ci: drop the redundant prefix and current-branch

.ci/manifest.toml

@@ -11,7 +11,6 @@ header = """
 
 [package]
 name = "eckit"
-prefix = "eckit"
 repo = "ecmwf/eckit"
 visibility = "public"
 compiler-inputs = ["cxx-compiler"]
@@ -31,6 +30,7 @@ compiler-inputs = ["cxx-compiler"]
 [matrix.build.defaults]
 build-type = "RelWithDebInfo"
 runs-on = "arc-runner-very-large"
+ctest-args = '-j "$(nproc)"'
 
 [[matrix.build.include]]
 cxx-compiler = "clang++-18"
@@ -49,9 +49,10 @@ triggers = ["upstream-change", "rebuild-request"]
 action = "./.github/actions/build-eckit"
 forwarded-inputs = ["c-compiler", "cxx-compiler", "build-type"]
 forwarded-deps-outputs = ["cmake-prefix-path"]
-needs = ["ecbuild/build", "stack-deps/build"]
 ctest = true
-ctest-args = '-j "$(nproc)"'
+
+[matrix.build-hpc.defaults]
+job-script = "./.ci/hpc/build.sh.j2"
 
 [[matrix.build-hpc.include]]
 cxx-compiler = "g++-8"
@@ -70,14 +71,10 @@ time = "00:40:00"
 [matrix.build-hpc]
 execution = "hpc"
 container-credentials = true
-job-script = "./.ci/hpc/build.sh.j2"
 triggers = ["upstream-change", "rebuild-request"]
 forwarded-deps-outputs = ["cmake-prefix-path"]
-needs = ["ecbuild/build-hpc", "stack-deps/build-hpc"]
 
 [[trigger-downstream]]
 repo = "ecmwf/eccodes"
 ref = "develop"
 
-[downstream-gate]
-label = "run-downstream-CI"

.github/actionlint.yaml

@@ -11,5 +11,5 @@ self-hosted-runner:
     - arc-runner-normal
     - arc-runner-large
     - arc-runner-very-large
-    - arc-hpc-pet-vsphere-prod
+    - hpc-submit
     - hpc

.github/workflows/ci.yml

@@ -59,11 +59,10 @@ jobs:
           client-id: ${{ secrets.CI_PERMISSIONS_APP_CLIENT_ID }}
           private-key: ${{ secrets.CI_PERMISSIONS_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
-      - uses: ecmwf/ci-infrastructure/actions/checkout-under-test@main
+      - uses: actions/checkout@v6
       - id: r
         uses: ecmwf/ci-infrastructure/actions/resolve-deps@main
         with:
-          current-branch: ${{ github.head_ref || github.ref_name }}
           matrix: build,build-hpc
           token: ${{ steps.mint.outputs.token }}
           client-id: ${{ secrets.CI_PERMISSIONS_APP_CLIENT_ID }}
@@ -87,7 +86,7 @@ jobs:
           client-id: ${{ secrets.CI_PERMISSIONS_APP_CLIENT_ID }}
           private-key: ${{ secrets.CI_PERMISSIONS_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
-      - uses: ecmwf/ci-infrastructure/actions/checkout-under-test@main
+      - uses: actions/checkout@v6
 
       - name: Fetch resolved deps
         id: deps
@@ -145,7 +144,7 @@ jobs:
           client-id: ${{ secrets.CI_PERMISSIONS_APP_CLIENT_ID }}
           private-key: ${{ secrets.CI_PERMISSIONS_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
-      - uses: ecmwf/ci-infrastructure/actions/checkout-under-test@main
+      - uses: actions/checkout@v6
 
       - name: Fetch resolved deps
         id: deps
@@ -162,7 +161,7 @@ jobs:
         uses: ecmwf/ci-infrastructure/actions/build-on-hpc@main
         with:
           site: ${{ matrix.site }}
-          job-script: ${{ matrix.job-script || './.ci/hpc/build.sh.j2' }}
+          job-script: ${{ matrix.job-script }}
           # The render context for the .j2 recipe: the toolchain this leg declares.
           matrix-leg: ${{ toJSON(matrix) }}
           artifact-name: ${{ matrix._resolved.own-artifact-name }}

