verify.yml

name: Verify

on:
  pull_request:
  merge_group:
  workflow_dispatch:

permissions:
  contents: read

# Each merge group has its own gh-readonly-queue ref, so queued groups never cancel each other; the
# queue itself discards a group's run when it rebuilds the group.
concurrency:
  group: verify-${{ github.workflow }}-${{ github.event.merge_group.head_ref || github.ref }}
  cancel-in-progress: ${{ github.event_name != 'merge_group' }}

jobs:
  changes:
    name: Classify verification scope
    runs-on: ubuntu-24.04
    outputs:
      checks: ${{ steps.scope.outputs.checks }}
      compiler_differential: ${{ steps.scope.outputs.compiler_differential }}
      duckdb: ${{ steps.scope.outputs.duckdb }}
      postgres: ${{ steps.scope.outputs.postgres }}
      clickhouse: ${{ steps.scope.outputs.clickhouse }}
      performance: ${{ steps.scope.outputs.performance }}
      format_performance: ${{ steps.scope.outputs.format_performance }}
      rules_performance: ${{ steps.scope.outputs.rules_performance }}
      wheels: ${{ steps.scope.outputs.wheels }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Select relevant suites
        id: scope
        env:
          EVENT_NAME: ${{ github.event_name }}
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha }}
          HEAD_REF: ${{ github.event.pull_request.head.ref }}
          HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
        run: |
          write_scope() {
            {
              echo "duckdb=$1"
              echo "postgres=$2"
              echo "performance=$3"
              echo "format_performance=$4"
              echo "rules_performance=$5"
              echo "checks=$6"
              echo "wheels=$7"
              echo "compiler_differential=$8"
              echo "clickhouse=$9"
            } >> "${GITHUB_OUTPUT}"
          }

          if [[ "${EVENT_NAME}" != "pull_request" && "${EVENT_NAME}" != "merge_group" ]]; then
            write_scope true true true true true true true true true
            exit 0
          fi

          # A merge group's head is its base plus every queued pull request ahead of and including
          # this one, so the base..head diff covers the whole group. Anything that prevents an exact
          # diff runs everything rather than risk skipping a suite. Three dots compare with the merge
          # base, so changes that landed on main after a branch started are not counted as its own.
          changed_paths="${RUNNER_TEMP}/changed-paths"
          if [[ -z "${BASE_SHA}" || -z "${HEAD_SHA}" ]] || \
             ! git diff --name-only -z "${BASE_SHA}...${HEAD_SHA}" > "${changed_paths}"; then
            echo "Could not diff ${BASE_SHA:-<none>}...${HEAD_SHA:-<none>}; running every suite" >&2
            write_scope true true true true true true true true true
            exit 0
          fi

          # Succeeds when every change is a release metadata change: the manifest, the changelog,
          # or version lines of the package and lock files, so no dependency or build setting
          # moves. Keep the file list in sync with the release checks in release-please.yml.
          release_metadata_only() {
            local path diff offending changed_any=false
            local metadata_paths="${RUNNER_TEMP}/release-metadata-paths"
            local version='[0-9]+\.[0-9]+\.[0-9]+'
            local version_line="^[-+](version = \"${version}\""
            version_line+="|  \"[a-z0-9_-]+==${version}\",  # x-release-please-version)\$"
            git diff --name-only --no-renames -z "${BASE_SHA}...${HEAD_SHA}" > "${metadata_paths}" \
              || return 1
            while IFS= read -r -d '' path; do
              changed_any=true
              case "${path}" in
                .release-please-manifest.json|CHANGELOG.md) ;;
                crates/sqlbuild-cli/Cargo.toml|crates/sqlbuild-python/Cargo.toml|Cargo.lock|pyproject.toml|uv.lock)
                  diff="$(git diff -U0 --text --no-color --no-renames "${BASE_SHA}...${HEAD_SHA}" -- "${path}")" \
                    || return 1
                  offending="$(awk '/^@@/ { hunk = 1; next } hunk && /^[-+]/' <<< "${diff}" \
                    | grep -Ev "${version_line}" || true)"
                  if [[ -n "${offending}" ]]; then
                    echo "${path} changes more than version lines:" >&2
                    echo "${offending}" >&2
                    return 1
                  fi
                  ;;
                *) return 1 ;;
              esac
            done < "${metadata_paths}"
            [[ "${changed_any}" == "true" ]]
          }

