Skip to content

Route sim Linux CI to self-hosted CPU runners #1591

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
luohuan19 wants to merge 6 commits into from
Closed

Route sim Linux CI to self-hosted CPU runners #1591

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
7baec39
Route sim Linux CI to self-hosted CPU runners
luohuan19 Jul 29, 2026
71f7f14
Skip sudo on self-hosted CPU sim runners
luohuan19 Jul 29, 2026
b0068f3
Use venv for self-hosted sim runners
wangqin1723-max Jul 30, 2026
20e2d8e
Force self-hosted sim jobs to activate venv
luohuan19 Jul 30, 2026
ed04467
Use venv python explicitly in sim jobs
luohuan19 Jul 30, 2026
e5fb618
chore: retrigger ci
luohuan19 Jul 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
168 changes: 133 additions & 35 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,40 +164,66 @@ jobs:
st-sim-a2a3:
needs: [detect-changes, pre-commit]
if: needs.detect-changes.outputs.a2a3_changed == 'true'
runs-on: ${{ matrix.os }}
runs-on: ${{ fromJSON(matrix.runner) }}
timeout-minutes: 30
env:
SIMPLER_SCHEDULER_TIMEOUT_MS: "5000"
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, macos-latest]
python-version: ['3.10']
include:
- runner: '["self-hosted", "cpu"]'
python-version: '3.10'
- runner: '["macos-latest"]'
python-version: '3.10'

steps:
- name: Checkout repository
uses: actions/checkout@v5
Comment on lines 181 to 182

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Missing persist-credentials: false on checkout in both simulator jobs. Both jobs can now run on a self-hosted runner where the workspace may persist across job runs, widening the exposure window for the checkout-persisted GITHUB_TOKEN; neither job needs to push, so credentials should not be persisted.

  • .github/workflows/ci.yml#L181-L182: add with: persist-credentials: false to the Checkout repository step in st-sim-a2a3.
  • .github/workflows/ci.yml#L326-L327: add with: persist-credentials: false to the Checkout repository step in st-sim-a5.
🧰 Tools
🪛 zizmor (1.28.0)

[warning] 181-182: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

📍 Affects 1 file
  • .github/workflows/ci.yml#L181-L182 (this comment)
  • .github/workflows/ci.yml#L326-L327
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 181 - 182, Add
with.persist-credentials set to false on the Checkout repository step in both
simulator jobs, st-sim-a2a3 at .github/workflows/ci.yml lines 181-182 and
st-sim-a5 at lines 326-327; no other checkout steps require changes.

Source: Linters/SAST tools

- name: Set up C++ compiler
run: |
if [[ "${{ runner.os }}" == "Linux" ]]; then
sudo add-apt-repository -y ppa:ubuntu-toolchain-r/test
sudo apt-get update
sudo apt-get install -y ninja-build
sudo apt-get install -y g++-15 || sudo apt-get install -y g++
if ! command -v g++-15; then sudo ln -s $(which g++) /usr/local/bin/g++-15; fi
# graphviz: required by the dep_gen smoke (deps_viewer -> dot).
# Both a2a3 and a5 sim jobs run dep_gen, so install it in both.
sudo apt-get install -y graphviz
runner_spec='${{ matrix.runner }}'
if [[ "$runner_spec" == *self-hosted* ]]; then
command -v ninja
command -v g++
command -v dot
if ! command -v g++-15 >/dev/null 2>&1; then
mkdir -p "$RUNNER_TEMP/bin"
ln -sf "$(command -v g++)" "$RUNNER_TEMP/bin/g++-15"
echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
fi
else
sudo add-apt-repository -y ppa:ubuntu-toolchain-r/test
sudo apt-get update
sudo apt-get install -y ninja-build
sudo apt-get install -y g++-15 || sudo apt-get install -y g++
if ! command -v g++-15; then sudo ln -s $(which g++) /usr/local/bin/g++-15; fi
# graphviz: required by the dep_gen smoke (deps_viewer -> dot).
# Both a2a3 and a5 sim jobs run dep_gen, so install it in both.
sudo apt-get install -y graphviz
fi
else
brew install ninja
brew install gcc@15 || brew install gcc
brew install graphviz
fi

- name: Set up Python ${{ matrix.python-version }}
- name: Set up Python ${{ matrix.python-version }} (GitHub-hosted)
if: ${{ !contains(matrix.runner, 'self-hosted') }}
uses: actions/setup-python@v6
with:
python-version: ${{ matrix.python-version }}

- name: Set up Python ${{ matrix.python-version }} (self-hosted)
if: ${{ contains(matrix.runner, 'self-hosted') }}
run: |
python3 -m venv --system-site-packages .venv
source .venv/bin/activate
pip install --upgrade pip
pip install torch --index-url https://download.pytorch.org/whl/cpu
pip install '.[test]'

- name: Cache pip packages
uses: actions/cache@v5
with:
Expand All @@ -207,13 +233,18 @@ jobs:
${{ runner.os }}-pip-

