Merge branch 'main' into fix-density-matrix-overlap-dimension

Author: khalatepradnya

.github/workflows/ci_macos.yml

@@ -1,4 +1,7 @@
 on:
+  # Daily rebuild on main to ensure devdeps rebuilt as needed
+  schedule:
+    - cron: '0 4 * * *'  # aim to be ready by 9am CET/CEST
   workflow_dispatch:
     inputs:
       cache_base:
@@ -246,8 +249,13 @@ jobs:
 
       - name: Validate wheel
         run: |
-          # Full validation: core tests, examples, snippets, backends
-          # GPU/MPI tests are automatically skipped on macOS (CPU-only)
+          # Validates wheel: core tests, examples, snippets, backends.
+          # GPU/remote targets are skipped (no CUDA on macOS runners).
+          # TODO: When adding macOS to publishing.yml, align the validation
+          # approach with python_wheels.yml (which uses
+          # explicit find exclusions for platform/backends/dynamics paths,
+          # and does not use validate_pycudaq.sh for snippets/examples
+          # currently used in python_wheels.yml).
           bash scripts/validate_pycudaq.sh \
             -v ${{ needs.wheel.outputs.cudaq_version }} \
             -i dist \

.github/workflows/codeql.yml

@@ -88,8 +88,8 @@ jobs:
       with:
         category: "/language:${{matrix.language}}"
 
-  # The CodeQL action status is not reported in merge queues. See https://github.com/github/codeql-action/issues/1537.
-  # This is a workaround to check the status of the CodeQL analysis in the PR but not in the merge queue. See https://github.com/orgs/community/discussions/46757#discussioncomment-7768838
+  # CodeQL status is not reported in merge queues. See https://github.com/github/codeql-action/issues/1537.
+  # Workaround: verify CodeQL passed via API keyed by pull_request.number so the PR gets a required status.
   check_codeql_status:
       name: Check CodeQL Status
       needs: analyze
@@ -105,21 +105,29 @@ jobs:
                 gh auth login --with-token <<< "${{ secrets.GITHUB_TOKEN }}"
           - name: Check CodeQL Status
             run: |
-                response=$(gh api graphql -f query='
-                  {
-                    repository(owner: "${{ github.event.repository.owner.login }}", name: "${{ github.event.repository.name }}") {
-                      pullRequest(number: ${{ github.event.pull_request.number }}) {
-                        commits(last: 1) {
-                          nodes {
-                            commit {
-                              checkSuites(first: 1, filterBy: {checkName: "CodeQL"}) {
-                                nodes {
-                                  checkRuns(first: 1) {
-                                    nodes {
-                                      name
-                                      status
-                                      conclusion
-                                    }
+              # Query by pull_request.number so the check is tied to the PR (required for merge-queue workaround).
+              # Find the "Analyze (language)" check run (the one that completes); filterBy "CodeQL" returns a different check that stays QUEUED.
+              pr_number="${{ github.event.pull_request.number }}"
+              owner="${{ github.event.repository.owner.login }}"
+              repo="${{ github.event.repository.name }}"
+              max_attempts=24
+              attempt=0
+              conclusion=""
+              while [ $attempt -lt $max_attempts ]; do
+                # Inline pr_number in the query so we only pass string variables (gh -f sends all as strings otherwise).
+                response=$(gh api graphql -f query="query(\$owner: String!, \$repo: String!) {
+                  repository(owner: \$owner, name: \$repo) {
+                    pullRequest(number: $pr_number) {
+                      commits(last: 1) {
+                        nodes {
+                          commit {
+                            checkSuites(first: 20) {
+                              nodes {
+                                checkRuns(first: 20) {
+                                  nodes {
+                                    name
+                                    status
+                                    conclusion
                                   }
                                 }
                               }
@@ -129,10 +137,26 @@ jobs:
                       }
                     }
                   }
-                ')
-                conclusion=$(echo $response | jq -r '.data.repository.pullRequest.commits.nodes[0].commit.checkSuites.nodes[0].checkRuns.nodes[0].conclusion')
-                  if [ "$conclusion" != "SUCCESS" ]; then
-                    echo "$response"
-                    echo "CodeQL check failed"
-                    exit 1
-                  fi
+                }" -f owner="$owner" -f repo="$repo")
+                # Find the check run whose name starts with "Analyze (" (the CodeQL matrix job)
+                conclusion=$(echo "$response" | jq -r '
+                  .data.repository.pullRequest.commits.nodes[0].commit.checkSuites.nodes[]
+                  | .checkRuns.nodes[] | select(.name | startswith("Analyze (")) | .conclusion
+                ' | head -1)
+                status=$(echo "$response" | jq -r '
+                  .data.repository.pullRequest.commits.nodes[0].commit.checkSuites.nodes[]
+                  | .checkRuns.nodes[] | select(.name | startswith("Analyze (")) | .status
+                ' | head -1)
+                if [ "$conclusion" != "null" ] && [ -n "$conclusion" ]; then
+                  break
+                fi
+                attempt=$((attempt + 1))
+                echo "CodeQL check (PR #$pr_number) status=$status conclusion=$conclusion (attempt $attempt/$max_attempts), waiting 10s..."
+                sleep 10
+              done
+              if [ "$conclusion" != "SUCCESS" ]; then
+                echo "$response" | jq .
+                echo "CodeQL check failed (conclusion=$conclusion)"
+                exit 1
+              fi
+              echo "CodeQL check passed."

