main.yml

name: CI

on:
  pull_request:
    types:
      - opened
      - synchronize
      - reopened
      - labeled
  merge_group:
  workflow_dispatch:
    inputs:
      libneo_ref:
        description: libneo branch, tag or commit to build against
        required: false
        default: ''
      experimental_compilers:
        description: run non-blocking Intel ifx and LLVM flang smoke tests
        type: boolean
        required: false
        default: false
      full:
        description: run the full suite (fast + slow + regression); set by the libneo full-ci gate
        required: false
        default: 'false'
      verification_report:
        description: build and upload the bounded EUROfusion verification report
        required: false
        default: 'false'
      runner:
        description: 'where Build and Test runs: Slurm or the isolated owned Ubuntu runner'
        type: choice
        options:
          - itp-slurm
          - portable
        required: false
        default: itp-slurm

# A new push cancels superseded PR checks. Label-triggered full-ci compiler
# checks keep their own group and do not cancel an ordinary PR run.
  push:
    branches:
      - main
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || format('{0}-{1}', github.ref, github.run_id) }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
permissions:
  contents: write
  pull-requests: write
  issues: write
  checks: write
  actions: read

jobs:
  changed-line-lint:
    permissions:
      contents: read
    name: Changed-line lint
    runs-on:
      - self-hosted
      - itp-ubuntu24
    if: >-
      github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.actor != 'github-merge-queue[bot]')


    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha || github.sha }}

      # The runner's Python 3.12 (Ubuntu 24.04); setup-python would download one
      # from GitHub on every run of this ephemeral runner.
      - name: Set up Python
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends python3-venv
          python3 -m venv "$RUNNER_TEMP/venv"
          echo "$RUNNER_TEMP/venv/bin" >> "$GITHUB_PATH"

      - name: Install lint tools
        run: python -m pip install fprettify==0.3.7 ruff==0.14.1

      - name: Test the changed-line checker
        run: python -m unittest discover -s test/python -p test_changed_line_lint.py -v

      - name: Check the nightly triage
        run: python ci/test_nightly_triage.py

      - name: Check changed lines
        run: >-
          python tools/check_changed_lines.py --base "${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || github.event.before || format('{0}^', github.sha) }}"

  # Ordinary PR events skip without allocating a runner. Explicit PR validation
  # uses the isolated owned Ubuntu runner. The merge queue runs the fast suite
  # on sCluster, the nightly the full one; dispatch selects either owned capacity.
  test:
    name: Build and Test
    runs-on: >-
      ${{ (github.event_name == 'pull_request' || inputs.runner == 'portable' || inputs.runner == 'hosted') && fromJSON('["self-hosted","itp-ubuntu24","itp-mem16"]') || fromJSON('["self-hosted","itp-dispatch"]') }}
    timeout-minutes: 150
    env:
      OMP_NUM_THREADS: 2
      OPENBLAS_NUM_THREADS: 1
      CI_HOSTED: >-
        ${{ (github.event_name == 'pull_request' || inputs.runner == 'portable' || inputs.runner == 'hosted') && 'true' || 'false' }}

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Set up Python for the offline bundle
        if: env.CI_HOSTED != 'true'
        run: python3 --version
      - name: Build and test on sCluster
        if: env.CI_HOSTED != 'true'
        env:
          EVENT: ${{ github.event_name }}
          FULL_INPUT: ${{ inputs.full }}
          SCI_HEAD_REF: ${{ github.head_ref || github.ref_name }}
          SCI_LIBNEO_REF: ${{ inputs.libneo_ref }}
          SCI_OUT: ${{ runner.temp }}/sci-out
        run: |
          # The merge queue runs the fast tier; nightly.yml runs the full tier.
          case $EVENT in
          workflow_dispatch) [ "$FULL_INPUT" = true ] && tier=full || tier=smoke ;;
          merge_group) tier=fast ;;
          *) tier=full ;;
          esac
          echo "tier: $tier"
          export TMPDIR=$RUNNER_TEMP
          if [ "$tier" = full ]; then rm -f "$SCI_OUT/full-status.txt"; fi
          SCI_TIER=$tier ci/bundle.sh "$RUNNER_TEMP/bundle.tar.zst"
          sci-dispatch "$tier" "$RUNNER_TEMP/bundle.tar.zst"
          if [ "$tier" = full ]; then
            if [ ! -s "$SCI_OUT/full-status.txt" ] ||
               ! grep -qx 'Correctness gate: exit 0 (authoritative)' "$SCI_OUT/full-status.txt"; then
              echo 'Full cluster correctness gate did not complete successfully.' >&2
              exit 1
            fi
          fi

