jharlow-intel · Oct 30, 2026
@@ -5,13 +5,13 @@ CI/CD workflows, automation, security scanning, and package distribution.
 ## Workflows
 The conda workflows build and test the Python versions in the `python:` list of their recipe's `conda_build_config.yaml`; the other build/test workflows list theirs in the workflow file.
 
-- **conda-package.yml** — main build/test pipeline (Linux/Windows)
 - **conda-package-cf.yml** — build/test using only conda-forge channel (Linux/Windows/macOS), set up like `conda-forge/mkl-service-feedstock`: Windows uses `windows-2022` (Visual Studio 2022)
 - **build-with-clang.yml** — Linux Clang compiler compatibility validation
 - **build-with-standard-clang.yml** — standard Clang compiler compatibility validation
 - **build_pip.yml** — validates editable build
 - **pre-commit.yml** — code quality checks (flake8, etc.)
 - **openssf-scorecard.yml** — security posture scanning
+- **intel-ci.yml** — Intel Python CI: builds and tests the conda packages of `conda-recipe-cf` and the wheels, for the platforms and Python versions the recipe and `pyproject.toml` declare (`ci/matrix.py`); see `ci/README.md`
 - **coverity.yml** — weekly Coverity Scan static analysis of the C/Cython extensions (scan.coverity.com)
 
 ## Actions
@@ -21,11 +21,12 @@ The conda workflows build and test the Python versions in the `python:` list of
 - Platforms are set in the caller workflows. The conda workflows read their Python versions from the `python:` list in the recipe's `conda_build_config.yaml`: the `variants` job of `conda-build-test.yml` turns it into the build/test matrix with the `.github/actions/conda-python-matrix` composite action. The other workflows keep their Python matrix in the workflow file
 - Every entry of a recipe's `python:` list is a full spec on its own line, without selectors (`3.12.* *_cpython`, `3.13.* *_cp313`, `3.14.* *_cp314`, `3.14.* *_cp314t`); the `variants` job rejects bare versions, selectors, an ABI that doesn't match the version (`3.13.* *_cp314t`) and a second entry for the same build, whose artifact names would collide
 - The `variants` job keeps the check names of the former static matrix: `Build (3.12)` for a version with one build, `Build (3.14, 3.14.* *_cp314t, 3.14t)` for a version with GIL and free-threaded builds. The master ruleset requires the 3.14 `Test` checks by these exact names
+- `intel-ci.yml` reads its conda matrix from the same `python:` list of `conda-recipe-cf/conda_build_config.yaml`, and its wheel matrix from the Python classifiers in `pyproject.toml`, with `ci/matrix.py`
 - Required checks: conda build + test on supported Python versions/platforms in CI
 - In workflow-file matrices (`build_pip.yml`), Python 3.14 is expressed as two `include` rows carrying `python_spec` (`3.14.* *_cp314` and `3.14.* *_cp314t`); a bare `--python 3.14` has been observed to select the free-threaded ABI and must not be relied on
 - Python 3.15 follows the same pattern as 3.14: two `include` rows with `python_spec` `3.15.* *_cp315` and `3.15.* *_cp315t`
 - Artifact naming: `$PACKAGE_NAME $OS Python $VERSION`, where `$VERSION` is `python_tag`: the Python version, with a `t` suffix for free-threaded builds (`3.12`, `3.14`, `3.14t`)
-- Channels: `conda-forge`, Intel channel
+- Channels: `conda-forge`
 - Build jobs run `conda build --no-test`; test jobs run `conda build --test` on the built package on a fresh runner, so CI runs the test section of the recipe, as the feedstock does
 - `conda-package-cf.yml` and `conda-recipe-cf/` follow `conda-forge/mkl-service-feedstock`. The feedstock's pins are kept only in `conda-recipe-cf/conda_build_config.yaml` (compiler versions, `mkl_devel`, and Python versions in its `python:` list): when the feedstock is re-rendered with new pins, update them there, and don't restate the numbers in the `AGENTS.md` files
 

@@ -35,7 +35,7 @@ Higher-precedence file overrides; lower must not restate overridden guidance.
 
