Upstream sync: 112 commits through upstream a099d00643, and CI on self-hosted runners

.github/scripts/extract_matrix.py

@@ -68,26 +68,40 @@
     "cpython-gate",
 
     "darwin",
+
+    # python-graalos-resources downloads the GraalOS runtime from an Oracle-internal
+    # location (GRAALPY_GRAALOS_ARTIFACT_BASE_URL, an overlay import that is empty in the
+    # public ci.jsonnet) and python-resource-variants consumes that artifact. Both fail
+    # the same way in upstream's own GitHub Actions runs.
+    "graalos",
 )
 
 DOWNLOADS_LINKS = {
     "GRADLE_JAVA_HOME": "https://download.oracle.com/java/{major_version}/latest/jdk-{major_version}_{os}-{arch_short}_bin{ext}",
     "ECLIPSE": "https://www.eclipse.org/downloads/download.php?file=/eclipse/downloads/drops4/R-4.26-202211231800/eclipse-SDK-4.26-linux-gtk-x86_64.tar.gz"
 }
 
-# Github Runners OSS
+# Runner labels by required capabilities. Elide's fork builds and tests on its
+# self-hosted runner pool, not on GitHub-hosted runners.
+LINUX_AMD64_RUNNER = "linux-amd64-cipool"
+LINUX_AARCH64_RUNNER = "linux-arm64-cipool"
+WINDOWS_AMD64_RUNNER = "windows-amd64-cipool"
 OSS = {
-    "ubuntu-latest": ["linux", "amd64"],
-    "ubuntu-24.04-arm": ["linux", "aarch64"],
-    "windows-latest": ["windows", "amd64"]
+    LINUX_AMD64_RUNNER: ["linux", "amd64"],
+    LINUX_AARCH64_RUNNER: ["linux", "aarch64"],
+    WINDOWS_AMD64_RUNNER: ["windows", "amd64"]
 }
 
 # Override unavailable Python versions for some OS/Arch / job name combinations
 PYTHON_VERSIONS = {
-    "ubuntu-24.04-arm": "3.12.8",
-    "ubuntu-latest": "3.12.8",
+    LINUX_AARCH64_RUNNER: "3.12.8",
+    LINUX_AMD64_RUNNER: "3.12.8",
     "style-gate": "3.8.12",
     "style-ecj-gate": "3.8.12",
+    # The JUnit gates build a delvewheel venv, which needs CPython >= 3.12 (or an
+    # Oracle-internal ARTIFACT_DOWNLOAD_SCRIPT); ci.jsonnet's 3.8 fails there upstream as well.
+    "python-junit-gate-windows": "3.12.8",
+    "python-junit-maven-gate-windows": "3.12.8",
 }
 
 EXCLUDED_SYSTEM_PACKAGES = {
@@ -119,7 +133,7 @@ def runs_on(self) -> str:
         for os, caps in OSS.items():
             if all(required in capabilities for required in caps): return os
 
-        return "ubuntu-latest"
+        return LINUX_AMD64_RUNNER
 
     @cached_property
     def name(self) -> str:
@@ -132,7 +146,7 @@ def targets(self) -> list[str]:
     @cached_property
     def env(self) -> dict[str, str]:
         environment = self.job.get("environment", {}) | DEFAULT_ENV
-        if self.runs_on == "windows-latest":
+        if self.runs_on == WINDOWS_AMD64_RUNNER:
             def _to_windows_env_format(s: str) -> str:
                 # Replace ${VAR} and $VAR with %VAR%
                 s = re.sub(r"\$\{([A-Za-z_][A-Za-z0-9_]*)\}", r"%\1%", s)
@@ -180,7 +194,7 @@ def system_packages(self) -> list[str]:
                 k = k[3:]
             if any(excluded in k for excluded in EXCLUDED_SYSTEM_PACKAGES):
                 continue
-            system_packages.append(f"'{k}'" if self.runs_on != "windows-latest" else f"{k}")
+            system_packages.append(f"'{k}'" if self.runs_on != WINDOWS_AMD64_RUNNER else f"{k}")
         return system_packages
 
