CI: streamline pre-commit builds and GCC 15 setup

.github/actions/setup-gcc-15/action.yml

@@ -0,0 +1,150 @@
+name: Set up GCC 15
+description: Use and verify GCC 15 on Linux or macOS, installing missing tools on Ubuntu or macOS.
+
+inputs:
+  install-graphviz:
+    description: Install Graphviz when dot is not already available.
+    required: false
+    default: "false"
+  install-build-essential:
+    description: >-
+      Linux only: require unversioned gcc and g++ for _ensure_host_compilers, installing build-essential on Ubuntu
+      when either is missing. Simulator builds still use gcc-15/g++-15. Ignored on macOS.
+    required: false
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - name: Install GCC 15 and build tools
+      if: runner.os == 'Linux'
+      shell: bash
+      env:
+        EXPECTED_PPA_FINGERPRINT: 60C317803A41BA51845E371A1E9377A2BA9EF27F
+      run: |
+        set -euo pipefail
+
+        is_version_15() {
+          command -v "$1" >/dev/null 2>&1 &&
+            [[ "$("$1" -dumpversion | cut -d. -f1)" == 15 ]]
+        }
+
+        packages=()
+        needs_gcc_ppa=false
+        if ! is_version_15 gcc-15 || ! is_version_15 g++-15; then
+          packages+=(gcc-15 g++-15)
+          needs_gcc_ppa=true
+        fi
+        command -v ninja >/dev/null 2>&1 || packages+=(ninja-build)
+        if [[ "${{ inputs.install-graphviz }}" == true ]] && ! command -v dot >/dev/null 2>&1; then
+          packages+=(graphviz)
+        fi
+        if [[ "${{ inputs.install-build-essential }}" == true ]] &&
+          { ! command -v gcc >/dev/null 2>&1 || ! command -v g++ >/dev/null 2>&1; }; then
+          packages+=(build-essential)
+        fi
+
+        if (( ${#packages[@]} )); then
+          if [[ ! -r /etc/os-release ]]; then
+            echo "::error::setup-gcc-15 can automatically install missing Linux tools only on Ubuntu"
+            exit 1
+          fi
+          source /etc/os-release
+          if [[ "${ID:-}" != ubuntu ]]; then
+            echo "::error::setup-gcc-15 can automatically install missing Linux tools only on Ubuntu"
+            exit 1
+          fi
+          export DEBIAN_FRONTEND=noninteractive
+
+          if [[ "$needs_gcc_ppa" == true ]]; then
+            : "${VERSION_CODENAME:?Ubuntu /etc/os-release must define VERSION_CODENAME}"
+            key_file="${{ github.action_path }}/ubuntu-toolchain-r-test.asc"
+            keyring_file="$RUNNER_TEMP/ubuntu-toolchain-r-test.gpg"
+            key_metadata="$(gpg --batch --show-keys --with-colons "$key_file")"
+            primary_key_count="$(
+              awk -F: '$1 == "pub" { count++ } END { print count + 0 }' <<<"$key_metadata"
+            )"
+            if [[ "$primary_key_count" != 1 ]]; then
+              echo "::error::expected exactly one PPA primary key, found $primary_key_count"
+              exit 1
+            fi
+            actual_fingerprint="$(
+              awk -F: '$1 == "fpr" { print $10; exit }' <<<"$key_metadata"
+            )"
+            if [[ "$actual_fingerprint" != "$EXPECTED_PPA_FINGERPRINT" ]]; then
+              echo "::error::unexpected PPA signing key: $actual_fingerprint"
+              exit 1
+            fi
+
+            gpg --batch --yes --dearmor --output "$keyring_file" "$key_file"
+            sudo install -d -m 0755 /etc/apt/keyrings
+            sudo install -m 0644 "$keyring_file" /etc/apt/keyrings/ubuntu-toolchain-r-test.gpg
+            printf '%s\n' \
+              'Types: deb' \
+              'URIs: https://ppa.launchpadcontent.net/ubuntu-toolchain-r/test/ubuntu/' \
+              "Suites: $VERSION_CODENAME" \
+              'Components: main' \
+              "Signed-By: /etc/apt/keyrings/ubuntu-toolchain-r-test.gpg $EXPECTED_PPA_FINGERPRINT" |
+              sudo tee /etc/apt/sources.list.d/ubuntu-toolchain-r-test.sources >/dev/null
+          fi
+
+          apt_options=(
+            -o Acquire::Retries=3
+            -o Acquire::http::Timeout=20
+            -o Acquire::https::Timeout=20
+          )
+          sudo apt-get "${apt_options[@]}" update
+          sudo apt-get "${apt_options[@]}" install -y "${packages[@]}"
+        fi
+
+        command -v gcc-15
+        command -v g++-15
+        command -v ninja
+        is_version_15 gcc-15
+        is_version_15 g++-15
+        if [[ "${{ inputs.install-graphviz }}" == true ]]; then
+          command -v dot
+        fi
+        if [[ "${{ inputs.install-build-essential }}" == true ]]; then
+          command -v gcc
+          command -v g++
+        fi
+
+    - name: Install GCC 15 and build tools
+      if: runner.os == 'macOS'
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        is_version_15() {
+          command -v "$1" >/dev/null 2>&1 &&
+            [[ "$("$1" -dumpversion | cut -d. -f1)" == 15 ]]
+        }
+
+        formulae=()
+        command -v ninja >/dev/null 2>&1 || formulae+=(ninja)
+        if ! is_version_15 gcc-15 || ! is_version_15 g++-15; then
+          formulae+=(gcc@15)
+        fi
+        if [[ "${{ inputs.install-graphviz }}" == true ]] && ! command -v dot >/dev/null 2>&1; then
+          formulae+=(graphviz)
+        fi
+        if (( ${#formulae[@]} )); then
+          brew install "${formulae[@]}"
+        fi
+
+        command -v gcc-15
+        command -v g++-15
+        command -v ninja
+        is_version_15 gcc-15
+        is_version_15 g++-15
+        if [[ "${{ inputs.install-graphviz }}" == true ]]; then
+          command -v dot
+        fi
+
+    - name: Reject unsupported runner
+      if: runner.os != 'Linux' && runner.os != 'macOS'
+      shell: bash
+      run: |
+        echo "::error::setup-gcc-15 does not support $RUNNER_OS"
+        exit 1

