CI: deduplicate reusable CI workflows

[luohuan19]

Summary

• Add canonical reusable CI workflows for the duplicated job bodies shared by .github/workflows/ci.yml and .github/workflows/ci-self-cpu.yml:
  • _detect-changes.yml
  • _pre-commit.yml
  • _ut-no-hardware.yml
  • _packaging.yml
  • _profiling-flags-smoke.yml
  • _st-sim.yml
  • _ut-npu.yml
  • _st-npu.yml
• Reduce ci.yml and ci-self-cpu.yml to topology callers: triggers, needs, gate if: expressions, matrices, runner labels, setup variants, and PR/fork checkout inputs.
• Extract repeated pip-cache and venv scaffolding into composite actions under .github/actions/.
• Keep /run-cpu compatibility: ci-self-cpu.yml still supports workflow_call and workflow_dispatch, still accepts repository / ref, and still runs the emergency lane on [self-hosted, cpu] plus NPU pools.
• Update CI docs and change-detection rules to describe the reusable workflow layout and to keep CI implementation workflows out of NON_CODE.

Behavior notes

• Main CI preserves GitHub-hosted no-hardware matrices and NPU runner labels.
• CPU emergency lane preserves its explicit repository@ref checkout path for fork PRs and manual dispatch.
• Caller workflows keep their previous needs shape: main CI gated jobs still need both detect-changes and pre-commit; CPU lane jobs still only need detect-changes.
• a2a3 SDMA selection is parameterized so main CI keeps marker-based selection while the CPU lane keeps its legacy path-limited emergency behavior.

Closes #1639

Validation

• git diff --check
• YAML parse for every .github/workflows/*.yml and .github/actions/*/action.yml
• actionlint -config-file <self-hosted labels config> .github/workflows/*.yml
• Local output consistency check between _detect-changes.yml declarations and ci.yml / ci-self-cpu.yml consumers

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b03ccb61-1632-4c74-96ed-da0116b2ab81

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Changes

CI Change Detection

Layer / File(s)	Summary
Canonical detector and classifications .github/workflows/_detect-changes.yml	Adds a reusable workflow that resolves commits, computes changed files, fails open when attribution fails, and emits centralized classification outputs.
CI workflow integration .github/workflows/ci.yml, .github/workflows/ci-self-cpu.yml, docs/ci.md	Both CI workflows invoke the canonical detector with lane-specific inputs and runners. The documentation describes the shared implementation and outputs.
Detection rules and verification .claude/rules/ci-change-detection.md	Updates maintenance and verification rules for the canonical detector and its consumers.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related issues

• [Code Health] Deduplicate jobs between ci.yml and ci-self-cpu.yml workflows #1639: Centralizes detect-changes in _detect-changes.yml for both CI workflows.

Possibly related PRs

• hw-native-sys/simpler#1589: Earlier changes to the inline ci.yml detector are replaced by the reusable workflow.
• hw-native-sys/simpler#1590: Test-category outputs are centralized in the reusable workflow.
• hw-native-sys/simpler#1635: The reusable workflow centralizes its tests_only detection logic.

Poem

A rabbit checks the changed-file trail,
One shared workflow guards each rail.
CPU and main now share the view,
With fail-open flags when facts are few.
Carrots cheer the gates in flight! 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly states that CI workflows are being deduplicated through reusable workflows.
Description check	✅ Passed	The description directly explains the reusable workflow extraction, preserved CI behavior, documentation updates, and validation.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.claude/rules/ci-change-detection.md:
- Around line 185-192: Update the declared-output extraction in the workflow
comparison section to limit parsing to the outputs block of _detect-changes.yml,
excluding workflow_call inputs such as repository and ref. Use the existing
awk-based approach or equivalent block-scoped parsing, while preserving the
current normalization and sorting behavior.

In @.github/workflows/_detect-changes.yml:
- Around line 75-80: Update the “Checkout target ref” step to avoid persisting
checkout credentials on the shared self-hosted runner. Confirm whether the
repository is public; for public repositories disable persisted credentials,
while private repositories should use an explicit access token in the base-fetch
URL rather than relying on checkout’s persisted credential. Preserve the
existing repository and ref selection.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 43e917e7-56e8-4aa4-8e64-47273d14738c

📥 Commits

Reviewing files that changed from the base of the PR and between a93a331 and 8dcd97f.

📒 Files selected for processing (5)

• .claude/rules/ci-change-detection.md
• .github/workflows/_detect-changes.yml
• .github/workflows/ci-self-cpu.yml
• .github/workflows/ci.yml
• docs/ci.md

[luohuan19]

/fix-pr

[luohuan19]

/github-pr