blender-smoke.yml

name: Blender Smoke Test

# Executes the snippets' and skills' headline examples inside REAL Blender, headless,
# on the current stable (5.2.x LTS) and the fallback LTS (4.5.x) on every PR and
# every push to main (direct pushes are released, and release-gate.sh waits for
# this run on the pushed SHA),
# plus 5.1.x on the weekly cron, the opt-in `needs-5.1` PR label, or a
# workflow_dispatch series input, and fails on any error or
# empty-output assertion. Shipped examples go through tests/smoke/run_example.py
# (catalog.json): SKIP is exit 77 + SMOKE_SKIP below --min-version, never exit 0.
# Post-exit sidecars are opt-in. A leg with zero PASSes is red.
# py_compile (in validate.yml) cannot catch API-level regressions
# like the EEVEE-id inversion, the slotted-actions boundary, the driver TypeError, or the
# dead SDF link -- this gate runs the code so those surface in CI, not in users' files.
#
# Default PR matrix stays 5.2 + 4.5. `labeled` is in pull_request.types so
# applying `needs-5.1` starts a 5.1 job; other labels are ignored and must
# not cancel an in-progress default run. Auto-label does not apply needs-5.1.
# Manual dispatch: Actions > Blender Smoke Test > Run workflow > pick series.

on:
  workflow_dispatch:
    inputs:
      series:
        description: Blender series to smoke (single version, on-demand)
        required: true
        type: choice
        options:
          - "5.2"
          - "5.1"
          - "4.5"
        default: "5.2"
      sweep:
        description: Also run the full showcase falsifier sweep (5.2, sharded)
        required: false
        type: boolean
        default: false
  schedule:
    - cron: "0 7 * * 1"   # weekly, Monday 07:00 UTC
  push:
    branches: [main]
    # Same filter as pull_request below. release-gate.sh mirrors these globs to
    # decide whether a push has a smoke run to wait for; keep them in step.
    paths-ignore:
      - "**.md"
      - "docs/**"
      - "assets/**"
      - ".claude-plugin/**"
      - ".cursor-plugin/**"
      - "live-session/**"
      - ".github/ISSUE_TEMPLATE/**"
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened, labeled]
    # Docs-only PRs do not touch anything Blender runs. A PR that also changes
    # code is not ignored: paths-ignore skips only when every file matches.
    paths-ignore:
      - "**.md"
      - "docs/**"
      - "assets/**"
      - ".claude-plugin/**"
      - ".cursor-plugin/**"
      - "live-session/**"
      - ".github/ISSUE_TEMPLATE/**"

permissions:
  contents: read

concurrency:
  # Isolate labeled runs so auto-label (`ci`, `documentation`, ...) does not
  # cancel the default 4.5/5.2 jobs. synchronize still cancels the previous
  # synchronize on the same PR. Pushes to main group per SHA so a later push
  # never cancels the run an earlier push's release gate is waiting on.
  group: blender-smoke-${{ github.event.pull_request.number || (github.event_name == 'push' && github.sha) || github.ref }}${{ github.event.action == 'labeled' && format('-label-{0}', github.event.label.name) || '' }}
  cancel-in-progress: true

jobs:
  resolve-matrix:
    name: Resolve smoke matrix
    runs-on: ubuntu-latest
    timeout-minutes: 5
    if: github.event.action != 'labeled' || github.event.label.name == 'needs-5.1'
    outputs:
      series: ${{ steps.set.outputs.series }}
    steps:
      - id: set
        env:
          EVENT_NAME: ${{ github.event_name }}
          EVENT_ACTION: ${{ github.event.action }}
          DISPATCH_SERIES: ${{ github.event.inputs.series }}
          PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
        run: |
          set -euo pipefail
          if [ "$EVENT_NAME" = "schedule" ]; then
            json='["5.2","5.1","4.5"]'
          elif [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            json=$(printf '["%s"]' "$DISPATCH_SERIES")
          elif [ "$EVENT_ACTION" = "labeled" ]; then
            json='["5.1"]'
          elif echo ",$PR_LABELS," | grep -q ",needs-5.1,"; then
            json='["5.2","5.1","4.5"]'
          else
            json='["5.2","4.5"]'
          fi
          echo "series=$json" >> "$GITHUB_OUTPUT"
          echo "Smoke matrix: $json"

