ci: migrate to Miniforge and restore GPU tests

.github/workflows/build-upload-conda.yml

@@ -42,21 +42,25 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Create and activate conda env
-        uses: conda-incubator/setup-miniconda@fc2d68f6413eb2d87b895e92f8584b5b94a10167
+      - name: Setup and activate base conda env
+        uses: conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 # v4.0.1
         with:
-          python-version: "3.12"
+          # Keep Conda and conda-build on conda-forge so its build plugin loads.
+          miniforge-version: "26.3.2-3"
+          conda-remove-defaults: true
+          activate-environment: ""
+          auto-activate: true
           auto-update-conda: false
           show-channel-urls: true
 
       - name: Build and upload pyomp
         # This ensures conda env is active.
         shell: bash -l {0}
         run: |
-          # Setup the anaconda environment.
-          conda remove --name base conda-anaconda-telemetry
-          conda install -q -y -c conda-forge conda-build conda-verify anaconda-client
+          # Setup the conda-forge environment.
+          conda install -n base -q -y --override-channels -c conda-forge conda-build anaconda-client
           conda config --set anaconda_upload no
+          conda build --version
 
           # Build the package.
           conda build \
@@ -70,7 +74,7 @@ jobs:
             buildscripts/conda-recipes/pyomp)
 
           # Upload the package.
-          anaconda -t ${{ secrets.ANACONDA_TOKEN }} upload \
+          conda run -n base anaconda -t ${{ secrets.ANACONDA_TOKEN }} upload \
             --user python-for-hpc --label ${{ env.CONDA_LABEL}} \
             --force "$OUTPUT"
 

.github/workflows/build-upload-wheels.yml

@@ -6,9 +6,20 @@ permissions:
 on:
   release:
     types: [published]
+  push:
+    branches: [main]
+    paths:
+      - "buildscripts/cibuildwheel/**"
+      - "buildscripts/modal/**"
+      - ".github/workflows/build-upload-wheels.yml"
+      - "src/**"
+      - setup.py
+      - MANIFEST.in
+      - pyproject.toml
   pull_request:
     paths:
       - "buildscripts/cibuildwheel/**"
+      - "buildscripts/modal/**"
       - ".github/workflows/build-upload-wheels.yml"
       - "src/**"
       - setup.py
@@ -110,9 +121,61 @@ jobs:
           OMP_TARGET_OFFLOAD=mandatory TEST_DEVICE=host RUN_TARGET=1 \
             python -m numba.runtests -v -- numba.openmp.tests.test_openmp.TestOpenmpTarget
 
+  # Test Linux wheels on a real NVIDIA GPU. Fork PRs run after merging to main,
+  # where Modal credentials are available to trusted code.
+  test-modal-gpu:
+    needs: build-wheels
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    concurrency:
+      group: modal-gpu-${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: true
+    env:
+      MODAL_TOKEN_ID: ${{ secrets.MODAL_TOKEN_ID }}
+      MODAL_TOKEN_SECRET: ${{ secrets.MODAL_TOKEN_SECRET }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+
+      - name: Download Linux wheels
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
+        with:
+          pattern: cibw-wheels-ubuntu-latest-*
+          path: dist
+          merge-multiple: true
+
+      - name: Setup Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: "3.12"
+
+      - name: Validate Modal credentials
+        shell: bash
+        run: |
+          if [[ -z "$MODAL_TOKEN_ID" || -z "$MODAL_TOKEN_SECRET" ]]; then
+            echo "::error::MODAL_TOKEN_ID and MODAL_TOKEN_SECRET must be configured"
+            exit 1
+          fi
+
+      - name: Run GPU tests on Modal
+        run: |
+          python -m pip install modal==1.5.3
+          set +e
+          timeout --signal=TERM --kill-after=30s 10m \
+            modal run --timestamps buildscripts/modal/test_gpu.py
+          modal_status=$?
+          set -e
+
+          if [[ $modal_status -eq 124 ]]; then
+            echo "::error::Modal GPU tests exceeded the 10-minute timeout"
+            exit 1
+          fi
+          exit "$modal_status"
+
   # Only on pre-release: Publish to TestPyPI for testing.
   publish-testpypi:
-    needs: [build-wheels, test-wheels, build-sdist]
+    needs: [build-wheels, test-wheels, test-modal-gpu, build-sdist]
     if: github.event.release.prerelease
     runs-on: ubuntu-latest
     environment: testpypi
@@ -133,7 +196,7 @@ jobs:
 
   # Only on full release: Publish to production PyPI.
   publish-pypi:
-    needs: [build-wheels, test-wheels, build-sdist]
+    needs: [build-wheels, test-wheels, test-modal-gpu, build-sdist]
     if: github.event_name == 'release' && !github.event.release.prerelease
     runs-on: ubuntu-latest
     environment: pypi