port changes from oqh to slab

.github/SUPPORT.md

@@ -0,0 +1,3 @@
+# Getting help with QICK
+
+For ways to get in touch with developers and members of the QICK community, see the [contact page](https://qick-docs.readthedocs.io/latest/contact.html) on our Read the Docs site.

.github/dependabot.yml

@@ -0,0 +1,14 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  # Enable version updates for GitHub Actions
+  - package-ecosystem: "github-actions"
+    # Workflow files stored in the default location of `.github/workflows`
+    # You don't need to specify `/.github/workflows` for `directory`. You can use `directory: "/"`.
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/test_zcu111.yml

@@ -0,0 +1,48 @@
+# Install the QICK library on the runner (a QICK board) and run tests.
+# The FPGA can only be accessed as root, so the tests must run with sudo.
+# This pollutes the repo with files owned by root, which interfere with the "clean" step in the checkout action.
+# We therefore do the clean manually (with sudo) before checkout.
+
+name: Test ZCU111
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - 'qick_demos/**'
+      - 'qick_lib/**'
+      - '**.py'
+      - '!qick_lib/qick/VERSION'
+
+permissions:
+  contents: write
+
+jobs:
+  run_test:
+    runs-on: [zcu111]
+    steps:
+    - name: Clean repo
+      continue-on-error: true
+      run: |
+        sudo git clean -ffdx
+        sudo git reset --hard HEAD
+    - uses: actions/checkout@v7
+    - name: Install package
+      run: |
+        sudo -E -H python -m pip install -e .
+    - name: Test notebooks
+      run: |
+        sudo -E python -m pytest --nbmake --overwrite ./qick_demos/00_Send_receive_pulse.ipynb
+        sudo -E python -m pytest --nbmake ./qick_demos/01_Phase_coherent_readout.ipynb
+        sudo -E python -m pytest --nbmake ./qick_demos/02_Sweeping_variables.ipynb
+        sudo -E python -m pytest --nbmake ./qick_demos/03_Conditional_logic.ipynb
+        sudo -E python -m pytest --nbmake ./qick_demos/04_Reading_Math_Writing.ipynb
+        sudo -E python -m pytest --nbmake ./qick_demos/05_PhaseCoherence_QickProgram.ipynb
+        # sudo -E python -m pytest --nbmake ./qick_demos/06_qubit_demos.ipynb
+        sudo -E python -m pytest --nbmake ./qick_demos/07_Sweep_ND_variables.ipynb
+        sudo -E python -m pytest --nbmake ./qick_demos/08_Special_buffers.ipynb
+    - name: Archive test results
+      uses: actions/upload-artifact@v7
+      with:
+        name: demo_notebooks
+        path: qick_demos/*.ipynb

