Update docker and Spack CI (celeritas-project#1555)

.github/workflows/build-docker.yml

@@ -24,47 +24,42 @@ jobs:
         special: [null]
         geometry: ["orange", "vecgeom"]
         buildtype: ["debug", "ndebug"]
-        image: ["ubuntu-cuda"] # TODO: upgrade CI images, add ["centos-rocm"]
+        image: ["rocky-cuda", "ubuntu-rocm"]
         exclude:
           - geometry: "vecgeom"
-            image: "centos-rocm" # VecGeom not installed on HIP
+            image: "ubuntu-rocm" # VecGeom not installed on HIP
           - buildtype: "debug"
-            image: "centos-rocm" # Debug builds don't work with HIP
+            image: "ubuntu-rocm" # Debug builds don't work with HIP
         include:
           - geometry: "vecgeom"
             buildtype: "reldeb"
-            image: "ubuntu-cuda"
+            image: "rocky-cuda"
     env:
       CELER_TEST_STRICT: 1
-      CELER_DISABLE_DEVICE: 1 # IMPORTANT
+      CELER_DISABLE_DEVICE: 1 # REQUIRED for GHA runners
       CMAKE_PRESET: >-
         ${{format('{0}-{1}{2}{3}',
                 matrix.buildtype,
                 matrix.geometry,
                 matrix.special && '-' || '',
                 matrix.special)}}
-      ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true # TODO: DELETEME, see #1305
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     container:
       image: >-
         docker.io/celeritas/${{
-             matrix.image == 'ubuntu-cuda' && 'ci-jammy-cuda11:2023-08-02'
-          || matrix.image == 'centos-rocm' && 'ci-centos7-rocm5:2022-12-14.2'
+             matrix.image == 'rocky-cuda' && 'ci-rocky-cuda12:2024-12-29'
+          || matrix.image == 'ubuntu-rocm' && 'ci-ubuntu-rocm6:2025-01-02'
         }}
-      # TODO: I think this will be fixed if we upgrade checkout
-      # See https://github.com/actions/checkout/issues/956
-      options: --user root
     steps:
       - name: Set up environment
         run: |
           . /etc/profile
           echo "/opt/view/bin" >> $GITHUB_PATH
           echo "CMAKE_PREFIX_PATH=${CMAKE_PREFIX_PATH}" >> $GITHUB_ENV
       # NOTE: checkout must occur *after* setting up environment for git tags to work
-      # NOTE: checkout v4 fails: https://github.com/actions/checkout/issues/1487
       # NOTE: depth must be enough to include the previous tag
       - name: Check out Celeritas
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 383
           fetch-tags: true
@@ -77,21 +72,10 @@ jobs:
         working-directory: build
         run: |
           ninja
-      - name: Regenerate ROOT test data
-        working-directory: build
-        # NOTE: we have to do this for now because the ROOT version on the CI image is too old:
-        # see https://github.com/root-project/root/pull/12845
-        # Revert when we update the CI images
-        run: |
-          if [ -e test ]; then
-            ninja -v -k0 update-root-test-data
-          fi
       - name: Test Celeritas
         id: test
-        working-directory: build
         run: |
-          ctest --parallel $(nproc) --timeout 180 --output-on-failure \
-            --test-output-size-passed=65536 --test-output-size-failed=1048576
+          ctest --preset=base
       - name: Install Celeritas
         working-directory: build
         run: |
@@ -108,26 +92,19 @@ jobs:
         # TODO: rocm+ndebug fails to propagate HIP library link
         if: >-
           ${{
-            !(matrix.image == 'centos-rocm' && matrix.buildtype == 'ndebug')
+            !(matrix.image == 'ubuntu-rocm' && matrix.buildtype == 'ndebug')
           }}
         run: |
           . /etc/profile
-          if [ "${{matrix.geometry}}" = "vecgeom" ]; then
-            # TODO: vecgeom is loosey goosey about symbols whereas Ubuntu is strict
-            export LDFLAGS=-Wl,--no-as-needed ${LDFLAGS}
-          fi
           ./scripts/ci/test-examples.sh
       - name: Upload test results
-        # Note: upload-v3 doesn't seem to pick up the paths: delete the "false" line below once we 
-        # upgrade the centos/ubuntu docker images
         if: >-
           ${{
-            false &&
             always()
             && (steps.test.outcome == 'success'
                 || steps.test.outcome == 'failure')
           }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: test-results-${{matrix.image}}-${{env.CMAKE_PRESET}}
           path: "test-output/**/*.xml"

