ci.yaml

on:
  pull_request:
    paths-ignore:
      - '.github/workflows/latest-deps.yaml'
  merge_group:
  push:
    branches:
      - master
      - main

name: Continuous integration

env:
  CARGO_TERM_COLOR: always
  HOST: x86_64-unknown-linux-gnu
  FEATURES: "approx,serde,rayon"
  # `-C target-cpu=x86-64-v3` was removed from the global env. It conflicts
  # with the cross_test matrix (`i686-unknown-linux-gnu` is 32-bit, `s390x`
  # isn't even x86) and contradicts the design intent recorded in
  # `.cargo/config.toml`: per-function `#[target_feature]` + runtime
  # `LazyLock<Tier>` detection means one binary, all ISAs. Jobs that
  # specifically need a higher target-cpu can opt in via per-job env.
  #
  # The two `--cfg` flags are NOT a preference — they are the matryoshka
  # guarantee, and they are here because SETTING THIS VARIABLE AT ALL SILENTLY
  # DISABLED THEM (found 2026-09-16). A RUSTFLAGS env REPLACES every
  # cargo-config `rustflags` entry rather than joining it, so from the moment
  # this workflow gained a global RUSTFLAGS, NOTHING in `.cargo/config.toml`
  # applied to any job here — including the two cfgs that compile out
  # curve25519-dalek's AVX2 backend (57 raw `_mm*` intrinsics under 52
  # `unsafe`) and poly1305's (424 under 30). Those are second and third
  # unaudited SIMD surfaces beside `ndarray::simd`, in the crypto path, and
  # `.cargo/config.toml` argues at length for keeping them out. In CI they
  # were in.
  #
  # Measured two-sided on one unit, same tree, same day:
  #   no RUSTFLAGS env            -> 65x -Ctarget-cpu, 65x poly1305_force_soft
  #   RUSTFLAGS="-D warnings"     -> ZERO of each
  #   RUSTFLAGS="-D warnings <the two cfgs>" -> both cfgs present, build clean
  #
  # Only the ARCH-NEUTRAL half is restored here. `-Ctarget-cpu` stays out for
  # the reason above (i686 / s390x); both cfgs are read by their crates on
  # every arch, so they are safe across the whole cross matrix.
  #
  # Rule for anyone editing this line: a flag added to a RUSTFLAGS env does not
  # ADD to the cargo config, it REPLACES it. Re-read `.cargo/config.toml`
  # before changing this value and carry forward anything still needed.
  RUSTFLAGS: '-D warnings --cfg curve25519_dalek_backend="serial" --cfg poly1305_force_soft'
  MSRV: 1.99.0
  BLAS_MSRV: 1.99.0

jobs:
  pass-msrv:
    runs-on: ubuntu-latest
    name: Pass MSRV values to other jobs
    outputs:
      MSRV: ${{ env.MSRV }}
      BLAS_MSRV: ${{ env.BLAS_MSRV }}
    steps:
      - name: Pass MSRV
        run: |
          echo "MSRV=${{ env.MSRV }}" >> $GITHUB_OUTPUT
          echo "BLAS_MSRV=${{ env.BLAS_MSRV }}" >> $GITHUB_OUTPUT

  clippy:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        # Must equal `rust-toolchain.toml`'s channel. The version is NOT
        # restated in this comment on purpose: CI here does NOT read the
        # toolchain file (it uses `dtolnay/rust-toolchain@<version>`), so the
        # number lives in two places — the matrix entry below and each
        # `dtolnay/rust-toolchain@` step — which move together with the
        # toolchain file. The `MSRV`/`BLAS_MSRV` env above tracks
        # `Cargo.toml`'s `rust-version` floor instead, which can lag the
        # channel (it did from the 1.99.0 bump). The toolchain file's bump log
        # records WHY each move happened.
        rust:
          - "1.99.0"
    name: clippy/${{ matrix.rust }}
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@1.99.0
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
      - run: cargo clippy --features approx,serde,rayon -- -D warnings
      - run: cargo clippy --features native -- -D warnings