- name: Install dependencies
if: ${{ !contains(matrix.runner, 'self-hosted') }}
run: |
pip install torch --index-url https://download.pytorch.org/whl/cpu
pip install '.[test]'

- name: Run pytest scene tests (a2a3sim)
run: |
pytest examples tests/st --platform a2a3sim --device 0-15 -v \
PYTHON=python
if [[ '${{ matrix.runner }}' == *self-hosted* ]]; then
PYTHON=.venv/bin/python
fi
"$PYTHON" -m pytest examples tests/st --platform a2a3sim --device 0-15 -v \
--pto-session-timeout 600 --require-pto-isa

# DFX per-feature smokes — the default pytest above passes no --enable-*
Expand All @@ -222,7 +253,11 @@ jobs:
# CI step rather than buried in a combined run.
- name: dep_gen smoke
run: |
pytest tests/st/a2a3/tensormap_and_ringbuffer/dfx/dep_gen/test_dep_gen.py \
PYTHON=python
if [[ '${{ matrix.runner }}' == *self-hosted* ]]; then
PYTHON=.venv/bin/python
fi
"$PYTHON" -m pytest tests/st/a2a3/tensormap_and_ringbuffer/dfx/dep_gen/test_dep_gen.py \
--platform a2a3sim --device 0-15 -p no:xdist --pto-session-timeout 600 \
--require-pto-isa --enable-dep-gen

Expand All @@ -233,65 +268,107 @@ jobs:
# children take xdist args that `-p no:xdist` has disabled.
- name: dep_gen smoke (host_build_graph)
run: |
pytest tests/st/a2a3/host_build_graph/dfx/dep_gen/test_dep_gen.py \
PYTHON=python
if [[ '${{ matrix.runner }}' == *self-hosted* ]]; then
PYTHON=.venv/bin/python
fi
"$PYTHON" -m pytest tests/st/a2a3/host_build_graph/dfx/dep_gen/test_dep_gen.py \
--platform a2a3sim --device 0-15 -p no:xdist --pto-session-timeout 600 \
--require-pto-isa --enable-dep-gen

- name: l2_swimlane smoke
run: |
pytest tests/st/a2a3/tensormap_and_ringbuffer/dfx/l2_swimlane/ \
PYTHON=python
if [[ '${{ matrix.runner }}' == *self-hosted* ]]; then
PYTHON=.venv/bin/python
fi
"$PYTHON" -m pytest tests/st/a2a3/tensormap_and_ringbuffer/dfx/l2_swimlane/ \
--platform a2a3sim --device 0-15 -p no:xdist --pto-session-timeout 600 \
--require-pto-isa --enable-l2-swimlane --enable-dep-gen

- name: PMU smoke
run: |
pytest tests/st/a2a3/tensormap_and_ringbuffer/dfx/pmu/test_pmu.py \
PYTHON=python
if [[ '${{ matrix.runner }}' == *self-hosted* ]]; then
PYTHON=.venv/bin/python
fi
"$PYTHON" -m pytest tests/st/a2a3/tensormap_and_ringbuffer/dfx/pmu/test_pmu.py \
--platform a2a3sim --device 0-15 -p no:xdist --pto-session-timeout 600 \
--require-pto-isa --enable-pmu 2

- name: args_dump smoke
run: |
pytest tests/st/a2a3/tensormap_and_ringbuffer/dfx/args_dump/test_args_dump.py \
PYTHON=python
if [[ '${{ matrix.runner }}' == *self-hosted* ]]; then
PYTHON=.venv/bin/python
fi
"$PYTHON" -m pytest tests/st/a2a3/tensormap_and_ringbuffer/dfx/args_dump/test_args_dump.py \
--platform a2a3sim --device 0-15 -p no:xdist --pto-session-timeout 600 \
--require-pto-isa --dump-args

st-sim-a5:
needs: [detect-changes, pre-commit]
if: needs.detect-changes.outputs.a5_changed == 'true'
runs-on: ${{ matrix.os }}
runs-on: ${{ fromJSON(matrix.runner) }}
timeout-minutes: 30
env:
SIMPLER_SCHEDULER_TIMEOUT_MS: "5000"
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, macos-latest]
python-version: ['3.10']
include:
- runner: '["self-hosted", "cpu"]'
python-version: '3.10'
- runner: '["macos-latest"]'
python-version: '3.10'

