Import Aurora Mesa with M3 Air support and CI

.github/actionlint.yaml

@@ -0,0 +1,3 @@
+# GitHub-hosted labels documented in runner-images; actionlint 1.7.12 predates them.
+self-hosted-runner:
+  labels: [ubuntu-26.04, ubuntu-26.04-arm]

.github/copilot-instructions.md

@@ -0,0 +1 @@
+AGENTS.md

.github/mesa-ci/README.md

@@ -0,0 +1,72 @@
+# Omacom Mesa CI
+
+Proposed integration CI, vetted first in `chriskearney/omacom-mesa`.
+No CODEOWNERS, Omacom repository settings, package source pins, or driver code are changed.
+
+## PR checks
+
+`ci / result` is the single required check. It always runs and fails on failures,
+cancellations, absent planner output or unexpected skips. The workflow has no
+path/branch filters on PRs, supports `merge_group`, and tests GitHub's checked-out
+merge commit rather than replacing it with the PR head. New PR commits cancel
+older PR runs. New events do not cancel running merge-group or post-merge builds; GitHub keeps only the newest pending run in each concurrency group.
+
+Every PR runs production CPU fixtures, pinned kernel UAPI-layout checks, workflow lint and negative CI-control tests. The linter is a SHA-256-verified official release binary, avoiding a cold Go build on every PR. Planner and result jobs check out only their small controller scripts.
+Only a small documentation allowlist can skip native builds on PRs. Unknown paths,
+CI files, dependency metadata and every source change build both architectures.
+Merge-queue, manual and integration-branch push runs always build both.
+
+The parallel x86_64 and native aarch64 jobs use hosted Ubuntu 26.04, a matching
+LLVM/Clang/translator 22 toolchain and hash-pinned Meson 1.10.2. Four build workers
+match the hosted CPUs while bounding peak memory. Compiler tools come from the same source; the final
+Asahi/Zink/Honeykrisp driver build disables LLVM and SPIRV-Tools linkage. It runs
+all configured Meson tests (including explicitly built dependencies of Python-wrapped executables that Meson omits from its default build), then the existing no-submit drm-shim admission,
+pipeline and memory-map probes with Vulkan validation. Complete shader-compilation probes also cover float-to-int64 and perspective interpolateAtOffset on G13G, G15S, G15C, G17P and G15G. Installed ELF dependencies
+are checked before a manifest is created. CPU/shim success is not GPU or CTS proof.
+
+Ccache speeds up subsequent PR revisions; successfully compiled objects are retained even when a later test fails. Keys include architecture and build
+configuration, and GitHub isolates PR cache writes to each PR ref. Merge-queue, manual and post-merge
+builds disable ccache and do not restore PR caches. No build directory, prebuilt
+shader tool or driver binary is shared between runs. Timeouts, bounded cache size
+and artifact retention limit cost. Exact cold/warm timings are measured in the
+personal-fork trial, not promised in advance.
+
+## Delivery and release
+
+A successful push to `integration/aurora` retains a staged ARM driver candidate
+and manifest after both architecture jobs and the required gate pass, not an Arch package or automatic release. A separate trusted job verifies the archive digest and issues a GitHub provenance attestation. The tar archive preserves file modes and symlinks. The manifest identifies
+the exact commit, runner architecture, run/attempt, per-file SHA-256, tested suites
+and installed toolchain packages. Failure artifacts retain Meson configure logs,
+test logs and JUnit evidence. Artifacts have 14-day retention.
+
+These are integration/debug builds with assertions. Shipping remains in
+`omarchy-pkgs`: pin an exact Omacom source commit, build the actual split packages
+with its production flags, obtain relevant hardware/CTS qualification and the
+normal maintainer release approval. Do not publish a PR artifact or assume a
+hosted ARM CPU is an Apple GPU. A new compiler/kernel contract needs new hardware
+results. Existing M3 Air and full CTS limitations remain.
+
+PR code runs only on disposable GitHub-hosted runners with a read-only token,
+no secrets, no retained checkout credentials and full-SHA action/tool pins. There is no
+`pull_request_target`, privileged `workflow_run`, automatic lab access or package-write permission. Only the post-merge attestation job receives OIDC/attestations permission; it does not check out or execute repository code. Action pin updates should be reviewed like source.
+
+## Maintainer rollout after the trial
+
+1. Establish Omacom's intended `integration/aurora` base and land this workflow there.
+2. Require the exact `ci / result` check from the GitHub Actions app (ID 15368).
+   Do not require optional matrix job names or the old lightweight check.
+3. Require PR review and approval of the latest push; disallow branch deletion and
+   force-pushes. Merge queues can use this workflow's `merge_group` coverage.
+4. Confirm a failing PR is blocked, a docs-only PR succeeds without build-pending
+   checks, and a merge-group run produces the same required context before release.
+
+CODEOWNERS and owner-review settings are deliberately outside this change, per
+Chris's hold. Workflow files and CI-control code are PR-editable, so the required
+status check alone is not tamper-proof: human review of workflow/gate changes or
+an organization-controlled required workflow is still necessary. Do not attach lab runners to untrusted PR workflows; any later hardware job needs a restricted runner group and an exact trusted source revision. Required status
+checks cannot enforce a numeric hardware/CTS result that this workflow never ran.
+
+Public design references:
+- https://docs.github.com/en/actions/reference/security/secure-use
+- https://docs.github.com/en/pull-requests/how-tos/merge-and-close-pull-requests/troubleshooting-required-status-checks
+- https://github.com/actions/runner-images

