verify.yml

name: Verify

on:
  pull_request:
    # Labelling a pull request `full-verify` (or removing the label) changes how much it runs.
    types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled]
  merge_group:
  workflow_dispatch:

permissions:
  contents: read

# Each merge group has its own gh-readonly-queue ref, so queued groups never cancel each other; the
# queue itself discards a group's run when it rebuilds the group. A push to a pull request cancels
# its older run. Adding or removing any label other than `full-verify` starts a run in a group of its
# own that verifies nothing, so it never cancels the pull request's real run.
concurrency:
  group: >-
    verify-${{ github.workflow }}-${{ github.event.merge_group.head_ref || github.ref }}${{
    (github.event.action == 'labeled' || github.event.action == 'unlabeled')
    && github.event.label.name != 'full-verify' && format('-label-{0}', github.run_id) || '' }}
  cancel-in-progress: ${{ github.event_name != 'merge_group' }}

jobs:
  changes:
    name: Classify verification scope
    # A label other than `full-verify` changes nothing this workflow verifies.
    if: ${{ !((github.event.action == 'labeled' || github.event.action == 'unlabeled') && github.event.label.name != 'full-verify') }}
    runs-on: ubuntu-24.04
    outputs:
      full: ${{ steps.depth.outputs.full }}
      partial: ${{ steps.depth.outputs.partial }}
      checks: ${{ steps.scope.outputs.checks }}
      compiler_differential: ${{ steps.scope.outputs.compiler_differential }}
      duckdb: ${{ steps.scope.outputs.duckdb }}
      postgres: ${{ steps.scope.outputs.postgres }}
      clickhouse: ${{ steps.scope.outputs.clickhouse }}
      performance: ${{ steps.scope.outputs.performance }}
      format_performance: ${{ steps.scope.outputs.format_performance }}
      rules_performance: ${{ steps.scope.outputs.rules_performance }}
      wheels: ${{ steps.scope.outputs.wheels }}
      recovery: ${{ steps.scope.outputs.recovery }}
      ui: ${{ steps.scope.outputs.ui }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Select relevant suites
        id: scope
        env:
          EVENT_NAME: ${{ github.event_name }}
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha }}
          HEAD_REF: ${{ github.event.pull_request.head.ref }}
          HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
        run: |
          write_scope() {
            {
              echo "duckdb=$1"
              echo "postgres=$2"
              echo "performance=$3"
              echo "format_performance=$4"
              echo "rules_performance=$5"
              echo "checks=$6"
              echo "wheels=$7"
              echo "compiler_differential=$8"
              echo "clickhouse=$9"
              echo "recovery=${10}"
              echo "ui=${11}"
            } >> "${GITHUB_OUTPUT}"
          }

          if [[ "${EVENT_NAME}" != "pull_request" && "${EVENT_NAME}" != "merge_group" ]]; then
            write_scope true true true true true true true true true true true
            exit 0
          fi

          # A merge group's head is its base plus every queued pull request ahead of and including
          # this one, so the base..head diff covers the whole group. Anything that prevents an exact
          # diff runs everything rather than risk skipping a suite. Three dots compare with the merge
          # base, so changes that landed on main after a branch started are not counted as its own.
          changed_paths="${RUNNER_TEMP}/changed-paths"
          if [[ -z "${BASE_SHA}" || -z "${HEAD_SHA}" ]] || \
             ! git diff --name-only -z "${BASE_SHA}...${HEAD_SHA}" > "${changed_paths}"; then
            echo "Could not diff ${BASE_SHA:-<none>}...${HEAD_SHA:-<none>}; running every suite" >&2
            write_scope true true true true true true true true true true true
            exit 0
          fi

          # Succeeds when every change is a release metadata change: the manifest, the changelog,
          # or version lines of the package and lock files, so no dependency or build setting
          # moves. Keep the file list in sync with the release checks in release-please.yml.
          release_metadata_only() {
            local path diff offending changed_any=false
            local metadata_paths="${RUNNER_TEMP}/release-metadata-paths"
            local version='[0-9]+\.[0-9]+\.[0-9]+'
            local version_line="^[-+](version = \"${version}\""
            version_line+="|  \"[a-z0-9_-]+==${version}\",  # x-release-please-version)\$"
            git diff --name-only --no-renames -z "${BASE_SHA}...${HEAD_SHA}" > "${metadata_paths}" \
              || return 1
            while IFS= read -r -d '' path; do
              changed_any=true
              case "${path}" in
                .release-please-manifest.json|CHANGELOG.md) ;;
                crates/sqlbuild-cli/Cargo.toml|crates/sqlbuild-python/Cargo.toml|Cargo.lock|pyproject.toml|uv.lock)
                  diff="$(git diff -U0 --text --no-color --no-renames "${BASE_SHA}...${HEAD_SHA}" -- "${path}")" \
                    || return 1
                  offending="$(awk '/^@@/ { hunk = 1; next } hunk && /^[-+]/' <<< "${diff}" \
                    | grep -Ev "${version_line}" || true)"
                  if [[ -n "${offending}" ]]; then
                    echo "${path} changes more than version lines:" >&2
                    echo "${offending}" >&2
                    return 1
                  fi
                  ;;
                *) return 1 ;;
              esac
            done < "${metadata_paths}"
            [[ "${changed_any}" == "true" ]]
          }