 ## Source-of-truth files
 - Build/config: `pyproject.toml`, `meson.build`
-- Recipe/deps: `conda-recipe/meta.yaml`, `conda-recipe/conda_build_config.yaml`
+- Recipe/deps: `conda-recipe-cf/meta.yaml`, `conda-recipe-cf/conda_build_config.yaml`
 - CI: `.github/workflows/*.{yml,yaml}`
 - API contracts: `mkl/__init__.py`, `mkl/_py_mkl_service.pyx`, `mkl/_mkl_memory.pyx`
 - Tests: `mkl/tests/test_mkl_service.py`, `mkl/tests/test_mkl_memory.py`

@@ -19,11 +19,6 @@ on:
         description: Path to the conda recipe directory
         required: true
         type: string
-      build-wheels:
-        description: Whether to build and upload wheel packages
-        required: false
-        default: false
-        type: boolean
 
 permissions:
   contents: read
@@ -90,9 +85,6 @@ jobs:
           CONDA_SUBDIR: ${{ inputs.conda-subdir }}
         run: |
           echo "CONDA_BLD=$CONDA/conda-bld/${CONDA_SUBDIR}" >> "$GITHUB_ENV"
-          if [ "${{ inputs.build-wheels }}" = "true" ]; then
-            echo "WHEELS_OUTPUT_FOLDER=${{ github.workspace }}" >> "$GITHUB_ENV"
-          fi
 
       - name: Build conda package
         env:
@@ -110,13 +102,6 @@ jobs:
           name: ${{ env.package-name }} ${{ runner.os }} Python ${{ matrix.python_tag }}
           path: ${{ env.CONDA_BLD }}/${{ env.package-name }}-*.conda
 
-      - name: Upload wheels artifact
-        if: ${{ inputs.build-wheels }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: ${{ env.package-name }} ${{ runner.os }} Wheels Python ${{ matrix.python_tag }}
-          path: ${{ env.WHEELS_OUTPUT_FOLDER }}/mkl_service-*.whl
-
   test:
     name: Test (${{ matrix.label }})
     needs: [variants, build]