.github/workflows/dev_environment_macos.yml

@@ -50,7 +50,8 @@ jobs:
       platform_tag: ${{ steps.build_info.outputs.platform_tag }}
       owner: ${{ steps.build_info.outputs.owner }}
       pr_number: ${{ steps.build_info.outputs.pr_number }}
-      image_name: ${{ steps.build_info.outputs.image_name }}
+      scripts_hash: ${{ steps.build_info.outputs.scripts_hash }}
+      image_name_base: ${{ steps.build_info.outputs.image_name_base }}
 
     environment:
       name: ${{ inputs.environment || 'default' }}
@@ -89,28 +90,28 @@ jobs:
           # when the copied files change), macOS uses ORAS artifact caching with no
           # content-based invalidation. This hash ensures cache is rebuilt when
           # build scripts change. Update this list if new files affect the build.
-          deps_hash=$(cat \
+          scripts_hash=$(cat \
             scripts/install_prerequisites.sh \
             scripts/build_llvm.sh \
             scripts/set_env_defaults.sh \
             | sha256sum | cut -c1-8)
-          echo "deps_hash=$deps_hash"
+          echo "scripts_hash=$scripts_hash" >> $GITHUB_OUTPUT
 
           # Registry and image name
-          image_name=ghcr.io/${repo_owner,,}/${{ vars.packages_prefix }}cuda-quantum-macos-devdeps
+          image_name_base=ghcr.io/${repo_owner,,}/${{ vars.packages_prefix }}cuda-quantum-macos-devdeps
           if [ -n "$pr_number" ]; then
-            image_name=${image_name}-ci
+            image_name_base=${image_name_base}-ci
           fi
 
           registry_cache_base=$(echo ${{ inputs.registry_cache_from || github.event.pull_request.base.ref || 'main' }} | tr / -)
-          image_name="${image_name}:${platform_tag}-${registry_cache_base}-${deps_hash}"
-          echo "image_name=$image_name" >> $GITHUB_OUTPUT
+          image_name_base="${image_name_base}:${platform_tag}-${registry_cache_base}-"
+          echo "image_name_base=$image_name_base" >> $GITHUB_OUTPUT
 
   build:
     name: Build macOS Cache
     needs: metadata
     runs-on: ${{ needs.metadata.outputs.runner }}
-    timeout-minutes: 180
+    timeout-minutes: 240
     permissions:
       contents: read
       packages: write
@@ -136,14 +137,27 @@ jobs:
       - name: Log in to GitHub CR
         run: echo "${{ github.token }}" | oras login ghcr.io -u ${{ github.actor }} --password-stdin
 