.github/workflows/build-spack.yml

@@ -1,4 +1,9 @@
 # Build directly on the GitHub runner with caching
+# NOTE: sync spack versions with https://github.com/celeritas-project/spack-gha-buildcache
+# - Spack version
+# - Any required spack patches
+# - Github runner versions
+# - Environment versions at scripts/ci/spack.yaml
 name: build-spack
 on:
   workflow_dispatch:
@@ -8,7 +13,7 @@ concurrency:
   group: build-spack-${{github.ref}}-${{github.event.pull_request.number || github.run_number}}-${{github.workflow}}
 
 env:
-  SPACK_REF: 5fe93fee1eec46a0750bd340198bffcb92ff9eec # v0.22.0
+  SPACK_REF: 866785bd74964142e4b47bf71bee68d7426c84ee # develop@2024-12-31
 
 jobs:
   spack:
@@ -24,7 +29,7 @@ jobs:
       matrix:
         geometry: ["vecgeom"]
         special: [null]
-        geant: ["10.5", "10.6", "10.7", "11.0", "11.1", "11.2"]
+        geant: ["10.5", "10.6", "10.7", "11.0", "11.1", "11.2", "11.3"]
         include:
           - geometry: "orange"
             special: "minimal"
@@ -54,10 +59,12 @@ jobs:
                   matrix.special)}}
       SPACK_VIEW: "/opt/spack-view"
       SPACK_BUILDCACHE: "celer-buildcache" # see spack.yaml
-      CC: "clang-15"
-      CXX: "clang++-15"
-      CLANG_TIDY: "clang-tidy-15"
-    runs-on: ubuntu-22.04
+      CC: "clang-18"
+      CXX: "clang++-18"
+      CLANG_TIDY: "clang-tidy-18"
+      CXXSTD: ${{(matrix.geant == '10.5' || matrix.geant == '10.6')
+                 && 17 || 20}}
+    runs-on: ubuntu-24.04
     continue-on-error: false
     steps:
       - name: Check out Celeritas
@@ -66,28 +73,35 @@ jobs:
           fetch-depth: ${{format('{0}', matrix.special != 'clang-tidy' && 383 || 0)}}
           fetch-tags: true # to get version information
       - name: Setup Spack
-        uses: spack/setup-spack@0ce61628ed8a32a5664cf01a0e0b5a4834a3b413 # 2024/03
+        uses: spack/setup-spack@5792f7c7055c3707819380b5e3831d2be6e64b6c # 2024/12
         with:
           ref: ${{env.SPACK_REF}}
           buildcache: true
           color: true
           path: spack-src
+      - name: Patch spack # To be deleted; see associated github pulls
+        working-directory: spack-src
+        run: |
+          curl -LfsS https://github.com/spack/spack/pull/48328.diff | patch -p1
+          curl -LfsS https://github.com/spack/spack/pull/48332.diff | patch -p1
+          curl -LfsS https://github.com/spack/spack/pull/48347.diff | patch -p1
       - name: Initialize spack environment
         run: |
-          # TODO: https://github.com/spack/spack/pull/43136
-          curl -LfsS https://github.com/spack/spack/pull/43136.patch | git -C spack-src apply -
-          cp scripts/ci/spack.yaml .
+          sed -e 's/cxxstd=default/cxxstd=${{env.CXXSTD}}/' \
+            scripts/ci/spack.yaml > spack.yaml
           if [ "${{matrix.geometry}}" == "vecgeom" ]; then
-            spack -e . add vecgeom
+            spack -e . add vecgeom+gdml
           fi
-          if [ "${{matrix.special}}" != "minimal" ] && [  "${{matrix.special}}" != "asanlite" ] ; then
+          if ${{(matrix.special != 'minimal'
+                 && matrix.special != 'asanlite'
+                 && env.CXXSTD == '20')
+                && 'true' || 'false'}}; then
             spack -e . add root
           fi
           if [ "${{matrix.geant}}" != "" ]; then
             spack -e . add geant4@${{matrix.geant}}
           fi
-          spack -e . config add packages:all:require:"'%clang@15 target=x86_64_v3'"
-          spack -e . compiler find
+          spack -vd -e . compiler find --mixed-toolchain
           # Add the spack ref so that updating spack will reconcretize
           echo "# Concretized with ${{env.SPACK_REF}}" >> spack.yaml
       - name: Cache concretization
@@ -105,8 +119,11 @@ jobs:
           spack -e . env depfile -o Makefile
           make -Orecurse -j $(($(nproc) + 1)) SPACK_INSTALL_FLAGS=--no-check-signature
       - name: Save Spack installation to build cache
+        env:
+          GITHUB_ACTOR: ${{github.actor}}
+          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
         run: |
-          spack -e . mirror set --push --oci-username ${{github.actor}} --oci-password "${{secrets.GITHUB_TOKEN}}" ${SPACK_BUILDCACHE}
+          spack -e . mirror set --push --oci-username-variable GITHUB_ACTOR --oci-password-variable GITHUB_TOKEN ${SPACK_BUILDCACHE}
           spack -e . buildcache push -j $(($(nproc) + 1)) --base-image ubuntu:22.04 --unsigned --update-index ${SPACK_BUILDCACHE}
         if: ${{github.event_name == 'push' && !cancelled()}}
       - name: Activate environment