  format:
    runs-on: ubuntu-latest
    name: format/stable
    # Blocking — no continue-on-error. `rustfmt.toml` was stripped of all
    # nightly-only directives in PR #133 (`7ca1cf3d chore(fmt): strip
    # unstable rustfmt options, keep stable-only config` + `ed59b3b1
    # style: normalize codebase to stable rustfmt 1.94.1`) and the
    # codebase normalized — so stable rustfmt enforces the project's
    # style losslessly. The previous `continue-on-error: true` +
    # `dtolnay/rust-toolchain@nightly` setup was a stale band-aid from
    # when `brace_style = AlwaysNextLine`, `imports_granularity =
    # Preserve`, `unstable_features = true` still lived in rustfmt.toml.
    # That state no longer exists; the band-aid is removed in this PR.
    steps:
      - uses: actions/checkout@v4
      # Stable rustfmt on the pinned channel (see `rust-toolchain.toml`;
      # version deliberately not restated here). No nightly dependency since
      # rustfmt.toml is stable-clean post-PR #133.
      - uses: dtolnay/rust-toolchain@1.99.0
        with:
          components: rustfmt
      - run: cargo fmt --all --check

  nostd:
    runs-on: ubuntu-latest
    continue-on-error: ${{ matrix.experimental }}
    strategy:
      matrix:
        include:
          - rust: stable
            experimental: false
            target: thumbv6m-none-eabi

    name: nostd/${{ matrix.target }}/${{ matrix.rust }}
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ matrix.rust }}
          targets: ${{ matrix.target }}
      # rust-toolchain.toml pins the channel — install the cross-compile target
      # for that toolchain too, since dtolnay/rust-toolchain only installs
      # for the matrix value which may differ from the pinned version.
      - run: rustup target add ${{ matrix.target }}
      - name: Tests
        run: |
          # Scope to `-p ndarray` so workspace dev-deps (criterion → serde_core
          # → getrandom) don't get evaluated against the no_std target. The
          # library itself builds cleanly under no_std + portable-atomic-
          # critical-section; only its dev-dependency tree pulls std-requiring
          # crates that have no business existing in the nostd build.
          cargo rustc -p ndarray "--target=${{ matrix.target }}" --no-default-features --features portable-atomic-critical-section

  wasm_simd:
    # The x86 `cargo test` suite never touches `simd_wasm.rs` (it is cfg'd to
    # wasm32), so wasm SIMD correctness is otherwise unverified. Build the real
    # `ndarray::simd` wasm types (+simd128) via the excluded `wasm-simd-parity`
    # cdylib and run its numeric selfcheck under node — both integration (the
    # lib compiles for wasm32+simd128) and parity (each lane == scalar). The
    # standing version of the one-off node check from commit 500d57e6.
    runs-on: ubuntu-latest
    name: wasm-simd/parity-node
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown
      # rust-toolchain.toml pins the channel — install the wasm target for the pinned
      # toolchain too (dtolnay installs for `stable`, which may differ).
      - run: rustup target add wasm32-unknown-unknown
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
      - name: wasm SIMD parity (build + node run)
        run: ./scripts/wasm-parity.sh
      # Guard the wasm matryoshka: the chacha20 fork's ndarray_simd backend must
      # keep compiling for wasm32+simd128 (it rides the same U32x16 lane the node
      # parity step above proves bit-exact). A future ndarray::simd change that
      # broke the wasm backend build would fail here.
      - name: wasm matryoshka backend (chacha20 fork) compiles for wasm32+simd128
        run: RUSTFLAGS="-C target-feature=+simd128" cargo build --manifest-path vendor/chacha20/Cargo.toml --target wasm32-unknown-unknown --lib

  neon_simd:
    # The x86 `cargo test` suite never touches `simd_neon.rs` (it is cfg'd to
    # aarch64), so NEON SIMD correctness is otherwise unverified. Cross-build the
    # real `ndarray::simd` aarch64 types via the excluded `neon-simd-parity` bin
    # and run its numeric selfcheck under qemu — both integration (the lib
    # compiles for aarch64 on stable) and parity (each lane == scalar). The
    # aarch64 twin of the wasm_simd job above.
    runs-on: ubuntu-latest
    name: neon-simd/parity-qemu
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-unknown-linux-gnu
      # rust-toolchain.toml pins the channel — install the aarch64 target for the
      # pinned toolchain too (dtolnay installs for `stable`, which may differ).
      - run: rustup target add aarch64-unknown-linux-gnu
      - name: install aarch64 cross toolchain + qemu-user
        run: sudo apt-get update && sudo apt-get install -y gcc-aarch64-linux-gnu qemu-user-static
      - name: NEON SIMD parity (cross-build + qemu run)
        run: ./scripts/neon-parity.sh