          # Release Please pull requests change only release metadata on top of product code that
          # already passed every suite before it reached main, so the suites are skipped. Their
          # required Verify status is posted only by the trusted release checks in
          # release-please.yml after the metadata, version and distribution checks pass; the
          # verify job below reports under another name on Release Please branches.
          if [[ "${EVENT_NAME}" == "pull_request" \
                && "${HEAD_REPOSITORY}" == "${GITHUB_REPOSITORY}" \
                && "${HEAD_REF}" == release-please--branches--* ]] && release_metadata_only; then
            echo "Release Please pull request changes only release metadata; skipping the suites" \
              | tee -a "${GITHUB_STEP_SUMMARY}"
            write_scope false false false false false false false false false
            exit 0
          fi

          duckdb=false
          postgres=false
          clickhouse=false
          performance=false
          format_performance=false
          rules_performance=false
          wheels=false
          compiler_differential=false
          broad=false
          changed=false
          # A change that only touches the website, root-level Markdown, the README demo GIFs or the
          # skill pages generated from the website docs skips the Python checks and test suites.
          # The website builds in its own workflow.
          docs_only=true
          while IFS= read -r -d '' path; do
            changed=true
            case "${path}" in
              website/*|.github/workflows/website.yml|.github/demos/*) ;;
              src/sqlbuild/.agents/skills/sqlbuild/references/docs/*.md) ;;
              */*) docs_only=false ;;
              *.md) ;;
              *) docs_only=false ;;
            esac
            case "${path}" in
              crates/*|Cargo.toml|Cargo.lock|pyproject.toml|.github/workflows/verify.yml|.github/workflows/build-distributions.yml)
                wheels=true
                ;;
            esac
            case "${path}" in
              scripts/compiler_differential/*|scripts/run_compiler_differential.py|tests/*/scripts/compiler_differential/*|tests/goldens/*|tests/e2e/fixtures/*|website/examples/*|.github/workflows/verify.yml|Makefile)
                compiler_differential=true
                ;;
            esac
            case "${path}" in
              crates/*|Cargo.toml|Cargo.lock|pyproject.toml|uv.lock)
                broad=true
                performance=true
                format_performance=true
                rules_performance=true
                ;;
              src/sqlbuild/compiler/*|src/sqlbuild/adapter/type_system/*)
                broad=true
                performance=true
                rules_performance=true
                ;;
              benchmarks/duckshop-10k/*|src/sqlbuild/executor/testing/*|scripts/cold_compile_performance/*|scripts/compile_performance_ratio/*|scripts/compare_compile_performance.py|tests/e2e/src/sqlbuild/cli/commands/main/compile/*)
                broad=true
                performance=true
                ;;
              src/sqlbuild/executor/build/*|src/sqlbuild/executor/run/*|src/sqlbuild/presentation/*)
                # Inspection, plan, and build guards run inside the fresh-process compile jobs.
                broad=true
                performance=true
                ;;
              src/sqlbuild/rule_engine/*|src/sqlbuild/lint/*|scripts/rules_benchmark/*|scripts/benchmark_rules_ci.py)
                broad=true
                performance=true
                format_performance=true
                rules_performance=true
                ;;
              tests/e2e/src/sqlbuild/cli/commands/main/format/*)
                duckdb=true
                format_performance=true
                ;;
              tests/e2e/src/sqlbuild/cli/commands/main/postgres/*|tests/integration/src/sqlbuild/adapters/postgres/*|tests/integration/src/sqlbuild/runtime/execution_history/*)
                postgres=true
                ;;
              src/sqlbuild/adapters/clickhouse/*|tests/e2e/src/sqlbuild/cli/commands/main/clickhouse/*|tests/integration/src/sqlbuild/adapters/clickhouse/*)
                clickhouse=true
                ;;
              tests/e2e/*)
                duckdb=true
                ;;
              tests/unit/*|tests/integration/*)
                ;;
              .github/workflows/verify.yml|Makefile)
                performance=true
                format_performance=true
                rules_performance=true
                ;;
              .github/*|docs/*|website/*|*.md|.gitignore|LICENSE)
                ;;
              *)
                broad=true
                ;;
            esac
          done < "${changed_paths}"

          if [[ "${changed}" != "true" ]]; then
            write_scope true true true true true true true true true
            exit 0
          fi

          checks=true
          if [[ "${docs_only}" == "true" ]]; then
            checks=false
          fi