.github/workflows/build-ultralite.yml

@@ -15,13 +15,13 @@ jobs:
       CCACHE_DIR: "${{github.workspace}}/.ccache"
       CCACHE_MAXSIZE: "50Mi"
       CMAKE_PRESET: ultralite
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Install dependencies
         run: |
           sudo apt-get -q -y update
           sudo apt-get -q -y install \
-            ccache cmake ninja-build nlohmann-json3-dev
+            ccache cmake ninja-build nlohmann-json3-dev libpng-dev
       - name: Check out Celeritas
         uses: actions/checkout@v4
       - name: Cache ccache

.github/workflows/clear-cache.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   clear-cache:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Clear ccache
         uses: actions/github-script@v7

.github/workflows/cron_weekly.yml

@@ -26,7 +26,7 @@ jobs:
     - build-fast
     - build-spack
     - build-ultralite
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Check that all jobs succeeded
       uses: re-actors/alls-green@release/v1

.github/workflows/deploy-pages.yml

@@ -15,7 +15,7 @@ jobs:
   build-docs:
     uses: ./.github/workflows/doc.yml
   build-site:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: build-docs
     steps:
       - uses: actions/setup-python@v5
@@ -60,7 +60,7 @@ jobs:
       - name: Upload artifact
         uses: actions/upload-pages-artifact@v3
   deploy:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: build-site
     permissions:
       contents: read

.github/workflows/doc.yml

@@ -21,7 +21,7 @@ jobs:
     env:
       CELER_TARGET: doxygen
       CELER_UPLOAD_DIR: build/doc/doxygen-html
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Install dependencies
         run: |
@@ -59,7 +59,7 @@ jobs:
           retention-days: 1 # developer docs can be large
 
   user:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       CELER_TARGET: doc
       CELER_UPLOAD_DIR: build/doc/html

.github/workflows/merge_group.yml

@@ -22,7 +22,7 @@ jobs:
     needs:
     - build-docker
     - build-spack
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Decide whether the needed jobs succeeded or failed
       uses: re-actors/alls-green@release/v1

.github/workflows/pull_request.yml

@@ -24,7 +24,7 @@ concurrency:
 jobs:
   metadata:
     name: "Save job metadata"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     # Event file is needed for EnricoMi/publish-unit-test-result-action
     - name: Upload event file
@@ -40,7 +40,7 @@ jobs:
     uses: ./.github/workflows/doc.yml
   all-prechecks:
     needs: [build-fast, build-ultralite, doc]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Success
       run: "true"
@@ -59,7 +59,7 @@ jobs:
     needs:
     - build-docker
     - build-spack
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Decide whether the needed jobs succeeded or failed
       uses: re-actors/alls-green@release/v1

.github/workflows/pull_request_completed.yml

@@ -16,7 +16,7 @@ permissions:
 
 jobs:
   report-tests:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       ARTIFACTS_DIR: artifacts
     steps:

.github/workflows/push.yml

@@ -21,7 +21,7 @@ jobs:
     uses: ./.github/workflows/build-spack.yml
   all:
     needs: [build-fast, build-docker, build-spack]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Success
       run: "true"