+      - name: Compute cache key
+        id: cache_key
+        run: |
+          # Combine build scripts hash with the runner image version to detect
+          # tool updates (cmake, compilers, etc.) that would invalidate the cache.
+          scripts_hash=${{ needs.metadata.outputs.scripts_hash }}
+          runner_image=${ImageVersion:-unknown}
+          deps_hash=$(echo "${scripts_hash}-${runner_image}" | shasum -a 256 | cut -c1-8)
+          image_name="${{ needs.metadata.outputs.image_name_base }}${deps_hash}"
+          echo "image_name=$image_name" >> $GITHUB_OUTPUT
+          echo "Cache key: scripts_hash=$scripts_hash runner_image=$runner_image deps_hash=$deps_hash"
+          echo "Image name: $image_name"
+
       - name: Check for cached image
         id: cache_check
         run: |
-          if oras manifest fetch ${{ needs.metadata.outputs.image_name }} > /dev/null 2>&1; then
-            echo "Cache hit: ${{ needs.metadata.outputs.image_name }}"
+          if oras manifest fetch ${{ steps.cache_key.outputs.image_name }} > /dev/null 2>&1; then
+            echo "Cache hit: ${{ steps.cache_key.outputs.image_name }}"
             echo "cache_hit=true" >> $GITHUB_OUTPUT
           else
-            echo "Cache miss: ${{ needs.metadata.outputs.image_name }}"
+            echo "Cache miss: ${{ steps.cache_key.outputs.image_name }}"
             echo "cache_hit=false" >> $GITHUB_OUTPUT
           fi
 
@@ -177,12 +191,12 @@ jobs:
           ls -lh macos-artifacts.tar.gz
           
           # Push directly to GHCR as OCI artifact using ORAS
-          oras push ${{ needs.metadata.outputs.image_name }} \
+          oras push ${{ steps.cache_key.outputs.image_name }} \
             macos-artifacts.tar.gz:application/gzip
           
           # Get digest for signing
-          digest=$(oras manifest fetch ${{ needs.metadata.outputs.image_name }} --descriptor | jq -r '.digest')
-          echo "digest=${{ needs.metadata.outputs.image_name }}@${digest}" >> $GITHUB_OUTPUT
+          digest=$(oras manifest fetch ${{ steps.cache_key.outputs.image_name }} --descriptor | jq -r '.digest')
+          echo "digest=${{ steps.cache_key.outputs.image_name }}@${digest}" >> $GITHUB_OUTPUT
 
       - name: Install Cosign
         if: steps.cache_check.outputs.cache_hit != 'true' && steps.push_image.outputs.digest != ''
@@ -201,10 +215,10 @@ jobs:
         run: |
           if [ "${{ steps.cache_check.outputs.cache_hit }}" == "true" ]; then
             # Cache hit - use tag reference directly
-            echo "image_hash=${{ needs.metadata.outputs.image_name }}" >> $GITHUB_OUTPUT
+            echo "image_hash=${{ steps.cache_key.outputs.image_name }}" >> $GITHUB_OUTPUT
           else
             # Cache miss - use digest after push
-            echo "image_hash=${{ steps.push_image.outputs.digest || needs.metadata.outputs.image_name }}" >> $GITHUB_OUTPUT
+            echo "image_hash=${{ steps.push_image.outputs.digest || steps.cache_key.outputs.image_name }}" >> $GITHUB_OUTPUT
           fi
 
   finalize:

CMakeLists.txt

@@ -216,7 +216,7 @@ SET(CMAKE_SKIP_INSTALL_RPATH FALSE)
 SET(CMAKE_BUILD_WITH_INSTALL_RPATH TRUE)
 SET(CMAKE_INSTALL_RPATH_USE_LINK_PATH TRUE)
 if(APPLE)
-  SET(CMAKE_INSTALL_RPATH "@executable_path;@executable_path/lib;@executable_path/lib/plugins;@executable_path/../lib;@executable_path/../lib/plugins")
+  SET(CMAKE_INSTALL_RPATH "@loader_path;@loader_path/lib;@loader_path/lib/plugins;@loader_path/../lib;@loader_path/../lib/plugins;@executable_path;@executable_path/lib;@executable_path/lib/plugins;@executable_path/../lib;@executable_path/../lib/plugins")
 else()
   SET(CMAKE_INSTALL_RPATH "$ORIGIN:$ORIGIN/lib:$ORIGIN/lib/plugins:$ORIGIN/../lib:$ORIGIN/../lib/plugins")
 endif()