          if [[ "${broad}" == "true" ]]; then
            duckdb=true
            postgres=true
            clickhouse=true
            format_performance=true
            compiler_differential=true
          fi
          write_scope \
            "${duckdb}" \
            "${postgres}" \
            "${performance}" \
            "${format_performance}" \
            "${rules_performance}" \
            "${checks}" \
            "${wheels}" \
            "${compiler_differential}" \
            "${clickhouse}"

  lockfile:
    name: Lockfile consistency
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v5
        with:
          version: "0.12.3"
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - name: Install Python
        run: uv python install 3.12
      - name: Verify lockfile
        run: uv lock --check --python 3.12

  checks:
    name: Static checks and unit + integration tests
    needs: [changes, lockfile]
    if: needs.changes.outputs.checks == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v5
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      # Restores the native dependency builds that rust-cache.yml saves on main; workspace crates
      # always build from source. Verify never saves: a pull request or merge queue cache is
      # visible only to its own ref. Jobs that run the same cargo builds share a key.
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-checks
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras
      - name: Fetch pull request base for the new-duplicate check
        if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
        run: git fetch --no-tags --depth=1 origin "$BASE_SHA"
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
      - name: Run static checks
        run: make check-ci
        env:
          DUPES_BASE: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || 'origin/main' }}
      - name: Run native checks
        run: make rust-check
      - name: Run unit and integration tests
        run: make test

  e2e_shards:
    name: DuckDB E2E (${{ matrix.name }})
    needs: [changes, lockfile]
    if: needs.changes.outputs.duckdb == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: build core
            target: test-e2e-duckdb-build-core
          - name: build incremental
            target: test-e2e-duckdb-build-incremental
          - name: CLI data
            target: test-e2e-duckdb-cli-data
          - name: CLI commands
            target: test-e2e-duckdb-cli
          - name: CLI inspection
            target: test-e2e-duckdb-inspection
          - name: integrations
            target: test-e2e-duckdb-integrations
    env:
      PYTEST_XDIST_AUTO_NUM_WORKERS: "4"
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v5
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras
      - name: Report runner CPU topology
        run: |
          echo "nproc=$(nproc)"
          echo "online_processors=$(getconf _NPROCESSORS_ONLN)"
          lscpu
          uv run python - <<'PY'
          import os

          print(f"os.cpu_count={os.cpu_count()}")
          print(f"sched_getaffinity={sorted(os.sched_getaffinity(0))}")
          print(
              "PYTEST_XDIST_AUTO_NUM_WORKERS="
              f"{os.environ.get('PYTEST_XDIST_AUTO_NUM_WORKERS', '<unset>')}"
          )
          PY
      - name: Run DuckDB E2E shard
        run: make ${{ matrix.target }}

  compiler_differential:
    name: Compiler golden outputs
    needs: [changes, lockfile]
    if: needs.changes.outputs.compiler_differential == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v5
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras
      - name: Check fixtures, examples, generated seeds and the failure corpus against the goldens
        run: >-
          make compiler-differential
          COMPILER_DIFFERENTIAL_ARGS="--stage-captures --require-discovery-coverage
          --require-render-coverage --require-analysis-coverage
          --evidence-dir ${{ runner.temp }}/compiler-differential-evidence"
      - name: Upload failing projects' targets, stderr and compiled-test stats
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: compiler-differential-evidence-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/compiler-differential-evidence
          if-no-files-found: warn
          retention-days: 30

  compiler_differential_python_versions:
    name: Native compiler on Python ${{ matrix.python }}
    needs: [changes, lockfile]
    if: needs.changes.outputs.compiler_differential == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        python: ["3.13", "3.14"]
    env:
      UV_PYTHON: ${{ matrix.python }}
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v5
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install ${{ matrix.python }}
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras --python ${{ matrix.python }}
      - name: Check fixtures, examples, the failure corpus and a few seeds against the goldens
        env:
          PYTHONUNBUFFERED: "1"
        run: >-
          uv run --no-sync python -m scripts.run_compiler_differential
          --goldens check
          --corpus fixtures examples failures seeds --seeds 4 --jobs 4

