build: refresh dependencies and release v0.4.0

[aoirint]

Warning

This pull request was created with assistance from LLMs.

Summary

• Update PyTorch to 2.13.0+cu130, torchvision to 0.28.0+cu130, xformers to 0.0.35, and ONNX to 1.22.0, including the available fixes for the current dependency advisories.
• Retain the CUDA 12.9.1 runtime base required by the ONNX Runtime 1.23.2 GPU wheel while using the CUDA 13.0 libraries bundled with the PyTorch and xformers wheels.
• Update charset-normalizer to 3.5.0 and the Ubuntu CA certificate package to 20260601~24.04.1.
• Document the bundled NVIDIA CUDA container license, add repeatable GPU validation guidance, and promote VERSION and the canonical changelog to v0.4.0.

Related Issues

• Closes #121

Notes for reviewers

The bundled sd-scripts checkout remains v0.11.1 on Python 3.10. Python 3.10 is intentional: the Python 3.12 attempt in #104 broke the accelerate/timm startup path and was reverted in #109. GitHub Actions, uv, Python, CUDA, hadolint, and APM were audited and already use their latest reviewed versions that completed the seven-day cooldown. No cooldown exception was used.

The initial CUDA 13.3 runtime candidate allowed PyTorch and xformers GPU execution but caused ONNX Runtime to fall back to CPU because its released Python 3.10 GPU wheel requires CUDA 12 libraries. The final image therefore keeps the CUDA 12.9.1 base and uses the independently bundled CUDA 13.0 PyTorch wheel stack. Both sides of that mixed runtime were exercised on an NVIDIA GeForce RTX 5070 Ti with driver 610.88 and compute capability 12.0. The release uses a minor-version bump because the PyTorch/xformers CUDA wheel line changes from CUDA 12.9 to CUDA 13.0.

Proposed merge attribution

• Included: Co-authored-by: Codex <noreply@openai.com> for material implementation assistance.

AI disclosure

Codex inspected dependency and release metadata, prepared the source and lockfile updates, reviewed the final diff and container contents, investigated the #104/#109 regression history, and ran the reported CPU and GPU checks. The exact changes and outputs were reviewed before publication.

Testing

Automated checks

• uv lock --check
• apm audit --ci — all 10 repository-local checks passed.
• hadolint Dockerfile
• actionlint
• shellcheck scripts/*.sh
• pinact run --check --min-age 7
• docker buildx build --check .
• docker build --progress=plain -t sd-scripts:v0.4.0-test .
• scripts/run-sd-scripts-release-tests.sh --image sd-scripts:v0.4.0-test — 142 passed, 7 skipped.
• Final-image source SHA, Python/package versions, non-root user, entrypoint, nvrtc link, CA package, and bundled license checks.

GPU checks

• PyTorch 2.13.0+cu130 CUDA matrix multiplication completed on the RTX 5070 Ti.
• xformers 0.0.35 memory_efficient_attention completed with finite GPU output.
• bitsandbytes 0.50.0 Linear8bitLt completed with finite GPU output.
• ONNX Runtime 1.23.2 created a session with CUDAExecutionProvider first, ran a generated ONNX model, and returned the expected result without CPU fallback.
• libonnxruntime_providers_cuda.so had no unresolved dynamic-library dependencies with the GPU runtime mounted.
• accelerate launch finetune/tag_images_by_wd14_tagger.py --onnx downloaded the real WD14 model, processed an actual image with CUDAExecutionProvider, and wrote the expected caption file. This exercises the startup path that failed after build: upgrade to Python 3.12 #104 and was restored by fix: restore Python 3.10 runtime #109.

The optional upstream inpainting training scripts were not run because no compatible model checkpoint was supplied; they require a separate SD 1.5 or SDXL checkpoint. The dependency-specific GPU kernels and the complete WD14 model inference path were exercised instead.

The local Markdown CLI was unavailable; the pull-request Check job runs the repository's pinned Markdown action.

AI-assisted inspections

• Request: Review cooldown eligibility, dependency provenance, immutable pins, advisory remediation, workflow safety, lockfile scope, final-container licensing, and GPU compatibility across PyTorch, xformers, bitsandbytes, and ONNX Runtime.
  • AI-assisted result: All adopted artifacts were pinned and at least seven days old; Actions and tools needed no eligible pin changes; the final mixed CUDA runtime built successfully and completed both the repository release tests and the targeted GPU workloads.