From 705d56165785a1ff50f7f3faee817f2652d2054f Mon Sep 17 00:00:00 2001 From: Andreas Hatziiliou Date: Sun, 16 Aug 2026 21:36:35 -0400 Subject: [PATCH 1/2] CI: Only run SLOTHY when its inputs change SLOTHY starts a c8g.8xlarge for every PR push and merge_group run, regardless of what changed. Gate it on a changed-files job, as in hol_light.yml. Signed-off-by: Andreas Hatziiliou --- .github/workflows/slothy.yml | 40 +++++++++++++++++++++++++++++++++++- 1 file changed, 39 insertions(+), 1 deletion(-) diff --git a/.github/workflows/slothy.yml b/.github/workflows/slothy.yml index 191061ff59..b17ca846cf 100644 --- a/.github/workflows/slothy.yml +++ b/.github/workflows/slothy.yml @@ -8,11 +8,49 @@ permissions: on: workflow_call: workflow_dispatch: + push: + branches: ["main"] jobs: + # Coarse gate so the EC2 instance only starts when the SLOTHY + # inputs or toolchain are changed. + check_modified_files: + name: Determine changed files + runs-on: ubuntu-latest + if: github.repository_owner == 'pq-code-package' && !github.event.pull_request.head.repo.fork + outputs: + # Pushes to main always run SLOTHY. + run_needed: >- + ${{ github.event_name == 'push' || + steps.changed-files.outputs.any_changed == 'true' || + github.event_name == 'workflow_dispatch' }} + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + if: github.event_name != 'workflow_dispatch' + with: + # Enough history for changed-files (rebase-merge pushes can be multi-commit) + fetch-depth: 100 + - name: Get changed files + id: changed-files + if: github.event_name != 'workflow_dispatch' + uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6 + with: + files: | + .github/workflows/slothy.yml + .github/workflows/ci_ec2_reusable.yml + scripts/autogen + dev/aarch64_clean/** + dev/aarch64_opt/** + dev/fips202/aarch64/** + mldsa/src/native/aarch64/** + mldsa/src/fips202/native/aarch64/** + flake.nix + flake.lock + nix/** slothy: name: SLOTHY - if: ${{ github.repository_owner == 'pq-code-package' && !github.event.pull_request.head.repo.fork }} + needs: [ check_modified_files ] + if: needs.check_modified_files.outputs.run_needed == 'true' permissions: contents: 'read' id-token: 'write' From 25bd63255155ca37a2073a6b2595c1591365deb5 Mon Sep 17 00:00:00 2001 From: Andreas Hatziiliou Date: Sun, 16 Aug 2026 21:44:15 -0400 Subject: [PATCH 2/2] CI: Allow requesting SLOTHY with the slothy-tests label This commit introduces a slothy-tests label for PR's which can manually trigger SLOTHY upon addition. - Resolves https://github.com/pq-code-package/mldsa-native/issues/1175 Signed-off-by: Andreas Hatziiliou --- .github/workflows/slothy.yml | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/.github/workflows/slothy.yml b/.github/workflows/slothy.yml index b17ca846cf..7eb91a66ff 100644 --- a/.github/workflows/slothy.yml +++ b/.github/workflows/slothy.yml @@ -10,6 +10,12 @@ on: workflow_dispatch: push: branches: ["main"] + # Standalone trigger so SLOTHY can be requested on an existing PR by adding + # the `slothy-tests` label. Adding `labeled` to all.yml instead would re-run + # all of CI on every label change. + pull_request: + branches: ["main"] + types: [ "labeled" ] jobs: # Coarse gate so the EC2 instance only starts when the SLOTHY @@ -19,20 +25,28 @@ jobs: runs-on: ubuntu-latest if: github.repository_owner == 'pq-code-package' && !github.event.pull_request.head.repo.fork outputs: + # The `slothy-tests` label is the manual override for changes the file + # filter below cannot see, e.g. a toolchain regression to reproduce. # Pushes to main always run SLOTHY. + # A `labeled` event is only ever a request for SLOTHY itself, so adding + # an unrelated label must not start an EC2 instance; other PR events + # fall back to the file filter. run_needed: >- ${{ github.event_name == 'push' || - steps.changed-files.outputs.any_changed == 'true' || - github.event_name == 'workflow_dispatch' }} + (github.event.action == 'labeled' && github.event.label.name == 'slothy-tests') || + (github.event.action != 'labeled' && + (steps.changed-files.outputs.any_changed == 'true' || + github.event_name == 'workflow_dispatch' || + contains(github.event.pull_request.labels.*.name, 'slothy-tests'))) }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - if: github.event_name != 'workflow_dispatch' + if: github.event_name != 'workflow_dispatch' && github.event.action != 'labeled' with: # Enough history for changed-files (rebase-merge pushes can be multi-commit) fetch-depth: 100 - name: Get changed files id: changed-files - if: github.event_name != 'workflow_dispatch' + if: github.event_name != 'workflow_dispatch' && github.event.action != 'labeled' uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6 with: files: |