  native_discovery_windows:
    name: Native compiler on Windows
    needs: [changes, lockfile]
    if: needs.changes.outputs.compiler_differential == 'true'
    runs-on: windows-2025
    timeout-minutes: 45
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v5
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-windows
          save-if: false
      - name: Test the native discovery crate (walk, junctions, ordering, read errors)
        run: cargo test --locked -p sqlbuild-discovery
      - name: Install Python
        run: uv python install 3.12
      - name: Install SQLBuild and pytest
        run: |
          uv sync --locked --no-dev --python 3.12
          uv pip install "pytest>=8.4.2" "pytest-xdist>=3.8.0"
      - name: Check the native YAML and TOML readers and the lineage fingerprint with this Python
        run: >-
          uv run --no-sync pytest
          tests/integration/src/sqlbuild/compiler/discovery/test_native_yaml_oracle.py
          tests/integration/src/sqlbuild/compiler/discovery/test_native_toml_oracle.py
          tests/unit/src/sqlbuild/cli/commands/_helpers/lineage/test_cache.py
          -n auto --dist loadfile
      - name: Compile and build playground projects
        run: |
          project="${RUNNER_TEMP}/waffle-shop"
          uv run --no-sync sqb playground "${project}"
          uv run --no-sync sqb --project-dir "${project}" --no-color compile
          if ! test -f "${project}/target/cache/compiler-native-v1/macro-calls.bin"; then
            echo "The compile did not write the macro-call store; macro bridge debug log:"
            rm -rf "${project}/target"
            uv run --no-sync sqb --project-dir "${project}" --no-color --debug compile 2>&1 \
              | grep "macro_bridge" || true
            exit 1
          fi
          uv run --no-sync sqb --project-dir "${project}" --no-color build
          nodes="${RUNNER_TEMP}/python-nodes"
          uv run --no-sync sqb playground --template python_nodes "${nodes}"
          uv run --no-sync sqb --project-dir "${nodes}" --no-color compile

  format_performance:
    name: Formatter performance guards
    needs: [changes, lockfile]
    if: needs.changes.outputs.format_performance == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v5
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras --python 3.12
      - name: Run formatter performance guards
        timeout-minutes: 10
        run: >-
          uv run pytest
          tests/e2e/src/sqlbuild/cli/commands/main/format/test_format_performance.py
          -n auto --dist loadfile -m performance

  performance:
    name: Performance guards
    needs: [changes, lockfile]
    # Temporarily disabled while the Blacksmith runner allowance is unavailable.
    # These budgets are calibrated for the 8-vCPU Blacksmith runner.
    if: false
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v5
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras
      - name: Run performance guards
        run: make test-e2e-performance

  cold_compile_performance:
    name: Fresh-process compile (${{ matrix.models }} models)
    needs: [changes, lockfile]
    if: needs.changes.outputs.performance == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        models: [3000, 5000, 10000]
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v5
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras
      - name: Run fresh-process compile guard under 4 GiB
        env:
          BENCHMARK_MODELS: ${{ matrix.models }}
          MEMORY_LIMIT_BYTES: "4294967296"
        run: |
          sudo systemd-run \
            --unit="sqlbuild-cold-${BENCHMARK_MODELS}-${GITHUB_RUN_ID}" \
            --uid="$(id -u)" \
            --gid="$(id -g)" \
            --same-dir \
            --setenv="HOME=${HOME}" \
            --setenv="PATH=${PATH}" \
            --setenv="SQLBUILD_REQUIRE_MEMORY_LIMIT_BYTES=${MEMORY_LIMIT_BYTES}" \
            --property="MemoryMax=${MEMORY_LIMIT_BYTES}" \
            --property="MemorySwapMax=0" \
            --wait \
            --collect \
            --pipe \
            make test-e2e-cold-compile-performance \
              SQLBUILD_BENCHMARK_MODELS="${BENCHMARK_MODELS}"

  dense_compile_performance:
    name: Dense all-rules compile (${{ matrix.models }} models)
    needs: [changes, lockfile]
    if: needs.changes.outputs.performance == 'true'
    runs-on: ubuntu-24.04
    # The 3k and 10k cells also run the delta edit-loop guard, about five minutes at 10k.
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        models: [1000, 3000, 5000, 10000]
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v5
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras
      - name: Run dense all-rules and delta edit-loop guards under 4 GiB
        env:
          BENCHMARK_MODELS: ${{ matrix.models }}
          MEMORY_LIMIT_BYTES: "4294967296"
        run: |
          sudo systemd-run \
            --unit="sqlbuild-dense-${BENCHMARK_MODELS}-${GITHUB_RUN_ID}" \
            --uid="$(id -u)" \
            --gid="$(id -g)" \
            --same-dir \
            --setenv="HOME=${HOME}" \
            --setenv="PATH=${PATH}" \
            --setenv="SQLBUILD_REQUIRE_MEMORY_LIMIT_BYTES=${MEMORY_LIMIT_BYTES}" \
            --property="MemoryMax=${MEMORY_LIMIT_BYTES}" \
            --property="MemorySwapMax=0" \
            --wait \
            --collect \
            --pipe \
            make test-e2e-dense-compile-performance \
              SQLBUILD_BENCHMARK_MODELS="${BENCHMARK_MODELS}"