          # Release Please pull requests change only release metadata on top of product code that
          # already passed every suite before it reached main, so the suites are skipped. Their
          # required Verify status is posted only by the trusted release checks in
          # release-please.yml after the metadata, version and distribution checks pass; the
          # verify job below reports under another name on Release Please branches.
          if [[ "${EVENT_NAME}" == "pull_request" \
                && "${HEAD_REPOSITORY}" == "${GITHUB_REPOSITORY}" \
                && "${HEAD_REF}" == release-please--branches--* ]] && release_metadata_only; then
            echo "Release Please pull request changes only release metadata; skipping the suites" \
              | tee -a "${GITHUB_STEP_SUMMARY}"
            write_scope false false false false false false false false false false false
            exit 0
          fi

          duckdb=false
          postgres=false
          clickhouse=false
          performance=false
          format_performance=false
          rules_performance=false
          wheels=false
          compiler_differential=false
          recovery=false
          ui=false
          broad=false
          changed=false
          # A change that only touches the website, root-level Markdown, the README demo GIFs or the
          # skill pages generated from the website docs skips the Python checks and test suites.
          # The website builds in its own workflow.
          docs_only=true
          # A change that only touches the web UI (and documentation) runs the UI checks and the
          # wheels that embed its build, but not the Python and native checks it cannot affect.
          ui_only=true
          while IFS= read -r -d '' path; do
            changed=true
            case "${path}" in
              website/*|.github/workflows/website.yml|.github/demos/*) ;;
              src/sqlbuild/.agents/skills/sqlbuild/references/docs/*.md) ;;
              */*) docs_only=false ;;
              *.md) ;;
              *) docs_only=false ;;
            esac
            case "${path}" in
              ui/*|website/*|.github/workflows/website.yml|.github/demos/*) ;;
              src/sqlbuild/.agents/skills/sqlbuild/references/docs/*.md) ;;
              */*) ui_only=false ;;
              *.md) ;;
              *) ui_only=false ;;
            esac
            case "${path}" in
              crates/*|ui/*|Cargo.toml|Cargo.lock|pyproject.toml|.github/workflows/verify.yml|.github/workflows/build-distributions.yml|deploy/Dockerfile|deploy/project/*|deploy/compose*|compose.yml|.dockerignore|Makefile|tests/integration/src/sqlbuild/compiler/compiled_project/publication/test_compose.py|tests/integration/src/sqlbuild/compiler/compiled_project/publication/docker/compose/*|benchmarks/duckshop/edge_cases/orchestration/container_deployment.json)
                wheels=true
                ;;
            esac
            case "${path}" in
              ui/*|clients/typescript/*|.github/workflows/verify.yml|website/src/assets/logo-light.png|website/src/assets/logo-dark.png|website/public/favicon.png)
                # The web UI's own checks and unit tests; the wheels embed its build. It compiles
                # against the generated control client, so client changes run them too, and it
                # imports the website's logos and favicon, so moving them fails its build.
                ui=true
                ;;
            esac
            case "${path}" in
              crates/sqlbuild-orchestration/*|crates/sqlbuild-process-ownership/*|crates/sqlbuild-cli/*|Cargo.toml|Cargo.lock|.github/workflows/verify.yml)
                recovery=true
                ;;
            esac
            case "${path}" in
              scripts/compiler_differential/*|scripts/run_compiler_differential.py|tests/*/scripts/compiler_differential/*|tests/goldens/*|tests/e2e/fixtures/*|website/examples/*|.github/workflows/verify.yml|Makefile)
                compiler_differential=true
                ;;
            esac
            case "${path}" in
              crates/*|Cargo.toml|Cargo.lock|pyproject.toml|uv.lock)
                broad=true
                performance=true
                format_performance=true
                rules_performance=true
                ;;
              src/sqlbuild/compiler/*|src/sqlbuild/adapter/type_system/*)
                broad=true
                performance=true
                rules_performance=true
                ;;
              benchmarks/duckshop-10k/*|src/sqlbuild/executor/testing/*|scripts/cold_compile_performance/*|scripts/compile_performance_ratio/*|scripts/compare_compile_performance.py|tests/e2e/src/sqlbuild/cli/commands/main/compile/*)
                broad=true
                performance=true
                ;;
              src/sqlbuild/executor/build/*|src/sqlbuild/executor/run/*|src/sqlbuild/presentation/*)
                # Inspection, plan, and build guards run inside the fresh-process compile jobs.
                broad=true
                performance=true
                ;;
              src/sqlbuild/rule_engine/*|src/sqlbuild/lint/*|scripts/rules_benchmark/*|scripts/benchmark_rules_ci.py)
                broad=true
                performance=true
                format_performance=true
                rules_performance=true
                ;;
              tests/e2e/src/sqlbuild/cli/commands/main/format/*)
                duckdb=true
                format_performance=true
                ;;
              tests/e2e/src/sqlbuild/cli/commands/main/postgres/*|tests/integration/src/sqlbuild/adapters/postgres/*|tests/integration/src/sqlbuild/runtime/execution_history/*)
                postgres=true
                ;;
              src/sqlbuild/adapters/clickhouse/*|tests/e2e/src/sqlbuild/cli/commands/main/clickhouse/*|tests/integration/src/sqlbuild/adapters/clickhouse/*)
                clickhouse=true
                ;;
              tests/e2e/*)
                duckdb=true
                ;;
              tests/unit/*|tests/integration/*)
                ;;
              ui/*)
                ;;
              .github/workflows/verify.yml|Makefile)
                performance=true
                format_performance=true
                rules_performance=true
                ;;
              .github/*|docs/*|website/*|*.md|.gitignore|LICENSE)
                ;;
              *)
                broad=true
                ;;
            esac
          done < "${changed_paths}"

          if [[ "${changed}" != "true" ]]; then
            write_scope true true true true true true true true true true true
            exit 0
          fi

          checks=true
          if [[ "${docs_only}" == "true" || "${ui_only}" == "true" ]]; then
            checks=false
          fi

          if [[ "${broad}" == "true" ]]; then
            duckdb=true
            postgres=true
            clickhouse=true
            format_performance=true
            compiler_differential=true
          fi
          write_scope \
            "${duckdb}" \
            "${postgres}" \
            "${performance}" \
            "${format_performance}" \
            "${rules_performance}" \
            "${checks}" \
            "${wheels}" \
            "${compiler_differential}" \
            "${clickhouse}" \
            "${recovery}" \
            "${ui}"