  tests:
    runs-on: ubuntu-latest
    needs: pass-msrv
    strategy:
      matrix:
        rust:
          - stable
          - beta
          - ${{ needs.pass-msrv.outputs.MSRV }}

    name: tests/${{ matrix.rust }}
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust }}
      - uses: rui314/setup-mold@v1
      - uses: Swatinem/rust-cache@v2
      - uses: taiki-e/install-action@nextest
      - name: Install openblas
        run: sudo apt-get install libopenblas-dev gfortran
      - run: ./scripts/all-tests.sh "$FEATURES" ${{ matrix.rust }}
    
  native-backend:
    runs-on: ubuntu-latest
    name: native-backend/stable
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - uses: taiki-e/install-action@nextest
      - name: Build native backend
        run: cargo build --features native
      - name: Test native backend
        run: cargo nextest run -p ndarray --features native
      - name: Test native + approx
        run: cargo nextest run -p ndarray --features native,approx

  hpc-stream-parallel:
    # D-CSV-17 (sprint-13 W-I4): rayon par_* variants for hpc::stream.
    # This job co-ships with the par_* implementation so the rayon feature
    # gate is always exercised alongside the code it guards — prevents
    # silent-dead-code drift (spec §0 + worker-template-v2 §5 CI ownership).
    runs-on: ubuntu-latest
    name: hpc-stream-parallel/rayon
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@1.99.0
      - uses: Swatinem/rust-cache@v2
      - uses: taiki-e/install-action@nextest
      - name: cargo check (no rayon — scalar path unchanged)
        run: cargo check -p ndarray
      - name: cargo check --features rayon
        run: cargo check -p ndarray --features rayon
      - name: par_* stream tests (--features rayon, hpc::stream filter)
        run: cargo nextest run -p ndarray --features rayon -E 'test(hpc::stream)'
      - name: clippy --features rayon
        run: cargo clippy -p ndarray --features rayon --lib -- -D warnings