      - name: Summarize sCluster gate and coverage
        id: cluster-results
        if: always() && env.CI_HOSTED != 'true'
        run: |
          result=$RUNNER_TEMP/sci-out
          if [ -f "$result/full-status.txt" ]; then
            {
              echo '## sCluster correctness gate and fast-tier coverage (GCC 12.2)'
              echo 'The uninstrumented full gate decides this check. Coverage is reporting only.'
              echo '```text'
              cat "$result/full-status.txt"
              for status in gate-status coverage-status coverage-summary; do
                if [ -f "$result/$status.txt" ]; then cat "$result/$status.txt"; fi
              done
              echo '```'
            } >> "$GITHUB_STEP_SUMMARY"
            if ! grep -q '^Coverage worker: exit 0 ' "$result/full-status.txt"; then
              echo '::warning::Fast-tier coverage failed; see the coverage log and job summary. The correctness gate remains authoritative.'
            fi
          fi
          if [ -s "$result/coverage.xml" ] && [ -s "$result/coverage.html" ]; then
            echo 'coverage=true' >> "$GITHUB_OUTPUT"
          fi

      - name: Upload sCluster coverage
        if: always() && env.CI_HOSTED != 'true' && steps.cluster-results.outputs.coverage == 'true'
        continue-on-error: true
        uses: actions/upload-artifact@v6
        with:
          name: fast-suite-coverage
          if-no-files-found: warn
          path: ${{ runner.temp }}/sci-out/coverage*

      - name: Set up Python
        if: env.CI_HOSTED == 'true'
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install system dependencies
        if: env.CI_HOSTED == 'true'
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            gfortran gfortran-14 gcc-14 g++-14 \
            git-lfs \
            cmake \
            ninja-build \
            pkg-config \
            libgsl-dev \
            libhdf5-dev \
            libfftw3-dev \
            libnetcdf-dev \
            libnetcdff-dev \
            libopenblas-dev \
            liblapack-dev \
            openmpi-bin \
            libopenmpi-dev

      - name: Install Python dependencies
        if: env.CI_HOSTED == 'true'
        run: |
          if [ "$GITHUB_EVENT_NAME" = pull_request ]; then
            # Match the GCC fast tier; frontend/Python-package checks run in full CI.
            python -m pip install numpy netCDF4
          else
            python -m pip install --upgrade pip
            python -m pip install -r requirements.txt
          fi

      - name: Fetch Cached GVEC QA Data
        if: env.CI_HOSTED == 'true' && inputs.full == 'true'
        env:
          GITLAB_ACCESS_TOKEN: ${{ secrets.GITLAB_ACCESS_TOKEN }}
          SIMPLE_GVEC_QA_CACHE_ROOT: ${{ github.workspace }}/.ci-data/gvec_qa_roundtrip
        run: |
          if [ -n "${GITLAB_ACCESS_TOKEN:-}" ]; then
            make gvec-qa-cache-fetch
          else
            echo "GITLAB_ACCESS_TOKEN is not set; skipping GVEC QA cache fetch"
          fi

      - name: Build SIMPLE (deterministic FP for reproducibility)
        if: env.CI_HOSTED == 'true'
        run: |
          make clean
          CMAKE_BUILD_PARALLEL_LEVEL=$(env -u OMP_NUM_THREADS -u OMP_THREAD_LIMIT nproc)
          export CMAKE_BUILD_PARALLEL_LEVEL
          build_options=()
          config=Release
          if [ "$GITHUB_EVENT_NAME" = pull_request ]; then
            # The hosted PR tier uses deterministic Fast with GCC 14.
            export CC=gcc-14 CXX=g++-14 FC=gfortran-14
            config=Fast
            build_options+=("FLAGS=-DENABLE_PYTHON_INTERFACE=OFF -DSIMPLE_ENABLE_PYTHON_TOOLS=OFF")
          fi
          REF="${{ inputs.libneo_ref }}"
          if [ -n "$REF" ]; then
            make build-deterministic CONFIG="$config" "${build_options[@]}" LIBNEO_REF="$REF"
          else
            make build-deterministic CONFIG="$config" "${build_options[@]}"
          fi