.github/workflows/update_version.yml

@@ -0,0 +1,120 @@
+# Automatically update the package version.
+# The version has the format major.minor.PR, where PR is the number of the most recent pull request.
+# This action runs automatically when a pull request is opened, or a commit is added to an open pull request.
+# https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
+#
+# It checks the version number against the PR number; if it does not match, the version number is updated in a new commit.
+# The commit will be credited to the GitHub Actions user.
+# https://github.com/orgs/community/discussions/26560#discussioncomment-3252339
+# 
+# We need write access, which is only available using the pull_request_target trigger.
+# It is dangerous to have write access at the same time that you are checking out untrusted code from a PR.
+# However, we are only extracting a version number and (possibly) committing a new version number back to the PR, which is relatively safe.
+# In other words, we are doing a bad thing ("pull_request_target with an explicit PR checkout") but our workflow is safe ("Reformat and commit the code"):
+# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
+#
+# If you don't want this action to run (e.g. if you want a different version number for a certain PR), include [skip actions] in the commit message.
+# https://docs.github.com/en/actions/managing-workflow-runs/skipping-workflow-runs
+#
+# If we make a new commit in this action, the action doesn't get run on the new commit (not sure why, actually).
+# This is a problem if we want to use this as a status check.
+# The workaround is to manually apply the status at the end: ugly!
+# Using: https://docs.github.com/en/rest/commits/statuses?apiVersion=2022-11-28#create-a-commit-status
+#
+# Because this action uses the pull_request_target trigger, it's exempt from the workflow approval rules and will run automatically regardless of the submitter:
+# https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks#about-workflow-runs-from-public-forks
+
+name: Update version
+
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize]
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+  statuses: write
+  checks: write
+
+jobs:
+  update_version:
+    runs-on: ubuntu-latest
+    env:
+      PR_NUMBER: ${{ github.event.pull_request.number }}
+      GH_TOKEN: ${{ github.token }}
+      VERSION_PATH: qick_lib/qick/VERSION
+      CHECK_TOKEN: ${{ secrets.CHECK_TOKEN }}
+    steps:
+    - uses: actions/checkout@v7
+    - name: Checkout pull request
+      run: gh pr checkout $PR_NUMBER
+    - name: Compare version numbers
+      run: |
+        file_version=$(cut -d '.' -f 3 "$VERSION_PATH")
+        echo "PR number: $PR_NUMBER, VERSION number: $file_version"
+        echo "file_version=$file_version" >> $GITHUB_ENV
+    - name: Debug
+      run: gh auth status
+    - name: Update VERSION if necessary
+      if: env.file_version != github.event.pull_request.number
+      run: |
+        echo "updating VERSION"
+        echo "$(cut -d '.' -f -2 $VERSION_PATH).$PR_NUMBER" > "$VERSION_PATH"
+        git config user.email "129547417+qickbot@users.noreply.github.com"
+        git config user.name "QICK actions [bot]"
+        git config push.default upstream
+        git add "$VERSION_PATH"
+        git commit -am "update version"
+        git push
+        repopath=$(git remote get-url origin|cut -d'/' -f4,5)
+        headpath=$(gh pr view --json headRepositoryOwner,headRepository -t '{{.headRepositoryOwner.login}}/{{.headRepository.name}}')
+        new_sha="$(git rev-parse HEAD)"
+        reporef="/repos/${repopath}/statuses/${new_sha}"
+        headref="/repos/${headpath}/statuses/${new_sha}"
+        echo "reporef=$reporef" >> $GITHUB_ENV
+        echo "headref=$headref" >> $GITHUB_ENV
+    - name: Set status for update commit using CLI and GITHUB_TOKEN, PR head path
+      continue-on-error: true
+      if: env.file_version != github.event.pull_request.number
+      run: |
+        gh api \
+          --method POST \
+          -H "Accept: application/vnd.github+json" \
+          -H "X-GitHub-Api-Version: 2022-11-28" \
+          "$headref" \
+          -f state='success' \
+          -f context='update_version'
+    - name: Set status for update commit using CLI and GITHUB_TOKEN, repo path
+      continue-on-error: true
+      if: env.file_version != github.event.pull_request.number
+      run: |
+        gh api \
+          --method POST \
+          -H "Accept: application/vnd.github+json" \
+          -H "X-GitHub-Api-Version: 2022-11-28" \
+          "$reporef" \
+          -f state='success' \
+          -f context='update_version'
+    - name: Set status for update commit using curl and PAT, PR head path
+      continue-on-error: true
+      if: env.file_version != github.event.pull_request.number
+      run: |
+        curl -L -X POST \
+          -H "Accept: application/vnd.github+json" \
+          -H "X-GitHub-Api-Version: 2022-11-28" \
+          -H "Authorization: Bearer $CHECK_TOKEN" \
+          "https://api.github.com${headref}" \
+          -d '{"state":"success","context":"update_version"}'
+    - name: Set status for update commit using curl and PAT, repo path
+      continue-on-error: true
+      if: env.file_version != github.event.pull_request.number
+      run: |
+        repopath=$(git remote get-url origin|cut -d'/' -f4,5)
+        curl -L -X POST \
+          -H "Accept: application/vnd.github+json" \
+          -H "X-GitHub-Api-Version: 2022-11-28" \
+          -H "Authorization: Bearer $CHECK_TOKEN" \
+          "https://api.github.com${reporef}" \
+          -d '{"state":"success","context":"update_version"}'

.github/workflows/wheels.yml

@@ -0,0 +1,61 @@
+# Build a wheel and publish to PyPI when a pull request merges.
+# https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/
+#
+# Based on https://github.com/orgs/community/discussions/26724#discussioncomment-3253102 we trigger this workflow on a push to main branch, and protect the main branch.
+#
+# We previously used the pull_request_target workflow trigger, but it seems that since sometime between January and March 2026 this no longer works with trusted publishing.
+# How that used to work:
+#
+# We need access to the repo secrets, which are only available using the pull_request_target trigger.
+# For security this requires us to use the repo HEAD and not the PR merge commit.
+# But since this action only executes on merge, those are the same thing.
+# https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
+
+name: Build wheel
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.x"
+      - name: Build wheel
+        run: |
+          python -m pip install --user --upgrade pip build wheel
+          python -m build
+      - name: Store the distribution packages
+        uses: actions/upload-artifact@v7
+        with:
+          name: python-package-distributions
+          path: dist/
+
+  publish-to-pypi:
+    needs:
+    - build
+    runs-on: ubuntu-latest
+    environment:
+      name: release
+      url: https://pypi.org/p/qick
+    permissions:
+      # IMPORTANT: this permission is mandatory for trusted publishing
+      id-token: write
+    steps:
+    - name: Download all the dists
+      uses: actions/download-artifact@v8
+      with:
+        name: python-package-distributions
+        path: dist/
+    - name: Publish distribution to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1