      # Pull requests run the fast Linux core: static checks, unit and integration tests, native
      # workspace checks and the UI checks. The rest of the matrix (wheels, Compose, Windows, macOS,
      # DuckDB E2E, warehouse, compiler-golden and timing jobs) runs only once a pull request is
      # labelled `full-verify` and is not a draft, and always on merge groups and manual runs. A
      # run that leaves out suites its change needs reports under another name, so the required
      # Verify stays missing and blocks the merge until the full matrix has passed.
      - name: Choose the fast core or the full matrix
        id: depth
        env:
          FULL: >-
            ${{ github.event_name != 'pull_request'
            || (contains(github.event.pull_request.labels.*.name, 'full-verify')
            && !github.event.pull_request.draft) }}
          HEAVY_SELECTED: >-
            ${{ steps.scope.outputs.duckdb == 'true' || steps.scope.outputs.postgres == 'true' || steps.scope.outputs.clickhouse == 'true' || steps.scope.outputs.performance == 'true' || steps.scope.outputs.format_performance == 'true' || steps.scope.outputs.rules_performance == 'true' || steps.scope.outputs.wheels == 'true' || steps.scope.outputs.compiler_differential == 'true' || steps.scope.outputs.recovery == 'true' }}
        run: |
          partial=false
          if [[ "${FULL}" != "true" && "${HEAVY_SELECTED}" == "true" ]]; then
            partial=true
            echo "Fast core only: label the pull request full-verify to run the full matrix Verify needs" \
              | tee -a "${GITHUB_STEP_SUMMARY}"
          fi
          {
            echo "full=${FULL}"
            echo "partial=${partial}"
          } >> "${GITHUB_OUTPUT}"

  lockfile:
    name: Lockfile consistency
    if: ${{ !((github.event.action == 'labeled' || github.event.action == 'unlabeled') && github.event.label.name != 'full-verify') }}
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-uv
        with:
          version: "0.12.3"
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - name: Install Python
        run: uv python install 3.12
      - name: Verify lockfile
        run: uv lock --check --python 3.12
      - name: Verify native workspace lockfile
        run: cargo metadata --locked --format-version 1 > /dev/null

  checks:
    name: Static checks and unit + integration tests
    needs: [changes, lockfile]
    if: needs.changes.outputs.checks == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-uv
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      # Restores the native dependency builds that rust-cache.yml saves on main; workspace crates
      # always build from source. Verify never saves: a pull request or merge queue cache is
      # visible only to its own ref. Jobs that run the same cargo builds share a key.
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-checks
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: clients/typescript/package-lock.json
      - name: Fetch the base for the new-duplicate check
        run: git fetch --no-tags --depth=1 origin "$BASE_REF"
        env:
          BASE_REF: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || 'main:refs/remotes/origin/main' }}
      - name: Run static checks
        run: make check-ci
        env:
          DUPES_BASE: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || 'origin/main' }}
      - name: Prepare Docker worker tests
        run: |
          docker info > /dev/null
          docker pull alpine:3.23
      - name: Run unit and integration tests
        env:
          SQLBUILD_REQUIRE_DOCKER_TESTS: "1"
        run: make test

  native_checks:
    name: Native workspace checks
    needs: [changes, lockfile]
    if: needs.changes.outputs.checks == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-uv
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-checks
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install native test dependencies without rebuilding the packages
        run: uv sync --locked --all-groups --all-extras --no-install-package sqlbuild --no-install-package sqlbuild-cli
      - name: Run native checks
        env:
          UV_NO_SYNC: "1"
          PYO3_PYTHON: ${{ github.workspace }}/.venv/bin/python
        run: make rust-check

  e2e_shards:
    name: DuckDB E2E (${{ matrix.name }})
    needs: [changes, lockfile]
    if: needs.changes.outputs.duckdb == 'true' && needs.changes.outputs.full == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: build core
            target: test-e2e-duckdb-build-core
          - name: build incremental
            target: test-e2e-duckdb-build-incremental
          - name: CLI data
            target: test-e2e-duckdb-cli-data
          - name: CLI commands
            target: test-e2e-duckdb-cli
          - name: CLI inspection
            target: test-e2e-duckdb-inspection
          - name: integrations
            target: test-e2e-duckdb-integrations
    env:
      PYTEST_XDIST_AUTO_NUM_WORKERS: "4"
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-uv
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras
      - name: Report runner CPU topology
        run: |
          echo "nproc=$(nproc)"
          echo "online_processors=$(getconf _NPROCESSORS_ONLN)"
          lscpu
          uv run python - <<'PY'
          import os