  smoke:
    # The catalog (a cold Blender launch per happy path and per falsifier) is
    # split across three parallel jobs per series (#529): one serial job
    # took 15-40 minutes and grew two launches per series with every example.
    # Shard 0 also runs the template, harness-driver and canary steps, which
    # are not catalog rows.
    name: Blender ${{ matrix.series }} smoke (${{ matrix.shard }}/3)
    needs: resolve-matrix
    if: needs.resolve-matrix.result == 'success'
    runs-on: ubuntu-latest
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        series: ${{ fromJSON(needs.resolve-matrix.outputs.series) }}
        shard: [0, 1, 2]  # keep in step with the K/3 below
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Init smoke status log
        run: |
          set -euo pipefail
          # runner.temp is illegal in job-level env; set it from the step shell.
          echo "BDT_SMOKE_STATUS=$RUNNER_TEMP/smoke-status.jsonl" >> "$GITHUB_ENV"
          : > "$RUNNER_TEMP/smoke-status.jsonl"

      - name: Install Blender runtime libraries
        run: |
          set -euo pipefail
          sudo apt-get update
          # Blender needs these shared libs even in --background (GPU/GL module init);
          # xvfb provides a virtual display so GL/EGL init does not abort the process.
          sudo apt-get install -y --no-install-recommends \
            xvfb libgl1 libegl1 libxrender1 libxxf86vm1 libxfixes3 libxi6 \
            libxkbcommon0 libsm6 libice6

      - name: Resolve Blender ${{ matrix.series }}
        id: resolve
        run: |
          set -euo pipefail
          series="${{ matrix.series }}"
          base="https://download.blender.org/release/Blender${series}/"
          echo "Listing $base"
          # pick the highest point release for this series (linux x64 portable)
          file=$(curl -fsSL "$base" \
            | grep -oE "blender-${series}\.[0-9]+-linux-x64\.tar\.xz" \
            | sort -V | uniq | tail -1)
          if [ -z "$file" ]; then
            echo "::error::Could not resolve a linux-x64 build for Blender ${series} at $base"
            exit 1
          fi
          version="${file#blender-}"
          version="${version%-linux-x64.tar.xz}"
          echo "base=$base" >> "$GITHUB_OUTPUT"
          echo "file=$file" >> "$GITHUB_OUTPUT"
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "Resolved Blender $version"

      - name: Restore Blender ${{ steps.resolve.outputs.version }} from cache
        id: bl-cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ runner.temp }}/bl
          key: blender-${{ steps.resolve.outputs.version }}-linux-x64

      - name: Download Blender and verify its published sha256
        if: steps.bl-cache.outputs.cache-hit != 'true'
        run: |
          set -euo pipefail
          base="${{ steps.resolve.outputs.base }}"
          file="${{ steps.resolve.outputs.file }}"
          version="${{ steps.resolve.outputs.version }}"
          mkdir -p "$RUNNER_TEMP/bl"
          echo "Downloading ${base}${file}"
          curl -fSL --retry 3 -o "$RUNNER_TEMP/bl.tar.xz" "${base}${file}"
          curl -fsSL --retry 3 -o "$RUNNER_TEMP/bl.sha256" "${base}blender-${version}.sha256"
          expected=$(grep -E "  ${file}$" "$RUNNER_TEMP/bl.sha256" | awk '{print $1}')
          if [ -z "$expected" ]; then
            echo "::error::no published sha256 for ${file}"
            exit 1
          fi
          echo "${expected}  $RUNNER_TEMP/bl.tar.xz" | sha256sum -c - \
            || { echo "::error::sha256 mismatch for ${file}; refusing to extract"; exit 1; }
          tar -xf "$RUNNER_TEMP/bl.tar.xz" -C "$RUNNER_TEMP/bl"

