[DO NOT MERGE] Coarse/fine setup-repair phases — CI QoR evaluation

.bazelignore

@@ -6,3 +6,4 @@ jenkins/
 docs/
 
 
+tmp

.bazelrc

@@ -1,2 +1,22 @@
+# yosys 0.64 is not yet in BCR; add the unmerged PR's fork as a fallback
+# registry until bazelbuild/bazel-central-registry#8862 lands.  BCR is
+# listed first so all other modules resolve from the official source;
+# the fork is only consulted for modules/versions BCR doesn't carry yet.
+# The commit hash makes the fork reference immutable.  Mirrors what
+# bazel-orfs/.bazelrc does upstream — ORFS root has its own .bazelrc so
+# the upstream lines don't propagate automatically.
+common --registry=https://bcr.bazel.build/
+common --registry=https://raw.githubusercontent.com/oharboe/bazel-central-registry/0586b398db6edd245da97cbec29e26c5e2a808d7/
+
 build --incompatible_strict_action_env
+build --cxxopt "-std=c++20" --host_cxxopt "-std=c++20"
+
+# Don't track MODULE.bazel.lock.  Resolved versions ride along with the
+# pinned BCR + git_override(commit=…) coordinates in MODULE.bazel and
+# downstream cache hits are what we actually care about.  Tracking the
+# lockfile just means every bazel-orfs / yosys / openroad bump produces
+# a 1000-line lock diff that buries the real change.  Matches what
+# bazel-orfs itself does (its own .bazelrc:7).
+common --lockfile_mode=off
+
 try-import %workspace%/user.bazelrc

.bazelversion

@@ -1 +1 @@
-7.6.0
+8.6.0

.dockerignore

@@ -1,4 +1,7 @@
 # Build working directories
+tools/OpenROAD/build/
+tools/yosys-slang/build/
+tools/kepler-formal/build/
 
 # Build files
 build_openroad.log

.gitattributes

@@ -1,2 +1,3 @@
 # Make Github ignore the designs folder when determining repo language
 flow/designs/src/* linguist-vendored
+flow/scripts/variables.json linguist-generated=true

.github/dependabot.yml

@@ -1,14 +1,6 @@
-
 version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "daily"
-  - package-ecosystem: "gitsubmodule"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    ignore:
-      - dependency-name: "abc"
-        update-types: ["version-update:semver-major"]

.github/requirements/requirements.in

@@ -0,0 +1,4 @@
+firebase-admin
+pyyaml
+tclint==0.7.0
+yamlfix==1.19.1

.github/workflows/black.yaml

@@ -5,5 +5,5 @@ jobs:
   lint:
     runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted' || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@v5
-      - uses: psf/black@stable
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: psf/black@87928e6d6761a4a6d22250e1fee5601b3998086e  # 26.5.1

.github/workflows/github-actions-cron-test-installer.yml

@@ -30,7 +30,7 @@ jobs:
     runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted' || 'ubuntu-latest' }}
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 1
           submodules: recursive

.github/workflows/github-actions-cron-update-OR.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted' || 'ubuntu-latest' }}
     steps:
       - name: Check out repository code recursively
-        uses: actions/checkout@v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           submodules: recursive
       - name: Pull changes in OpenROAD submodule
@@ -24,7 +24,7 @@ jobs:
           git pull
       - if: "steps.remote-update.outputs.has_update != ''"
         name: Create Draft PR
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
         with:
           token: ${{ github.token }}
           signoff: true

.github/workflows/github-actions-cron-update-yosys.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted' || 'ubuntu-latest' }}
     steps:
       - name: Check out repository code recursively
-        uses: actions/checkout@v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           submodules: recursive
           fetch-depth: 0
@@ -28,7 +28,7 @@ jobs:
           git checkout ${latesttag}
       - if: "steps.remote-update.outputs.has_update != ''"
         name: Create Draft PR
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
         with:
           token: ${{ github.token }}
           signoff: true

.github/workflows/github-actions-cron-util-test.yml

@@ -4,12 +4,12 @@ on:
   - cron: "0 8 * * SUN"
   push:
     paths:
-      - 'flow/util/genElapsedTime.py'
-      - 'flow/test/test_genElapsedTime.py'
+      - 'flow/util/*.py'
+      - 'flow/test/test_*.py'
   pull_request:
     paths:
-      - 'flow/util/genElapsedTime.py'
-      - 'flow/test/test_genElapsedTime.py'
+      - 'flow/util/*.py'
+      - 'flow/test/test_*.py'
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
@@ -20,7 +20,7 @@ jobs:
     runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted' || 'ubuntu-latest' }}
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 1
           submodules: recursive

.github/workflows/github-actions-lint-tcl.yml

@@ -9,21 +9,25 @@ on:
     - master
 
 jobs:
-  build:
+  Tclint:
     runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted' || 'ubuntu-latest' }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.10"
 
       - name: Install Dependencies
         run: |
           python3 -m venv venv
-          venv/bin/pip install tclint==0.4.2
+          venv/bin/pip install -r .github/requirements/requirements_lock.txt
 
       - name: Lint
         run: |
           source venv/bin/activate
           tclfmt --version
           tclfmt --in-place .
           git diff --exit-code
-          tclint --no-check-style .
+          tclint .