.github/actions/setup-gcc-15/ubuntu-toolchain-r-test.asc

@@ -0,0 +1,12 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mI0ESuBvRwEEAMi4cDba7xlKaaoXjO1n1HX8RKrkW+HEIl79nSOSJyvzysajs7zU
+ow/OzCQp9NswqrDmNuH1+lPTTRNAGtK8r2ouq2rnXT1mTl23dpgHZ9spseR73s4Z
+BGw/ag4bpU5dNUStvfmHhIjVCuiSpNn7cyy1JSSvSs3N2mxteKjXLBf7ABEBAAG0
+GkxhdW5jaHBhZCBUb29sY2hhaW4gYnVpbGRziLYEEwECACAFAkrgb0cCGwMGCwkI
+BwMCBBUCCAMEFgIDAQIeAQIXgAAKCRAek3eiup7yfzGKA/4xzUqNACSlB+k+DxFF
+HqkwKa/ziFiAlkLQyyhm+iqz80htRZr7Ls/ZRYZl0aSU56/hLe0V+TviJ1s8qdN2
+lamkKdXIAFfavA04nOnTzyIBJ82EAUT3Nh45skMxo4z4iZMNmsyaQpNl/m/lNtOL
+hR64v5ZybofB2EWkMxUzX8D/FQ==
+=LcUQ
+-----END PGP PUBLIC KEY BLOCK-----

