gpu-validation.yml

name: GPU validation

on:
  workflow_dispatch:
    inputs:
      target:
        description: "Accelerator lane to validate"
        type: choice
        required: true
        default: cuda
        options: [cuda, metal, all]
      mode:
        description: "Quick validates selected lanes; full is release-grade and requires all"
        type: choice
        required: true
        default: quick
        options: [quick, full]
      coverage-base-ref:
        description: "Git revision used as the changed-line coverage base in full mode"
        type: string
        required: false
        default: "v0.6.2"

permissions:
  contents: read

concurrency:
  group: gpu-validation-${{ github.sha }}-${{ inputs.target }}-${{ inputs.mode }}
  cancel-in-progress: ${{ inputs.mode == 'quick' }}

env:
  CARGO_TERM_COLOR: always
  J2K_COVERAGE_BASE: ${{ inputs.coverage-base-ref }}
  RUSTFLAGS: "-D warnings"

jobs:
  validate-inputs:
    name: Validate GPU request
    runs-on: ubuntu-latest
    steps:
      - name: Reject unsafe or contradictory requests
        env:
          MODE: ${{ inputs.mode }}
          TARGET: ${{ inputs.target }}
        run: |
          if [ "${MODE}" = full ] && [ "${TARGET}" != all ]; then
            echo "full GPU validation requires target=all" >&2
            exit 1
          fi

  cuda-quick:
    name: CUDA quick validation
    needs: [validate-inputs]
    if: ${{ inputs.mode == 'quick' && (inputs.target == 'cuda' || inputs.target == 'all') }}
    runs-on: [self-hosted, Linux, X64, cuda]
    # Quick timing is telemetry until representative warm-cache runs establish a budget.
    timeout-minutes: 90
    env:
      J2K_REQUIRE_CUDA_RUNTIME: "1"
      J2K_REQUIRE_CUDA_OXIDE_BUILD: "1"
      J2K_REQUIRE_CUDA_JPEG_HARDWARE_DECODE: "1"
      RUST_TEST_THREADS: "1"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: "1.96"
      - name: Fingerprint CUDA cache environment
        run: |
          {
            nvidia-smi --query-gpu=driver_version --format=csv,noheader
            nvcc --version
          } | sha256sum | awk '{print "J2K_GPU_CACHE_ENV=cuda-" $1}' \
            >> "${GITHUB_ENV}"
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
        with:
          shared-key: gpu-cuda-${{ runner.os }}-${{ runner.arch }}-1.96
          key: profiles-gpu-quick-release-v1
          env-vars: "CARGO CC CFLAGS CXX CMAKE RUST J2K_GPU_CACHE_ENV"
          cache-bin: false
          save-if: false
      - name: Show CUDA runner diagnostics
        run: |
          uname -a
          rustc -Vv
          cargo -V
          nvidia-smi
          command -v nvcc
          nvcc --version
      - name: Configure CUDA Oxide bindgen
        run: bash scripts/configure-cuda-bindgen.sh
      - name: Run fail-closed quick CUDA validation
        run: |
          started="$(date +%s)"
          status=0
          cargo xtask release-cuda --mode quick || status=$?
          elapsed="$(( $(date +%s) - started ))"
          echo "CUDA quick wall time: ${elapsed}s" | tee -a "${GITHUB_STEP_SUMMARY}"
          exit "${status}"

  metal-quick:
    name: Metal quick validation
    needs: [validate-inputs]
    if: ${{ inputs.mode == 'quick' && (inputs.target == 'metal' || inputs.target == 'all') }}
    runs-on: [self-hosted, macOS, ARM64, metal]
    # Keep the 15-minute target informational until runner variance is measured.
    timeout-minutes: 60
    env:
      J2K_REQUIRE_METAL_RUNTIME: "1"
      RUST_TEST_THREADS: "1"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: "1.96"
          components: clippy
      - name: Fingerprint Metal cache environment
        run: |
          {
            sw_vers
            xcrun metal --version
          } | shasum -a 256 | awk '{print "J2K_GPU_CACHE_ENV=metal-" $1}' \
            >> "${GITHUB_ENV}"
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
        with:
          shared-key: gpu-metal-${{ runner.os }}-${{ runner.arch }}-1.96
          key: profiles-gpu-quick-release-v1
          env-vars: "CARGO CC CFLAGS CXX CMAKE RUST J2K_GPU_CACHE_ENV"
          cache-bin: false
          save-if: false
      - name: Show Metal runner diagnostics
        run: |
          uname -a
          system_profiler SPDisplaysDataType
          rustc -Vv
          cargo -V
      - name: Run fail-closed quick Metal validation
        run: |
          started="$(date +%s)"
          status=0
          cargo xtask release-metal --mode quick || status=$?
          elapsed="$(( $(date +%s) - started ))"
          echo "Metal quick wall time: ${elapsed}s (telemetry target: <=900s)" \
            | tee -a "${GITHUB_STEP_SUMMARY}"
          exit "${status}"