          print(f"os.cpu_count={os.cpu_count()}")
          print(f"sched_getaffinity={sorted(os.sched_getaffinity(0))}")
          print(
              "PYTEST_XDIST_AUTO_NUM_WORKERS="
              f"{os.environ.get('PYTEST_XDIST_AUTO_NUM_WORKERS', '<unset>')}"
          )
          PY
      - name: Validate diagnostic encryption recipient
        if: matrix.target == 'test-e2e-duckdb-cli'
        run: openssl x509 -in .github/diagnostics-recipient.pem -noout
      - name: Run DuckDB E2E shard
        env:
          SQLBUILD_COMPARISON_ENCRYPTED_DIR: ${{ matrix.target == 'test-e2e-duckdb-cli' && format('{0}/comparison-encrypted', runner.temp) || '' }}
          SQLBUILD_COMPARISON_RECIPIENT: ${{ github.workspace }}/.github/diagnostics-recipient.pem
        run: make ${{ matrix.target }}
      - name: Retain encrypted comparison failures
        if: failure() && matrix.target == 'test-e2e-duckdb-cli'
        uses: actions/upload-artifact@v4
        with:
          name: encrypted-comparison-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/comparison-encrypted/failure-*/failure.cms
          if-no-files-found: warn
          compression-level: 0
          retention-days: 7

  compiler_differential:
    name: Compiler golden outputs
    needs: [changes, lockfile]
    if: needs.changes.outputs.compiler_differential == 'true' && needs.changes.outputs.full == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-uv
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras
      - name: Check fixtures, examples, generated seeds and the failure corpus against the goldens
        run: >-
          make compiler-differential
          COMPILER_DIFFERENTIAL_ARGS="--stage-captures --require-discovery-coverage
          --require-render-coverage --require-analysis-coverage
          --evidence-dir ${{ runner.temp }}/compiler-differential-evidence"
      - name: Upload failing projects' targets, stderr and compiled-test stats
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: compiler-differential-evidence-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/compiler-differential-evidence
          if-no-files-found: warn
          retention-days: 30

  compiler_differential_python_versions:
    name: Native compiler on Python ${{ matrix.python }}
    needs: [changes, lockfile]
    if: needs.changes.outputs.compiler_differential == 'true' && needs.changes.outputs.full == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        python: ["3.13", "3.14"]
    env:
      UV_PYTHON: ${{ matrix.python }}
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-uv
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install ${{ matrix.python }}
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras --python ${{ matrix.python }}
      - name: Check fixtures, examples, the failure corpus and a few seeds against the goldens
        env:
          PYTHONUNBUFFERED: "1"
        run: >-
          uv run --no-sync python -m scripts.run_compiler_differential
          --goldens check
          --corpus fixtures examples failures seeds --seeds 4 --jobs 4

  native_discovery_windows:
    name: Native compiler on Windows
    needs: [changes, lockfile]
    if: needs.changes.outputs.compiler_differential == 'true' && needs.changes.outputs.full == 'true'
    runs-on: windows-2025
    timeout-minutes: 45
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-uv
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-windows
          save-if: false
      - name: Test the native discovery crate (walk, junctions, ordering, read errors)
        run: cargo test --locked -p sqlbuild-discovery
      - name: Install Python
        run: uv python install 3.12
      - name: Install SQLBuild and pytest
        run: |
          uv sync --locked --no-dev --python 3.12
          uv pip install "pytest>=8.4.2" "pytest-xdist>=3.8.0"
      - name: Check the native YAML and TOML readers and the lineage fingerprint with this Python
        run: >-
          uv run --no-sync pytest
          tests/integration/src/sqlbuild/compiler/discovery/test_native_yaml_oracle.py
          tests/integration/src/sqlbuild/compiler/discovery/test_native_toml_oracle.py
          tests/unit/src/sqlbuild/cli/commands/_helpers/lineage/test_cache.py
          -n auto --dist loadfile
      - name: Compile and build playground projects
        run: |
          project="${RUNNER_TEMP}/waffle-shop"
          uv run --no-sync sqb playground "${project}"
          uv run --no-sync sqb --project-dir "${project}" --no-color compile
          if ! test -f "${project}/target/cache/compiler-native-v1/macro-calls.bin"; then
            echo "The compile did not write the macro-call store; macro bridge debug log:"
            rm -rf "${project}/target"
            uv run --no-sync sqb --project-dir "${project}" --no-color --debug compile 2>&1 \
              | grep "macro_bridge" || true
            exit 1
          fi
          uv run --no-sync sqb --project-dir "${project}" --no-color build
          nodes="${RUNNER_TEMP}/python-nodes"
          uv run --no-sync sqb playground --template python_nodes "${nodes}"
          uv run --no-sync sqb --project-dir "${nodes}" --no-color compile

  scheduler_recovery:
    name: Scheduler recovery (${{ matrix.name }})
    needs: [changes, lockfile]
    if: needs.changes.outputs.recovery == 'true' && needs.changes.outputs.full == 'true'
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 75
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: macOS
            runner: macos-15
            test_threads: 3
          - name: Windows
            runner: windows-2025
            test_threads: 2
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-recovery-${{ matrix.name }}
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - name: Start a native PostgreSQL server
        run: |
          if [[ "${RUNNER_OS}" == "macOS" ]]; then
            brew install --quiet postgresql@16
            bin="$(brew --prefix postgresql@16)/bin"
          else
            bin="$(cygpath -u "${PGBIN}")"
          fi
          data="${RUNNER_TEMP}/postgres-data"
          "${bin}/initdb" -D "${data}" -U postgres --auth=trust -E UTF8 > /dev/null
          "${bin}/pg_ctl" -D "${data}" -o "-p 5433 -c listen_addresses=127.0.0.1" \
            -l "${RUNNER_TEMP}/postgres.log" -w start
      - name: Worker claim ownership, recovery and stop
        run: cargo test --locked -p sqlbuild-process-ownership
      - name: sqlbuild forwarder arguments, exit codes, streams, signals and missing sqb
        run: cargo test --locked -p sqlbuild-cli --test launcher
      - name: Control store, scheduler and recovery contracts on SQLite and PostgreSQL
        env:
          SQLBUILD_TEST_CONTROL_POSTGRES_URL: postgresql://postgres@127.0.0.1:5433/postgres
        run: cargo test --locked -p sqlbuild-orchestration --lib -- --test-threads=${{ matrix.test_threads }}
      - name: PostgreSQL server log
        if: failure()
        run: cat "${RUNNER_TEMP}/postgres.log" || true

