ci.yml

name: CI

on:
  merge_group:
  push:
    branches: [main]
    paths-ignore:
      - "**/*.md"
      - "docs/**"
  pull_request:
    paths-ignore:
      - "**/*.md"
      - "docs/**"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  # Latest-main-wins (issue #6399): cancelling in-progress runs in the
  # per-ref group lets the final aggregate SHA of a merge burst be validated
  # without queueing behind superseded intermediate runs. Because the group is
  # per-ref, a new main push only cancels superseded main runs, and a new pull
  # request push still only cancels its own superseded run.
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  PYTHONUNBUFFERED: "1"
  SDL_VIDEODRIVER: dummy
  MPLBACKEND: Agg
  PYGAME_HIDE_SUPPORT_PROMPT: "1"
  # The sys.monitoring backend is faster for full non-PR coverage, but its
  # hosted pytest-xdist worker data is not reliable on PR/merge-group runs.
  # Keep the trace backend for exact-head changed coverage so the shard union
  # represents executed tests rather than collection-only lines.
  COVERAGE_CORE: ${{ (github.event_name == 'pull_request' || github.event_name == 'merge_group') && 'ctrace' || 'sysmon' }}

jobs:
  fast-feedback:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    # Split every event across four runners. Pull requests retain their fast-only
    # shards; all events publish unique coverage data so the exact-head changed-
    # coverage gate can prove the final PR head before merge admission.
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4]
    env:
      PYTEST_SHARD_COUNT: 4
      PYTEST_SHARD_INDEX: ${{ matrix.shard }}
      ROBOT_SF_SHARD_INCLUDE_SLOW: ${{ github.event_name != 'pull_request' && '1' || '0' }}
      ROBOT_SF_PYTEST_COVERAGE: "1"
      COVERAGE_FILE: ${{ format('output/coverage/.coverage.{0}', matrix.shard) }}
      # The release-hydration tests invoke `gh` for a public pinned asset. Use
      # the Actions token so GitHub API rate limits cannot make main flaky.
      GH_TOKEN: ${{ github.token }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # Coverage must be collected from the same immutable head that the
          # changed-line gate evaluates, not an implicit merge ref.
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
          # The evidence-registry ratchet resolves historical producing commits.
          # A shallow checkout turns reachable provenance into false
          # ``dangling_commit`` findings and makes main CI environment-dependent.
          fetch-depth: 0
          persist-credentials: false

      - name: Set up CI Python environment
        uses: ./.github/actions/setup-ci-python

      - name: Prime uv cache metadata for offline software-candidate checks
        run: |
          set -euo pipefail
          # A locked sync records the selected wheel payload but may not retain the
          # wheel-metadata response needed by a later offline ``uv pip install``.
          # Refresh and reinstall the exact helper pins so each test shard can
          # resolve them without depending on a prior unrelated registry lookup.
          uv pip install \
            --python .venv/bin/python \
            --refresh-package packaging \
            --refresh-package pyyaml \
            --reinstall \
            "packaging==26.0" \
            "pyyaml==6.0.3"

      - name: Hydrate result-interpretation provenance
        run: uv run python scripts/dev/ensure_result_interpretation_provenance.py

      - name: Cache test results
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: .pytest_cache
          key: pytest-${{ runner.os }}-${{ hashFiles('pyproject.toml', 'uv.lock') }}
          restore-keys: |
            pytest-${{ runner.os }}-

      - name: Restore test durations for pytest-split balancing
        continue-on-error: true
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: .test_durations
          key: test-durations-${{ runner.os }}-${{ hashFiles('pyproject.toml', 'uv.lock') }}-${{ github.run_id }}-${{ github.run_attempt }}
          restore-keys: |
            test-durations-${{ runner.os }}-${{ hashFiles('pyproject.toml', 'uv.lock') }}

