Merge master into TerminalOutput

Conflict in m_collisions.fpp: master (#1745) deleted the loop comment; this branch added a max_overlap max-reduction to the same GPU_PARALLEL_LOOP. Kept the reduction, kept master's comment deletion.

Claude-Session: https://claude.ai/code/session_01G77jhrA4JPDz5TqJzt8ACC

Author: sbryngelson

.github/scripts/submit-slurm-job.sh

@@ -126,13 +126,29 @@ elif [ "$device" = "gpu" ]; then
     # Determine GPU partition
     gpu_partition="batch"
     if [ "$gpu_partition_dynamic" = "true" ]; then
-        # Use pre-selected bench partition if available, otherwise query sinfo
-        if [ -n "${BENCH_GPU_PARTITION:-}" ]; then
-            gpu_partition="$BENCH_GPU_PARTITION"
-            echo "Using pre-selected bench partition: $gpu_partition (PR/master consistency)"
+        if [ "$job_type" = "bench" ]; then
+            # Benchmarks compare PR against master, so both jobs must land on the
+            # SAME GPU type or the comparison is meaningless. That rules out a
+            # partition list (SLURM could place PR and master on different
+            # hardware); instead a single partition is picked and pinned across
+            # both jobs via BENCH_GPU_PARTITION. See run_parallel_benchmarks.sh.
+            if [ -n "${BENCH_GPU_PARTITION:-}" ]; then
+                gpu_partition="$BENCH_GPU_PARTITION"
+                echo "Using pre-selected bench partition: $gpu_partition (PR/master consistency)"
+            else
+                source "${SCRIPT_DIR}/select-gpu-partition.sh"
+                gpu_partition="$SELECTED_GPU_PARTITION"
+            fi
         else
-            source "${SCRIPT_DIR}/select-gpu-partition.sh"
-            gpu_partition="$SELECTED_GPU_PARTITION"
+            # Tests (and build+test) don't compare across hardware, so submit to a
+            # partition LIST and let SLURM start on whichever frees first instead
+            # of pinning one partition and queueing behind it. This restores the
+            # multi-partition backfill that #1299 dropped when it unified test and
+            # bench onto the single-partition bench selector. gpu-l40s (bad
+            # hardware) and gpu-rtx6000 (too slow for the test time limit) are
+            # intentionally omitted.
+            gpu_partition="gpu-h200,gpu-h100,gpu-a100,gpu-v100"
+            echo "Using GPU partition list for test job: $gpu_partition"
         fi
     fi
 

.github/workflows/bench.yml

@@ -10,12 +10,23 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}${{ github.event_name == 'pull_request_review' && format('-review-{0}', github.run_id) || '' }}
   cancel-in-progress: true
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   file-changes:
     name: Detect File Changes
     if: >
       github.event_name != 'pull_request_review' ||
       github.event.review.user.type != 'Bot'
+    # Job-level permissions replace the workflow default outright rather than
+    # merging with it, so contents must be restated here. paths-filter reads the
+    # PR's changed-file list via pulls.listFiles; this is the only job that needs
+    # it, so it is granted here instead of workflow-wide.
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: 'ubuntu-latest'
     outputs:
       checkall: ${{ steps.changes.outputs.checkall }}

.github/workflows/claude-code-review.yml

@@ -58,26 +58,17 @@ jobs:
             exit 1
           fi
 
-          PR_HEAD_REF="$(gh pr view "$PR_NUMBER" --repo "${{ github.repository }}" --json headRefName --jq .headRefName)"
-
           echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
-          echo "pr_head_ref=$PR_HEAD_REF" >> "$GITHUB_OUTPUT"
 
+      # Base repo only. This job is privileged (pull_request_target / issue_comment:
+      # it holds secrets and a write-capable token), so the PR head is never checked
+      # out or fetched here. The diff and per-file context are pulled through the gh
+      # API in later steps and treated purely as data.
       - name: Checkout base repo
         uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
-      - name: Fetch PR head
-        shell: bash
-        env:
-          PR_NUMBER: ${{ steps.mode.outputs.pr_number }}
-        run: |
-          set -euo pipefail
-          # Fetch the PR merge ref — works for both same-repo and fork PRs
-          # (fork branches don't exist on origin, but pull/<n>/head always does)
-          git fetch origin "pull/${PR_NUMBER}/head"
-
       - name: Resolve review state
         id: state
         shell: bash

.github/workflows/cleanliness.yml

@@ -10,9 +10,20 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   file-changes:
     name: Detect File Changes
+    # Job-level permissions replace the workflow default outright rather than
+    # merging with it, so contents must be restated here. paths-filter reads the
+    # PR's changed-file list via pulls.listFiles; this is the only job that needs
+    # it, so it is granted here instead of workflow-wide.
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: 'ubuntu-latest'
     outputs: 
       checkall: ${{ steps.changes.outputs.checkall }}

.github/workflows/convergence.yml

@@ -10,9 +10,20 @@ on:
 env:
   OMPI_MCA_rmaps_base_oversubscribe: 1
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   file-changes:
     name: Detect File Changes
+    # Job-level permissions replace the workflow default outright rather than
+    # merging with it, so contents must be restated here. paths-filter reads the
+    # PR's changed-file list via pulls.listFiles; this is the only job that needs
+    # it, so it is granted here instead of workflow-wide.
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: ubuntu-latest
     outputs:
       checkall: ${{ steps.changes.outputs.checkall }}

.github/workflows/coverage-health.yml

@@ -4,6 +4,10 @@ on:
   schedule:
     - cron: '0 7 * * *'      # daily; loud if the refresh stopped working
   workflow_dispatch:
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   health:
     if: github.repository == 'MFlowCode/MFC'

.github/workflows/coverage.yml

@@ -11,9 +11,20 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   file-changes:
     name: Detect File Changes
+    # Job-level permissions replace the workflow default outright rather than
+    # merging with it, so contents must be restated here. paths-filter reads the
+    # PR's changed-file list via pulls.listFiles; this is the only job that needs
+    # it, so it is granted here instead of workflow-wide.
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: 'ubuntu-latest'
     outputs: 
       checkall: ${{ steps.changes.outputs.checkall }}

.github/workflows/docs.yml

@@ -8,6 +8,10 @@ on:
     branches: [master]
   pull_request:
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build & Verify

.github/workflows/formatting.yml

@@ -6,6 +6,10 @@ on:
   pull_request:
   workflow_dispatch:
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   docs:
     name:    Formatting

.github/workflows/fp-stability.yml

@@ -35,9 +35,20 @@ on:
     types: [opened, synchronize, reopened, ready_for_review]
   workflow_dispatch:
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   file-changes:
     name: Detect File Changes
+    # Job-level permissions replace the workflow default outright rather than
+    # merging with it, so contents must be restated here. paths-filter reads the
+    # PR's changed-file list via pulls.listFiles; this is the only job that needs
+    # it, so it is granted here instead of workflow-wide.
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: ubuntu-latest
     outputs:
       checkall: ${{ steps.changes.outputs.checkall }}