.github/workflows/cross-repo-trigger-hpc.yml

@@ -83,11 +83,15 @@ env:
 jobs:
   resolve:
     if: contains(fromJSON(inputs.from-jobs), 'ecbuild/build-hpc') || contains(fromJSON(inputs.from-jobs), 'stack-deps/build-hpc') || inputs.rebuild-request
-    runs-on: ubuntu-slim
+    runs-on: arc-runner-normal
+    container:
+      image: eccr.ecmwf.int/public-ci-images/ubuntu24.04-base:latest
     outputs:
       ref: ${{ steps.pick.outputs.ref }}
       matrix-build-hpc: ${{ steps.r.outputs.matrix-build-hpc }}
     steps:
+    - name: Announce image
+      uses: ecmwf/ci-infrastructure/actions/announce-image@main
     - id: mint
       uses: actions/create-github-app-token@v3
       with:
@@ -110,6 +114,7 @@ jobs:
       uses: ecmwf/ci-infrastructure/actions/resolve-deps@main
       with:
         current-branch: ${{ steps.pick.outputs.ref }}
+        pin: ${{ !inputs.rebuild-request && format('{0}@{1}', inputs.from-repo, inputs.from-sha) || '' }}
         matrix: build-hpc
         token: ${{ steps.mint.outputs.token }}
         client-id: ${{ secrets.CI_PERMISSIONS_APP_CLIENT_ID }}
@@ -192,7 +197,7 @@ jobs:
       uses: ecmwf/ci-infrastructure/actions/build-on-hpc@main
       with:
         site: ${{ matrix.site }}
-        job-script: ${{ matrix.job-script || './.ci/hpc/build.sh.j2' }}
+        job-script: ${{ matrix.job-script }}
         matrix-leg: ${{ toJSON(matrix) }}
         artifact-name: ${{ steps.m.outputs.own-artifact-name }}
         cmake-prefix-path: ${{ steps.deps.outputs.cmake-prefix-path }}

.github/workflows/cross-repo-trigger.yml

@@ -83,11 +83,15 @@ env:
 jobs:
   resolve:
     if: contains(fromJSON(inputs.from-jobs), 'ecbuild/build') || contains(fromJSON(inputs.from-jobs), 'stack-deps/build') || inputs.rebuild-request
-    runs-on: ubuntu-slim
+    runs-on: arc-runner-normal
+    container:
+      image: eccr.ecmwf.int/public-ci-images/ubuntu24.04-base:latest
     outputs:
       ref: ${{ steps.pick.outputs.ref }}
       matrix-build: ${{ steps.r.outputs.matrix-build }}
     steps:
+    - name: Announce image
+      uses: ecmwf/ci-infrastructure/actions/announce-image@main
     - id: mint
       uses: actions/create-github-app-token@v3
       with:
@@ -110,6 +114,7 @@ jobs:
       uses: ecmwf/ci-infrastructure/actions/resolve-deps@main
       with:
         current-branch: ${{ steps.pick.outputs.ref }}
+        pin: ${{ !inputs.rebuild-request && format('{0}@{1}', inputs.from-repo, inputs.from-sha) || '' }}
         matrix: build
         token: ${{ steps.mint.outputs.token }}
         client-id: ${{ secrets.CI_PERMISSIONS_APP_CLIENT_ID }}
@@ -198,7 +203,7 @@ jobs:
         cxx-compiler: ${{ steps.m.outputs.cxx-compiler }}
         build-type: ${{ steps.m.outputs.build-type }}
     - name: Test
-      run: ctest --test-dir "${{ steps.build.outputs.build-dir }}" --output-on-failure -j "$(nproc)"
+      run: ctest --test-dir "${{ steps.build.outputs.build-dir }}" --output-on-failure ${{ matrix._resolved['ctest-args'] }}
     - name: Publish
       uses: ecmwf/ci-infrastructure/actions/publish-artifact@main
       with:

.github/workflows/pr-label-downstream-ci.yml

@@ -4,13 +4,9 @@
 name: "[PR] Downstream-CI label gate"
 
 on:
-  # pull_request_target runs the BASE branch's copy of this file and gets a token
-  # that can post a status on a fork's pull request. Safe here because nothing
-  # from the pull request is ever checked out or executed.
-  #
   # `labeled`/`unlabeled` are what make the gate reactive; `synchronize` re-posts
   # it, since a commit status is per-SHA.
-  pull_request_target:
+  pull_request:
     types: [opened, reopened, synchronize, labeled, unlabeled]
 
 permissions:
@@ -22,7 +18,5 @@ jobs:
     steps:
       - uses: ecmwf/ci-infrastructure/actions/require-label-decision@main
         with:
-          label: run-downstream-CI
-          opt-out-label: downstream-CI-not-needed
           context: downstream-ci-label
           description-decided: Downstream-CI decision recorded

.github/workflows/regenerate-workflows.yml

@@ -0,0 +1,27 @@
+# SPDX-FileCopyrightText: 1996- European Centre for Medium-Range Weather Forecasts (ECMWF)
+# SPDX-License-Identifier: Apache-2.0
+
+name: Regenerate downstream-CI workflows
+
+on:
+  push:
+    branches: [develop]
+  # Drift also comes from sibling manifests and the generator.
+  schedule:
+    - cron: '17 3 * * *'
+  workflow_dispatch:
+
+concurrency:
+  group: regenerate-workflows-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  regenerate:
+    uses: ecmwf/ci-infrastructure/.github/workflows/regenerate-workflows.yml@main
+    secrets: inherit
+    with:
+      # Downstream CI runs the default branch's orchestrator, so it cannot test this PR.
+      labels: downstream-ci-not-needed