  format_performance:
    name: Formatter performance guards
    needs: [changes, lockfile]
    if: needs.changes.outputs.format_performance == 'true' && needs.changes.outputs.full == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-uv
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras --python 3.12
      - name: Run formatter performance guards
        timeout-minutes: 10
        run: >-
          uv run pytest
          tests/e2e/src/sqlbuild/cli/commands/main/format/test_format_performance.py
          -n auto --dist loadfile -m performance

  performance:
    name: Performance guards
    needs: [changes, lockfile]
    # Temporarily disabled while the Blacksmith runner allowance is unavailable.
    # These budgets are calibrated for the 8-vCPU Blacksmith runner.
    if: false
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-uv
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras
      - name: Run performance guards
        run: make test-e2e-performance

  cold_compile_performance:
    name: Fresh-process compile (${{ matrix.models }} models)
    needs: [changes, lockfile]
    if: needs.changes.outputs.performance == 'true' && needs.changes.outputs.full == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        models: [3000, 5000, 10000]
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-uv
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras
      - name: Run fresh-process compile guard under 4 GiB
        env:
          BENCHMARK_MODELS: ${{ matrix.models }}
          MEMORY_LIMIT_BYTES: "4294967296"
        run: |
          sudo systemd-run \
            --unit="sqlbuild-cold-${BENCHMARK_MODELS}-${GITHUB_RUN_ID}" \
            --uid="$(id -u)" \
            --gid="$(id -g)" \
            --same-dir \
            --setenv="HOME=${HOME}" \
            --setenv="PATH=${PATH}" \
            --setenv="SQLBUILD_REQUIRE_MEMORY_LIMIT_BYTES=${MEMORY_LIMIT_BYTES}" \
            --property="MemoryMax=${MEMORY_LIMIT_BYTES}" \
            --property="MemorySwapMax=0" \
            --wait \
            --collect \
            --pipe \
            make test-e2e-cold-compile-performance \
              SQLBUILD_BENCHMARK_MODELS="${BENCHMARK_MODELS}"

  dense_compile_performance:
    name: Dense all-rules compile (${{ matrix.models }} models)
    needs: [changes, lockfile]
    if: needs.changes.outputs.performance == 'true' && needs.changes.outputs.full == 'true'
    runs-on: ubuntu-24.04
    # The 3k and 10k cells also run the delta edit-loop guard, about five minutes at 10k.
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        models: [1000, 3000, 5000, 10000]
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-uv
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras
      # Each timed compile runs in its own 4 GiB transient scope; pytest stays outside it.
      - name: Run dense all-rules and delta edit-loop guards with each compile under 4 GiB
        env:
          BENCHMARK_MODELS: ${{ matrix.models }}
          SQLBUILD_COMPILE_MEMORY_LIMIT_BYTES: "4294967296"
        run: |
          make test-e2e-dense-compile-performance \
            SQLBUILD_BENCHMARK_MODELS="${BENCHMARK_MODELS}"

      - name: Run diagnostic-heavy compile guards
        if: matrix.models == 1000
        run: make test-e2e-diagnostic-compile-performance

  compile_performance_ratio:
    name: Same-runner compile ratio (${{ matrix.label || matrix.kind }} 3000 models)
    needs: [changes, lockfile]
    if: needs.changes.outputs.performance == 'true' && needs.changes.outputs.full == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        include:
          - kind: dense
            max_ratio: "1.10"
            edit_max_ratio: "1.20"
            edit_max_cpu_ratio: "1.75"
          - kind: fresh
            max_ratio: "1.10"
          - kind: dense
            label: contracts CPU vs base
            gate_phase: contracts_cpu_ms
            max_ratio: "1.10"
          - kind: dense
            label: model analysis CPU vs base
            gate_phase: model_analysis_cpu_ms
            compile_args: --compile-arg=--select=*
            max_ratio: "1.10"
          - kind: dense
            label: custom rules CPU vs base
            gate_phase: custom_rules_cpu_ms
            # Temporary migration allowance; restore 1.10 after custom-host projection optimization.
            # Whole-command CPU, wall-time, memory and correctness gates retain their limits.
            max_ratio: "1.35"
    steps:
      - uses: actions/checkout@v4
      - name: Check out the comparison base
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || 'main' }}
          path: base
      - uses: ./.github/actions/setup-uv
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
            base/uv.lock
            base/Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Seed the base build directory with the cached dependency builds
        run: |
          if [[ -d target ]]; then
            cp -a target base/target
          fi
      - name: Install head dependencies
        run: uv sync --locked --all-groups --all-extras
      - name: Install base dependencies
        working-directory: base
        run: uv sync --locked --all-groups --all-extras
      - name: Compare base and head phase CPU
        if: matrix.gate_phase
        env:
          KIND: ${{ matrix.kind }}
          MAX_RATIO: ${{ matrix.max_ratio }}
          GATE_PHASE: ${{ matrix.gate_phase }}
          COMPILE_ARGS: ${{ matrix.compile_args }}
        run: |
          uv run python -m scripts.compare_compile_performance \
            --kind "${KIND}" \
            --modes cold \
            --max-ratio "${MAX_RATIO}" \
            --models 3000 \
            --base-root base \
            --base-python base/.venv/bin/python \
            --head-python .venv/bin/python \
            --gate-phase "${GATE_PHASE}" \
            ${COMPILE_ARGS:+"${COMPILE_ARGS}"}
      - name: Compare base and head cold, warm and one-model edit compiles
        if: ${{ !matrix.gate_phase }}
        env:
          KIND: ${{ matrix.kind }}
          MAX_RATIO: ${{ matrix.max_ratio }}
          COLD_MAX_RATIO: ${{ matrix.cold_max_ratio }}
          COLD_MAX_CPU_RATIO: ${{ matrix.cold_max_cpu_ratio }}
          EDIT_MAX_RATIO: ${{ matrix.edit_max_ratio }}
          EDIT_MAX_CPU_RATIO: ${{ matrix.edit_max_cpu_ratio }}
        run: |
          uv run python -m scripts.compare_compile_performance \
            --kind "${KIND}" \
            --modes cold warm edit \
            ${COLD_MAX_RATIO:+--cold-max-ratio "$COLD_MAX_RATIO"} \
            ${COLD_MAX_CPU_RATIO:+--cold-max-cpu-ratio "$COLD_MAX_CPU_RATIO"} \
            ${EDIT_MAX_RATIO:+--edit-max-ratio "$EDIT_MAX_RATIO"} \
            ${EDIT_MAX_CPU_RATIO:+--edit-max-cpu-ratio "$EDIT_MAX_CPU_RATIO"} \
            --max-ratio "${MAX_RATIO}" \
            --models 3000 \
            --base-root base \
            --base-python base/.venv/bin/python \
            --head-python .venv/bin/python