      # Lint and typecheck are shard-independent; run them once (shard 1 only)
      # to avoid quadruplicated annotations on pull-request shard matrices.
      - name: Lint
        if: ${{ matrix.shard == 1 }}
        run: scripts/dev/ci_driver.sh lint

      - name: Type check
        if: ${{ matrix.shard == 1 }}
        run: scripts/dev/ci_driver.sh typecheck

      - name: Unit tests
        run: scripts/dev/ci_driver.sh test

      - name: Upload test durations
        if: always()
        continue-on-error: true
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: pytest-durations-${{ matrix.shard }}
          path: .test_durations
          if-no-files-found: ignore
          include-hidden-files: true

      - name: Upload coverage shard
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: coverage-shard-${{ matrix.shard }}
          path: output/coverage/.coverage.${{ matrix.shard }}
          if-no-files-found: error
          include-hidden-files: true

  changed-coverage-gate:
    runs-on: ubuntu-latest
    # This lane performs a complete exact-head checkout and the shared all-extras
    # setup before it can combine shards and emit merge-admission proof.
    timeout-minutes: 30
    needs: fast-feedback
    if: >-
      (github.event_name == 'pull_request' || github.event_name == 'merge_group') &&
      needs.fast-feedback.result == 'success'
    steps:
      - name: Checkout exact evaluated head
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0
          persist-credentials: false

      - name: Set up CI Python environment
        uses: ./.github/actions/setup-ci-python

      - name: Audit changed fast-lane routing
        env:
          BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
          HEAD_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
        run: |
          set -euo pipefail
          uv run python scripts/dev/check_fast_lane_routing.py \
            --base-sha "$BASE_SHA" \
            --head-sha "$HEAD_SHA"

      - name: Download coverage shards
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: coverage-shard-*
          path: output/coverage
          merge-multiple: true

      - name: Combine coverage shards
        run: |
          set -euo pipefail
          uv run coverage combine output/coverage
          uv run coverage json

      - name: Enforce exact-head changed-line coverage
        id: changed-coverage
        env:
          BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
          HEAD_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
        run: |
          set -euo pipefail
          actual_head="$(git rev-parse HEAD)"
          if [[ "$actual_head" != "$HEAD_SHA" ]]; then
            echo "Checked-out head drifted: expected $HEAD_SHA, got $actual_head" >&2
            exit 2
          fi

          set +e
          uv run python scripts/coverage/check_changed_files_coverage.py \
            --base-sha "$BASE_SHA" \
            --head-sha "$HEAD_SHA" \
            --event-name "$GITHUB_EVENT_NAME" \
            --coverage output/coverage/coverage.json \
            --json-output output/coverage/changed-coverage-result.json \
            --show-skipped \
            >output/coverage/changed-coverage.log 2>&1
          coverage_status=$?
          set -e
          cat output/coverage/changed-coverage.log
          exit "$coverage_status"

      - name: Upload changed-coverage proof
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: changed-coverage-proof
          path: |
            output/coverage/changed-coverage-result.json
            output/coverage/changed-coverage.log
          if-no-files-found: error

  coverage-gate:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs: fast-feedback
    if: ${{ github.event_name != 'pull_request' && needs.fast-feedback.result == 'success' }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up CI Python environment
        uses: ./.github/actions/setup-ci-python

      - name: Download coverage shards
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: coverage-shard-*
          path: output/coverage
          merge-multiple: true

      - name: Combine coverage shards
        run: |
          uv run coverage combine output/coverage
          uv run coverage json
          uv run coverage html

      - name: Enforce absolute coverage floor
        run: >-
          uv run python scripts/coverage/compare_coverage.py
          --current output/coverage/coverage.json
          --absolute-only
          --format github
          --minimum-total 85.0

      - name: Restore coverage baseline
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: output/coverage/.coverage-baseline.json
          key: coverage-baseline-${{ github.ref_name }}
          restore-keys: |
            coverage-baseline-main