      - name: Locate Blender binary
        run: |
          set -euo pipefail
          bl=$(find "$RUNNER_TEMP/bl" -maxdepth 2 -type f -name blender | head -1)
          if [ -z "$bl" ]; then
            echo "::error::blender binary not found"
            exit 1
          fi
          echo "BLENDER=$bl" >> "$GITHUB_ENV"

      - name: Print Blender version
        run: |
          set -euo pipefail
          "$BLENDER" --version | head -1
          # series guard: confirm we actually got the matrix series
          "$BLENDER" --version | head -1 | grep -q "Blender ${{ matrix.series }}\." \
            || { echo "::error::version does not match series ${{ matrix.series }}"; exit 1; }

      - name: Run in-Blender smoke driver
        if: matrix.shard == 0
        run: |
          set -euo pipefail
          mkdir -p "$RUNNER_TEMP/out"
          xvfb-run -a "$BLENDER" --background --python-exit-code 1 --python tests/smoke/run_smoke.py -- "$RUNNER_TEMP/out"

      - name: Build template input scene
        if: matrix.shard == 0
        run: |
          set -euo pipefail
          xvfb-run -a "$BLENDER" --background --python-exit-code 1 --python tests/smoke/make_input.py -- "$RUNNER_TEMP/out/input.blend"

      - name: Headless glTF template runs (exit 0, .glb produced)
        if: matrix.shard == 0
        run: |
          set -euo pipefail
          xvfb-run -a "$BLENDER" --background "$RUNNER_TEMP/out/input.blend" \
            --python-exit-code 1 --python templates/headless-batch-script-template/script.py -- \
            --output "$RUNNER_TEMP/out/out.glb" --apply-modifier SUBSURF
          test -s "$RUNNER_TEMP/out/out.glb" || { echo "::error::glTF output missing/empty"; exit 1; }
          head -c4 "$RUNNER_TEMP/out/out.glb" | grep -q "glTF" || { echo "::error::not a glTF binary"; exit 1; }

      - name: Headless template no-mesh path returns exit 5
        if: matrix.shard == 0
        run: |
          set +e
          xvfb-run -a "$BLENDER" --background "$RUNNER_TEMP/out/empty.blend" \
            --python-exit-code 1 --python templates/headless-batch-script-template/script.py -- --output "$RUNNER_TEMP/out/none.glb"
          code=$?
          set -e
          [ "$code" -eq 5 ] || { echo "::error::expected exit 5 for no-mesh input, got $code"; exit 1; }
          echo "no-mesh exit code = $code (correct)"

      - name: Headless template applies the new modifier after the existing stack (#468)
        if: matrix.shard == 0
        run: |
          set -euo pipefail
          # stack.blend: a cube with a live SUBSURF (levels 1). SUBSURF then
          # TRIANGULATE is 48 tris; the reversed order a non-first
          # modifier_apply produces is 72.
          xvfb-run -a "$BLENDER" --background "$RUNNER_TEMP/out/stack.blend" \
            --python-exit-code 1 --python templates/headless-batch-script-template/script.py -- \
            --output "$RUNNER_TEMP/out/stack.glb" --apply-modifier TRIANGULATE
          xvfb-run -a "$BLENDER" --background --python-exit-code 1 --python tests/smoke/check_glb_tris.py -- \
            "$RUNNER_TEMP/out/stack.glb" 48

      - name: Extension template passes Blender's own manifest validator
        if: matrix.shard == 0
        run: |
          set -euo pipefail
          "$BLENDER" --command extension validate templates/extension-addon-template