  tier4-avx512-check:
    # Phase 6 of the SIMD integration plan (.claude/knowledge/
    # simd-dispatch-architecture.md). Exercises the AVX-512 dispatch
    # arm (`#[cfg(target_feature = "avx512f")]` in `src/simd.rs`) so it
    # doesn't bit-rot under the v3-default cargo config.
    #
    # `cargo check` rather than `cargo test`: GH-hosted `ubuntu-latest`
    # runners may not have AVX-512 silicon (intermittent across SKUs),
    # so a v4-baked binary would SIGILL at run time. `check` compiles
    # the AVX-512 code path through the type checker + borrow checker
    # + monomorphization without producing a runnable artifact —
    # catches type mismatches and dispatch-arm holes that the v3
    # default never touches.
    #
    # # Why `CARGO_TARGET_<triple>_RUSTFLAGS` instead of plain `RUSTFLAGS`:
    #
    # The first iteration used `env: RUSTFLAGS: "-Ctarget-cpu=x86-64-v4"`
    # and failed in ~23 s — RUSTFLAGS env applies to BOTH the target
    # compilation AND host build scripts (`build.rs` artifacts that
    # cargo runs natively). On a GH runner without AVX-512 silicon,
    # those v4-baked build scripts SIGILL during the dep build.
    #
    # `CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUSTFLAGS` is documented to
    # apply only when cargo is producing artifacts for that triple, NOT
    # to host build scripts. Combined with explicit `--target` (so cargo
    # distinguishes host from target even when they're the same triple),
    # this gives us "v4 for our crate, baseline for build scripts."
    #
    # # Why `--config .cargo/config-v4.toml` and NOT that env var (2026-09-14):
    #
    # cargo JOINS every matching `target.<triple>.rustflags` and
    # `target.<cfg>.rustflags` entry, and the last `-Ctarget-cpu` wins.
    # Measured with `cargo -v`: the env var form passed `x86-64-v4` and THEN
    # `.cargo/config.toml`'s cfg-keyed `x86-64-v3`, so this job had been
    # checking the AVX2 arm while named "tier4-avx512-check" — the codegen
    # witness on PR #306 found 0 `vpternlog` in a "v4" build. `--config`
    # is the same cfg key at higher precedence, placed LAST, so v4 wins;
    # explicit `--target` still keeps build scripts on the host baseline.
    #
    # # ...and why `env -u RUSTFLAGS` (first run of the assertion below, e730109):
    #
    # This workflow sets a GLOBAL `RUSTFLAGS: "-D warnings"`, and a RUSTFLAGS
    # env REPLACES every `.cargo/config*` rustflags entry outright (cargo's
    # precedence: RUSTFLAGS > target.<triple> > target.<cfg> > build). So with
    # the global env in force NO config target-cpu applies — `--config` or
    # not — and the probe assembled to 0 vpternlog. The steps below unset it
    # for the cargo call; `-Dwarnings` comes back through config-v4.toml's
    # own rustflags list so the warning gate is not lost. (The same global
    # env also erases the v3 pin and the dalek/poly1305 cfgs for every other
    # x86 job — a pre-existing gap, recorded in the blackboard, not this PR's.)
    #
    # # Two tiers (2026-10-13):
    #
    # Production runs on x86-64-v4 or better; the canonical deploy build is
    # Sapphire Rapids (`.cargo/config-avx512.toml`: VNNI, BF16, FP16 on top
    # of v4). Neither can run on GitHub's mostly-v3 runners, so both are
    # compiled and never executed. Both config files carry `-Dwarnings`.
    # Debug info is off for every artifact
    # (`CARGO_PROFILE_*_DEBUG=0`): `--target` keeps RUSTFLAGS-style flags off
    # build scripts, which then take the profile's debug level.
    runs-on: ubuntu-latest
    name: tier4-avx512-check (${{ matrix.tier }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - tier: x86-64-v4
            config: --config .cargo/config-v4.toml
          - tier: sapphirerapids
            config: --config .cargo/config-avx512.toml
    env:
      CARGO_PROFILE_DEV_DEBUG: "0"
      CARGO_PROFILE_TEST_DEBUG: "0"
      CARGO_INCREMENTAL: "0"
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.tier }}
      - name: cargo check (${{ matrix.tier }} / AVX-512 dispatch arm)
        run: env -u RUSTFLAGS cargo ${{ matrix.config }} check --target=x86_64-unknown-linux-gnu -p ndarray --features approx,serde,rayon
      - name: cargo check (${{ matrix.tier }} / AVX-512 + hpc-extras)
        run: env -u RUSTFLAGS cargo ${{ matrix.config }} check --target=x86_64-unknown-linux-gnu -p ndarray --features approx,serde,rayon,hpc-extras
      - name: prove the arm actually selected (an AVX-512 build must emit vpternlog)
        # Runs the witness script in asm-only mode (this runner may lack
        # avx512f, so the probe is never executed here) rather than an inline
        # copy: the script owns the stale-assembly guard (`rm -f` + `touch` of
        # the probe source, without which a rust-cache hit re-emits no `.s`).
        run: env -u RUSTFLAGS WITNESS_NO_RUN=1 CARGO_ARGS="${{ matrix.config }}" bash scripts/codegen-witness.sh avx512

  nightly-simd-polyfill:
    # TD-SIMD-9 from .claude/knowledge/simd-dispatch-architecture.md.
    # Exercises the `feature = "nightly-simd"` dispatch arm in
    # `src/simd.rs` (added in Phase 2 / PR #173) so the portable
    # `core::simd::*` backend doesn't bit-rot between PRs.
    #
    # Why nightly: `src/simd_nightly/*` uses `#![feature(portable_simd)]`
    # which only compiles on nightly rustc. The stable `cargo check`
    # paths in tests/clippy never reach this arm.
    #
    # `cargo check` rather than full build/test — pure type/borrow/cfg
    # verification. Catches arm shadowing bugs and the kind of API-break
    # codex flagged on PR #173 (lowercase aliases dropped).
    #
    # Runs only on merge_group + push (not every PR) to keep nightly
    # toolchain pulls out of the per-PR critical path. Mirrors the
    # `miri` job's gating strategy.
    if: github.event_name == 'merge_group' || github.event_name == 'push'
    runs-on: ubuntu-latest
    name: nightly-simd-polyfill
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
      - uses: Swatinem/rust-cache@v2
      - name: cargo check (nightly + nightly-simd feature)
        # `+nightly`: rust-toolchain.toml pins stable and takes precedence over
        # the toolchain dtolnay installs, so a plain `cargo` here is stable.
        run: cargo +nightly check -p ndarray --features approx,serde,rayon,nightly-simd
      - name: cargo check (nightly + nightly-simd + hpc-extras)
        run: cargo +nightly check -p ndarray --features approx,serde,rayon,nightly-simd,hpc-extras

