build: transfer native CI workloads and correct RISC-V ECDSA selection

.changes/preserve-unconditional-risc-v-1146.md

@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Preserve unconditional RISC-V ECDSA generator-table loads when LLVM optimizes masked selection.

.config/criterion.json

@@ -6,5 +6,5 @@
   "confidence_level": 0.95,
   "significance_level": 0.05,
   "noise_threshold": 0.01,
-  "max_run_seconds": 3600
+  "max_run_seconds": 5400
 }

.config/tooling.toml

@@ -43,12 +43,12 @@ packages = ["build-essential", "ca-certificates", "curl", "git", "jq", "pkgconf"
 [ci]
 cargo = ["just", "cargo-nextest"]
 
-[ci-riscv-build]
+[ci-cross-build]
 cargo = ["just", "cargo-nextest"]
-packages = ["build-essential", "ca-certificates", "curl", "git", "jq", "python3", "cmake", "clang", "libclang-dev", "perl", "gcc-riscv64-linux-gnu", "g++-riscv64-linux-gnu", "libc6-dev-riscv64-cross"]
+packages = ["build-essential", "ca-certificates", "curl", "git", "jq", "python3", "cmake", "clang", "libclang-dev", "perl"]
 
-[ci-riscv-run]
-cargo = ["just", "cargo-nextest"]
+[ci-cross-run]
+cargo = []
 packages = ["ca-certificates", "curl", "git", "python3"]
 
 [ci-compat]

.githooks/pre-commit

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(git rev-parse --show-toplevel)"
+# Test the staged source, not a different working-tree version.
+git diff --quiet || { echo 'Stage or set aside unstaged tracked changes before committing.' >&2; exit 1; }
+if [[ -n "$(git ls-files --others --exclude-standard)" ]]; then
+  echo 'Stage intended new files or move unrelated untracked files outside the checkout before committing.' >&2
+  exit 1
+fi
+before=$(git write-tree)
+just check-macos
+git diff --quiet && [[ "$(git write-tree)" == "$before" && -z "$(git ls-files --others --exclude-standard)" ]] || {
+  echo 'Source changed during macOS validation; review and retry the commit.' >&2
+  exit 1
+}

.githooks/pre-merge-commit

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -euo pipefail
+exec "$(git rev-parse --show-toplevel)/.githooks/pre-commit"

.github/runs-on.yml

@@ -1,23 +1,75 @@
-# AWS runners. Other providers are selected directly in workflows.
+# AWS runner shapes. Workflows reference these names; other providers keep their own labels.
 runners:
+  plan:
+    family: [c7a.large, c7i.large, c8a.large, c8i.large]
+    cpu: 2
+    image: ubuntu24-minimal-x64
+    spot: price-capacity-optimized
+    volume: 40gb:gp3
+  miri:
+    family: [c7a.xlarge, c7i.xlarge, c8a.xlarge, c8i.xlarge]
+    cpu: 4
+    image: ubuntu24-minimal-x64
+    spot: price-capacity-optimized
+    volume: 150gb:gp3
+  package:
+    family: [c7a.2xlarge, c7i.2xlarge, c8a.2xlarge, c8i.2xlarge]
+    cpu: 8
+    image: ubuntu24-minimal-x64
+    spot: price-capacity-optimized
+    volume: 100gb:gp3
+  cross-build:
+    family: [c7a.8xlarge, c7i.8xlarge, c8a.8xlarge, c8i.8xlarge]
+    cpu: 32
+    image: ubuntu24-minimal-x64
+    spot: price-capacity-optimized
+    volume: 150gb:gp3
   x86_64-linux:
-    family: [c7a, c7i, c8a, c8i, m7a, m7i, m8a, m8i]
-    cpu: [16, 32]
-    ram: [32, 128]
-    image: ubuntu24-full-x64
+    family: [c7a.4xlarge, c7i.4xlarge, c8a.4xlarge, c8i.4xlarge]
+    cpu: 16
+    image: ubuntu24-minimal-x64
     spot: price-capacity-optimized
     volume: 150gb:gp3
   aarch64-linux:
-    family: [c7g, c8g, m7g, m8g]
-    cpu: [16, 32]
-    ram: [32, 128]
-    image: ubuntu24-full-arm64
+    family: [c7g.4xlarge, c8g.4xlarge, c9g.4xlarge]
+    cpu: 16
+    image: ubuntu24-minimal-arm64
     spot: price-capacity-optimized
     volume: 150gb:gp3
   x86_64-win:
-    family: [c7a, c7i, c8a, c8i, m7a, m7i, m8a, m8i]
-    cpu: [16, 32]
-    ram: [32, 128]
+    family: [c7a.4xlarge, c7i.4xlarge, c8a.4xlarge, c8i.4xlarge]
+    cpu: 16
     image: windows25-full-x64
     spot: price-capacity-optimized
     volume: 200gb:gp3
+  # Fixed, non-Flex, On-Demand hardware for timing and benchmark evidence.
+  measure-x86_64-linux-intel:
+    family: [c8i.2xlarge]
+    cpu: 8
+    image: ubuntu24-minimal-x64
+    spot: false
+    volume: 100gb:gp3
+  measure-x86_64-linux-amd:
+    family: [c8a.2xlarge]
+    cpu: 8
+    image: ubuntu24-minimal-x64
+    spot: false
+    volume: 100gb:gp3
+  measure-x86_64-win-intel:
+    family: [c8i.2xlarge]
+    cpu: 8
+    image: windows25-full-x64
+    spot: false
+    volume: 100gb:gp3
+  measure-x86_64-win-amd:
+    family: [c8a.2xlarge]
+    cpu: 8
+    image: windows25-full-x64
+    spot: false
+    volume: 100gb:gp3
+  measure-aarch64-linux:
+    family: [c9g.2xlarge]
+    cpu: 8
+    image: ubuntu24-minimal-arm64
+    spot: false
+    volume: 100gb:gp3