      - name: Run diagnostic-heavy compile guards
        if: matrix.models == 1000
        run: make test-e2e-diagnostic-compile-performance

  compile_performance_ratio:
    name: Same-runner compile ratio (${{ matrix.label || matrix.kind }} 3000 models)
    needs: [changes, lockfile]
    if: needs.changes.outputs.performance == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        include:
          - kind: dense
            max_ratio: "1.10"
            edit_max_ratio: "1.20"
            edit_max_cpu_ratio: "1.75"
          - kind: fresh
            max_ratio: "1.10"
          - kind: dense
            label: contracts CPU vs base
            gate_phase: contracts_cpu_ms
            max_ratio: "1.10"
          - kind: dense
            label: model analysis CPU vs base
            gate_phase: model_analysis_cpu_ms
            compile_args: --compile-arg=--select=*
            max_ratio: "1.10"
          - kind: dense
            label: custom rules CPU vs base
            gate_phase: custom_rules_cpu_ms
            # Temporary migration allowance; restore 1.10 after custom-host projection optimization.
            # Whole-command CPU, wall-time, memory and correctness gates retain their limits.
            max_ratio: "1.35"
    steps:
      - uses: actions/checkout@v4
      - name: Check out the comparison base
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || 'main' }}
          path: base
      - uses: astral-sh/setup-uv@v5
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
            base/uv.lock
            base/Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Seed the base build directory with the cached dependency builds
        run: |
          if [[ -d target ]]; then
            cp -a target base/target
          fi
      - name: Install head dependencies
        run: uv sync --locked --all-groups --all-extras
      - name: Install base dependencies
        working-directory: base
        run: uv sync --locked --all-groups --all-extras
      - name: Compare base and head phase CPU
        if: matrix.gate_phase
        env:
          KIND: ${{ matrix.kind }}
          MAX_RATIO: ${{ matrix.max_ratio }}
          GATE_PHASE: ${{ matrix.gate_phase }}
          COMPILE_ARGS: ${{ matrix.compile_args }}
        run: |
          uv run python -m scripts.compare_compile_performance \
            --kind "${KIND}" \
            --modes cold \
            --max-ratio "${MAX_RATIO}" \
            --models 3000 \
            --base-root base \
            --base-python base/.venv/bin/python \
            --head-python .venv/bin/python \
            --gate-phase "${GATE_PHASE}" \
            ${COMPILE_ARGS:+"${COMPILE_ARGS}"}
      - name: Compare base and head cold, warm and one-model edit compiles
        if: ${{ !matrix.gate_phase }}
        env:
          KIND: ${{ matrix.kind }}
          MAX_RATIO: ${{ matrix.max_ratio }}
          EDIT_MAX_RATIO: ${{ matrix.edit_max_ratio }}
          EDIT_MAX_CPU_RATIO: ${{ matrix.edit_max_cpu_ratio }}
        run: |
          uv run python -m scripts.compare_compile_performance \
            --kind "${KIND}" \
            --modes cold warm edit \
            ${EDIT_MAX_RATIO:+--edit-max-ratio "$EDIT_MAX_RATIO"} \
            ${EDIT_MAX_CPU_RATIO:+--edit-max-cpu-ratio "$EDIT_MAX_CPU_RATIO"} \
            --max-ratio "${MAX_RATIO}" \
            --models 3000 \
            --base-root base \
            --base-python base/.venv/bin/python \
            --head-python .venv/bin/python