  blas-msrv:
    runs-on: ubuntu-latest
    name: blas-msrv
    needs: pass-msrv
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ needs.pass-msrv.outputs.BLAS_MSRV }}
      - uses: rui314/setup-mold@v1
      - uses: Swatinem/rust-cache@v2
      - uses: taiki-e/install-action@nextest
      - name: Install openblas
        run: sudo apt-get install libopenblas-dev gfortran
      - run: ./scripts/blas-integ-tests.sh $BLAS_MSRV

  miri:
    # Nightly-only. Cannot run SIMD intrinsics or FFI.
    # Only runs on merge queue / push to main — never blocks PR checks.
    if: github.event_name == 'merge_group' || github.event_name == 'push'
    runs-on: ubuntu-latest
    name: miri
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: miri
      - uses: Swatinem/rust-cache@v2
      - uses: taiki-e/install-action@nextest
      - run: ./scripts/miri-tests.sh

  cross_test:
    # Gated on merge_group only — cross-compile via docker (cross-rs) for
    # s390x / i686 is slow, flaky on the s390x docker image's toolchain
    # resolution (rust-toolchain.toml's 1.94.1 pin doesn't resolve cleanly
    # inside the s390x cross container), and reliably caught by the
    # `tests/{stable,beta,1.94.0}` jobs on every PR push. Reserve cross
    # validation for the merge queue where it can fail loudly without
    # gating individual PRs on infra flakiness. The commented `if:` was
    # the original intent (per the pre-existing comment) — uncommenting
    # per the PR #143 codex thread that surfaced this consistently.
    if: ${{ github.event_name == 'merge_group' }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - rust: stable
            target: s390x-unknown-linux-gnu
          - rust: stable
            target: i686-unknown-linux-gnu

    name: cross_test/${{ matrix.target }}/${{ matrix.rust }}
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust }}
          targets: ${{ matrix.target }}
      - uses: rui314/setup-mold@v1
      - uses: Swatinem/rust-cache@v2
      - name: Install cross
        run: cargo install cross
      - run: ./scripts/cross-tests.sh "approx,serde,rayon" ${{ matrix.rust }} ${{ matrix.target }}

  cargo-careful:
    # Nightly-only. Only runs on merge queue / push — never blocks PR checks.
    if: github.event_name == 'merge_group' || github.event_name == 'push'
    runs-on: ubuntu-latest
    name: cargo-careful
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
        with:
          # careful rebuilds std from source; without rust-src it stalls
          # (seen locally: no compiler process, no output, for 25 min).
          components: rust-src
      - uses: Swatinem/rust-cache@v2
      - uses: taiki-e/install-action@nextest
      - name: Install cargo-careful
        run: cargo install cargo-careful
      # `+nightly`: see nightly-simd-polyfill. On stable, careful fails at
      # `rustc --print target-spec-json` ("output is invalid JSON").
      - run: cargo +nightly careful nextest run -Zcareful-sanitizer --features="$FEATURES"

  docs:
    # Nightly needed for --cfg docsrs. Only on merge queue / push.
    if: github.event_name == 'merge_group' || github.event_name == 'push'
    runs-on: ubuntu-latest
    name: docs/nightly
    env:
      RUSTDOCFLAGS: "-Dwarnings --cfg docsrs"
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
      # `+nightly`: see nightly-simd-polyfill. Features match
      # `[package.metadata.docs.rs]`: `--all-features` cannot build, because
      # `intel-mkl`/`openblas` and `runtime-dispatch`/`nightly-simd` are
      # mutually exclusive (`compile_error!`).
      - run: cargo +nightly doc --no-deps --features approx,serde,rayon

  conclusion:
    needs:
      - clippy
      - format
      - nostd
      - wasm_simd
      - neon_simd
      - tests
      - native-backend
      - hpc-stream-parallel
      - tier4-avx512-check
      - nightly-simd-polyfill
      - miri
      - cross_test
      - cargo-careful
      - docs
    runs-on: ubuntu-latest
    steps:
      - name: Result
        run: |
          jq -C <<< "${needs}"
          # Check if all needs were successful or skipped.
          "$(jq -r 'all(.result as $result | (["success", "skipped"] | contains([$result])))' <<< "${needs}")"
        env:
          needs: ${{ toJson(needs) }}