  cache_compile_performance:
    name: Fresh-process compile cache (${{ matrix.models }} models)
    needs: [changes, lockfile]
    if: needs.changes.outputs.performance == 'true' && needs.changes.outputs.full == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        models: [3000, 5000, 10000]
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-uv
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras
      - name: Run fresh-process compile cache guard under 4 GiB
        timeout-minutes: 15
        env:
          BENCHMARK_MODELS: ${{ matrix.models }}
          MEMORY_LIMIT_BYTES: "4294967296"
        run: |
          sudo systemd-run \
            --unit="sqlbuild-cache-${BENCHMARK_MODELS}-${GITHUB_RUN_ID}" \
            --uid="$(id -u)" \
            --gid="$(id -g)" \
            --same-dir \
            --setenv="HOME=${HOME}" \
            --setenv="PATH=${PATH}" \
            --setenv="SQLBUILD_REQUIRE_MEMORY_LIMIT_BYTES=${MEMORY_LIMIT_BYTES}" \
            --property="MemoryMax=${MEMORY_LIMIT_BYTES}" \
            --property="MemorySwapMax=0" \
            --wait \
            --collect \
            --pipe \
            make test-e2e-cache-compile-performance \
              SQLBUILD_BENCHMARK_MODELS="${BENCHMARK_MODELS}"

      - name: Run varied 1k warm-cache guard under 4 GiB
        if: matrix.models == 3000
        timeout-minutes: 15
        env:
          MEMORY_LIMIT_BYTES: "4294967296"
        run: |
          sudo systemd-run \
            --unit="sqlbuild-varied-cache-${GITHUB_RUN_ID}" \
            --uid="$(id -u)" \
            --gid="$(id -g)" \
            --same-dir \
            --setenv="HOME=${HOME}" \
            --setenv="PATH=${PATH}" \
            --setenv="SQLBUILD_REQUIRE_MEMORY_LIMIT_BYTES=${MEMORY_LIMIT_BYTES}" \
            --property="MemoryMax=${MEMORY_LIMIT_BYTES}" \
            --property="MemorySwapMax=0" \
            --wait \
            --collect \
            --pipe \
            make test-e2e-varied-cache-performance

  rules_performance:
    name: Rules performance guards
    needs: [changes, lockfile]
    # Temporarily disabled while the Blacksmith runner allowance is unavailable.
    # These budgets are calibrated for the 8-vCPU Blacksmith runner.
    if: false
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-uv
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras
      - name: Run required Rules performance profile
        timeout-minutes: 10
        run: >-
          uv run python -m scripts.benchmark_rules_ci
          --output "${RUNNER_TEMP}/rules-performance-ci.json"
          --summary-output "${RUNNER_TEMP}/rules-performance-ci.md"
          --max-seconds 420
      - name: Publish benchmark summary
        if: always()
        run: |
          if [[ -f "${RUNNER_TEMP}/rules-performance-ci.md" ]]; then
            cat "${RUNNER_TEMP}/rules-performance-ci.md" >> "${GITHUB_STEP_SUMMARY}"
          fi
      - name: Upload benchmark evidence
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: rules-performance-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            ${{ runner.temp }}/rules-performance-ci.json
            ${{ runner.temp }}/rules-performance-ci.md
          if-no-files-found: error
          retention-days: 90

  postgres:
    name: PostgreSQL integration and E2E tests
    needs: [changes, lockfile]
    if: needs.changes.outputs.postgres == 'true' && needs.changes.outputs.full == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-uv
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras
      - name: Verify Docker
        run: docker info
      - name: Run PostgreSQL tests
        env:
          PYTHONUNBUFFERED: "1"
          TESTCONTAINERS_RYUK_DISABLED: "true"
        run: >-
          uv run pytest tests
          -m "real_warehouse and postgres"
          -vv --color=yes -n auto --dist loadfile