      - name: Compare coverage with baseline
        continue-on-error: true
        run: |
          if [ -f output/coverage/.coverage-baseline.json ]; then
            echo "Baseline found, comparing coverage..."
            uv run python scripts/coverage/compare_coverage.py \
              --current output/coverage/coverage.json \
              --baseline output/coverage/.coverage-baseline.json \
              --format github \
              --threshold 1.0
          else
            echo "No baseline found, skipping comparison"
          fi

      - name: Update coverage baseline (main branch only)
        if: github.ref == 'refs/heads/main' && success()
        run: |
          mkdir -p output/coverage
          cp output/coverage/coverage.json output/coverage/.coverage-baseline.json
          echo "Coverage baseline updated for main branch"

      - name: Save coverage baseline (main branch only)
        if: github.ref == 'refs/heads/main' && success()
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: output/coverage/.coverage-baseline.json
          key: coverage-baseline-${{ github.ref_name }}-${{ github.sha }}

      - name: Upload coverage reports
        if: ${{ failure() || github.ref == 'refs/heads/main' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: coverage-reports
          path: |
            output/coverage/coverage.json
            output/coverage/htmlcov/
            output/coverage/.coverage
          include-hidden-files: true

  compat-matrix:
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
        python: ["3.11", "3.13"]
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up matrixed compatibility CI environment
        uses: ./.github/actions/setup-ci-python
        with:
          python-version: ${{ matrix.python }}
          sync-args: "--all-extras --frozen"

      - name: Run compatibility tests with full extras
        run: >-
          uv run pytest tests/common tests/contract tests/factories tests/gym_env tests/maps
          tests/nav tests/ped_npc tests/render tests/scenarios tests/sensor tests/sim tests/unit
          -q -m "not slow"

  fast-pysf-compat:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python 3.11
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"

      - name: Install pinned uv with bounded retry
        env:
          UV_VERSION: "0.11.21"
          UV_INSTALL_MAX_ATTEMPTS: "3"
          UV_INSTALL_BACKOFF_BASE: "5"
          UV_INSTALL_BACKOFF_CAP: "30"
        run: bash scripts/dev/ci_install_uv_retry.sh "${UV_VERSION}"

      - name: Validate fast-pysf standalone lock
        run: uv lock --check --directory fast-pysf

  smoke-artifacts:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up CI Python environment
        uses: ./.github/actions/setup-ci-python

      - name: Validation smoke tests
        id: smoke_tests
        run: scripts/dev/ci_driver.sh smoke

      - name: Upload map verification manifest
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: map-verification-manifest
          path: output/validation/map_verification.json
          if-no-files-found: warn

      - name: Upload benchmark artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: benchmark-artifacts
          path: output/benchmarks/
          if-no-files-found: ignore

      - name: Upload recording artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: recording-artifacts
          path: output/recordings/
          if-no-files-found: ignore

      - name: Upload cold/warm perf smoke artifact
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: cold-warm-perf-smoke
          path: |
            output/benchmarks/perf/cold_warm_pr_smoke.json
            output/benchmarks/perf/cold_warm_pr_smoke.md
          if-no-files-found: warn

      - name: Upload smoke artifact on failure
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ci-smoke-episodes
          path: output/benchmarks/ci_smoke/episodes.jsonl

      - name: Enforce artifact root policy
        if: >-
          ${{ always() && (steps.smoke_tests.outcome == 'success' ||
          steps.smoke_tests.outcome == 'failure') }}
        env:
          CI_STEP_TIMEOUT_SECONDS: "300"
        run: bash scripts/dev/ci_step_timer.sh "Enforce artifact root policy" scripts/dev/ci_driver.sh artifact-policy

  scenario-validation:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout exact evaluated head
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0
          persist-credentials: false

      - name: Set up CI Python environment
        uses: ./.github/actions/setup-ci-python

      - name: Enforce pinned geometry contract
        run: >-
          uv run python scripts/validation/check_scenario_archetype_geometry.py
          --fail-on-violation
          --waiver-file configs/scenarios/archetype_validation_waivers.yaml