.github/workflows/bench.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       architectures:
-        description: all, or comma-separated x86_64-linux,aarch64-linux,x86_64-win,s390x-linux,powerpc64le-linux,riscv64-linux
+        description: "x86-64 runs Intel + AMD; all, or comma-separated x86_64-linux,aarch64-linux,x86_64-win,s390x-linux,powerpc64le-linux,riscv64-linux"
         type: string
         required: true
         default: x86_64-linux
@@ -49,20 +49,62 @@ defaults:
 
 jobs:
   plan:
-    runs-on: runs-on=${{ github.run_id }}/family=c7a+c7i+c8a+c8i+m7a+m7i+m8a+m8i/cpu=2/image=ubuntu24-minimal-x64/spot=price-capacity-optimized/env=production
+    runs-on: runs-on=${{ github.run_id }}/runner=plan/env=production
     timeout-minutes: 5
     outputs:
       matrix: ${{ steps.plan.outputs.matrix }}
+      cross: ${{ steps.plan.outputs.cross }}
+      builds: ${{ steps.plan.outputs.builds }}
     steps:
       - uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" # v7.0.1
         with:
           persist-credentials: false
       - id: plan
         run: python3 scripts/bench/ci.py plan
 
-  bench:
+  cross-build:
     needs: plan
-    name: ${{ matrix.platform }}
+    if: needs.plan.outputs.cross == 'true'
+    name: Prepare ${{ matrix.target }} benchmarks
+    runs-on: runs-on=${{ github.run_id }}/runner=cross-build/env=production
+    timeout-minutes: 120
+    strategy:
+      fail-fast: true
+      matrix: ${{ fromJSON(needs.plan.outputs.builds) }}
+    env:
+      TARGET: ${{ matrix.target }}
+    steps:
+      - uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Cross-build selected benchmark configurations
+        run: |
+          scripts/tooling/x86_64-linux.sh --ci-cross-build "$TARGET"
+          source "$HOME/.local/share/rscrypto-tooling/environment.sh"
+          python3 scripts/bench/ci.py prepare "$TARGET" "target/$TARGET-bench.tar.gz"
+          git diff --exit-code HEAD
+      - name: Transfer exact benchmark binaries and runner tools
+        uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
+        with:
+          name: ${{ matrix.target }}-bench-prepared
+          path: |
+            target/${{ matrix.target }}-bench.tar.gz
+            target/${{ matrix.target }}-tools.tar.gz
+          if-no-files-found: error
+          retention-days: 2
+      - name: Retain benchmark preparation evidence
+        if: ${{ !cancelled() }}
+        uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
+        with:
+          name: bench-prepare-${{ matrix.target }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: target/bench/preparation/
+          if-no-files-found: warn
+          retention-days: 30
+
+  bench:
+    needs: [plan, cross-build]
+    if: ${{ !cancelled() && needs.plan.result == 'success' && (needs.cross-build.result == 'success' || needs.cross-build.result == 'skipped') }}
+    name: ${{ matrix.name }}
     strategy:
       fail-fast: true
       matrix: ${{ fromJSON(needs.plan.outputs.matrix) }}
@@ -73,14 +115,30 @@ jobs:
         with:
           persist-credentials: false
       - name: Install tooling and measure (Linux)
-        if: runner.os == 'Linux'
+        if: runner.os == 'Linux' && !matrix.target
         env:
           PLATFORM: ${{ matrix.platform }}
         run: |
           scripts/tooling/"$PLATFORM.sh" --ci-bench
           source "$HOME/.local/share/rscrypto-tooling/environment.sh"
           python3 scripts/bench/ci.py run
           git diff --exit-code HEAD
+      - name: Download prepared benchmark binaries and runner tools
+        if: matrix.target
+        uses: "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" # v8.0.1
+        with:
+          name: ${{ matrix.target }}-bench-prepared
+          path: target/bench-download
+      - name: Discover and measure on native hardware
+        if: matrix.target
+        env:
+          PLATFORM: ${{ matrix.platform }}
+          TARGET: ${{ matrix.target }}
+        run: |
+          scripts/tooling/"$PLATFORM.sh" --ci-cross-run "target/bench-download/$TARGET-tools.tar.gz"
+          source "$HOME/.local/share/rscrypto-tooling/environment.sh"
+          python3 scripts/bench/ci.py measure "$TARGET" "target/bench-download/$TARGET-bench.tar.gz"
+          git diff --exit-code HEAD
       - name: Install tooling and measure (Windows)
         if: runner.os == 'Windows'
         shell: powershell
@@ -94,7 +152,7 @@ jobs:
         if: ${{ always() }}
         uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
         with:
-          name: bench-${{ matrix.platform }}-${{ github.run_id }}-${{ github.run_attempt }}
+          name: bench-${{ matrix.name }}-${{ github.run_id }}-${{ github.run_attempt }}
           path: target/bench/
           if-no-files-found: warn
           retention-days: 30