     @cached_property
@@ -191,13 +205,13 @@ def python_packages(self) -> list[str]:
                 key = k[4:]
                 if key in PYTHON_PACKAGES_VERSIONS: continue
                 python_packages.append(f"{key}{v}")
-        return [f"'{pkg}'" if self.runs_on != "windows-latest" else f"{pkg}" for pkg in python_packages]
+        return [f"'{pkg}'" if self.runs_on != WINDOWS_AMD64_RUNNER else f"{pkg}" for pkg in python_packages]
 
     def get_download_steps(self, key: str, version: str) -> str:
         download_link = self.get_download_link(key, version)
         filename = download_link.split('/')[-1]
 
-        if self.runs_on == "windows-latest":
+        if self.runs_on == WINDOWS_AMD64_RUNNER:
             return (f"""
                 Invoke-WebRequest -Uri {download_link} -OutFile {filename}
                 Expand-Archive -Path {filename} -DestinationPath .

.github/workflows/_downstream-test-common.yml

@@ -29,10 +29,10 @@ jobs:
       fail-fast: false
       matrix:
         os:
-          - id: ubuntu-latest
+          - id: linux-amd64-cipool
             platform: linux
             arch: amd64
-          - id: macos-latest
+          - id: macos-arm64-cipool
             platform: macos
             arch: aarch64
 

.github/workflows/_downstream-test-oracledb.yml

@@ -25,7 +25,7 @@ permissions:
 
 jobs:
   build-numpy-wheels:
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cipool
     env:
       PACKAGES_TO_BUILD: numpy==2.2.6
     steps:
@@ -58,7 +58,7 @@ jobs:
 
   build-pandas-wheels:
     needs: build-numpy-wheels
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cipool
     env:
       PACKAGES_TO_BUILD: pandas==2.2.3
       PIP_FIND_LINKS: ${{ github.workspace }}/dependency-wheels
@@ -99,7 +99,7 @@ jobs:
 
   build-pyarrow-wheels:
     needs: build-numpy-wheels
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cipool
     env:
       PACKAGES_TO_BUILD: pyarrow==20.0.0
       PIP_FIND_LINKS: ${{ github.workspace }}/dependency-wheels
@@ -163,7 +163,7 @@ jobs:
       fail-fast: false
       matrix:
         os:
-          - id: ubuntu-latest
+          - id: linux-amd64-cipool
             platform: linux
             arch: amd64
 

.github/workflows/build-wheels.yml

@@ -28,15 +28,12 @@ permissions:
 
 jobs:
   build_wheels:
+    # Elide's fork builds on its self-hosted runner pool, not on GitHub-hosted runners.
     runs-on: >-
-      ${{ contains(inputs.platform, 'self-hosted-linux-amd64') && fromJson('["self-hosted", "Linux", "X86"]') ||
-          contains(inputs.platform, 'self-hosted-linux-aarch64') && fromJson('["self-hosted", "Linux", "ARM64"]') ||
-          contains(inputs.platform, 'self-hosted-macos') && fromJson('["self-hosted", "macOS"]') ||
-          contains(inputs.platform, 'self-hosted-windows') && fromJson('["self-hosted", "Windows"]') ||
-          contains(inputs.platform, 'linux-amd64') && fromJson('["ubuntu-latest"]') ||
-          contains(inputs.platform, 'linux-aarch64') && fromJson('["ubuntu-24.04-arm"]') ||
-          contains(inputs.platform, 'windows') && fromJson('["windows-latest"]') ||
-          contains(inputs.platform, 'macos') && fromJson('["macos-latest"]') }}
+      ${{ contains(inputs.platform, 'aarch64') && contains(inputs.platform, 'linux') && 'linux-arm64-cipool' ||
+          contains(inputs.platform, 'linux') && 'linux-amd64-cipool' ||
+          contains(inputs.platform, 'windows') && 'windows-amd64-cipool' ||
+          contains(inputs.platform, 'macos') && 'macos-arm64-cipool' }}
     container: >-
       ${{ contains(inputs.platform, 'linux-amd64') && 'quay.io/pypa/manylinux_2_28_x86_64' ||
           contains(inputs.platform, 'linux-aarch64') && 'quay.io/pypa/manylinux_2_28_aarch64' ||