      # libneo-gate dispatch (no full) runs only the sub-minute smoke set;
      # PRs, the merge queue and full=true run the suites below.
      - name: Run Smoke Tests (libneo gate)
        if: env.CI_HOSTED == 'true' && (github.event_name == 'workflow_dispatch' && inputs.full != 'true')
        run: make test-smoke CONFIG=Release

      - name: Run Fast Tests (Fortran only)
        if: env.CI_HOSTED == 'true' && (github.event_name != 'workflow_dispatch' || inputs.full == 'true')
        run: |
          CTEST_PARALLEL_LEVEL=$(env -u OMP_NUM_THREADS -u OMP_THREAD_LIMIT nproc)
          export CTEST_PARALLEL_LEVEL
          config=Release
          [ "$GITHUB_EVENT_NAME" != pull_request ] || config=Fast
          if [ "$GITHUB_EVENT_NAME" = pull_request ]; then
            /usr/bin/time -v make test-fast CONFIG="$config" \
              CTEST_CMD="cd build && ctest --test-dir test --output-on-failure"
          else
            /usr/bin/time -v make test-fast CONFIG="$config"
          fi

      - name: Install Python package
        if: env.CI_HOSTED == 'true' && inputs.full == 'true'
        run: python -m pip install -e '.[imas]' --no-build-isolation -Ccmake.define.SIMPLE_DETERMINISTIC_FP=ON

      # Full hosted dispatch is opt-in; the merge queue runs full on sCluster.
      - name: Run Slow Tests (Python)
        if: env.CI_HOSTED == 'true' && inputs.full == 'true'
        env:
          SIMPLE_GVEC_QA_CACHE_ROOT: ${{ github.workspace }}/.ci-data/gvec_qa_roundtrip
        run: make test-slow CONFIG=Release

      - name: Run Regression Tests (Golden Record)
        if: env.CI_HOSTED == 'true' && inputs.full == 'true'
        run: make test-regression CONFIG=Release

      - name: Upload test results
        if: always() && env.CI_HOSTED == 'true'
        uses: actions/upload-artifact@v6
        with:
          name: test-results
          path: |
            build/test/Testing/
            build/test/tests/golden_record/runs/**/simple.in
            build/test/tests/golden_record/runs/**/start.dat
            build/test/tests/golden_record/runs/**/times_lost.dat
            build/test/tests/golden_record/runs/**/orbit_exit_code.dat

    if: >-
      github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.actor != 'github-merge-queue[bot]')
  gcc-matrix:
    permissions:
      contents: read
    name: GCC ${{ matrix.gcc }}
    runs-on:
      - self-hosted
      - itp-ubuntu24
      - itp-mem16
    timeout-minutes: 45
    if: >-
      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.actor != 'github-merge-queue[bot]')) && ((github.event_name == 'merge_group' || (github.event_name == 'workflow_dispatch' && inputs.full == 'true') || (github.event_name == 'pull_request' && github.event.pull_request.draft == false)) && (github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'full-ci')))
    strategy:
      fail-fast: false
      matrix:
        include:
          - gcc: 13
    env:
      CC: gcc-${{ matrix.gcc }}
      CXX: g++-${{ matrix.gcc }}
      FC: gfortran-${{ matrix.gcc }}
      OMP_NUM_THREADS: 2

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Install GCC toolchain and system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            gcc-${{ matrix.gcc }} g++-${{ matrix.gcc }} gfortran-${{ matrix.gcc }} \
            git-lfs cmake ninja-build pkg-config lcov \
            libgsl-dev libhdf5-dev libfftw3-dev libnetcdf-dev libnetcdff-dev \
            libopenblas-dev liblapack-dev openmpi-bin libopenmpi-dev \
            python3-venv
          # System pip is externally managed (PEP 668); use a private venv.
          python3 -m venv "$RUNNER_TEMP/venv"
          "$RUNNER_TEMP/venv/bin/python" -m pip install numpy netCDF4
          echo "$RUNNER_TEMP/venv/bin" >> "$GITHUB_PATH"