.github/workflows/_pre-commit.yml

@@ -49,14 +49,84 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Install build and lint tools
+      - name: Set up Python 3.10
         if: inputs.setup_variant == 'github'
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.10"
+
+      - name: Resolve base SHA
+        id: base
+        if: inputs.setup_variant == 'self-cpu'
+        env:
+          BASE_REPOSITORY: ${{ inputs.base_repository || github.repository }}
+        run: |
+          git fetch --no-tags "https://github.com/${BASE_REPOSITORY}.git" main
+          echo "base_sha=$(git merge-base FETCH_HEAD HEAD)" >> "$GITHUB_OUTPUT"
+
+      - name: Select lint build target
+        id: lint-build
+        env:
+          BASE_SHA: ${{ inputs.setup_variant == 'self-cpu' && steps.base.outputs.base_sha || inputs.base_sha }}
+          HEAD_SHA: ${{ inputs.setup_variant == 'self-cpu' && (inputs.ref || github.sha) || inputs.head_sha }}
+        run: |
+          needs_build=false
+
+          changed_files=$(mktemp)
+          trap 'rm -f "$changed_files"' EXIT
+          if ! git diff --name-only --no-ext-diff -z "$BASE_SHA"..."$HEAD_SHA" > "$changed_files"; then
+            git diff --name-only --no-ext-diff -z "$BASE_SHA".."$HEAD_SHA" > "$changed_files"
+          fi
+
+          while IFS= read -r -d '' path; do
+            if [[ ! -e "$path" && ! -L "$path" ]]; then
+              continue
+            fi
+
+            case "$path" in
+              .pre-commit-config.yaml)
+                needs_build=true
+                ;;
+              3rdparty/*)
+                ;;
+              *)
+                shopt -s nocasematch
+                case "$path" in
+                  *.c|*.c++|*.c++m|*.cc|*.ccm|*.cpp|*.cppm|*.cxx|*.cxxm|*.h|*.hh|*.hpp|*.hxx|*.inl|*.ino|*.ipp|*.ixx|*.mm|*.tpp)
+                    case "$path" in
+                      python/bindings/*|*/kernels/*|*/aicore/*) ;;
+                      *) needs_build=true ;;
+                    esac
+                    ;;
+                  *.asc|*.cce|*.gyp|*.gypi|*.py|*.pyi|*.pyt|*.tac|*.wsgi|*.md|*.rst|*.txt|*.yml|*.yaml|*.json|*.toml|*.pin|*.cmake|*.in|*.sh|*.bash|*.zsh|*.fish|*.gitignore|*.clang-format|*.clang-tidy)
+                    ;;
+                  CMakeLists.txt|LICENSE|LICENSE.*) ;;
+                  *) needs_build=true ;;
+                esac
+                shopt -u nocasematch
+                ;;
+            esac
+          done < "$changed_files"
+
+          echo "needs_build=$needs_build" >> "$GITHUB_OUTPUT"
+
+      - name: Install build and lint tools
+        if: inputs.setup_variant == 'github' && steps.lint-build.outputs.needs_build == 'true'
         run: |
-          sudo apt-get update
-          sudo apt-get install -y cmake ninja-build g++ clang-tidy
+          missing_packages=()
+          command -v cmake >/dev/null 2>&1 || missing_packages+=(cmake)
+          command -v ninja >/dev/null 2>&1 || missing_packages+=(ninja-build)
+          command -v g++ >/dev/null 2>&1 || missing_packages+=(g++)
+          if ! command -v clang-tidy >/dev/null 2>&1; then
+            missing_packages+=(clang-tidy)
+          fi
+          if (( ${#missing_packages[@]} )); then
+            sudo apt-get update
+            sudo apt-get install -y "${missing_packages[@]}"
+          fi
 
       - name: Verify provisioned toolchain
-        if: inputs.setup_variant == 'self-cpu'
+        if: inputs.setup_variant == 'self-cpu' && steps.lint-build.outputs.needs_build == 'true'
         run: |
           command -v cmake
           command -v ninja
@@ -75,38 +145,29 @@ jobs:
           PATH="$RUNNER_TEMP/bin:$PATH" command -v clang-tidy
           PATH="$RUNNER_TEMP/bin:$PATH" clang-tidy --version
 
-      - name: Set up Python 3.10
-        if: inputs.setup_variant == 'github'
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.10"
-
       - name: Cache pip packages
-        if: inputs.setup_variant == 'self-cpu'
+        if: inputs.setup_variant == 'self-cpu' || steps.lint-build.outputs.needs_build == 'true'
         uses: ./.github/actions/cache-pip
 
-      - name: Install Python dependencies
-        if: inputs.setup_variant == 'github'
-        run: pip install torch --index-url https://download.pytorch.org/whl/cpu
-
-      - name: Install package (for pyright C extension symbol resolution)
-        if: inputs.setup_variant == 'github'
-        run: pip install --config-settings=build.targets=build_package_sim .
+      - name: Install package (for clang-tidy compile databases)
+        if: inputs.setup_variant == 'github' && steps.lint-build.outputs.needs_build == 'true'
+        run: pip install --config-settings="build.targets=build_package_sim" .
 
       - name: venv + deps
-        if: inputs.setup_variant == 'self-cpu'
+        if: inputs.setup_variant == 'self-cpu' && steps.lint-build.outputs.needs_build == 'true'
         uses: ./.github/actions/setup-venv
         with:
-          packages: "--config-settings=build.targets=build_package_sim ."
+          install-torch: "false"
+          packages: >-
+            --config-settings=build.targets=build_package_sim .
 