.github/mesa-ci/build-tests.py

@@ -0,0 +1,32 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: MIT
+"""Build every registered test dependency, including build_by_default:false wrappers."""
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+
+
+def outputs(build, tests, targets):
+    needed = {dep for test in tests for dep in test.get('depends', [])}
+    selected = {target['id']: target for target in targets if target['id'] in needed}
+    if missing := needed - selected.keys():
+        raise ValueError('Missing introspection targets: ' + str(missing))
+    return sorted({str(Path(filename).relative_to(build))
+                   for target in selected.values() for filename in target['filename']})
+
+
+if __name__ == '__main__':
+    build = Path(sys.argv[1]).resolve()
+    info = build / 'meson-info'
+    tests = json.loads((info / 'intro-tests.json').read_text())
+    targets = json.loads((info / 'intro-targets.json').read_text())
+    files = outputs(build, tests, targets)
+    if not tests or not files:
+        raise SystemExit('No configured tests or test executables')
+    print(f'Building {len(files)} outputs for {len(tests)} configured tests', flush=True)
+    if '--dry-run' in sys.argv[2:]:
+        print('\n'.join(files))
+    else:
+        subprocess.run(['ninja', '-C', str(build), '-j', os.environ.get('CI_JOBS', '4'), *files], check=True)

.github/mesa-ci/build.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MIT
+set -euo pipefail
+export PATH="$PWD/.ci-venv/bin:/usr/lib/llvm-22/bin:$PATH"
+export CC='ccache gcc' CXX='ccache g++'
+export CCACHE_BASEDIR="$PWD" CCACHE_COMPILERCHECK=content
+export CCACHE_MAXSIZE=400M
+if [[ ${GITHUB_EVENT_NAME:-local} != pull_request ]]; then
+  export CCACHE_DISABLE=true
+else
+  unset CCACHE_DISABLE
+fi
+# Keep hosted 16 GiB runners below OOM even on large compiler translation units.
+ci_jobs=${CI_JOBS:-4}
+ci_meson=(--buildtype=debugoptimized -Db_ndebug=false --wrap-mode=nodownload
+  --prefix=/usr --libdir=lib -Dplatforms=x11,wayland
+  -Dgallium-drivers=asahi,zink,softpipe -Dvulkan-drivers=asahi
+  -Degl=enabled -Dgbm=enabled -Dglx=dri -Dgles1=enabled -Dgles2=enabled
+  -Dglvnd=enabled -Dvideo-codecs= -Dgallium-va=disabled -Dvulkan-layers=
+  -Dvalgrind=disabled -Dlibunwind=disabled -Dtools=asahi,drm-shim)
+meson setup .ci-tools "${ci_meson[@]}" -Dllvm=enabled -Dbuild-tests=false
+ninja -C .ci-tools -j "$ci_jobs" \
+  src/compiler/clc/mesa_clc src/compiler/spirv/vtn_bindgen2 src/asahi/clc/asahi_clc
+printf '%s\n' '[binaries]' \
+  "mesa_clc = '$PWD/.ci-tools/src/compiler/clc/mesa_clc'" \
+  "vtn_bindgen2 = '$PWD/.ci-tools/src/compiler/spirv/vtn_bindgen2'" \
+  "asahi_clc = '$PWD/.ci-tools/src/asahi/clc/asahi_clc'" > .ci-tools.ini
+meson setup .ci-build "${ci_meson[@]}" --native-file .ci-tools.ini \
+  -Dllvm=disabled -Dspirv-tools=disabled -Dmesa-clc=system \
+  -Dprecomp-compiler=system -Dbuild-tests=true
+meson compile -C .ci-build -j "$ci_jobs"
+python3 .github/mesa-ci/build-tests.py .ci-build
+# Run ALL configured suites: NIR, SPIR-V and Vulkan support tests as well as Asahi.
+meson test -C .ci-build --no-rebuild --print-errorlogs --num-processes "$ci_jobs"
+VK_INSTANCE_LAYERS=VK_LAYER_KHRONOS_validation \
+  python3 tools/siliconforest/drm-smoke.py .ci-build
+python3 .github/mesa-ci/pipelines.py
+DESTDIR="$PWD/.ci-stage" meson install -C .ci-build --no-rebuild
+python3 .github/mesa-ci/manifest.py
+ccache --show-stats