      - name: Build and run tests
        env:
          LIBNEO_INPUT_REF: ${{ inputs.libneo_ref }}
          FLAGS: >-
            -DENABLE_COVERAGE=OFF
            -DENABLE_PYTHON_INTERFACE=OFF -DSIMPLE_ENABLE_PYTHON_TOOLS=OFF
        run: |
          # CTest's generated resource spec limits concurrent memory use.
          # Ignore OpenMP's thread count when counting runner cores.
          CTEST_PARALLEL_LEVEL=$(env -u OMP_NUM_THREADS -u OMP_THREAD_LIMIT nproc)
          export CTEST_PARALLEL_LEVEL
          make test-smoke CONFIG=Fast \
            LIBNEO_REF="$LIBNEO_INPUT_REF"

  intel-ifx:
    permissions:
      contents: read
    name: Intel ifx smoke tests (non-blocking)
    runs-on:
      - self-hosted
      - itp-ubuntu24
      - itp-mem16
    if: >-
      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.actor != 'github-merge-queue[bot]')) && (github.event_name == 'workflow_dispatch' && inputs.experimental_compilers)
    continue-on-error: true
    timeout-minutes: 30
    container:
      image: intel/oneapi-hpckit:latest

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Install build dependencies
        run: |
          apt-get update
          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
            git make python3-venv \
            cmake \
            ninja-build \
            pkg-config \
            libgsl-dev \
            libhdf5-dev \
            libfftw3-dev \
            libnetcdf-dev \
            libnetcdff-dev \
            libopenblas-dev \
            liblapack-dev \
            openmpi-bin \
            libopenmpi-dev

      - name: Build and run smoke tests with ifx
        shell: bash
        run: |
          source /opt/intel/oneapi/setvars.sh
          python3 -m venv .venv
          source .venv/bin/activate
          python -m pip install numpy
          make clean
          make test-smoke CONFIG=Fast \
            FLAGS='-DSIMPLE_DETERMINISTIC_FP=OFF -DCMAKE_Fortran_COMPILER=ifx -DCMAKE_C_COMPILER=icx -DENABLE_PYTHON_INTERFACE=OFF -DSIMPLE_ENABLE_PYTHON_TOOLS=OFF'

  llvm-flang:
    permissions:
      contents: read
    name: LLVM flang smoke tests (non-blocking)
    runs-on:
      - self-hosted
      - itp-ubuntu24
      - itp-mem16
    if: >-
      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.actor != 'github-merge-queue[bot]')) && (github.event_name == 'workflow_dispatch' && inputs.experimental_compilers)
    continue-on-error: true
    timeout-minutes: 30

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Install LLVM flang and build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            flang-18 libomp-18-dev \
            clang-18 \
            cmake \
            ninja-build \
            pkg-config \
            libgsl-dev \
            libhdf5-dev \
            libfftw3-dev \
            libnetcdf-dev \
            libnetcdff-dev \
            libopenblas-dev \
            liblapack-dev \
            openmpi-bin \
            libopenmpi-dev

      - name: Build and run smoke tests with LLVM flang
        run: |
          python -m pip install numpy netCDF4
          make clean
          make test-smoke CONFIG=Fast \
            FLAGS='-DSIMPLE_DETERMINISTIC_FP=OFF -DCMAKE_Fortran_COMPILER=flang-new-18 -DCMAKE_C_COMPILER=clang-18 -DENABLE_PYTHON_INTERFACE=OFF -DSIMPLE_ENABLE_PYTHON_TOOLS=OFF'

  cgal-wall:
    name: CGAL Wall Unit Tests
    runs-on:
      - self-hosted
      - itp-ubuntu24
      - itp-mem16
    if: >-
      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.actor != 'github-merge-queue[bot]')) && (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request')

    timeout-minutes: 20
    env:
      CMAKE_BUILD_PARALLEL_LEVEL: 8
      OMP_NUM_THREADS: 1
      OPENBLAS_NUM_THREADS: 1