      # The template ships its own CI (.github/workflows/blender.yml), which
      # GitHub never runs from inside templates/. Run its two steps here (#531).
      - name: Extension template CI - build excludes tests/ and .github/
        if: matrix.shard == 0
        run: |
          set -euo pipefail
          mkdir -p "$RUNNER_TEMP/extbuild"  # build does not create --output-dir
          "$BLENDER" --command extension build \
            --source-dir templates/extension-addon-template --output-dir "$RUNNER_TEMP/extbuild"
          zip=$(ls "$RUNNER_TEMP"/extbuild/*.zip | head -1)
          names=$(python3 -c "import sys, zipfile; print('\n'.join(zipfile.ZipFile(sys.argv[1]).namelist()))" "$zip")
          echo "$names"
          echo "$names" | grep -qx "__init__.py" || { echo "::error::__init__.py missing from the package"; exit 1; }
          if echo "$names" | grep -qE "^(tests|\.github)/"; then
            echo "::error::CI-only files were packed into the extension"; exit 1
          fi

      - name: Extension template CI - register round-trip
        if: matrix.shard == 0
        run: |
          set -euo pipefail
          "$BLENDER" --background --factory-startup --python-exit-code 1 \
            --python templates/extension-addon-template/tests/check_register.py

      - name: Falsifier - template register check catches a skipped unregister (exit 4)
        if: matrix.shard == 0
        run: |
          set +e
          "$BLENDER" --background --factory-startup --python-exit-code 1 \
            --python templates/extension-addon-template/tests/check_register.py -- --skip-unregister
          code=$?
          set -e
          [ "$code" -eq 4 ] || { echo "::error::skipped unregister exited $code, expected 4"; exit 1; }

      - name: Build pipeline template fixture GLB
        if: matrix.shard == 0
        run: |
          set -euo pipefail
          xvfb-run -a "$BLENDER" --background --python-exit-code 1 --python tests/smoke/make_pipeline_glb.py -- \
            "$RUNNER_TEMP/out/pipeline_src.glb"
          test -s "$RUNNER_TEMP/out/pipeline_src.glb" || { echo "::error::pipeline fixture missing"; exit 1; }

      - name: Headless AI asset pipeline template runs (exit 0, LODs produced)
        if: matrix.shard == 0
        run: |
          set -euo pipefail
          mkdir -p "$RUNNER_TEMP/out/pipeline"
          xvfb-run -a "$BLENDER" --background --python-exit-code 1 --python templates/ai-asset-pipeline-template/pipeline.py -- \
            --input "$RUNNER_TEMP/out/pipeline_src.glb" \
            --outdir "$RUNNER_TEMP/out/pipeline" \
            --preset unity \
            --lod-budgets 1024,256,64 \
            --collider convex
          test -s "$RUNNER_TEMP/out/pipeline/lod0.glb" || { echo "::error::lod0 missing/empty"; exit 1; }
          test -s "$RUNNER_TEMP/out/pipeline/collider.glb" || { echo "::error::collider missing/empty"; exit 1; }
          head -c4 "$RUNNER_TEMP/out/pipeline/lod0.glb" | grep -q "glTF" || { echo "::error::lod0 not a glTF binary"; exit 1; }

      - name: Headless pipeline template missing input returns exit 13
        if: matrix.shard == 0
        run: |
          set +e
          xvfb-run -a "$BLENDER" --background --python-exit-code 1 --python templates/ai-asset-pipeline-template/pipeline.py -- \
            --input "$RUNNER_TEMP/out/does-not-exist.glb" \
            --outdir "$RUNNER_TEMP/out/pipeline" \
            --preset unity
          code=$?
          set -e
          [ "$code" -eq 13 ] || { echo "::error::expected exit 13 for missing input, got $code"; exit 1; }
          echo "missing-input exit code = $code (correct)"