  cache_compile_performance:
    name: Fresh-process compile cache (${{ matrix.models }} models)
    needs: [changes, lockfile]
    if: needs.changes.outputs.performance == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        models: [3000, 5000, 10000]
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v5
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras
      - name: Run fresh-process compile cache guard under 4 GiB
        timeout-minutes: 15
        env:
          BENCHMARK_MODELS: ${{ matrix.models }}
          MEMORY_LIMIT_BYTES: "4294967296"
        run: |
          sudo systemd-run \
            --unit="sqlbuild-cache-${BENCHMARK_MODELS}-${GITHUB_RUN_ID}" \
            --uid="$(id -u)" \
            --gid="$(id -g)" \
            --same-dir \
            --setenv="HOME=${HOME}" \
            --setenv="PATH=${PATH}" \
            --setenv="SQLBUILD_REQUIRE_MEMORY_LIMIT_BYTES=${MEMORY_LIMIT_BYTES}" \
            --property="MemoryMax=${MEMORY_LIMIT_BYTES}" \
            --property="MemorySwapMax=0" \
            --wait \
            --collect \
            --pipe \
            make test-e2e-cache-compile-performance \
              SQLBUILD_BENCHMARK_MODELS="${BENCHMARK_MODELS}"

      - name: Run varied 1k warm-cache guard under 4 GiB
        if: matrix.models == 3000
        timeout-minutes: 15
        env:
          MEMORY_LIMIT_BYTES: "4294967296"
        run: |
          sudo systemd-run \
            --unit="sqlbuild-varied-cache-${GITHUB_RUN_ID}" \
            --uid="$(id -u)" \
            --gid="$(id -g)" \
            --same-dir \
            --setenv="HOME=${HOME}" \
            --setenv="PATH=${PATH}" \
            --setenv="SQLBUILD_REQUIRE_MEMORY_LIMIT_BYTES=${MEMORY_LIMIT_BYTES}" \
            --property="MemoryMax=${MEMORY_LIMIT_BYTES}" \
            --property="MemorySwapMax=0" \
            --wait \
            --collect \
            --pipe \
            make test-e2e-varied-cache-performance

  rules_performance:
    name: Rules performance guards
    needs: [changes, lockfile]
    # Temporarily disabled while the Blacksmith runner allowance is unavailable.
    # These budgets are calibrated for the 8-vCPU Blacksmith runner.
    if: false
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v5
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras
      - name: Run required Rules performance profile
        timeout-minutes: 10
        run: >-
          uv run python -m scripts.benchmark_rules_ci
          --output "${RUNNER_TEMP}/rules-performance-ci.json"
          --summary-output "${RUNNER_TEMP}/rules-performance-ci.md"
          --max-seconds 420
      - name: Publish benchmark summary
        if: always()
        run: |
          if [[ -f "${RUNNER_TEMP}/rules-performance-ci.md" ]]; then
            cat "${RUNNER_TEMP}/rules-performance-ci.md" >> "${GITHUB_STEP_SUMMARY}"
          fi
      - name: Upload benchmark evidence
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: rules-performance-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            ${{ runner.temp }}/rules-performance-ci.json
            ${{ runner.temp }}/rules-performance-ci.md
          if-no-files-found: error
          retention-days: 90

  postgres:
    name: PostgreSQL integration and E2E tests
    needs: [changes, lockfile]
    if: needs.changes.outputs.postgres == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v5
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras
      - name: Verify Docker
        run: docker info
      - name: Run PostgreSQL tests
        env:
          PYTHONUNBUFFERED: "1"
          TESTCONTAINERS_RYUK_DISABLED: "true"
        run: >-
          uv run pytest tests
          -m "real_warehouse and postgres"
          -vv --color=yes -n auto --dist loadfile

  clickhouse:
    name: ClickHouse integration and E2E tests
    needs: [changes, lockfile]
    if: needs.changes.outputs.clickhouse == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v5
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras
      - name: Verify Docker
        run: docker info
      - name: Run ClickHouse tests
        env:
          PYTHONUNBUFFERED: "1"
          TESTCONTAINERS_RYUK_DISABLED: "true"
        run: >-
          uv run pytest tests
          -m "real_warehouse and clickhouse"
          -vv --color=yes -n auto --dist loadfile

  wheels:
    name: Wheels
    needs: [changes]
    if: needs.changes.outputs.wheels == 'true'
    uses: ./.github/workflows/build-distributions.yml
    with:
      sdist: false