.github/mesa-ci/conversion.comp

@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: MIT
+#version 450
+#extension GL_EXT_shader_explicit_arithmetic_types_int64 : require
+layout(local_size_x = 1) in;
+layout(set = 0, binding = 0, std430) buffer Data {
+    float input_value;
+    uint64_t output_value;
+    int64_t signed_output_value;
+} data;
+void main() {
+    data.output_value = uint64_t(data.input_value);
+    data.signed_output_value = int64_t(data.input_value);
+}

.github/mesa-ci/deps.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MIT
+set -euo pipefail
+# Ubuntu 26.04 supplies a matching LLVM/Clang/translator 22 toolchain on both CPUs.
+sudo apt-get update
+sudo apt-get install --no-install-recommends -y \
+  build-essential bison flex ccache cmake ninja-build pkg-config python3-venv \
+  python3-mako python3-yaml python3-ply python3-packaging \
+  clang-22 llvm-22-dev libclang-22-dev libclang-cpp22-dev \
+  libllvmspirvlib-22-dev libclc-22 libclc-22-dev spirv-tools spirv-tools-dev glslang-tools \
+  libdrm-dev libexpat1-dev libglvnd-dev libvulkan-dev \
+  libx11-dev libx11-xcb-dev libxcb-dri2-0-dev libxcb-dri3-dev \
+  libxcb-keysyms1-dev libxcb-present-dev libxcb-randr0-dev libxcb-shm0-dev libxcb-sync-dev \
+  libxcb-xfixes0-dev libxcb-glx0-dev libxdamage-dev libxext-dev \
+  libxfixes-dev libxrandr-dev libxshmfence-dev libxxf86vm-dev \
+  libwayland-dev libwayland-egl-backend-dev libwayland-bin wayland-protocols libzstd-dev zlib1g-dev \
+  libdisplay-info-dev libelf-dev libpng-dev libunwind-dev libudev-dev libsensors-dev vulkan-validationlayers
+python3 -m venv --system-site-packages .ci-venv
+.ci-venv/bin/pip install --require-hashes -r .github/mesa-ci/requirements.txt

.github/mesa-ci/gate.py

@@ -0,0 +1,22 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: MIT
+"""Fail closed on failed, cancelled, missing or unexpectedly skipped work."""
+import json
+import os
+import sys
+
+
+def passes(needs):
+    if set(needs) != {'plan', 'source', 'build'}:
+        return False
+    if any(needs[j].get('result') != 'success' for j in ('plan', 'source')):
+        return False
+    required = needs['plan'].get('outputs', {}).get('build')
+    return (required == 'true' and needs['build'].get('result') == 'success') or (
+        required == 'false' and needs['build'].get('result') == 'skipped')
+
+
+if __name__ == '__main__':
+    needs = json.loads(os.environ['NEEDS_JSON'])
+    print(json.dumps(needs, indent=2))
+    sys.exit(0 if passes(needs) else 1)

.github/mesa-ci/interpolation.frag

@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: MIT
+#version 450
+layout(location = 0) in vec4 value;
+layout(location = 0) out vec4 color;
+void main() {
+    color = interpolateAtOffset(value, vec2(0.125, -0.25));
+}

.github/mesa-ci/interpolation.vert

@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: MIT
+#version 450
+layout(location = 0) out vec4 value;
+void main() {
+    gl_Position = vec4(float(gl_VertexIndex), 0.0, 0.0, 1.0);
+    value = vec4(float(gl_VertexIndex));
+}

