Do not download Python and CGAL on every self-hosted CI run (#782)

`actions/setup-python` downloads a Python build from GitHub on every run
of our ephemeral self-hosted runners. A GitHub 504 during that download
failed the CGAL job in the merge group of #780 today. The changed-line
lint, CGAL and verification-report jobs now make a venv from the
runner's system Python, which is 3.12 on Ubuntu 24.04, the version they
requested. The CGAL job also installs `python3-dev` for the Python
interface it builds. The GitHub-hosted fallback in `test` keeps
`setup-python`, where the toolcache is local.

The first merge-group run of this PR then failed one step later: SIMPLE
fetches CGAL 6.0.1 from GitHub releases on every configure, also in the
CGAL job, which already installs Ubuntu's `libcgal-dev` (5.6), and that
download returned 504 as well. CMake now uses an installed CGAL of
version 5.6 or later, header-only as before; SIMPLE includes only the
AABB-tree, surface-mesh and STL-reader headers, which 5.6 provides.
Without one it fetches 6.0.1 as before, now pinned by SHA-256. Both
configure paths were checked locally, and the wall library builds
against the fetched 6.0.1; the CGAL job compiles and runs the wall tests
against 5.6.

This PR's own merge-group run exercises the changed jobs.

## Risk tier

- [x] T4: parallelism, GPU, dependency, CI, or security-sensitive build
logic

Chris&AI

Author: krystophny

.github/workflows/main.yml

@@ -69,10 +69,14 @@ jobs:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha || github.sha }}
 
+      # The runner's Python 3.12 (Ubuntu 24.04); setup-python would download one
+      # from GitHub on every run of this ephemeral runner.
       - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.12"
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends python3-venv
+          python3 -m venv "$RUNNER_TEMP/venv"
+          echo "$RUNNER_TEMP/venv/bin" >> "$GITHUB_PATH"
 
       - name: Install lint tools
         run: python -m pip install fprettify==0.3.7 ruff==0.14.1
@@ -457,11 +461,6 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.12"
-
       - name: Install system dependencies (CGAL)
         run: |
           sudo apt-get update
@@ -482,7 +481,12 @@ jobs:
             libopenblas-dev \
             liblapack-dev \
             libopenmpi-dev \
-            openmpi-bin
+            openmpi-bin \
+            python3-dev \
+            python3-venv
+          # The runner's Python 3.12; setup-python would download one from GitHub.
+          python3 -m venv "$RUNNER_TEMP/venv"
+          echo "$RUNNER_TEMP/venv/bin" >> "$GITHUB_PATH"
 
       - name: Install wall-test Python dependencies
         run: |
@@ -595,10 +599,13 @@ jobs:
         with:
           fetch-depth: 0
 
+      # The runner's Python 3.12; setup-python would download one from GitHub.
       - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.12"
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends python3-venv
+          python3 -m venv "$RUNNER_TEMP/venv"
+          echo "$RUNNER_TEMP/venv/bin" >> "$GITHUB_PATH"
 
       - name: Install build dependencies
         run: |

CMakeLists.txt

@@ -407,26 +407,39 @@ else()
     link_libraries(${NETCDF_FLIBS_LIST})
 endif()
 
-# CGAL (optional, for STL wall intersections)
-# CGAL 5.x is header-only, fetch headers via FetchContent (don't run CGAL's CMake)
+# CGAL (optional, for STL wall intersections). Header-only: an installed CGAL
+# >= 5.6 is used as is; otherwise 6.0.1 is fetched, pinned by hash, so a
+# download failure cannot hit hosts that have CGAL.
 if(SIMPLE_ENABLE_CGAL)
     # CGAL requires Boost headers
     find_package(Boost REQUIRED)
     message(STATUS "Boost found: ${Boost_VERSION}")
 
-    include(FetchContent)
-    FetchContent_Declare(
-        cgal
-        URL https://github.com/CGAL/cgal/releases/download/v6.0.1/CGAL-6.0.1.tar.xz
-        DOWNLOAD_EXTRACT_TIMESTAMP TRUE
-    )
-    FetchContent_GetProperties(cgal)
-    if(NOT cgal_POPULATED)
-        FetchContent_Populate(cgal)
+    find_path(CGAL_INCLUDE_DIR CGAL/version.h)
+    set(_cgal_version "")
+    if(CGAL_INCLUDE_DIR)
+        file(STRINGS "${CGAL_INCLUDE_DIR}/CGAL/version.h" _cgal_version_line
+             REGEX "^#define CGAL_VERSION ")
+        string(REGEX MATCH "[0-9]+\\.[0-9]+(\\.[0-9]+)?" _cgal_version
+               "${_cgal_version_line}")
+    endif()
+    if(_cgal_version AND _cgal_version VERSION_GREATER_EQUAL 5.6)
+        message(STATUS "CGAL enabled from ${CGAL_INCLUDE_DIR}: ${_cgal_version} (header-only)")
+    else()
+        include(FetchContent)
+        FetchContent_Declare(
+            cgal
+            URL https://github.com/CGAL/cgal/releases/download/v6.0.1/CGAL-6.0.1.tar.xz
+            URL_HASH SHA256=0acdfbf317c556630dd526f3253780f29b6ec9713ee92903e81b5c93c0f59b7f
+            DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+        )
+        FetchContent_GetProperties(cgal)
+        if(NOT cgal_POPULATED)
+            FetchContent_Populate(cgal)
+        endif()
+        set(CGAL_INCLUDE_DIR "${cgal_SOURCE_DIR}/include" CACHE PATH "CGAL headers" FORCE)
+        message(STATUS "CGAL enabled via FetchContent: 6.0.1 (header-only)")
     endif()
-    # CGAL 6.x is header-only, just add include path
-    set(CGAL_INCLUDE_DIR "${cgal_SOURCE_DIR}/include")
-    message(STATUS "CGAL enabled via FetchContent: 6.0.1 (header-only)")
     message(STATUS "CGAL include dir: ${CGAL_INCLUDE_DIR}")
     add_compile_definitions(SIMPLE_ENABLE_CGAL)
 else()