      - name: Pipeline template keeps every part of a shared-mesh, parented GLB (#462, #467)
        if: matrix.shard == 0
        run: |
          set -euo pipefail
          # Root rotated 90 deg on X, scaled 2x, at z=3; Body plus two wheels
          # sharing one mesh. lod0 must hold every part (world bbox == source),
          # grounded on its world minimum Z, with no node rotation or scale.
          mkdir -p "$RUNNER_TEMP/out/pipeline_parented"
          xvfb-run -a "$BLENDER" --background --python-exit-code 1 --python tests/smoke/make_pipeline_glb.py -- \
            "$RUNNER_TEMP/out/parented_src.glb" --parented
          xvfb-run -a "$BLENDER" --background --python-exit-code 1 --python templates/ai-asset-pipeline-template/pipeline.py -- \
            --input "$RUNNER_TEMP/out/parented_src.glb" \
            --outdir "$RUNNER_TEMP/out/pipeline_parented" \
            --preset unity \
            --lod-budgets 1024,256,64 \
            --collider convex
          xvfb-run -a "$BLENDER" --background --python-exit-code 1 --python tests/smoke/check_pipeline_glb.py -- \
            "$RUNNER_TEMP/out/parented_src.glb" "$RUNNER_TEMP/out/pipeline_parented/lod0.glb"

      - name: Falsifier - pipeline template rejects a 2 km asset with exit 8
        if: matrix.shard == 0
        run: |
          set -euo pipefail
          xvfb-run -a "$BLENDER" --background --python-exit-code 1 --python tests/smoke/make_pipeline_glb.py -- \
            "$RUNNER_TEMP/out/huge_src.glb" --radius 1000
          set +e
          xvfb-run -a "$BLENDER" --background --python-exit-code 1 --python templates/ai-asset-pipeline-template/pipeline.py -- \
            --input "$RUNNER_TEMP/out/huge_src.glb" \
            --outdir "$RUNNER_TEMP/out/pipeline" \
            --preset unity
          code=$?
          set -e
          [ "$code" -eq 8 ] || { echo "::error::expected exit 8 for out-of-range extent, got $code"; exit 1; }
          echo "out-of-range extent exit code = $code (correct)"

      - name: Headless render template runs (exit 0, PNG produced)
        if: matrix.shard == 0
        run: |
          set -euo pipefail
          # Cycles (CPU) so this is reliable on GPU-less runners; the EEVEE-id regression
          # itself is gated in run_smoke.py via engine assignment.
          xvfb-run -a "$BLENDER" --background "$RUNNER_TEMP/out/input.blend" \
            --python-exit-code 1 --python tests/smoke/tmpl_render.py -- \
            --output "$RUNNER_TEMP/out/render.png" --engine CYCLES
          test -s "$RUNNER_TEMP/out/render.png" || { echo "::error::render PNG missing/empty"; exit 1; }

      # Canaries never write to $BDT_SMOKE_STATUS: a canary PASS in the status
      # file would make summarize.py's "zero PASS is red" guard unreachable
      # (#536). Each one asserts its own verdict inline instead.
      - name: Canary - expected skip is SKIP not PASS
        if: matrix.shard == 0
        run: |
          set -euo pipefail
          python3 tests/smoke/run_example.py --no-record \
            --name canary-skip \
            --blender "$BLENDER" \
            --script tests/smoke/canary_skip.py \
            --series "${{ matrix.series }}" \
            --min-version 99.0 \
            --xvfb | tee "$RUNNER_TEMP/canary-skip.log"
          grep -q '^\[SKIP\] canary-skip:' "$RUNNER_TEMP/canary-skip.log" \
            || { echo "::error::expected skip was not classified SKIP"; exit 1; }