.github/mesa-ci/kernel-contract.py

@@ -0,0 +1,12 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: MIT
+"""Fetch only the public, exact kernel contract declared by this source tree."""
+import json
+from pathlib import Path
+import re
+
+contract = json.loads(Path('SILICONFOREST-SOURCES.json').read_text())['integration_followups_20261024']
+assert contract['kernel_repository'] == 'https://github.com/omacom/linux-aurora'
+assert contract['kernel_header'] == 'include/uapi/drm/asahi_drm.h'
+assert re.fullmatch(r'[0-9a-f]{40}', contract['kernel_commit'])
+print('sha=' + contract['kernel_commit'])

.github/mesa-ci/lint.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MIT
+set -euo pipefail
+# Official v1.7.12 release; source commit 914e7df21a07ef503a81201c76d2b11c789d3fca.
+# Verify immutable bytes instead of recompiling Go dependencies on every PR.
+ci_lint_directory=$(mktemp -d "${RUNNER_TEMP:-/tmp}/mesa-actionlint.XXXXXX")
+trap 'rm -rf -- "$ci_lint_directory"' EXIT
+curl --fail --silent --show-error --location --retry 3 --proto '=https' --proto-redir '=https' \
+  https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz \
+  -o "$ci_lint_directory/actionlint.tar.gz"
+printf '%s  %s\n' \
+  8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8 \
+  "$ci_lint_directory/actionlint.tar.gz" | sha256sum --check
+tar -xzf "$ci_lint_directory/actionlint.tar.gz" -C "$ci_lint_directory" actionlint
+"$ci_lint_directory/actionlint" -shellcheck="${ACTIONLINT_SHELLCHECK-shellcheck}" .github/workflows/mesa.yml

.github/mesa-ci/manifest.py

@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: MIT
+"""Bind staged driver bytes, test results and dependency inventory to an exact commit."""
+import hashlib
+import json
+import os
+from pathlib import Path
+import platform
+import subprocess
+
+from policy import test_summary
+
+root = Path('.ci-stage')
+elfs = []
+files = []
+for path in sorted(root.rglob('*')):
+    if path.is_symlink():
+        if not path.resolve().is_relative_to(root.resolve()):
+            raise SystemExit(f'Staged symlink escapes install root: {path}')
+        files.append({'path': str(path.relative_to(root)), 'symlink': os.readlink(path)})
+        continue
+    if not path.is_file():
+        continue
+    data = path.read_bytes()
+    files.append({'path': str(path.relative_to(root)), 'sha256': hashlib.sha256(data).hexdigest()})
+    if data[:4] == b'\x7fELF':
+        dynamic = subprocess.check_output(['readelf', '-d', str(path)], text=True)
+        if any('NEEDED' in line and ('libLLVM' in line or 'libSPIRV-Tools' in line)
+               for line in dynamic.splitlines()):
+            raise SystemExit(f'Unexpected compiler runtime dependency in {path}')
+        elfs.append(str(path.relative_to(root)))
+if not elfs or not any(Path(p).name == 'libvulkan_asahi.so' for p in elfs):
+    raise SystemExit('Missing staged driver ELF payload')
+logs = Path('.ci-build/meson-logs/testlog.json')
+results = [json.loads(line) for line in logs.read_text().splitlines()]
+summary = test_summary(results)
+provenance = {
+    'source_commit': subprocess.check_output(['git', 'rev-parse', 'HEAD'], text=True).strip(),
+    'architecture': platform.machine(),
+    'kernel_contract': {k: v for k, v in json.loads(Path('SILICONFOREST-SOURCES.json').read_text())['integration_followups_20261024'].items() if k.startswith('kernel_')},
+    'event': os.environ.get('GITHUB_EVENT_NAME', 'local'),
+    'run_id': os.environ.get('GITHUB_RUN_ID'),
+    'run_attempt': os.environ.get('GITHUB_RUN_ATTEMPT'),
+    'hardware_qualified': False,
+    'claim': 'CPU build/tests and no-submit drm-shim only; not a release approval or Arch package',
+    'test_results': summary,
+    'elfs': elfs, 'files': files,
+    'packages': subprocess.check_output(['dpkg-query', '-W', '-f=${Package}=${Version}\n'], text=True).splitlines(),
+}
+Path('.ci-manifest.json').write_text(json.dumps(provenance, indent=2) + '\n')