  cuda-full:
    name: CUDA full release validation
    needs: [validate-inputs]
    if: ${{ inputs.mode == 'full' && inputs.target == 'all' }}
    runs-on: [self-hosted, Linux, X64, cuda]
    timeout-minutes: 90
    env:
      J2K_REQUIRE_CUDA_RUNTIME: "1"
      J2K_REQUIRE_CUDA_OXIDE_BUILD: "1"
      J2K_REQUIRE_CUDA_JPEG_HARDWARE_DECODE: "1"
      RUST_TEST_THREADS: "1"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: "1.96"
          components: clippy
      - name: Fingerprint CUDA cache environment
        run: |
          {
            nvidia-smi --query-gpu=driver_version --format=csv,noheader
            nvcc --version
          } | sha256sum | awk '{print "J2K_GPU_CACHE_ENV=cuda-" $1}' \
            >> "${GITHUB_ENV}"
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
        with:
          shared-key: gpu-cuda-${{ runner.os }}-${{ runner.arch }}-1.96
          key: profiles-gpu-quick-release-v1
          env-vars: "CARGO CC CFLAGS CXX CMAKE RUST J2K_GPU_CACHE_ENV"
          cache-bin: false
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - name: Show CUDA runner diagnostics
        run: |
          uname -a
          rustc -Vv
          cargo -V
          nvidia-smi
          command -v nvcc
          nvcc --version
      - name: Configure CUDA Oxide bindgen
        run: bash scripts/configure-cuda-bindgen.sh
      - name: Run fail-closed full CUDA validation
        run: |
          started="$(date +%s)"
          status=0
          cargo xtask release-cuda --mode full || status=$?
          elapsed="$(( $(date +%s) - started ))"
          echo "CUDA full wall time: ${elapsed}s" | tee -a "${GITHUB_STEP_SUMMARY}"
          exit "${status}"
      - name: Compile packaged CUDA adapter and dependencies as an external consumer
        run: cargo xtask package-consumer-smoke --target cuda --cuda-runtime
      - name: Generate exact-reference CUDA adapter evidence
        if: ${{ always() }}
        run: |
          status=0
          cargo xtask t803 fetch || status=$?
          if [ "${status}" -eq 0 ]; then
            cargo xtask t803 run --iut cuda --out-dir target/t803/reports || status=$?
          fi
          echo "T803_STATUS=${status}" >> "${GITHUB_ENV}"
      - name: Upload CUDA T.803 reports only
        if: ${{ always() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: j2k-t803-cuda-linux-x86_64-${{ github.sha }}
          path: |
            target/t803/reports/cuda.json
            target/t803/reports/cuda.md
          if-no-files-found: error
      - name: Ensure pinned coverage tool
        run: scripts/ensure-cargo-llvm-cov.sh
      - name: Collect changed-line CUDA host coverage
        run: cargo xtask coverage cuda
      - name: Compile CUDA benchmark lane
        run: cargo xtask bench-build --lane cuda
      - name: Upload CUDA coverage evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: j2k-cuda-full-coverage-${{ github.sha }}
          path: |
            lcov-cuda.info
            coverage-cuda-summary.json
            coverage-cuda-regions.json
          if-no-files-found: error
      - name: Enforce CUDA T.803 result after evidence upload
        if: ${{ always() }}
        run: exit "${T803_STATUS:-1}"

  metal-full:
    name: Metal full release validation
    needs: [validate-inputs]
    if: ${{ inputs.mode == 'full' && inputs.target == 'all' }}
    runs-on: [self-hosted, macOS, ARM64, metal]
    timeout-minutes: 60
    env:
      J2K_REQUIRE_METAL_RUNTIME: "1"
      RUST_TEST_THREADS: "1"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0
      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
        with:
          toolchain: "1.96"
          components: clippy
      - name: Fingerprint Metal cache environment
        run: |
          {
            sw_vers
            xcrun metal --version
          } | shasum -a 256 | awk '{print "J2K_GPU_CACHE_ENV=metal-" $1}' \
            >> "${GITHUB_ENV}"
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
        with:
          shared-key: gpu-metal-${{ runner.os }}-${{ runner.arch }}-1.96
          key: profiles-gpu-quick-release-v1
          env-vars: "CARGO CC CFLAGS CXX CMAKE RUST J2K_GPU_CACHE_ENV"
          cache-bin: false
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - name: Show Metal runner diagnostics
        run: |
          uname -a
          system_profiler SPDisplaysDataType
          rustc -Vv
          cargo -V
      - name: Run fail-closed full Metal validation
        run: |
          started="$(date +%s)"
          status=0
          cargo xtask release-metal --mode full || status=$?
          elapsed="$(( $(date +%s) - started ))"
          echo "Metal full wall time: ${elapsed}s" | tee -a "${GITHUB_STEP_SUMMARY}"
          exit "${status}"
      - name: Compile packaged Metal adapter and dependencies as an external consumer
        run: cargo xtask package-consumer-smoke --target metal
      - name: Generate exact-reference Metal adapter evidence
        if: ${{ always() }}
        run: |
          status=0
          cargo xtask t803 fetch || status=$?
          if [ "${status}" -eq 0 ]; then
            cargo xtask t803 run --iut metal --out-dir target/t803/reports || status=$?
          fi
          echo "T803_STATUS=${status}" >> "${GITHUB_ENV}"
      - name: Upload Metal T.803 reports only
        if: ${{ always() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: j2k-t803-metal-macos-aarch64-${{ github.sha }}
          path: |
            target/t803/reports/metal.json
            target/t803/reports/metal.md
          if-no-files-found: error
      - name: Ensure pinned coverage tool
        run: scripts/ensure-cargo-llvm-cov.sh
      - name: Collect changed-line Metal host coverage
        run: cargo xtask coverage metal
      - name: Compile Metal benchmark lane
        run: cargo xtask bench-build --lane metal
      - name: Upload Metal coverage evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: j2k-metal-full-coverage-${{ github.sha }}
          path: |
            lcov-metal.info
            coverage-metal-summary.json
            coverage-metal-regions.json
          if-no-files-found: error
      - name: Enforce Metal T.803 result after evidence upload
        if: ${{ always() }}
        run: exit "${T803_STATUS:-1}"