  clickhouse:
    name: ClickHouse integration and E2E tests
    needs: [changes, lockfile]
    if: needs.changes.outputs.clickhouse == 'true' && needs.changes.outputs.full == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-uv
        with:
          version: "0.12.3"
          enable-cache: true
          cache-dependency-glob: |
            uv.lock
            Cargo.lock
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: verify-linux
          save-if: false
      - name: Install Python
        run: uv python install 3.12
      - name: Install dependencies
        run: uv sync --locked --all-groups --all-extras
      - name: Verify Docker
        run: docker info
      - name: Run ClickHouse tests
        env:
          PYTHONUNBUFFERED: "1"
          TESTCONTAINERS_RYUK_DISABLED: "true"
        run: >-
          uv run pytest tests
          -m "real_warehouse and clickhouse"
          -vv --color=yes -n auto --dist loadfile

  wheels:
    name: Wheels
    needs: [changes]
    if: needs.changes.outputs.wheels == 'true' && needs.changes.outputs.full == 'true'
    uses: ./.github/workflows/build-distributions.yml
    with:
      sdist: false
      upload: true
      retention-days: 3
      # Release Distributions builds and smoke tests the slower dist profile for every release.
      cargo-profile: release

  compose:
    name: Packaged Compose lifecycle
    needs: [changes, lockfile, wheels]
    if: needs.changes.outputs.wheels == 'true' && needs.changes.outputs.full == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-uv
        with:
          version: "0.12.3"
          enable-cache: true
      - name: Install Python test dependencies without rebuilding the packages
        run: |
          uv python install 3.12
          uv sync --locked --all-groups --all-extras --no-install-package sqlbuild --no-install-package sqlbuild-cli
      - uses: actions/download-artifact@v4
        with:
          name: dist-wheel-linux-x86_64
          path: dist
      - name: Install the same wheels used by the images
        run: uv pip install --no-deps dist/*.whl
      - name: Verify packaged Compose deployment and operational recovery
        run: make test-compose-packaged

  ui:
    name: UI checks and unit tests
    needs: changes
    if: needs.changes.outputs.ui == 'true'
    runs-on: ubuntu-24.04
    defaults:
      run:
        working-directory: ui
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: ui/package-lock.json
      - name: Install dependencies
        run: npm ci
      - name: Type-check
        run: npm run check
      - name: Unit tests
        run: npm test
      - name: Build the static bundle sqb server embeds
        run: npm run build

