Skip to content

Route sim Linux CI to self-hosted CPU runners #1595

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
luohuan19 wants to merge 5 commits into from
Closed

Route sim Linux CI to self-hosted CPU runners #1595

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
6cfa132
ci: route sim Linux CI to self-hosted CPU runners
luohuan19 Jul 30, 2026
84ad526
docs: add CI trigger note
luohuan19 Jul 30, 2026
035704a
docs: refresh CI trigger note
luohuan19 Jul 30, 2026
b76e1d8
chore: nudge CI trigger
luohuan19 Jul 30, 2026
cdfeb12
ci: add workflow_dispatch fallback
luohuan19 Jul 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
213 changes: 176 additions & 37 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,14 +7,54 @@ permissions:
on:
pull_request:
branches: [main]
workflow_dispatch:
inputs:
base_sha:
description: "Base SHA for manual runs; defaults to merge-base with origin/main."
required: false
type: string
head_sha:
description: "Head SHA for manual runs; defaults to the checked-out commit."
required: false
type: string

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

jobs:
diff-refs:
runs-on: ubuntu-latest
outputs:
base_sha: ${{ steps.refs.outputs.base_sha }}
head_sha: ${{ steps.refs.outputs.head_sha }}
steps:
- name: Checkout repository
uses: actions/checkout@v5
with:
fetch-depth: 0

- name: Resolve diff refs
id: refs
run: |
if [[ "${{ github.event_name }}" == "pull_request" ]]; then
base_sha='${{ github.event.pull_request.base.sha }}'
head_sha='${{ github.event.pull_request.head.sha }}'
elif [[ -n "${{ github.event.inputs.base_sha }}" && -n "${{ github.event.inputs.head_sha }}" ]]; then
base_sha='${{ github.event.inputs.base_sha }}'
head_sha='${{ github.event.inputs.head_sha }}'
else
git fetch --no-tags origin main
base_sha=$(git merge-base origin/main HEAD)
head_sha='${{ github.sha }}'
fi

echo "base_sha=$base_sha" >> "$GITHUB_OUTPUT"
echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT"

# ---------- Pre-commit hooks (format, lint, clang-tidy) ----------
pre-commit:
needs: [diff-refs]
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
Expand Down Expand Up @@ -53,7 +93,7 @@ jobs:
- name: Run pre-commit
uses: pre-commit/action@v3.0.0
with:
extra_args: --from-ref ${{ github.event.pull_request.base.sha }} --to-ref ${{ github.event.pull_request.head.sha }}
extra_args: --from-ref ${{ needs['diff-refs'].outputs.base_sha }} --to-ref ${{ needs['diff-refs'].outputs.head_sha }}

# ---------- Packaging matrix: 5 install paths × 4 entry points, on macOS + Ubuntu ----------
# Smoke-checks that every supported install path exposes the four user entry points.
Expand Down Expand Up @@ -164,40 +204,66 @@ jobs:
st-sim-a2a3:
needs: [detect-changes, pre-commit]
if: needs.detect-changes.outputs.a2a3_changed == 'true'
runs-on: ${{ matrix.os }}
runs-on: ${{ fromJSON(matrix.runner) }}
timeout-minutes: 30
env:
SIMPLER_SCHEDULER_TIMEOUT_MS: "5000"
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, macos-latest]
python-version: ['3.10']
include:
- runner: '["self-hosted", "cpu"]'
python-version: '3.10'
- runner: '["macos-latest"]'
python-version: '3.10'

steps:
- name: Checkout repository
uses: actions/checkout@v5
Comment on lines 221 to 222

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow excerpt =="
sed -n '160,200p' .github/workflows/ci.yml
echo
sed -n '310,340p' .github/workflows/ci.yml

echo
echo "== checkout occurrences =="
rg -n "actions/checkout|persist-credentials|pytest|python|uv|pip" .github/workflows/ci.yml

Repository: hw-native-sys/simpler

Length of output: 15037

🌐 Web query:

actions/checkout persist-credentials default true local Git config

💡 Result:

In the actions/checkout GitHub Action, the persist-credentials input determines whether the authentication token or SSH key used for the checkout is configured in the local Git environment, allowing subsequent steps in the same job to run authenticated Git commands [1][2][3]. The default value for persist-credentials is true [1][3]. Key details regarding this setting include: 1. Functionality: When set to true (default), the action configures the Git credential helper or local Git config so that subsequent steps can perform authenticated operations (e.g., git fetch, git push) without needing to manually re-authenticate [2][3]. 2. Security Improvement: As of version v6.0.0, the action was updated to improve credential security [3][4]. Instead of storing credentials directly in the local.git/config file, it now stores them in a separate, more secure location (under $RUNNER_TEMP) while still maintaining the functionality for authenticated Git commands [3][4]. 3. Opt-out: Users can explicitly set persist-credentials: false if they do not want the credentials to be available to subsequent steps in the job [2][3]. 4. Context: While there have been community requests to change this default to false to reduce the risk of accidental exposure of the GITHUB_TOKEN, the default remains true as of July 2026 to ensure backward compatibility and ease of use for standard workflow requirements [5][6].

Citations:

Disable persisted checkout credentials before executing tests.

actions/checkout preserves workflow credentials for later Git commands by default; the following pytest steps execute repository-controlled code under the same job identity. Set persist-credentials: false here unless the job needs authenticated Git access afterward.

  • .github/workflows/ci.yml#L181-L182: add with: persist-credentials: false to the checkout step.
  • .github/workflows/ci.yml#L326-L327: add the same setting to the checkout step.
🧰 Tools
🪛 zizmor (1.28.0)

[warning] 181-182: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

📍 Affects 1 file
  • .github/workflows/ci.yml#L181-L182 (this comment)
  • .github/workflows/ci.yml#L326-L327
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 181 - 182, Disable persisted checkout
credentials on both actions/checkout steps in .github/workflows/ci.yml at lines
181-182 and 326-327 by adding the persist-credentials: false setting under each
step’s with configuration; no other workflow changes are needed.

Source: Linters/SAST tools

- name: Set up C++ compiler
run: |
if [[ "${{ runner.os }}" == "Linux" ]]; then
sudo add-apt-repository -y ppa:ubuntu-toolchain-r/test
sudo apt-get update
sudo apt-get install -y ninja-build
sudo apt-get install -y g++-15 || sudo apt-get install -y g++
if ! command -v g++-15; then sudo ln -s $(which g++) /usr/local/bin/g++-15; fi
# graphviz: required by the dep_gen smoke (deps_viewer -> dot).
# Both a2a3 and a5 sim jobs run dep_gen, so install it in both.
sudo apt-get install -y graphviz
runner_spec='${{ matrix.runner }}'
if [[ "$runner_spec" == *self-hosted* ]]; then
command -v ninja
command -v g++
command -v dot
if ! command -v g++-15 >/dev/null 2>&1; then
mkdir -p "$RUNNER_TEMP/bin"
ln -sf "$(command -v g++)" "$RUNNER_TEMP/bin/g++-15"
echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
Comment on lines +232 to +234

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Keep the compiler shim inside the assigned workspace.

Both branches create $RUNNER_TEMP/bin, outside the working directory. Use a workspace-relative directory (for example, $GITHUB_WORKSPACE/.ci-bin) before appending it to GITHUB_PATH.

  • .github/workflows/ci.yml#L192-L194: relocate the a2a3 g++-15 shim.
  • .github/workflows/ci.yml#L337-L339: relocate the a5 g++-15 shim.

As per coding guidelines, “Create new subdirectories only under the assigned working directory; when uncertain about modifying another area, ask the user first.”

📍 Affects 1 file
  • .github/workflows/ci.yml#L192-L194 (this comment)
  • .github/workflows/ci.yml#L337-L339
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 192 - 194, Relocate the g++-15
compiler shims in both the a2a3 block at .github/workflows/ci.yml#L192-L194 and
the a5 block at .github/workflows/ci.yml#L337-L339 from RUNNER_TEMP/bin to a
workspace-relative directory such as GITHUB_WORKSPACE/.ci-bin, then append that
same directory to GITHUB_PATH in each block.