.github/workflows/github-actions-manual-update-rules.yml

@@ -14,10 +14,10 @@ jobs:
       fail-fast: false
     steps:
       - name: Check out repository code recursively
-        uses: actions/checkout@v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 0
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         with:
           python-version: "3.10"
       - name: Install Python Packages

.github/workflows/github-actions-on-label-create.yml

@@ -51,11 +51,37 @@ jobs:
         deployToken: ${{ secrets.STAGING_GITHUB_TOKEN }}
         force: true
 
+    - id: resolve_key
+      name: Compute per-user secret key
+      env:
+        PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+      run: |
+        key=$(echo "$PR_AUTHOR" | tr 'a-z-' 'A-Z_')
+        echo "key=$key" >> "$GITHUB_OUTPUT"
+
+    - id: resolve_token
+      name: Pick per-user PAT or fall back to bot token
+      env:
+        USER_PAT: ${{ secrets[format('PAT_{0}', steps.resolve_key.outputs.key)] }}
+        BOT_TOKEN: ${{ secrets.STAGING_GITHUB_TOKEN }}
+      run: |
+        if [ -n "$USER_PAT" ]; then
+          echo "::add-mask::$USER_PAT"
+          echo "token=$USER_PAT" >> "$GITHUB_OUTPUT"
+          echo "source=user-pat" >> "$GITHUB_OUTPUT"
+          echo "Using per-user PAT for PR creation"
+        else
+          echo "::add-mask::$BOT_TOKEN"
+          echo "token=$BOT_TOKEN" >> "$GITHUB_OUTPUT"
+          echo "source=bot-fallback" >> "$GITHUB_OUTPUT"
+          echo "No per-user PAT found; falling back to bot token"
+        fi
+
     - id: send_pr
       name: Create PR if needed.
       uses: The-OpenROAD-Project/actions/send_pr@main
       env:
-        STAGING_GITHUB_TOKEN: ${{ secrets.STAGING_GITHUB_TOKEN }}
+        STAGING_GITHUB_TOKEN: ${{ steps.resolve_token.outputs.token }}
 
     - name: Linking to PR using deployment.
       uses: The-OpenROAD-Project/actions/link_pr@main

.github/workflows/github-actions-on-push.yml

@@ -11,6 +11,6 @@ jobs:
     runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted' || 'ubuntu-latest' }}
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: run security_scan_on_push
         uses: The-OpenROAD-Project/actions/security_scan_on_push@main

.github/workflows/github-actions-publish-docker-images.yml

@@ -30,24 +30,24 @@ jobs:
     runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted' || 'ubuntu-latest' }}
     timeout-minutes: 600
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Set environment variables
         run: echo "IMAGE=ghcr.io/$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4.1.0
 
       - name: Login to GitHub Container Registry (GHCR)
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
         with:
           registry: ghcr.io
           username: gha
           password: ${{ github.token }}
 
       - name: Build and export codespaces image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
         with:
           context: .
           push: true
@@ -64,7 +64,7 @@ jobs:
     runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted' || 'ubuntu-latest' }}
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 1
           submodules: recursive
@@ -74,11 +74,11 @@ jobs:
           echo "IMAGE_DEPS=ghcr.io/$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]')-dev/${{ matrix.os[0] }}" >> $GITHUB_ENV
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4.1.0
 
       - name: Login to GitHub Container Registry (GHCR)
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
         with:
           registry: ghcr.io
           username: gha
@@ -88,7 +88,7 @@ jobs:
         run: cp tools/OpenROAD/etc/DependencyInstaller.sh etc/InstallerOpenROAD.sh
 
       - name: Build and export dependencies image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
         with:
           context: etc
           push: true
@@ -108,12 +108,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Free Disk Space
-        uses: jlumbroso/free-disk-space@main
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be  # v1.3.1
         with:
           tool-cache: false
 
       - name: Check out repository code
-        uses: actions/checkout@v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 1
           submodules: recursive
@@ -125,18 +125,18 @@ jobs:
           echo "NUM_THREADS=$(nproc)" >> $GITHUB_ENV
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4.1.0
 
       - name: Login to GitHub Container Registry (GHCR)
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
         with:
           registry: ghcr.io
           username: gha
           password: ${{ github.token }}
 
       - name: Build and export ORFS image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
         with:
           context: .
           push: true

.github/workflows/github-actions-quarterly-tag.yml

@@ -0,0 +1,52 @@
+name: Quarterly Release Tag
+
+on:
+  schedule:
+    # Midnight UTC on the first day of each quarter (Jan, Apr, Jul, Oct)
+    - cron: '0 0 1 1,4,7,10 *'
+  workflow_dispatch:
+
+concurrency:
+  group: quarterly-tag
+  cancel-in-progress: false
+
+jobs:
+  create-tag:
+    name: Create quarterly tag
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+
+      - name: Determine tag name
+        id: tag
+        run: |
+          month=$(date -u +%-m)
+          year=$(date -u +%y)
+          case $month in
+          1|2|3)   quarter=1 ;;
+          4|5|6)   quarter=2 ;;
+          7|8|9)   quarter=3 ;;
+          10|11|12) quarter=4 ;;
+          esac
+          tag="${year}Q${quarter}"
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "Quarterly tag: $tag"
+
+      - name: Configure git user
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Create and push tag
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          if git ls-remote --tags origin "refs/tags/$TAG" | grep -q .; then
+          echo "Tag $TAG already exists, skipping."
+          exit 0
+          fi
+          git tag --annotate "$TAG" -m "Quarterly release $TAG"
+          git push origin "$TAG"