steps:
- name: Checkout repository
uses: actions/checkout@v5
- name: Set up C++ compiler
run: |
if [[ "${{ runner.os }}" == "Linux" ]]; then
sudo add-apt-repository -y ppa:ubuntu-toolchain-r/test
sudo apt-get update
sudo apt-get install -y ninja-build
sudo apt-get install -y g++-15 || sudo apt-get install -y g++
if ! command -v g++-15; then sudo ln -s $(which g++) /usr/local/bin/g++-15; fi
# graphviz: required by the dep_gen smoke (deps_viewer -> dot).
# Both a2a3 and a5 sim jobs run dep_gen, so install it in both.
sudo apt-get install -y graphviz
runner_spec='${{ matrix.runner }}'
if [[ "$runner_spec" == *self-hosted* ]]; then
command -v ninja
command -v g++
command -v dot
if ! command -v g++-15 >/dev/null 2>&1; then
mkdir -p "$RUNNER_TEMP/bin"
ln -sf "$(command -v g++)" "$RUNNER_TEMP/bin/g++-15"
echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
fi
else
sudo add-apt-repository -y ppa:ubuntu-toolchain-r/test
sudo apt-get update
sudo apt-get install -y ninja-build
sudo apt-get install -y g++-15 || sudo apt-get install -y g++
if ! command -v g++-15; then sudo ln -s $(which g++) /usr/local/bin/g++-15; fi
# graphviz: required by the dep_gen smoke (deps_viewer -> dot).
# Both a2a3 and a5 sim jobs run dep_gen, so install it in both.
sudo apt-get install -y graphviz
fi
else
brew install ninja
brew install gcc@15 || brew install gcc
brew install graphviz
fi

- name: Set up Python ${{ matrix.python-version }}
- name: Set up Python ${{ matrix.python-version }} (GitHub-hosted)
if: ${{ !contains(matrix.runner, 'self-hosted') }}
uses: actions/setup-python@v6
with:
python-version: ${{ matrix.python-version }}

- name: Set up Python ${{ matrix.python-version }} (self-hosted)
if: ${{ contains(matrix.runner, 'self-hosted') }}
run: |
python3 -m venv --system-site-packages .venv
source .venv/bin/activate
pip install --upgrade pip
pip install torch --index-url https://download.pytorch.org/whl/cpu
pip install '.[test]'

- name: Cache pip packages
uses: actions/cache@v5
with:
Expand All @@ -301,13 +378,18 @@ jobs:
${{ runner.os }}-pip-

- name: Install dependencies
if: ${{ !contains(matrix.runner, 'self-hosted') }}
run: |
pip install torch --index-url https://download.pytorch.org/whl/cpu
pip install '.[test]'

- name: Run pytest scene tests (a5sim)
run: |
pytest examples tests/st --platform a5sim --device 0-15 -v \
PYTHON=python
if [[ '${{ matrix.runner }}' == *self-hosted* ]]; then
PYTHON=.venv/bin/python
fi
"$PYTHON" -m pytest examples tests/st --platform a5sim --device 0-15 -v \
--pto-session-timeout 600 --require-pto-isa

# DFX per-feature smokes — the default pytest above passes no --enable-*
Expand All @@ -316,25 +398,41 @@ jobs:
# CI step rather than buried in a combined run. Mirrors st-sim-a2a3.
- name: dep_gen smoke
run: |
pytest tests/st/a5/tensormap_and_ringbuffer/dfx/dep_gen/test_dep_gen.py \
PYTHON=python
if [[ '${{ matrix.runner }}' == *self-hosted* ]]; then
PYTHON=.venv/bin/python
fi
"$PYTHON" -m pytest tests/st/a5/tensormap_and_ringbuffer/dfx/dep_gen/test_dep_gen.py \
--platform a5sim --device 0-15 -p no:xdist --pto-session-timeout 600 \
--require-pto-isa --enable-dep-gen

- name: l2_swimlane smoke
run: |
pytest tests/st/a5/tensormap_and_ringbuffer/dfx/l2_swimlane/ \
PYTHON=python
if [[ '${{ matrix.runner }}' == *self-hosted* ]]; then
PYTHON=.venv/bin/python
fi
"$PYTHON" -m pytest tests/st/a5/tensormap_and_ringbuffer/dfx/l2_swimlane/ \
--platform a5sim --device 0-15 -p no:xdist --pto-session-timeout 600 \
--require-pto-isa --enable-l2-swimlane --enable-dep-gen

- name: PMU smoke
run: |
pytest tests/st/a5/tensormap_and_ringbuffer/dfx/pmu/test_pmu.py \
PYTHON=python
if [[ '${{ matrix.runner }}' == *self-hosted* ]]; then
PYTHON=.venv/bin/python
fi
"$PYTHON" -m pytest tests/st/a5/tensormap_and_ringbuffer/dfx/pmu/test_pmu.py \
--platform a5sim --device 0-15 -p no:xdist --pto-session-timeout 600 \
--require-pto-isa --enable-pmu 2

- name: args_dump smoke
run: |
pytest tests/st/a5/tensormap_and_ringbuffer/dfx/args_dump/test_args_dump.py \
PYTHON=python
if [[ '${{ matrix.runner }}' == *self-hosted* ]]; then
PYTHON=.venv/bin/python
fi
"$PYTHON" -m pytest tests/st/a5/tensormap_and_ringbuffer/dfx/args_dump/test_args_dump.py \
--platform a5sim --device 0-15 -p no:xdist --pto-session-timeout 600 \
--require-pto-isa --dump-args

Expand Down
Loading