Source: Coding guidelines

fi
else
sudo add-apt-repository -y ppa:ubuntu-toolchain-r/test
sudo apt-get update
sudo apt-get install -y ninja-build
sudo apt-get install -y g++-15 || sudo apt-get install -y g++
if ! command -v g++-15; then sudo ln -s $(which g++) /usr/local/bin/g++-15; fi
# graphviz: required by the dep_gen smoke (deps_viewer -> dot).
# Both a2a3 and a5 sim jobs run dep_gen, so install it in both.
sudo apt-get install -y graphviz
fi
else
brew install ninja
brew install gcc@15 || brew install gcc
brew install graphviz
fi

- name: Set up Python ${{ matrix.python-version }}
- name: Set up Python ${{ matrix.python-version }} (GitHub-hosted)
if: ${{ !contains(matrix.runner, 'self-hosted') }}
uses: actions/setup-python@v6
with:
python-version: ${{ matrix.python-version }}

- name: Set up Python ${{ matrix.python-version }} (self-hosted)
if: ${{ contains(matrix.runner, 'self-hosted') }}
run: |
python3 -m venv --system-site-packages .venv
source .venv/bin/activate
pip install --upgrade pip
pip install torch --index-url https://download.pytorch.org/whl/cpu
pip install '.[test]'
Comment on lines +258 to +265

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow excerpt around ci.yml =="
wc -l .github/workflows/ci.yml
sed -n '160,240p' .github/workflows/ci.yml
sed -n '310,385p' .github/workflows/ci.yml

echo
echo "== python-version matrix usages =="
rg -n "python-version|matrix\.runner|python3 -m venv|source \.venv/bin/activate" .github/workflows/ci.yml

Repository: hw-native-sys/simpler

Length of output: 9748

Enforce the matrix Python version on self-hosted runners.

The self-hosted setup still uses the bare python3 interpreter instead of the matrix value, so python3 can resolve to any preinstalled interpreter despite the job declaring Python 3.10. Use a versioned/missing-fail-safe interpreter here too:

  • .github/workflows/ci.yml#L218-L225: use python"${{ matrix.python-version }}" (quote it).
  • .github/workflows/ci.yml#L363-L370: apply the same interpreter selection for a5.
📍 Affects 1 file
  • .github/workflows/ci.yml#L218-L225 (this comment)
  • .github/workflows/ci.yml#L363-L370
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 218 - 225, The self-hosted Python
setup steps use an unversioned interpreter instead of the matrix-selected
version. In .github/workflows/ci.yml lines 218-225 and 363-370, update the venv
creation command to invoke the quoted matrix-specific interpreter python"${{
matrix.python-version }}" so missing versions fail rather than falling back to
an arbitrary python3.


- name: Cache pip packages
uses: actions/cache@v5
with:
Expand All @@ -207,13 +273,18 @@ jobs:
${{ runner.os }}-pip-

- name: Install dependencies
if: ${{ !contains(matrix.runner, 'self-hosted') }}
run: |
pip install torch --index-url https://download.pytorch.org/whl/cpu
pip install '.[test]'

- name: Run pytest scene tests (a2a3sim)
run: |
pytest examples tests/st --platform a2a3sim --device 0-15 -v \
PYTHON=python
if [[ '${{ matrix.runner }}' == *self-hosted* ]]; then
PYTHON=.venv/bin/python
fi
"$PYTHON" -m pytest examples tests/st --platform a2a3sim --device 0-15 -v \
--pto-session-timeout 600 --require-pto-isa

# DFX per-feature smokes — the default pytest above passes no --enable-*
Expand All @@ -222,7 +293,11 @@ jobs:
# CI step rather than buried in a combined run.
- name: dep_gen smoke
run: |
pytest tests/st/a2a3/tensormap_and_ringbuffer/dfx/dep_gen/test_dep_gen.py \
PYTHON=python
if [[ '${{ matrix.runner }}' == *self-hosted* ]]; then
PYTHON=.venv/bin/python
fi
"$PYTHON" -m pytest tests/st/a2a3/tensormap_and_ringbuffer/dfx/dep_gen/test_dep_gen.py \
--platform a2a3sim --device 0-15 -p no:xdist --pto-session-timeout 600 \
--require-pto-isa --enable-dep-gen

Expand All @@ -233,65 +308,107 @@ jobs:
# children take xdist args that `-p no:xdist` has disabled.
- name: dep_gen smoke (host_build_graph)
run: |
pytest tests/st/a2a3/host_build_graph/dfx/dep_gen/test_dep_gen.py \
PYTHON=python
if [[ '${{ matrix.runner }}' == *self-hosted* ]]; then
PYTHON=.venv/bin/python
fi
"$PYTHON" -m pytest tests/st/a2a3/host_build_graph/dfx/dep_gen/test_dep_gen.py \
--platform a2a3sim --device 0-15 -p no:xdist --pto-session-timeout 600 \
--require-pto-isa --enable-dep-gen

