[CI] add pr gate workflow

.github/actionlint.yaml

@@ -2,4 +2,5 @@ self-hosted-runner:
   # Labels of self-hosted runner in array of strings.
   labels:
     - default
-    - arc-runner-ucm
+    - gpu
+    - npu

.github/workflows/lint-and-test.yml

@@ -0,0 +1,78 @@
+name: 'Lint and Unit Tests'
+
+on:
+  workflow_call:
+
+jobs:
+  cpp-linter:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: cpp-linter/cpp-linter-action@main
+        id: linter
+        continue-on-error: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          style: file
+          tidy-checks: '-*'
+          files-changed-only: true
+          lines-changed-only: diff
+          format-review: false
+          version: 20
+
+      - name: Fail fast?!
+        if: steps.linter.outputs.checks-failed != 0
+        run: |
+          echo "some linter checks failed. ${{ steps.linter.outputs.checks-failed }}"
+          exit 1
+
+  py-linter:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: "3.12"
+
+    - name: Add matchers for better error display
+      run: |
+        echo "::add-matcher::.github/workflows/matchers/actionlint.json"
+        echo "::add-matcher::.github/workflows/matchers/mypy.json"
+
+    - name: Run pre-commit checks on all files
+      uses: pre-commit/action@v3.0.1
+      env:
+        SHELLCHECK_OPTS: "--exclude=SC2046,SC2006,SC2086"
+      with:
+        extra_args: --all-files --hook-stage manual
+
+  cpp_gtest:
+    runs-on: ubuntu-latest
+    env:
+      BUILD_TYPE: Debug
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Install googletest
+      run: |
+        git clone https://github.com/google/googletest.git --depth=1 --branch=v1.17.0
+        cd googletest
+        mkdir build && cd build
+        cmake -DCMAKE_CXX_FLAGS="-fPIC" -DCMAKE_C_FLAGS="-fPIC" -DCMAKE_CXX_STANDARD=17 -DCMAKE_CXX_STANDARD_REQUIRED=True ..
+        sudo make install -j
+
+    - name: Configure CMake
+      run: cmake -B ${{github.workspace}}/build -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}} -DBUILD_UCM_SPARSE=OFF -DBUILD_UNIT_TESTS=ON -DRUNTIME_ENVIRONMENT=simu
+
+    - name: Build
+      run: cmake --build ${{github.workspace}}/build --config ${{env.BUILD_TYPE}} -j
+
+    - name: Test
+      working-directory: ${{github.workspace}}/build
+      run: ctest -C ${{env.BUILD_TYPE}} --output-on-failure

.github/workflows/pull-request.yml

@@ -0,0 +1,129 @@
+name: 'Pull Request Gate'
+
+on:
+  pull_request:
+    branches: [ "dev*", "main", "*release", "feature*" ]
+
+jobs:
+  # protect the workflows dir, only allow specific users to modify
+  protect-workflows-dir:
+    runs-on: ubuntu-latest
+    outputs:
+      allowed: ${{ steps.check.outputs.allowed }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - id: check
+        env:
+          ACTOR: ${{ github.actor }}
+        run: |
+          # get the target branch contents
+          git fetch origin ${{ github.base_ref }}
+
+          CHANGED_FILES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD)
+          echo "CHANGED_FILES=$CHANGED_FILES"
+
+          if ! echo "$CHANGED_FILES" | grep -q '^\.github/workflows/'; then
+            echo "No .github/workflows changes, allow."
+            echo "allowed=true" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          ALLOWED_USERS=("dante159753" "mag1c-h")
+
+          echo ".github changes detected, check if user is allowed..."
+          ACTOR="${{ github.actor }}"
+          echo "PR author: $ACTOR"
+
+          for u in "${ALLOWED_USERS[@]}"; do
+            if [[ "$ACTOR" == "$u" ]]; then
+              echo "Authorized user, allowing change."
+              echo "allowed=true" >> $GITHUB_OUTPUT
+              exit 0
+            fi
+          done
+
+          echo "ERROR: Only privileged users may modify .github/workflows/"
+          echo "allowed=false" >> $GITHUB_OUTPUT
+          exit 1
+
+  lint-and-unit-tests:
+    needs: protect-workflows-dir
+    if: needs.protect-workflows-dir.outputs.allowed == 'true'
+    uses: ./.github/workflows/lint-and-test.yml
+
+  test-e2e-pc-gpu:
+    runs-on: gpu
+    needs: lint-and-unit-tests
+    env:
+      BUILD_TYPE: Release
+    permissions:
+      checks: write
+      pull-requests: write
+    steps:
+    - name: Clean repo
+      run: |
+        if [ -d "${{github.workspace}}" ]; then
+          cd ${{github.workspace}}
+          rm -rf ./*
+          rm -rf .[!.]*
+        fi
+    - uses: actions/checkout@v4
+    - name: Build
+      run: |
+        cd ${{github.workspace}}
+        export PLATFORM=cuda
+        pip install -v -e . --no-build-isolation
+    - name: Test E2E
+      run: |
+        cd ${{github.workspace}}
+        cd test
+        pip install pytest pytest-cov pynvml pandas
+        python3 -m pytest --stage=1 --feature=offline_inference --junitxml=offline-inference.xml
+    - name: Upload pytest results
+      uses: EnricoMi/publish-unit-test-result-action/linux@v2
+      if: (!cancelled())
+      with:
+        files: |
+          ${{github.workspace}}/test/offline-inference.xml
+        check_name: Prefix cache test results
+
+  test-e2e-sparse-gpu:
+    runs-on: gpu
+    needs: lint-and-unit-tests
+    env:
+      BUILD_TYPE: Release
+    permissions:
+      checks: write
+      pull-requests: write
+    steps:
+    - name: Clean repo
+      run: |
+        if [ -d "${{github.workspace}}" ]; then
+          cd ${{github.workspace}}
+          rm -rf ./*
+          rm -rf .[!.]*
+        fi
+    - uses: actions/checkout@v4
+    - name: Build
+      run: |
+        cd ${{github.workspace}}
+        export PLATFORM=cuda
+        export ENABLE_SPARSE=TRUE
+        pip install -v -e . --no-build-isolation
+    - name: Test E2E
+      run: |
+        cd ${{github.workspace}}
+        cd test
+        pip install pytest pytest-cov pynvml pandas
+        python3 -m pytest --stage=1 --feature=offline_inference_sparse --junitxml=offline-inference-sparse.xml
+    - name: Upload pytest results
+      uses: EnricoMi/publish-unit-test-result-action/linux@v2
+      if: (!cancelled())
+      with:
+        files: |
+          ${{github.workspace}}/test/offline-inference-sparse.xml
+        check_name: Sparse attention test results
+

.github/workflows/push-check.yml

@@ -0,0 +1,9 @@
+name: 'Push Commit Checks'
+
+on:
+  push:
+    branches: [ "**" ] # ** matches all branches, while * matches only top-level branches without '/'
+
+jobs:
+  lint-and-unit-tests:
+    uses: ./.github/workflows/lint-and-test.yml