      - name: Canary - unexpected skip is red
        if: matrix.shard == 0
        run: |
          set +e
          python3 tests/smoke/run_example.py --no-record \
            --name canary-skip-unexpected \
            --blender "$BLENDER" \
            --script tests/smoke/canary_skip.py \
            --series "${{ matrix.series }}" \
            --min-version 4.0 \
            --xvfb
          code=$?
          set -e
          [ "$code" -eq 1 ] || { echo "::error::unexpected skip did not fail (got $code)"; exit 1; }
          echo "unexpected skip exited 1 (correct)"

      - name: Canary - uncaught exception is red
        if: matrix.shard == 0
        run: |
          set +e
          python3 tests/smoke/run_example.py --no-record \
            --name canary-raise \
            --blender "$BLENDER" \
            --script tests/smoke/canary_raise.py \
            --series "${{ matrix.series }}" \
            --xvfb
          code=$?
          set -e
          [ "$code" -eq 1 ] || { echo "::error::uncaught exception did not fail (got $code)"; exit 1; }
          echo "uncaught exception exited 1 (correct)"

      - name: Canary - post-exit sidecar
        if: matrix.shard == 0
        run: |
          set -euo pipefail
          python3 tests/smoke/run_example.py --no-record \
            --name canary-sidecar \
            --blender "$BLENDER" \
            --script tests/smoke/canary_sidecar.py \
            --series "${{ matrix.series }}" \
            --expect-sidecar "$RUNNER_TEMP/out/canary.sidecar" \
            --sidecar-contains sidecar-ok \
            --xvfb | tee "$RUNNER_TEMP/canary-sidecar.log"
          grep -q '^\[PASS\] canary-sidecar$' "$RUNNER_TEMP/canary-sidecar.log" \
            || { echo "::error::post-exit sidecar canary did not PASS"; exit 1; }

      - name: Canary - missing sidecar is red
        if: matrix.shard == 0
        run: |
          set +e
          python3 tests/smoke/run_example.py --no-record \
            --name canary-sidecar-missing \
            --blender "$BLENDER" \
            --script tests/smoke/canary_sidecar.py \
            --series "${{ matrix.series }}" \
            --expect-sidecar "$RUNNER_TEMP/out/missing.sidecar" \
            --sidecar-contains sidecar-ok \
            --xvfb \
            -- --omit-sidecar
          code=$?
          set -e
          [ "$code" -eq 1 ] || { echo "::error::missing sidecar did not fail (got $code)"; exit 1; }
          echo "missing sidecar exited 1 (correct)"

      - name: Shipped examples
        run: |
          set -euo pipefail
          python3 tests/smoke/run_catalog.py \
            --blender "$BLENDER" \
            --series "${{ matrix.series }}" \
            --shard "${{ matrix.shard }}/3" \
            --status "$BDT_SMOKE_STATUS" \
            --out "$RUNNER_TEMP/out" \
            --xvfb \
            --catalog tests/smoke/catalog.json

      - name: Smoke summary
        if: ${{ always() && env.BLENDER != '' }}
        run: |
          set -euo pipefail
          python3 tests/smoke/summarize.py --status "$BDT_SMOKE_STATUS"

  showcase-sweep:
    # The catalog runs one falsifier per row on every smoke run. The weekly
    # cron also runs every falsifier in every showcase README table and asserts
    # each lands on the exit it declares. At 80 pieces / 800+ falsifiers one
    # serial sweep no longer fit beside the happy paths in the smoke job's 75
    # minutes (cancelled on 2026-10-12, #482), so it is its own job, fanned out
    # over four jobs by piece (check_falsifier_targets.py --shard K/N).
    name: Showcase falsifier sweep ${{ matrix.shard }}/4 (5.2)
    if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.sweep)
    runs-on: ubuntu-latest
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        shard: [0, 1, 2, 3]  # N is 4: keep the "/4" in the job name and the run step in step
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Install Blender runtime libraries
        run: |
          set -euo pipefail
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            xvfb libgl1 libegl1 libxrender1 libxxf86vm1 libxfixes3 libxi6 \
            libxkbcommon0 libsm6 libice6