- name: l2_swimlane smoke
run: |
pytest tests/st/a2a3/tensormap_and_ringbuffer/dfx/l2_swimlane/ \
PYTHON=python
if [[ '${{ matrix.runner }}' == *self-hosted* ]]; then
PYTHON=.venv/bin/python
fi
"$PYTHON" -m pytest tests/st/a2a3/tensormap_and_ringbuffer/dfx/l2_swimlane/ \
--platform a2a3sim --device 0-15 -p no:xdist --pto-session-timeout 600 \
--require-pto-isa --enable-l2-swimlane --enable-dep-gen

- name: PMU smoke
run: |
pytest tests/st/a2a3/tensormap_and_ringbuffer/dfx/pmu/test_pmu.py \
PYTHON=python
if [[ '${{ matrix.runner }}' == *self-hosted* ]]; then
PYTHON=.venv/bin/python
fi
"$PYTHON" -m pytest tests/st/a2a3/tensormap_and_ringbuffer/dfx/pmu/test_pmu.py \
--platform a2a3sim --device 0-15 -p no:xdist --pto-session-timeout 600 \
--require-pto-isa --enable-pmu 2

- name: args_dump smoke
run: |
pytest tests/st/a2a3/tensormap_and_ringbuffer/dfx/args_dump/test_args_dump.py \
PYTHON=python
if [[ '${{ matrix.runner }}' == *self-hosted* ]]; then
PYTHON=.venv/bin/python
fi
"$PYTHON" -m pytest tests/st/a2a3/tensormap_and_ringbuffer/dfx/args_dump/test_args_dump.py \
--platform a2a3sim --device 0-15 -p no:xdist --pto-session-timeout 600 \
--require-pto-isa --dump-args

st-sim-a5:
needs: [detect-changes, pre-commit]
if: needs.detect-changes.outputs.a5_changed == 'true'
runs-on: ${{ matrix.os }}
runs-on: ${{ fromJSON(matrix.runner) }}
timeout-minutes: 30
env:
SIMPLER_SCHEDULER_TIMEOUT_MS: "5000"
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, macos-latest]
python-version: ['3.10']
include:
- runner: '["self-hosted", "cpu"]'
python-version: '3.10'
- runner: '["macos-latest"]'
python-version: '3.10'

steps:
- name: Checkout repository
uses: actions/checkout@v5
- name: Set up C++ compiler
run: |
if [[ "${{ runner.os }}" == "Linux" ]]; then
sudo add-apt-repository -y ppa:ubuntu-toolchain-r/test
sudo apt-get update
sudo apt-get install -y ninja-build
sudo apt-get install -y g++-15 || sudo apt-get install -y g++
if ! command -v g++-15; then sudo ln -s $(which g++) /usr/local/bin/g++-15; fi
# graphviz: required by the dep_gen smoke (deps_viewer -> dot).
# Both a2a3 and a5 sim jobs run dep_gen, so install it in both.
sudo apt-get install -y graphviz
runner_spec='${{ matrix.runner }}'
if [[ "$runner_spec" == *self-hosted* ]]; then
command -v ninja
command -v g++
command -v dot
if ! command -v g++-15 >/dev/null 2>&1; then
mkdir -p "$RUNNER_TEMP/bin"
ln -sf "$(command -v g++)" "$RUNNER_TEMP/bin/g++-15"
echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
fi
else
sudo add-apt-repository -y ppa:ubuntu-toolchain-r/test
sudo apt-get update
sudo apt-get install -y ninja-build
sudo apt-get install -y g++-15 || sudo apt-get install -y g++
if ! command -v g++-15; then sudo ln -s $(which g++) /usr/local/bin/g++-15; fi
# graphviz: required by the dep_gen smoke (deps_viewer -> dot).
# Both a2a3 and a5 sim jobs run dep_gen, so install it in both.
sudo apt-get install -y graphviz
fi
else
brew install ninja
brew install gcc@15 || brew install gcc
brew install graphviz
fi

- name: Set up Python ${{ matrix.python-version }}
- name: Set up Python ${{ matrix.python-version }} (GitHub-hosted)
if: ${{ !contains(matrix.runner, 'self-hosted') }}
uses: actions/setup-python@v6
with:
python-version: ${{ matrix.python-version }}