  verify:
    # The required Verify of a Release Please pull request is the commit status that the trusted
    # release checks in release-please.yml post on the branch's current head, after the lockfile
    # refresh and every dispatched check. This job reports under another name there, so its quick
    # metadata-only pass can never satisfy Verify first; a skipped job would count as passing, so
    # the job always runs and only its name changes. Until those checks post Verify on the head,
    # the pull request waits for an expected check, and every new push to the branch waits again.
    # The same holds for a fast-core run that leaves out suites its change needs, and for a run
    # started by an unrelated label: neither reports as Verify.
    name: >-
      ${{ (github.event_name == 'pull_request'
      && github.event.pull_request.head.repo.full_name == github.repository
      && startsWith(github.event.pull_request.head.ref, 'release-please--branches--'))
      && 'Release pull request suites'
      || ((github.event.action == 'labeled' || github.event.action == 'unlabeled') && github.event.label.name != 'full-verify') && 'Label change (nothing verified)'
      || needs.changes.outputs.partial == 'true' && 'Fast core (label full-verify for Verify)'
      || 'Verify' }}
    if: always()
    needs:
      [
        changes,
        lockfile,
        checks,
        native_checks,
        e2e_shards,
        compiler_differential,
        compiler_differential_python_versions,
        native_discovery_windows,
        scheduler_recovery,
        format_performance,
        performance,
        cold_compile_performance,
        dense_compile_performance,
        compile_performance_ratio,
        cache_compile_performance,
        rules_performance,
        postgres,
        clickhouse,
        wheels,
        compose,
        ui,
      ]
    runs-on: ubuntu-24.04
    steps:
      - name: Confirm all required verification jobs passed
        env:
          CHANGES_RESULT: ${{ needs.changes.result }}
          CHECKS_SELECTED: ${{ needs.changes.outputs.checks }}
          LOCKFILE_RESULT: ${{ needs.lockfile.result }}
          CHECKS_RESULT: ${{ needs.checks.result }}
          NATIVE_CHECKS_RESULT: ${{ needs.native_checks.result }}
          E2E_SHARDS_RESULT: ${{ needs.e2e_shards.result }}
          COMPILER_DIFFERENTIAL_RESULT: ${{ needs.compiler_differential.result }}
          COMPILER_DIFFERENTIAL_PYTHON_VERSIONS_RESULT: ${{ needs.compiler_differential_python_versions.result }}
          NATIVE_DISCOVERY_WINDOWS_RESULT: ${{ needs.native_discovery_windows.result }}
          SCHEDULER_RECOVERY_RESULT: ${{ needs.scheduler_recovery.result }}
          FORMAT_PERFORMANCE_RESULT: ${{ needs.format_performance.result }}
          PERFORMANCE_RESULT: ${{ needs.performance.result }}
          COLD_COMPILE_PERFORMANCE_RESULT: ${{ needs.cold_compile_performance.result }}
          DENSE_COMPILE_PERFORMANCE_RESULT: ${{ needs.dense_compile_performance.result }}
          COMPILE_PERFORMANCE_RATIO_RESULT: ${{ needs.compile_performance_ratio.result }}
          CACHE_COMPILE_PERFORMANCE_RESULT: ${{ needs.cache_compile_performance.result }}
          RULES_PERFORMANCE_RESULT: ${{ needs.rules_performance.result }}
          POSTGRES_RESULT: ${{ needs.postgres.result }}
          CLICKHOUSE_RESULT: ${{ needs.clickhouse.result }}
          WHEELS_RESULT: ${{ needs.wheels.result }}
          COMPOSE_RESULT: ${{ needs.compose.result }}
          UI_SELECTED: ${{ needs.changes.outputs.ui }}
          UI_RESULT: ${{ needs.ui.result }}
          LABEL_ONLY: ${{ (github.event.action == 'labeled' || github.event.action == 'unlabeled') && github.event.label.name != 'full-verify' }}
          PARTIAL: ${{ needs.changes.outputs.partial }}
          DUCKDB_SELECTED: ${{ needs.changes.outputs.duckdb }}
          COMPILER_DIFFERENTIAL_SELECTED: ${{ needs.changes.outputs.compiler_differential }}
          RECOVERY_SELECTED: ${{ needs.changes.outputs.recovery }}
          FORMAT_PERFORMANCE_SELECTED: ${{ needs.changes.outputs.format_performance }}
          PERFORMANCE_SELECTED: ${{ needs.changes.outputs.performance }}
          POSTGRES_SELECTED: ${{ needs.changes.outputs.postgres }}
          CLICKHOUSE_SELECTED: ${{ needs.changes.outputs.clickhouse }}
          WHEELS_SELECTED: ${{ needs.changes.outputs.wheels }}
        run: |
          if [[ "${LABEL_ONLY}" == "true" ]]; then
            echo "A label other than full-verify changed; this run verifies nothing"
            exit 0
          fi
          if [[ "${CHANGES_RESULT}" != "success" || "${LOCKFILE_RESULT}" != "success" ]]; then
            echo "Required classification or lockfile checks did not pass" >&2
            exit 1
          fi
          for result in "${CHECKS_RESULT}" "${NATIVE_CHECKS_RESULT}"; do
            if [[ "${result}" != "success" ]] && \
               ! [[ "${CHECKS_SELECTED}" == "false" && "${result}" == "skipped" ]]; then
              echo "Required static or native checks did not pass: ${result}" >&2
              exit 1
            fi
          done
          if [[ "${WHEELS_RESULT}" == "success" && "${COMPOSE_RESULT}" != "success" ]]; then
            echo "Required packaged Compose verification did not pass: ${COMPOSE_RESULT}" >&2
            exit 1
          fi
          for result in \
            "${E2E_SHARDS_RESULT}" \
            "${COMPILER_DIFFERENTIAL_RESULT}" \
            "${COMPILER_DIFFERENTIAL_PYTHON_VERSIONS_RESULT}" \
            "${NATIVE_DISCOVERY_WINDOWS_RESULT}" \
            "${SCHEDULER_RECOVERY_RESULT}" \
            "${FORMAT_PERFORMANCE_RESULT}" \
            "${PERFORMANCE_RESULT}" \
            "${COLD_COMPILE_PERFORMANCE_RESULT}" \
            "${DENSE_COMPILE_PERFORMANCE_RESULT}" \
            "${COMPILE_PERFORMANCE_RATIO_RESULT}" \
            "${CACHE_COMPILE_PERFORMANCE_RESULT}" \
            "${RULES_PERFORMANCE_RESULT}" \
            "${POSTGRES_RESULT}" \
            "${CLICKHOUSE_RESULT}" \
            "${WHEELS_RESULT}" \
            "${COMPOSE_RESULT}"; do
            if [[ "${result}" != "success" && "${result}" != "skipped" ]]; then
              echo "A selected verification suite did not pass: ${result}" >&2
              exit 1
            fi
          done
          if [[ "${UI_RESULT}" != "success" ]] && \
             ! [[ "${UI_SELECTED}" != "true" && "${UI_RESULT}" == "skipped" ]]; then
            echo "Required UI checks did not pass: ${UI_RESULT}" >&2
            exit 1
          fi
          # A full run must have run every suite its change selected; a skip here is never a pass.
          if [[ "${PARTIAL}" != "true" ]]; then
            for pair in \
              "${DUCKDB_SELECTED}:${E2E_SHARDS_RESULT}" \
              "${COMPILER_DIFFERENTIAL_SELECTED}:${COMPILER_DIFFERENTIAL_RESULT}" \
              "${COMPILER_DIFFERENTIAL_SELECTED}:${COMPILER_DIFFERENTIAL_PYTHON_VERSIONS_RESULT}" \
              "${COMPILER_DIFFERENTIAL_SELECTED}:${NATIVE_DISCOVERY_WINDOWS_RESULT}" \
              "${RECOVERY_SELECTED}:${SCHEDULER_RECOVERY_RESULT}" \
              "${FORMAT_PERFORMANCE_SELECTED}:${FORMAT_PERFORMANCE_RESULT}" \
              "${PERFORMANCE_SELECTED}:${COLD_COMPILE_PERFORMANCE_RESULT}" \
              "${PERFORMANCE_SELECTED}:${DENSE_COMPILE_PERFORMANCE_RESULT}" \
              "${PERFORMANCE_SELECTED}:${COMPILE_PERFORMANCE_RATIO_RESULT}" \
              "${PERFORMANCE_SELECTED}:${CACHE_COMPILE_PERFORMANCE_RESULT}" \
              "${POSTGRES_SELECTED}:${POSTGRES_RESULT}" \
              "${CLICKHOUSE_SELECTED}:${CLICKHOUSE_RESULT}" \
              "${WHEELS_SELECTED}:${WHEELS_RESULT}" \
              "${WHEELS_SELECTED}:${COMPOSE_RESULT}"; do
              if [[ "${pair%%:*}" == "true" && "${pair#*:}" != "success" ]]; then
                echo "A suite this change needs did not run to success: ${pair#*:}" >&2
                exit 1
              fi
            done
          else
            echo "Fast core passed; the full matrix runs once the pull request is labelled full-verify"
            exit 0
          fi
          echo "All path-relevant verification jobs passed"