      - name: Resolve Blender 5.2
        id: resolve
        run: |
          set -euo pipefail
          base="https://download.blender.org/release/Blender5.2/"
          file=$(curl -fsSL "$base" \
            | grep -oE "blender-5\.2\.[0-9]+-linux-x64\.tar\.xz" \
            | sort -V | uniq | tail -1)
          if [ -z "$file" ]; then
            echo "::error::Could not resolve a linux-x64 build for Blender 5.2 at $base"
            exit 1
          fi
          version="${file#blender-}"
          version="${version%-linux-x64.tar.xz}"
          echo "base=$base" >> "$GITHUB_OUTPUT"
          echo "file=$file" >> "$GITHUB_OUTPUT"
          echo "version=$version" >> "$GITHUB_OUTPUT"

      - name: Restore Blender ${{ steps.resolve.outputs.version }} from cache
        id: bl-cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ runner.temp }}/bl
          key: blender-${{ steps.resolve.outputs.version }}-linux-x64

      - name: Download Blender and verify its published sha256
        if: steps.bl-cache.outputs.cache-hit != 'true'
        run: |
          set -euo pipefail
          base="${{ steps.resolve.outputs.base }}"
          file="${{ steps.resolve.outputs.file }}"
          version="${{ steps.resolve.outputs.version }}"
          mkdir -p "$RUNNER_TEMP/bl"
          curl -fSL --retry 3 -o "$RUNNER_TEMP/bl.tar.xz" "${base}${file}"
          curl -fsSL --retry 3 -o "$RUNNER_TEMP/bl.sha256" "${base}blender-${version}.sha256"
          expected=$(grep -E "  ${file}$" "$RUNNER_TEMP/bl.sha256" | awk '{print $1}')
          if [ -z "$expected" ]; then
            echo "::error::no published sha256 for ${file}"
            exit 1
          fi
          echo "${expected}  $RUNNER_TEMP/bl.tar.xz" | sha256sum -c - \
            || { echo "::error::sha256 mismatch for ${file}; refusing to extract"; exit 1; }
          tar -xf "$RUNNER_TEMP/bl.tar.xz" -C "$RUNNER_TEMP/bl"

      - name: Locate Blender binary
        run: |
          set -euo pipefail
          bl=$(find "$RUNNER_TEMP/bl" -maxdepth 2 -type f -name blender | head -1)
          if [ -z "$bl" ]; then
            echo "::error::blender binary not found"
            exit 1
          fi
          "$bl" --version | head -1
          echo "BLENDER=$bl" >> "$GITHUB_ENV"

      - name: Run shard ${{ matrix.shard }}/4
        run: |
          set -euo pipefail
          python3 tests/check_falsifier_targets.py --run "$BLENDER" --shard "${{ matrix.shard }}/4"

  report-scheduled-failure:
    # A red or cancelled weekly run used to go unnoticed (#482): open an issue,
    # or comment on the one already open, so the cron is never silently red.
    name: Report a failed weekly run
    needs: [smoke, showcase-sweep]
    if: >-
      always() && github.event_name == 'schedule' &&
      (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      issues: write
    steps:
      - name: Open or update the tracking issue
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          SMOKE: ${{ needs.smoke.result }}
          SWEEP: ${{ needs.showcase-sweep.result }}
        run: |
          set -euo pipefail
          title="Weekly Blender smoke run failed"
          body="Scheduled run: $RUN_URL
          - smoke matrix: \`$SMOKE\`
          - showcase falsifier sweep: \`$SWEEP\`

          Opened by blender-smoke.yml (report-scheduled-failure). Close it once a weekly run is green."
          num=$(gh issue list --state open --search "\"$title\" in:title" --json number --jq '.[0].number // empty')
          if [ -n "$num" ]; then
            gh issue comment "$num" --body "$body"
            echo "commented on #$num"
          else
            gh issue create --title "$title" --body "$body" --label "bug,ci,priority: high"
          fi