  verify:
    # The required Verify of a Release Please pull request is the commit status that the trusted
    # release checks in release-please.yml post on the branch's current head, after the lockfile
    # refresh and every dispatched check. This job reports under another name there, so its quick
    # metadata-only pass can never satisfy Verify first; a skipped job would count as passing, so
    # the job always runs and only its name changes. Until those checks post Verify on the head,
    # the pull request waits for an expected check, and every new push to the branch waits again.
    name: >-
      ${{ (github.event_name == 'pull_request'
      && github.event.pull_request.head.repo.full_name == github.repository
      && startsWith(github.event.pull_request.head.ref, 'release-please--branches--'))
      && 'Release pull request suites' || 'Verify' }}
    if: always()
    needs:
      [
        changes,
        lockfile,
        checks,
        e2e_shards,
        compiler_differential,
        compiler_differential_python_versions,
        native_discovery_windows,
        format_performance,
        performance,
        cold_compile_performance,
        dense_compile_performance,
        compile_performance_ratio,
        cache_compile_performance,
        rules_performance,
        postgres,
        clickhouse,
        wheels,
      ]
    runs-on: ubuntu-24.04
    steps:
      - name: Confirm all required verification jobs passed
        env:
          CHANGES_RESULT: ${{ needs.changes.result }}
          CHECKS_SELECTED: ${{ needs.changes.outputs.checks }}
          LOCKFILE_RESULT: ${{ needs.lockfile.result }}
          CHECKS_RESULT: ${{ needs.checks.result }}
          E2E_SHARDS_RESULT: ${{ needs.e2e_shards.result }}
          COMPILER_DIFFERENTIAL_RESULT: ${{ needs.compiler_differential.result }}
          COMPILER_DIFFERENTIAL_PYTHON_VERSIONS_RESULT: ${{ needs.compiler_differential_python_versions.result }}
          NATIVE_DISCOVERY_WINDOWS_RESULT: ${{ needs.native_discovery_windows.result }}
          FORMAT_PERFORMANCE_RESULT: ${{ needs.format_performance.result }}
          PERFORMANCE_RESULT: ${{ needs.performance.result }}
          COLD_COMPILE_PERFORMANCE_RESULT: ${{ needs.cold_compile_performance.result }}
          DENSE_COMPILE_PERFORMANCE_RESULT: ${{ needs.dense_compile_performance.result }}
          COMPILE_PERFORMANCE_RATIO_RESULT: ${{ needs.compile_performance_ratio.result }}
          CACHE_COMPILE_PERFORMANCE_RESULT: ${{ needs.cache_compile_performance.result }}
          RULES_PERFORMANCE_RESULT: ${{ needs.rules_performance.result }}
          POSTGRES_RESULT: ${{ needs.postgres.result }}
          CLICKHOUSE_RESULT: ${{ needs.clickhouse.result }}
          WHEELS_RESULT: ${{ needs.wheels.result }}
        run: |
          if [[ "${CHANGES_RESULT}" != "success" || "${LOCKFILE_RESULT}" != "success" ]]; then
            echo "Required classification or lockfile checks did not pass" >&2
            exit 1
          fi
          if [[ "${CHECKS_RESULT}" != "success" ]] && \
             ! [[ "${CHECKS_SELECTED}" == "false" && "${CHECKS_RESULT}" == "skipped" ]]; then
            echo "Required static checks did not pass: ${CHECKS_RESULT}" >&2
            exit 1
          fi
          for result in \
            "${E2E_SHARDS_RESULT}" \
            "${COMPILER_DIFFERENTIAL_RESULT}" \
            "${COMPILER_DIFFERENTIAL_PYTHON_VERSIONS_RESULT}" \
            "${NATIVE_DISCOVERY_WINDOWS_RESULT}" \
            "${FORMAT_PERFORMANCE_RESULT}" \
            "${PERFORMANCE_RESULT}" \
            "${COLD_COMPILE_PERFORMANCE_RESULT}" \
            "${DENSE_COMPILE_PERFORMANCE_RESULT}" \
            "${COMPILE_PERFORMANCE_RATIO_RESULT}" \
            "${CACHE_COMPILE_PERFORMANCE_RESULT}" \
            "${RULES_PERFORMANCE_RESULT}" \
            "${POSTGRES_RESULT}" \
            "${CLICKHOUSE_RESULT}" \
            "${WHEELS_RESULT}"; do
            if [[ "${result}" != "success" && "${result}" != "skipped" ]]; then
              echo "A selected verification suite did not pass: ${result}" >&2
              exit 1
            fi
          done
          echo "All path-relevant verification jobs passed"