      - name: Enforce pinned parameter contract
        run: >-
          uv run python scripts/validation/check_scenario_archetype_parameters.py
          --fail-on-violation
          --waiver-file configs/scenarios/archetype_validation_waivers.yaml

  reproducibility-check:
    # Run on pull requests so hosted reproducibility evidence is green rather
    # than skipped; retain manual dispatch for standalone diagnostics.
    if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up CI Python environment
        uses: ./.github/actions/setup-ci-python

      - name: Run reproducibility diagnostic
        run: uv run python scripts/benchmark_repro_check.py

      - name: Upload reproducibility report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: reproducibility-report
          path: output/benchmarks/reproducibility_check.json
          if-no-files-found: warn

  reproducibility-check-reconciliation:
    # A successful Actions job can transiently retain a pending check-run on
    # GitHub-hosted state. Reconcile only that exact job identity; keep the
    # hosted-state repair diagnostic-only and outside the ci aggregate.
    if: >-
      ${{ always() && (github.event_name == 'pull_request' ||
      github.event_name == 'workflow_dispatch') }}
    needs: [reproducibility-check]
    continue-on-error: true
    permissions:
      actions: read
      checks: write
      contents: read
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Reconcile exact successful check-run
        env:
          GH_TOKEN: ${{ github.token }}
          REPRODUCIBILITY_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
          REPRODUCIBILITY_JOB_RESULT: ${{ needs.reproducibility-check.result }}
        run: >-
          python scripts/dev/reconcile_reproducibility_check_run.py
          --output output/validation/reproducibility_check_run_reconciliation.json

      - name: Upload reconciliation report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: reproducibility-check-reconciliation
          path: output/validation/reproducibility_check_run_reconciliation.json
          if-no-files-found: warn

  xdist-scratch-isolation:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up CI Python environment
        uses: ./.github/actions/setup-ci-python

      - name: Run xdist scratch-isolation guard
        run: |
          uv run pytest -n 4 --dist worksteal \
            tests/test_runner_policy_timeout.py::test_planner_step_timeout_fails_fast_and_reports_metadata \
            tests/tools/test_release_evidence_gate.py::test_archive_integrity_pass_and_fail \
            tests/benchmark/test_scenario_criticality_optimization.py::test_effective_workers_capped_at_candidate_count \
            'tests/analysis/test_recenter_topology_panels_issue_2227.py::test_both_arm_traces_validate_against_schema[topology_result]' \
            'tests/analysis/test_recenter_topology_panels_issue_2227.py::test_both_arm_traces_validate_against_schema[static_recenter_result]' \
            tests/validation/test_evaluate_predictive_planner_smoke.py::test_evaluate_predictive_planner_fails_closed_without_collision_metric \
            tests/validation/test_predictive_success_campaign_tags.py::test_main_writes_failure_summary_for_missing_jsonl \
            tests/validation/test_predictive_success_campaign_tags.py::test_main_writes_failure_summary_for_malformed_jsonl

  wheel-smoke-install:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up CI Python environment
        uses: ./.github/actions/setup-ci-python

      - name: Build wheel
        run: uv build

      - name: Check distribution license payloads
        run: uv run python scripts/tools/check_distribution_licenses.py dist

      - name: Clean wheel install/import smoke
        run: bash scripts/validation/wheel_install_smoke.sh

      - name: Upload wheel smoke report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheel-smoke-report
          path: output/validation/wheel_install_smoke_report.json
          if-no-files-found: warn