.github/workflows/ci-matrix-gen.yml

@@ -82,6 +82,17 @@ jobs:
       matrix:
         include: ${{ fromJson(needs.generate-tier1.outputs.artifact_matrix) }}
     steps: &buildsteps
+      # The self-hosted runners keep their workspace between jobs, and these steps clone
+      # mx and other repositories next to the checkout, so start from an empty workspace.
+      - name: Clean workspace
+        if: runner.os != 'Windows'
+        shell: bash
+        run: find "${GITHUB_WORKSPACE:?}" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
+      - name: Clean workspace (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: Get-ChildItem -Force -LiteralPath $env:GITHUB_WORKSPACE | Remove-Item -Recurse -Force
+
       - name: Process matrix downloads
         if: ${{ matrix.downloads_steps }}
         run: |
@@ -91,8 +102,13 @@ jobs:
         shell: bash
         if: runner.os != 'Windows'
         run: |
+          # A UTF-8 locale, as on GitHub's runners: the JDK uses it for file names (some CA
+          # certificates in /etc/ssl/certs have non-ASCII names).
+          if [ "$RUNNER_OS" = macOS ]; then echo "LANG=en_US.UTF-8" >> $GITHUB_ENV; echo "LC_ALL=en_US.UTF-8" >> $GITHUB_ENV;
+          else echo "LANG=C.UTF-8" >> $GITHUB_ENV; echo "LC_ALL=C.UTF-8" >> $GITHUB_ENV; fi
           matrix_env='${{ toJson(matrix.env) }}'
-          echo $matrix_env | jq -r 'to_entries[] | "\(.key)=\(.value)"' >> tmp.env
+          # python3 rather than jq, which the self-hosted runners don't all have.
+          echo $matrix_env | python3 -c 'import json, sys; [print(f"{k}={v}") for k, v in json.load(sys.stdin).items()]' >> tmp.env
           while IFS= read -r line; do
             eval "echo \"$line\"" >> $GITHUB_ENV
           done < tmp.env
@@ -126,9 +142,31 @@ jobs:
 