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Install system dependencies (CGAL)
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            gfortran \
            cmake \
            ninja-build \
            pkg-config \
            libgsl-dev \
            libhdf5-dev \
            libfftw3-dev \
            libcgal-dev \
            libboost-dev \
            libgmp-dev \
            libmpfr-dev \
            libnetcdf-dev \
            libnetcdff-dev \
            libopenblas-dev \
            liblapack-dev \
            libopenmpi-dev \
            openmpi-bin \
            python3-dev \
            python3-venv
          # The runner's Python 3.12; setup-python would download one from GitHub.
          python3 -m venv "$RUNNER_TEMP/venv"
          echo "$RUNNER_TEMP/venv/bin" >> "$GITHUB_PATH"

      - name: Install wall-test Python dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install 'numpy==2.2.6' 'scipy==1.16.3' netCDF4 shapely pytest vtk f90wrap==0.3.0 \
            'git+https://github.com/itpplasma/map2disc.git@14da2f094ab2505a639b9cd04af57f5c0dbfaa54'

      - name: Run CGAL Wall Tests
        run: |
          make clean
          # Same libneo as the other jobs: SIMPLE links its frozen-current field.
          REF="${{ inputs.libneo_ref }}"
          make test CONFIG=Fast \
            FLAGS="-DSIMPLE_ENABLE_CGAL=ON -DENABLE_PYTHON_INTERFACE=ON -DSIMPLE_ENABLE_PYTHON_TOOLS=ON -DLIBNEO_REF=$REF" \
            TEST='test_chartmap_metadata|test_stl_wall_intersection|test_collisional_stl_wall_fast|test_triangle_heat_load|test_profiles' VERBOSE=1
          # A missing Python interface must not silently omit the integration test.
          ctest --test-dir build/test -N -R '^test_collisional_stl_wall_fast$' | grep 'Test.*test_collisional_stl_wall_fast'
          ctest --test-dir build/test -N -R '^test_triangle_heat_load$' | grep 'Test.*test_triangle_heat_load'

      - name: Upload wall-test results
        if: always()
        uses: actions/upload-artifact@v6
        with:
          name: cgal-wall-results
          path: |
            build/test/Testing/
            build/test/tests/collisional_stl_wall_fast/

  vmecpp:
    name: VMEC++ Direct Geometry
    runs-on:
      - self-hosted
      - itp-ubuntu24
      - itp-mem16
    # About 16 minutes, so it runs nightly (nightly.yml), not in the merge queue.
    if: >-
      github.event_name == 'workflow_dispatch'

    timeout-minutes: 60
    env:
      OMP_NUM_THREADS: 1
      OPENBLAS_NUM_THREADS: 1

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - uses: ./.github/actions/vmecpp-setup

      - name: Configure SIMPLE with VMEC++
        run: |
          cmake -S . -B build -GNinja -DCMAKE_BUILD_TYPE=Release \
            -DSIMPLE_ENABLE_VMECPP=ON

      - name: Build SIMPLE with VMEC++
        run: cmake --build build --config Release

      - name: Run VMEC++ tests
        run: ctest --test-dir build/test -R vmecpp --output-on-failure

  build-docs:
    name: Build Documentation
    if: >-
      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.actor != 'github-merge-queue[bot]')) && (github.event_name == 'workflow_dispatch')
    runs-on:

      - self-hosted
      - itp-ubuntu24
    steps:
      - uses: actions/checkout@v6

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            latexmk \
            lyx \
            texlive-latex-extra \
            texlive-publishers \
            texlive-science

      - name: Build LaTeX documents
        run: |
          cd DOC
          latexmk -pdf canonical_and_boozer_flux_coords_via_VMEC.tex
          lyx --export pdf2 neo-orb.lyx

      - name: Upload documentation artifacts
        uses: actions/upload-artifact@v6
        with:
          name: documentation
          path: |
            DOC/canonical_and_boozer_flux_coords_via_VMEC.pdf
            DOC/neo-orb.pdf

  verification-report:
    name: Generate Verification Report
    runs-on:
      - self-hosted
      - itp-ubuntu24
      - itp-mem16
    timeout-minutes: 20
    permissions:
      contents: read
    if: >-
      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.actor != 'github-merge-queue[bot]')) && (github.event_name == 'workflow_dispatch' && inputs.verification_report == 'true')
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      # The runner's Python 3.12; setup-python would download one from GitHub.
      - name: Set up Python
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends python3-venv
          python3 -m venv "$RUNNER_TEMP/venv"
          echo "$RUNNER_TEMP/venv/bin" >> "$GITHUB_PATH"