  examples-smoke:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout (attempt 1)
        id: checkout_attempt_1
        continue-on-error: true
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Checkout (attempt 2)
        id: checkout_attempt_2
        if: steps.checkout_attempt_1.outcome == 'failure'
        continue-on-error: true
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Checkout (attempt 3)
        id: checkout_attempt_3
        if: steps.checkout_attempt_1.outcome == 'failure' && steps.checkout_attempt_2.outcome == 'failure'
        continue-on-error: true
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Fail-closed guard when checkout fails
        if: steps.checkout_attempt_1.outcome == 'failure' && steps.checkout_attempt_2.outcome == 'failure' && steps.checkout_attempt_3.outcome == 'failure'
        run: |
          # shellcheck disable=SC2016
          {
            echo "## Checkout failed: examples-smoke did not run"
            echo ""
            echo "All three bounded checkout attempts failed before the local repository could be set up."
            echo "No example smoke tests ran."
            echo "TLS certificate verification was **not** bypassed."
            echo ""
            echo "After the underlying infrastructure recovers, rerun the failed job with:"
            echo ""
            echo '```bash'
            echo 'gh run rerun "$GITHUB_RUN_ID" --failed'
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"
          echo "::error::examples-smoke checkout failed after 3 attempts; no example tests ran. TLS verification was not bypassed. Rerun with: gh run rerun '$GITHUB_RUN_ID' --failed"
          exit 1

      - name: Set up CI Python environment
        uses: ./.github/actions/setup-ci-python

      - name: Example smoke tests
        run: scripts/dev/ci_driver.sh examples-smoke

  notebooks-smoke:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up CI Python environment
        uses: ./.github/actions/setup-ci-python

      - name: Notebook smoke tests
        run: scripts/dev/ci_driver.sh notebooks-smoke

  # --- Path-triggered exact-repeat determinism gate (Option B, issue #6191) ---
  #
  # Runs the full exact-repeat determinism test suite only when the PR diff
  # touches paths that can affect determinism.  Most PRs pay zero overhead.
  # When triggered the check is genuinely blocking (failing it fails CI).
  #
  # Determinism-relevant paths — update this list when code moves:
  #   robot_sf/planner/        – planner implementations
  #   robot_sf/models/registry.py – model registry
  #   robot_sf/benchmark/      – benchmark runner / exact-repeat campaign
  #   configs/baselines/       – baseline configs
  determinism-gate:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    # The dedicated preflight job owns the checksum-verified model cache. Wait
    # for it and restore the same key before the full suite, otherwise this
    # parallel job independently redownloads the model and turns a cacheable
    # provisioning dependency into a network-flaky determinism failure.
    needs: exact-repeat-model-preflight
    env:
      PPO_ALGO_CONFIG: configs/baselines/ppo_issue_791_eval_aligned_large_capacity_cpu.yaml
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Check determinism-relevant path changes
        id: check-changes
        shell: bash
        run: |
          # Determine the base ref for diffing
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            BASE_REF="${{ github.event.pull_request.base.sha }}"
          elif [[ "${{ github.event_name }}" == "merge_group" ]]; then
            BASE_REF="${{ github.event.merge_group.base_sha }}"
          else
            BASE_REF="origin/main"
          fi

          # Determinism-relevant paths — single source of truth for the
          # path-triggered gate.  Keep in sync with the comment above.
          DETERMINISM_PATHS=(
            "robot_sf/planner/"
            "robot_sf/models/registry.py"
            "robot_sf/benchmark/"
            "configs/baselines/"
          )

          CHANGED=$(git diff --name-only "$BASE_REF...HEAD" -- "${DETERMINISM_PATHS[@]}")
          if [[ -n "$CHANGED" ]]; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
            echo "Changed determinism-relevant paths:"
            echo "$CHANGED"
          else
            echo "changed=false" >> "$GITHUB_OUTPUT"
            echo "No determinism-relevant paths changed"
          fi

      - name: No determinism-relevant changes
        if: steps.check-changes.outputs.changed == 'false'
        run: echo "Skipping exact-repeat determinism check (no changes to determinism-relevant paths)"

      - name: Set up CI Python environment
        if: steps.check-changes.outputs.changed == 'true'
        uses: ./.github/actions/setup-ci-python