 
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        if: ${{ matrix.python_version }}
+        if: ${{ runner.os == 'Windows' && matrix.python_version }}
         with:
           python-version: ${{ matrix.python_version }}
+      # actions/setup-python only has interpreters for GitHub's own runner images, so on
+      # the self-hosted Linux and macOS runners the version comes from uv (python-build-standalone),
+      # in a virtualenv with pip that is put first on the PATH.
+      - name: Set up Python with uv
+        if: ${{ runner.os != 'Windows' && matrix.python_version }}
+        shell: bash
+        env:
+          UV_VERSION: 0.12.20
+          PYTHON_VERSION: ${{ matrix.python_version }}
+        run: |
+          # Everything in the job's temp directory, and only uv-managed interpreters: the runners
+          # can have partial interpreters (and a shared uv cache) left by earlier jobs.
+          export UV_INSTALL_DIR="$RUNNER_TEMP/uv/bin" UV_PYTHON_INSTALL_DIR="$RUNNER_TEMP/uv/python" UV_NO_MODIFY_PATH=1
+          export UV_CACHE_DIR="$RUNNER_TEMP/uv/cache" UV_LINK_MODE=copy UV_PYTHON_PREFERENCE=only-managed
+          # The temp directory survives between jobs on these runners: a partial interpreter from an
+          # earlier job would be reused ("Python installation is missing a _sysconfigdata_ file").
+          rm -rf "$RUNNER_TEMP/uv"
+          curl -LsSf "https://astral.sh/uv/${UV_VERSION}/install.sh" | sh
+          rm -rf "$RUNNER_TEMP/python-venv"
+          "$UV_INSTALL_DIR/uv" venv --seed --python "$PYTHON_VERSION" "$RUNNER_TEMP/python-venv"
+          echo "$RUNNER_TEMP/python-venv/bin" >> "$GITHUB_PATH"
+          "$RUNNER_TEMP/python-venv/bin/python" --version
       - name: Install python packages on Unix
         if: ${{ runner.os != 'Windows' && matrix.python_packages }}
         run: |
@@ -150,6 +188,19 @@ jobs:
           for pkg in ${{ matrix.system_packages }}; do
               sudo apt-get -qq install "$pkg" || true
           done
+          # apt failures are tolerated above, and on a self-hosted runner whose dpkg state is
+          # broken the maven package can be unpacked but unconfigured (no /usr/bin/mvn), so
+          # fall back to a direct Maven download when the job needs it and mvn is missing.
+          case " ${{ matrix.system_packages }} " in *"'maven'"*)
+            if ! command -v mvn >/dev/null; then
+              maven_version=3.9.9
+              maven_dir="$RUNNER_TEMP/maven"
+              rm -rf "$maven_dir" && mkdir -p "$maven_dir"
+              curl -fsSL "https://archive.apache.org/dist/maven/maven-3/$maven_version/binaries/apache-maven-$maven_version-bin.tar.gz" | tar -xz -C "$maven_dir"
+              echo "$maven_dir/apache-maven-$maven_version/bin" >> "$GITHUB_PATH"
+              echo "Installed Maven $maven_version to $maven_dir (mvn was not on the PATH after apt-get)"
+            fi
+          ;; esac
       - name: Install system packages on macOS
         if: ${{ runner.os == 'macOS' && matrix.system_packages }}
         run: |
@@ -162,12 +213,34 @@ jobs:
         if: ${{ runner.os == 'Windows' && matrix.system_packages }}
         run: |
           $packages = '${{ matrix.system_packages }}' -split ' '
+          # The self-hosted Windows runners have no Chocolatey (and no preinstalled Maven, unlike
+          # GitHub's images), so Maven is downloaded directly when choco is missing; cmake is
+          # already on their PATH.
+          $haveChoco = [bool](Get-Command choco -ErrorAction SilentlyContinue)
           foreach ($pkg in $packages) {
-            try {
-                choco install $pkg -y
-            } catch {
-                Write-Host "Failed to install $pkg, skipping."
-                Write-Host "Error: $($_.Exception.Message)" -ForegroundColor Yellow
+            if ($haveChoco) {
+              try {
+                  choco install $pkg -y
+              } catch {
+                  Write-Host "Failed to install $pkg, skipping."
+                  Write-Host "Error: $($_.Exception.Message)" -ForegroundColor Yellow
+              }
+            } elseif ($pkg -eq 'maven' -and -not (Get-Command mvn -ErrorAction SilentlyContinue)) {
+              $mavenVersion = '3.9.9'
+              $mavenDir = Join-Path $env:RUNNER_TEMP 'maven'
+              Remove-Item -Recurse -Force -ErrorAction SilentlyContinue $mavenDir
+              New-Item -ItemType Directory -Force $mavenDir | Out-Null
+              $zip = Join-Path $mavenDir "apache-maven-$mavenVersion-bin.zip"
+              Invoke-WebRequest -Uri "https://archive.apache.org/dist/maven/maven-3/$mavenVersion/binaries/apache-maven-$mavenVersion-bin.zip" -OutFile $zip
+              Expand-Archive -Path $zip -DestinationPath $mavenDir
+              $mavenBin = Join-Path $mavenDir "apache-maven-$mavenVersion\bin"
+              $mavenBin | Out-File -FilePath $env:GITHUB_PATH -Append
+              # Not verified with `mvn --version` here: the JDK is only fetched in a later step.
+              Write-Host "Installed Maven $mavenVersion to $mavenBin"
+            } elseif (Get-Command $pkg -ErrorAction SilentlyContinue) {
+              Write-Host "$pkg is already available: $((Get-Command $pkg).Source)"
+            } else {
+              Write-Host "No choco on this runner and no fallback for $pkg, skipping." -ForegroundColor Yellow
             }
           }
 

.github/workflows/ci-unittests.yml

@@ -11,15 +11,20 @@ permissions:
 jobs:
   abi-check:
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cipool
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install libabigail
         shell: bash
         run: |
-          sudo apt-get update
-          sudo apt-get install -y abigail-tools
+          # The self-hosted runners keep abigail-tools installed; only touch apt when it is
+          # missing, so a broken dpkg state left by another job's package install does not fail
+          # the check.
+          if ! command -v abidiff >/dev/null; then
+            sudo apt-get update
+            sudo apt-get install -y abigail-tools
+          fi
 
       - name: Get mx and labsjdk
         shell: bash

.github/workflows/platforms-tests.yml

@@ -9,7 +9,7 @@ permissions:
 
 jobs:
   centos-ppc64le-test:
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cipool
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2