@@ -0,0 +1,186 @@
+# Intel Python CI (gh-ci): builds and tests the conda packages and wheels for Intel's Jenkins, see ci/README.md
+name: Intel Python CI
+
+on:
+  push:
+    branches: [master]
+    tags: ['*']
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: intel-ci-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  matrix:
+    name: Platforms and Python versions
+    runs-on: ${{ vars.GH_CI_RUNNER || 'ubuntu-latest' }}
+    timeout-minutes: 10
+    outputs:
+      matrix: ${{ steps.declared.outputs.matrix }}
+      wheel: ${{ steps.declared.outputs.wheel }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+
+      - name: Read the declared platforms and Python versions
+        id: declared
+        run: |
+          python ci/matrix.py --event "$GITHUB_EVENT_NAME" --github-output matrix
+          python ci/matrix.py --system wheel --event "$GITHUB_EVENT_NAME" --github-output wheel
+
+  build:
+    name: ${{ matrix.name }} Python ${{ matrix.python }}
+    needs: matrix
+    runs-on: ${{ matrix.platform == 'windows' && (vars.GH_CI_WINDOWS_RUNNER || 'windows-2022') || (vars.GH_CI_RUNNER || 'ubuntu-latest') }}
+    timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.matrix.outputs.matrix) }}
+    defaults:
+      run:
+        shell: bash -el {0}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          # The recipe takes its version from git describe.
+          fetch-depth: 0
+
+      # Miniforge 26.9.4-0 fails setup-miniconda's conda init on Windows runners; 26.7.2-0 works.
+      - uses: conda-incubator/setup-miniconda@be893c923ea9cf1cf7cd510fbdde27c7e18cbdcb # v4.1.0
+        with:
+          miniforge-version: 26.7.2-0
+          activate-environment: ""
+          conda-remove-defaults: "true"
+
+      - name: Install conda-build
+        run: conda install -y -q -n base --override-channels -c conda-forge conda-build
+
+      - name: Build and run the recipe tests
+        env:
+          PYTHON_VERSION: ${{ matrix.python }}
+        run: python ci/build.py --python "$PYTHON_VERSION" --output "$RUNNER_TEMP/output"
+
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: mkl-service ${{ matrix.name }} Python ${{ matrix.python }}
+          path: ${{ runner.temp }}/output/*.conda
+          if-no-files-found: error
+          # Jenkins downloads them within minutes of the run; tags keep them 30 days.
+          retention-days: ${{ startsWith(github.ref, 'refs/tags/') && 30 || 3 }}
+
+  test:
+    name: Test ${{ matrix.name }} Python ${{ matrix.python }}
+    needs: [matrix, build]
+    runs-on: ${{ matrix.platform == 'windows' && (vars.GH_CI_WINDOWS_RUNNER || 'windows-2022') || (vars.GH_CI_RUNNER || 'ubuntu-latest') }}
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.matrix.outputs.matrix) }}
+    defaults:
+      run:
+        shell: bash -el {0}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: mkl-service ${{ matrix.name }} Python ${{ matrix.python }}
+          path: ${{ runner.temp }}/artifacts
+
+      - uses: conda-incubator/setup-miniconda@be893c923ea9cf1cf7cd510fbdde27c7e18cbdcb # v4.1.0
+        with:
+          miniforge-version: 26.7.2-0
+          activate-environment: ""
+          conda-remove-defaults: "true"
+
+      - name: Install the package and run ci/test.py
+        env:
+          PYTHON_VERSION: ${{ matrix.python }}
+          EVENT: ${{ startsWith(github.ref, 'refs/tags/') && 'tag' || github.event_name == 'pull_request' && 'pr' || 'push' }}
+          COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: >-
+          python ci/hooks.py --python "$PYTHON_VERSION" --artifacts "$RUNNER_TEMP/artifacts"
+          --work "$RUNNER_TEMP/hooks" --event "$EVENT" --commit "$COMMIT"
+
+  build-wheel:
+    name: ${{ matrix.name }} Wheels Python ${{ matrix.python }}
+    needs: matrix
+    runs-on: ${{ matrix.platform == 'windows' && (vars.GH_CI_WINDOWS_RUNNER || 'windows-2022') || (vars.GH_CI_RUNNER || 'ubuntu-latest') }}
+    timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.matrix.outputs.wheel) }}
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+
+      - name: Install cibuildwheel
+        run: python -m pip install --no-input cibuildwheel==4.3.5
+
+      - name: Build the wheel
+        env:
+          PYTHON_VERSION: ${{ matrix.python }}
+        run: python ci/build.py --system wheel --python "$PYTHON_VERSION" --output "$RUNNER_TEMP/output"
+
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: mkl-service ${{ matrix.name }} Wheels Python ${{ matrix.python }}
+          path: ${{ runner.temp }}/output/*.whl
+          if-no-files-found: error
+          retention-days: ${{ startsWith(github.ref, 'refs/tags/') && 30 || 3 }}
+
+  test-wheel:
+    name: Test ${{ matrix.name }} Wheels Python ${{ matrix.python }}
+    needs: [matrix, build-wheel]
+    runs-on: ${{ matrix.platform == 'windows' && (vars.GH_CI_WINDOWS_RUNNER || 'windows-2022') || (vars.GH_CI_RUNNER || 'ubuntu-latest') }}
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.matrix.outputs.wheel) }}
+    defaults:
+      run:
+        shell: bash -el {0}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: mkl-service ${{ matrix.name }} Wheels Python ${{ matrix.python }}
+          path: ${{ runner.temp }}/artifacts
+
+      - uses: conda-incubator/setup-miniconda@be893c923ea9cf1cf7cd510fbdde27c7e18cbdcb # v4.1.0
+        with:
+          miniforge-version: 26.7.2-0
+          activate-environment: ""
+          conda-remove-defaults: "true"
+
+      - name: Install the wheel and run ci/test.py
+        env:
+          PYTHON_VERSION: ${{ matrix.python }}
+          EVENT: ${{ startsWith(github.ref, 'refs/tags/') && 'tag' || github.event_name == 'pull_request' && 'pr' || 'push' }}
+          COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: >-
+          python ci/hooks.py --kind wheel --python "$PYTHON_VERSION" --artifacts "$RUNNER_TEMP/artifacts"
+          --work "$RUNNER_TEMP/hooks" --event "$EVENT" --commit "$COMMIT"
@@ -21,6 +21,7 @@ Originally part of Intel® Distribution for Python*, now a standalone package av
 - **C init module:** `mkl/_mklinitmodule.c` — Linux-side MKL runtime preloading / initialization
 - **Helper:** `mkl/_init_helper.py` — Windows venv DLL loading helper
 - **Build system:** meson-python + Cython
+- **Intel Python CI:** `ci/`, `.github/workflows/intel-ci.yml`; see `ci/README.md`
 