      - name: Derive model-cache key from registry-pinned digests
        if: steps.check-changes.outputs.changed == 'true'
        id: model-cache-key
        run: |
          KEY=$(uv run python scripts/dev/model_cache_key.py --config "${PPO_ALGO_CONFIG}" --machine)
          echo "key=$KEY" >> "$GITHUB_OUTPUT"

      - name: Restore exact-repeat model cache
        if: steps.check-changes.outputs.changed == 'true'
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: output/model_cache
          key: model-cache-exact-repeat-ppo-${{ steps.model-cache-key.outputs.key }}

      - name: Run exact-repeat determinism test
        if: steps.check-changes.outputs.changed == 'true'
        run: uv run pytest tests/benchmark/test_exact_repeat_executor.py -v

  exact-repeat-model-preflight:
    # Issue #6189: prove the exact-repeat native-PPO path runs offline. The
    # required model assets are staged (checksum-verified) in a SETUP step and
    # cached via actions/cache keyed on their registry-pinned SHA-256, so the
    # timed test never downloads a model inside its loop. The test itself
    # monkeypatches the downloader to fail-closed if any in-loop fetch is
    # attempted.
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      PPO_ALGO_CONFIG: configs/baselines/ppo_issue_791_eval_aligned_large_capacity_cpu.yaml
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up CI Python environment
        uses: ./.github/actions/setup-ci-python

      - name: Derive model-cache key from registry-pinned digests
        id: model-cache-key
        run: |
          KEY=$(uv run python scripts/dev/model_cache_key.py --config "${PPO_ALGO_CONFIG}" --machine)
          echo "key=$KEY" >> "$GITHUB_OUTPUT"

      - name: Restore model cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: output/model_cache
          key: model-cache-exact-repeat-ppo-${{ steps.model-cache-key.outputs.key }}

      - name: Preflight required model assets (before the timed test)
        run: uv run python scripts/models/preflight_models.py --config "${PPO_ALGO_CONFIG}"

      - name: Run exact-repeat native-PPO determinism offline
        run: |
          uv run pytest -m slow -p no:cacheprovider \
            tests/benchmark/test_exact_repeat_executor.py::test_native_ppo_runs_offline_after_model_preflight \
            -q

  ci:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    needs:
      - fast-feedback
      - changed-coverage-gate
      - coverage-gate
      - compat-matrix
      - fast-pysf-compat
      - smoke-artifacts
      - scenario-validation
      - xdist-scratch-isolation
      - wheel-smoke-install
      - examples-smoke
      - notebooks-smoke
      - determinism-gate
      - exact-repeat-model-preflight
    if: always()
    steps:
      - name: Checkout for duration-cache update
        id: checkout_duration_cache
        if: ${{ always() }}
        continue-on-error: true
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Check split job results
        env:
          CI_NEEDS_JSON: ${{ toJSON(needs) }}
        run: |
          python scripts/dev/check_ci_needs.py \
            --event-name "${{ github.event_name }}" \
            --treat-cancelled-as-superseded \
            --results "$CI_NEEDS_JSON"

      - name: Download test-duration shards
        if: ${{ always() && needs.fast-feedback.result == 'success' && steps.checkout_duration_cache.outcome == 'success' }}
        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: pytest-durations-*
          path: .duration-artifacts

      - name: Merge test durations
        id: merge-test-durations
        if: ${{ always() && needs.fast-feedback.result == 'success' && steps.checkout_duration_cache.outcome == 'success' }}
        continue-on-error: true
        run: |
          python scripts/dev/merge_test_durations.py \
            --artifact-dir .duration-artifacts --output .test_durations

      - name: Save merged test durations
        if: ${{ always() && needs.fast-feedback.result == 'success' && steps.checkout_duration_cache.outcome == 'success' && steps.merge-test-durations.outcome == 'success' }}
        continue-on-error: true
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: .test_durations
          key: test-durations-${{ runner.os }}-${{ hashFiles('pyproject.toml', 'uv.lock') }}-${{ github.run_id }}-${{ github.run_attempt }}