      - name: Install build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            gfortran git-lfs cmake ninja-build pkg-config \
            libgsl-dev libhdf5-dev libfftw3-dev libnetcdf-dev \
            libnetcdff-dev libopenblas-dev liblapack-dev

      - name: Install report dependencies
        run: python -m pip install numpy matplotlib netCDF4 scipy pytest

      - name: Build deterministic SIMPLE
        run: make build-deterministic CONFIG=Fast FLAGS='-DENABLE_PYTHON_INTERFACE=OFF'

      - name: Test report helpers
        run: make test CONFIG=Fast TEST='^test_verification_report$$'

      - name: Generate report
        run: python tools/generate_verification_report.py

      - name: Upload verification report
        if: always()
        uses: actions/upload-artifact@v6
        with:
          name: verification-report
          path: build/output/verification-report/

  # Matrix job names gain a shard suffix. Preserve the branch rule's exact
  # Build and Test context and require every shard to succeed.
  performance:
    permissions:
      contents: read
    name: Performance
    # GitHub-hosted, so no other job shares the machine. Base and candidate
    # run side by side in every repetition and see the same load.
    runs-on: ubuntu-24.04
    if: >-
      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.actor != 'github-merge-queue[bot]')) && (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch')
    timeout-minutes: 75
    env:
      BASE_SHA: ${{ github.event.merge_group.base_sha }}
      FLAGS: >-
        -DCMAKE_BUILD_TYPE=Release -DENABLE_COVERAGE=OFF
        -DENABLE_PYTHON_INTERFACE=OFF -DSIMPLE_ENABLE_PYTHON_TOOLS=OFF

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            gfortran git-lfs cmake ninja-build pkg-config \
            libgsl-dev libhdf5-dev libfftw3-dev libnetcdf-dev libnetcdff-dev \
            libopenblas-dev liblapack-dev openmpi-bin libopenmpi-dev python3-venv
          python3 -m venv "$RUNNER_TEMP/venv"
          "$RUNNER_TEMP/venv/bin/python" -m pip install numpy netCDF4
          echo "$RUNNER_TEMP/venv/bin" >> "$GITHUB_PATH"

      - name: Build base and candidate
        run: |
          base=${BASE_SHA:-$(git merge-base HEAD origin/main)}
          echo "base $base"
          git worktree add "$RUNNER_TEMP/base" "$base"
          for tree in "$PWD" "$RUNNER_TEMP/base"; do
            cmake -S "$tree" -B "$tree/build" -GNinja $FLAGS
            cmake --build "$tree/build" --target simple.x
          done

      - name: Compare run times
        run: |
          python3 test/performance/benchmark.py \
            "$RUNNER_TEMP/base/build/simple.x" build/simple.x --work performance-runs

      - name: Upload timings
        if: always()
        uses: actions/upload-artifact@v6
        with:
          name: performance
          path: performance-runs/benchmark.json
          if-no-files-found: ignore

  build-and-test-result:
    permissions: {}
    name: Build and Test
    if: >-
      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.actor != 'github-merge-queue[bot]')) && (always())
    needs: [test]
    runs-on:
      - self-hosted
      - itp-light
    steps:
      - name: Require successful test shards
        env:
          TEST_RESULT: ${{ needs.test.result }}
        run: test "$TEST_RESULT" = success

  # Single required check for the merge queue: fails if any gating job failed
  # or was cancelled; full-tier jobs skipped on pull requests count as passed.
  ci-result:
    permissions: {}
    name: CI result
    if: >-
      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.actor != 'github-merge-queue[bot]')) && (always())
    needs: [build-and-test-result, gcc-matrix, cgal-wall, vmecpp, performance]
    runs-on:
      - self-hosted
      - itp-light
    steps:
      - name: Check gating jobs
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
        run: |
          echo "A gating job failed or was cancelled; see the jobs above."
          exit 1