- name: Set up Python ${{ matrix.python-version }} (self-hosted)
if: ${{ contains(matrix.runner, 'self-hosted') }}
run: |
python3 -m venv --system-site-packages .venv
source .venv/bin/activate
pip install --upgrade pip
pip install torch --index-url https://download.pytorch.org/whl/cpu
pip install '.[test]'

- name: Cache pip packages
uses: actions/cache@v5
with:
Expand All @@ -301,13 +418,18 @@ jobs:
${{ runner.os }}-pip-

- name: Install dependencies
if: ${{ !contains(matrix.runner, 'self-hosted') }}
run: |
pip install torch --index-url https://download.pytorch.org/whl/cpu
pip install '.[test]'

- name: Run pytest scene tests (a5sim)
run: |
pytest examples tests/st --platform a5sim --device 0-15 -v \
PYTHON=python
if [[ '${{ matrix.runner }}' == *self-hosted* ]]; then
PYTHON=.venv/bin/python
fi
"$PYTHON" -m pytest examples tests/st --platform a5sim --device 0-15 -v \
--pto-session-timeout 600 --require-pto-isa

# DFX per-feature smokes — the default pytest above passes no --enable-*
Expand All @@ -316,25 +438,41 @@ jobs:
# CI step rather than buried in a combined run. Mirrors st-sim-a2a3.
- name: dep_gen smoke
run: |
pytest tests/st/a5/tensormap_and_ringbuffer/dfx/dep_gen/test_dep_gen.py \
PYTHON=python
if [[ '${{ matrix.runner }}' == *self-hosted* ]]; then
PYTHON=.venv/bin/python
fi
"$PYTHON" -m pytest tests/st/a5/tensormap_and_ringbuffer/dfx/dep_gen/test_dep_gen.py \
--platform a5sim --device 0-15 -p no:xdist --pto-session-timeout 600 \
--require-pto-isa --enable-dep-gen

- name: l2_swimlane smoke
run: |
pytest tests/st/a5/tensormap_and_ringbuffer/dfx/l2_swimlane/ \
PYTHON=python
if [[ '${{ matrix.runner }}' == *self-hosted* ]]; then
PYTHON=.venv/bin/python
fi
"$PYTHON" -m pytest tests/st/a5/tensormap_and_ringbuffer/dfx/l2_swimlane/ \
--platform a5sim --device 0-15 -p no:xdist --pto-session-timeout 600 \
--require-pto-isa --enable-l2-swimlane --enable-dep-gen

- name: PMU smoke
run: |
pytest tests/st/a5/tensormap_and_ringbuffer/dfx/pmu/test_pmu.py \
PYTHON=python
if [[ '${{ matrix.runner }}' == *self-hosted* ]]; then
PYTHON=.venv/bin/python
fi
"$PYTHON" -m pytest tests/st/a5/tensormap_and_ringbuffer/dfx/pmu/test_pmu.py \
--platform a5sim --device 0-15 -p no:xdist --pto-session-timeout 600 \
--require-pto-isa --enable-pmu 2

- name: args_dump smoke
run: |
pytest tests/st/a5/tensormap_and_ringbuffer/dfx/args_dump/test_args_dump.py \
PYTHON=python
if [[ '${{ matrix.runner }}' == *self-hosted* ]]; then
PYTHON=.venv/bin/python
fi
"$PYTHON" -m pytest tests/st/a5/tensormap_and_ringbuffer/dfx/args_dump/test_args_dump.py \
--platform a5sim --device 0-15 -p no:xdist --pto-session-timeout 600 \
--require-pto-isa --dump-args

Expand Down Expand Up @@ -728,6 +866,7 @@ jobs:

# ---------- Detect platform-specific changes (runs on GitHub server) ----------
detect-changes:
needs: [diff-refs]
runs-on: ubuntu-latest
outputs:
a2a3_changed: ${{ steps.check.outputs.a2a3_changed }}
Expand All @@ -741,7 +880,7 @@ jobs:
- name: Check file changes
id: check
run: |
FILES=$(git diff --name-only ${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }})
FILES=$(git diff --name-only ${{ needs['diff-refs'].outputs.base_sha }}...${{ needs['diff-refs'].outputs.head_sha }})

NON_CODE='^(docs/|\.docs/|\.claude/|\.gitignore$|\.pre-commit-config\.yaml$)|\.md$'

Expand Down
Loading