pip install $STD_ARGS --pre -e .[test_extra]

tools/circleci_dependencies.sh

@@ -19,4 +19,4 @@ python -m pip install --upgrade --progress-bar off \
     mne-icalabel mne-lsl mne-microstates mne-nirs mne-rsa \
     neurodsp neurokit2 niseq nitime openneuro-py pactools \
     plotly pycrostates pyprep pyriemann python-picard sesameeg \
-    sleepecg tensorpac yasa meegkit
+    sleepecg tensorpac yasa meegkit eeg_positions

tools/github_actions_dependencies.sh

@@ -20,6 +20,11 @@ if [ ! -z "$CONDA_ENV" ]; then
 		INSTALL_KIND="test"
 		STD_ARGS="--progress-bar off"
 	fi
+elif [[ "${MNE_CI_KIND}" == "pip" ]]; then
+	# Only used for 3.13 at the moment, just get test deps plus a few extras
+	# that we know are available
+	INSTALL_ARGS="nibabel scikit-learn numpydoc PySide6 mne-qt-browser"
+	INSTALL_KIND="test"
 else
 	test "${MNE_CI_KIND}" == "pip-pre"
 	STD_ARGS="$STD_ARGS --pre"

tools/github_actions_env_vars.sh

@@ -4,9 +4,13 @@ set -eo pipefail -x
 # old and minimal use conda
 if [[ "$MNE_CI_KIND" == "pip"* ]]; then
     echo "Setting pip env vars for $MNE_CI_KIND"
-    echo "MNE_QT_BACKEND=PyQt6" >> $GITHUB_ENV
-    # We should test an eager import somewhere, might as well be here
-    echo "EAGER_IMPORT=true" >> $GITHUB_ENV
+    if [[ "$MNE_CI_KIND" == "pip-pre" ]]; then
+        echo "MNE_QT_BACKEND=PyQt6" >> $GITHUB_ENV
+        # We should test an eager import somewhere, might as well be here
+        echo "EAGER_IMPORT=true" >> $GITHUB_ENV
+    else
+        echo "MNE_QT_BACKEND=PySide6" >> $GITHUB_ENV
+    fi
 else  # conda-like
     echo "Setting conda env vars for $MNE_CI_KIND"
     if [[ "$MNE_CI_KIND" == "old" ]]; then