-      - name: Resolve base SHA
-        id: base
+      - name: Lint-only venv
+        if: inputs.setup_variant == 'self-cpu' && steps.lint-build.outputs.needs_build != 'true'
+        run: python3 -m venv .venv
+
+      - name: Use lint venv
         if: inputs.setup_variant == 'self-cpu'
-        env:
-          BASE_REPOSITORY: ${{ inputs.base_repository || github.repository }}
-        run: |
-          git fetch --no-tags "https://github.com/${BASE_REPOSITORY}.git" main
-          echo "base_sha=$(git merge-base FETCH_HEAD HEAD)" >> "$GITHUB_OUTPUT"
+        run: echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
 
       - name: Run pre-commit
         uses: pre-commit/action@v3.0.0

.github/workflows/_profiling-flags-smoke.yml

@@ -35,12 +35,7 @@ jobs:
 
       - name: Set up C++ compiler
         if: inputs.setup_variant == 'github'
-        run: |
-          sudo add-apt-repository -y ppa:ubuntu-toolchain-r/test
-          sudo apt-get update
-          sudo apt-get install -y ninja-build
-          sudo apt-get install -y g++-15 || sudo apt-get install -y g++
-          if ! command -v g++-15; then sudo ln -s "$(which g++)" /usr/local/bin/g++-15; fi
+        uses: ./.github/actions/setup-gcc-15
 
       - name: Set up Python 3.10
         if: inputs.setup_variant == 'github'

.github/workflows/_st-npu-a2a3.yml

@@ -19,11 +19,6 @@ on:
         required: false
         default: false
         type: boolean
-      a2a3_sdma_mode:
-        description: marker for main CI, legacy-paths for the CPU emergency lane.
-        required: false
-        default: marker
-        type: string
       manual_mode:
         description: exclude for Per-PR, include for the Daily full sweep.
         required: false
@@ -90,7 +85,6 @@ jobs:
             --manual "$MANUAL_MODE"
 
       - name: Run pytest scene tests (a2a3)
-        if: inputs.a2a3_sdma_mode == 'marker'
         run: |
           source /usr/local/Ascend/cann/set_env.sh
           if [ "$(uname -m)" = "x86_64" ]; then
@@ -100,20 +94,8 @@ jobs:
               --run ".venv/bin/python -m pytest examples tests/st -m 'not sdma' --platform a2a3 --exclude-level 4 --device \$TASK_DEVICE -v --require-pto-isa --pto-session-timeout 1200 --manual '$MANUAL_MODE'"
           fi
 
-      - name: Run pytest scene tests (a2a3 legacy SDMA paths)
-        if: inputs.a2a3_sdma_mode == 'legacy-paths' && inputs.manual_mode != 'only'
-        run: |
-          source /usr/local/Ascend/cann/set_env.sh
-          SDMA_IGNORE="--ignore=examples/a2a3/tensormap_and_ringbuffer/prefetch_async_demo --ignore=examples/a2a3/tensormap_and_ringbuffer/sdma_async_completion_demo"
-          if [ "$(uname -m)" = "x86_64" ]; then
-            .venv/bin/python -m pytest examples tests/st $SDMA_IGNORE --platform a2a3 --exclude-level 4 --device ${DEVICE_RANGE} -v --require-pto-isa --pto-session-timeout 600
-          else
-            task-submit --timeout 1800 --max-time 1800 --device auto --device-num "$DEVICE_NUM" \
-              --run ".venv/bin/python -m pytest examples tests/st $SDMA_IGNORE --platform a2a3 --exclude-level 4 --device \$TASK_DEVICE -v --require-pto-isa --pto-session-timeout 600"
-          fi
-
       - name: SDMA pytest (a2a3)
-        if: inputs.a2a3_sdma_mode == 'marker' && inputs.manual_mode != 'only'
+        if: inputs.manual_mode != 'only'
         run: |
           source /usr/local/Ascend/cann/set_env.sh
           SDMA_TESTS="examples tests/st -m sdma"
@@ -124,18 +106,6 @@ jobs:
               --run ".venv/bin/python -m pytest $SDMA_TESTS --platform a2a3 --device \$TASK_DEVICE -v --require-pto-isa --pto-session-timeout 600"
           fi
 
-      - name: SDMA pytest (a2a3 legacy paths)
-        if: inputs.a2a3_sdma_mode == 'legacy-paths' && inputs.manual_mode != 'only'
-        run: |
-          source /usr/local/Ascend/cann/set_env.sh
-          SDMA_TESTS="examples/a2a3/tensormap_and_ringbuffer/prefetch_async_demo examples/a2a3/tensormap_and_ringbuffer/sdma_async_completion_demo"
-          if [ "$(uname -m)" = "x86_64" ]; then
-            .venv/bin/python -m pytest $SDMA_TESTS --platform a2a3 --device ${DEVICE_RANGE} -v --require-pto-isa --pto-session-timeout 600
-          else
-            task-submit --timeout 1800 --max-time 1800 --device auto --device-num 2 \
-              --run ".venv/bin/python -m pytest $SDMA_TESTS --platform a2a3 --device \$TASK_DEVICE -v --require-pto-isa --pto-session-timeout 600"
-          fi
-
       - name: DFX smokes (a2a3)
         if: inputs.include_dfx_smokes
         uses: ./.github/actions/run-onboard-dfx-smokes