 ## Build dependencies
 **Required:**
@@ -48,11 +49,10 @@ python -m pip install --no-deps --no-build-isolation .
 
 ## CI/CD
 - **Platforms in CI workflows:** Linux, Windows, macOS (conda-forge workflow only)
-- **Python versions:** the conda workflows build and test the entries of the `python:` list in the recipe's `conda_build_config.yaml` (`conda-recipe/` or `conda-recipe-cf/`), one build and one test job per entry; the other workflows list their Python versions in the workflow file
+- **Python versions:** the conda workflows build and test the entries of the `python:` list in `conda-recipe-cf/conda_build_config.yaml`, one build and one test job per entry; the other workflows list their Python versions in the workflow file
 - **Python 3.14 ABI selection:** conda jobs must request an explicit ABI, `3.14.* *_cp314` (GIL) or `3.14.* *_cp314t` (free-threaded). Once the recipes stopped constraining `python-gil`, a bare `--python 3.14` was observed to resolve to the free-threaded build, so it must not be relied on.
 - **Python 3.15 ABI selection:** same as 3.14; conda jobs request `3.15.* *_cp315` (GIL) or `3.15.* *_cp315t` (free-threaded) explicitly.
 - **Workflows:** `.github/workflows/`
-  - `conda-package.yml` — main conda build/test pipeline
   - `conda-package-cf.yml` — conda build/test using only conda-forge channel, set up like `conda-forge/mkl-service-feedstock`
   - `build-with-clang.yml` — Linux Clang compatibility
   - `build-with-standard-clang.yml` — standard Clang compiler compatibility validation
@@ -98,7 +98,7 @@ Below directories have local `AGENTS.md` for deeper context:
 - `.github/AGENTS.md` — CI/CD workflows and automation
 - `mkl/AGENTS.md` — Python/Cython implementation
 - `mkl/tests/AGENTS.md` — unit tests
-- `conda-recipe/AGENTS.md` — conda packaging
+- `conda-recipe-cf/AGENTS.md` — conda packaging
 - `examples/AGENTS.md` — usage examples
 
 ---

@@ -1,5 +1,5 @@
 # `mkl-service` - Python package for run-time control of Intel® oneAPI Math Kernel Library (oneMKL).
-[![Conda package](https://github.com/IntelPython/mkl-service/actions/workflows/conda-package.yml/badge.svg)](https://github.com/IntelPython/mkl-service/actions/workflows/conda-package.yml)
+[![Conda package](https://github.com/IntelPython/mkl-service/actions/workflows/conda-package-cf.yml/badge.svg)](https://github.com/IntelPython/mkl-service/actions/workflows/conda-package-cf.yml)
 [![Build mkl-service with clang](https://github.com/IntelPython/mkl-service/actions/workflows/build-with-clang.yml/badge.svg)](https://github.com/IntelPython/mkl-service/actions/workflows/build-with-clang.yml)
 [![Coverity Scan Build Status](https://scan.coverity.com/projects/intelpython-mkl-service/badge.svg)](https://scan.coverity.com/projects/intelpython-mkl-service)
 [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/IntelPython/mkl-service/badge)](https://securityscorecards.dev/viewer/?uri=github.com/IntelPython/mkl-service)