.github/workflows/trigger-downstream-hpc.yml

@@ -35,19 +35,23 @@ jobs:
       pull-requests: read
     outputs:
       run: ${{ steps.gate.outputs.run }}
+      depth: ${{ steps.gate.outputs.depth }}
     steps:
     - name: Check the downstream-CI label
       id: gate
       uses: ecmwf/ci-infrastructure/actions/check-pr-label@main
       with:
-        label: run-downstream-CI
         sha: ${{ needs.context.outputs.head-sha }}
     needs:
     - context
   validate:
     if: ${{ (needs.context.outputs.ci-conclusion == 'success') && needs['label-gate'].outputs.run == 'true' }}
-    runs-on: ubuntu-slim
+    runs-on: arc-runner-normal
+    container:
+      image: eccr.ecmwf.int/public-ci-images/ubuntu24.04-base:latest
     steps:
+    - name: Announce image
+      uses: ecmwf/ci-infrastructure/actions/announce-image@main
     - id: mint
       uses: actions/create-github-app-token@v3
       with:
@@ -58,7 +62,6 @@ jobs:
       with:
         ref: ${{ needs.context.outputs.head-sha }}
         token: ${{ steps.mint.outputs.token }}
-        allow-unsafe-pr-checkout: true
     - uses: ecmwf/ci-infrastructure/actions/validate-generated-workflows@main
       with:
         token: ${{ steps.mint.outputs.token }}
@@ -117,7 +120,7 @@ jobs:
       branch: ${{ needs.context.outputs.head-branch }}
       fallback-ref: develop
     secrets: inherit
-    if: ${{ needs['label-gate'].outputs.run == 'true' }}
+    if: ${{ needs['label-gate'].outputs.run == 'true' && (needs['label-gate'].outputs.depth == 'all' || needs['label-gate'].outputs.depth >= 1) }}
   report-result:
     needs:
     - context
@@ -139,9 +142,12 @@ jobs:
             state=failure
           fi
         done
+        depth="${{ needs['label-gate'].outputs.depth }}"
+        scope=""
+        if [ "$depth" != all ]; then scope=" (up to level $depth)"; fi
         gh api -X POST \
           "/repos/${{ github.repository }}/statuses/${{ needs.context.outputs.head-sha }}" \
           -f state="$state" \
           -f context='downstream/hpc' \
           -f target_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
-          -f description="Downstream HPC tests $state"
+          -f description="Downstream HPC tests $state$scope"

.github/workflows/trigger-downstream.yml

@@ -35,19 +35,23 @@ jobs:
       pull-requests: read
     outputs:
       run: ${{ steps.gate.outputs.run }}
+      depth: ${{ steps.gate.outputs.depth }}
     steps:
     - name: Check the downstream-CI label
       id: gate
       uses: ecmwf/ci-infrastructure/actions/check-pr-label@main
       with:
-        label: run-downstream-CI
         sha: ${{ needs.context.outputs.head-sha }}
     needs:
     - context
   validate:
     if: ${{ (needs.context.outputs.ci-conclusion == 'success') && needs['label-gate'].outputs.run == 'true' }}
-    runs-on: ubuntu-slim
+    runs-on: arc-runner-normal
+    container:
+      image: eccr.ecmwf.int/public-ci-images/ubuntu24.04-base:latest
     steps:
+    - name: Announce image
+      uses: ecmwf/ci-infrastructure/actions/announce-image@main
     - id: mint
       uses: actions/create-github-app-token@v3
       with:
@@ -58,7 +62,6 @@ jobs:
       with:
         ref: ${{ needs.context.outputs.head-sha }}
         token: ${{ steps.mint.outputs.token }}
-        allow-unsafe-pr-checkout: true
     - uses: ecmwf/ci-infrastructure/actions/validate-generated-workflows@main
       with:
         token: ${{ steps.mint.outputs.token }}
@@ -117,7 +120,7 @@ jobs:
       branch: ${{ needs.context.outputs.head-branch }}
       fallback-ref: develop
     secrets: inherit
-    if: ${{ needs['label-gate'].outputs.run == 'true' }}
+    if: ${{ needs['label-gate'].outputs.run == 'true' && (needs['label-gate'].outputs.depth == 'all' || needs['label-gate'].outputs.depth >= 1) }}
   report-result:
     needs:
     - context
@@ -139,9 +142,12 @@ jobs:
             state=failure
           fi
         done
+        depth="${{ needs['label-gate'].outputs.depth }}"
+        scope=""
+        if [ "$depth" != all ]; then scope=" (up to level $depth)"; fi
         gh api -X POST \
           "/repos/${{ github.repository }}/statuses/${{ needs.context.outputs.head-sha }}" \
           -f state="$state" \
           -f context='downstream/runner' \
           -f target_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
-          -f description="Downstream runner tests $state"
+          -f description="Downstream runner tests $state$scope"