Dev to master -> v2.6.0

.github/actions/lfs-runff/action.yml

@@ -0,0 +1,22 @@
+name: Fetch runff LFS data
+description: >
+  Pulls only the LFS files tests/runff reads (~4 MB of the ~61 MB in LFS),
+  cached by object id so a run downloads nothing unless they change.
+  Checkout must run with `lfs: false` first.
+
+runs:
+  using: composite
+  steps:
+    - name: LFS cache key
+      id: key
+      shell: bash
+      run: echo "key=lfs-runff-$(git lfs ls-files -l -I 'tests/runff/*' | cut -d' ' -f1,3 | git hash-object --stdin)" >> "$GITHUB_OUTPUT"
+
+    - uses: actions/cache@v6
+      with:
+        path: .git/lfs
+        key: ${{ steps.key.outputs.key }}
+
+    - name: Pull runff LFS data
+      shell: bash
+      run: git lfs pull --include="tests/runff/*"

.github/workflows/docker.yml

@@ -2,12 +2,20 @@ name: 📦 Build & Test Docker Image
 
 on:
   push:
+    paths-ignore: [ "docs/**", "**/*.md" ]
     branches: [ "master" ]
     tags: [ 'v*.*.*' ]
   pull_request:
+    paths-ignore: [ "docs/**", "**/*.md" ]
     branches: [ "master" ]
   workflow_dispatch:
 
+# A new push to a PR cancels its older run. Pushes to branches, tags and
+# releases each get their own group, so none is ever queued or dropped.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
@@ -23,18 +31,20 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v6
         with:
-          lfs: true
+          lfs: false # only tests/runff is needed, fetched below
+
+      - uses: ./.github/actions/lfs-runff
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -45,7 +55,7 @@ jobs:
 
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           # Only push if the ref starts with 'refs/tags/'

.github/workflows/invariants.yml

@@ -0,0 +1,65 @@
+name: 🔬 Model Invariants (Linux)
+
+# Complements the runff test in main.yml. That one compares ForeFire against
+# frozen ForeFire output, so it cannot distinguish a physics fix from a
+# physics regression. This one asserts properties that follow from the
+# published spread equations and holds no reference data.
+#
+# It is a separate workflow because it needs the pyforefire extension, which
+# install-forefire.sh does not build: outside a wheel build, CMakeLists
+# defaults FOREFIRE_BUILD_PYTHON to OFF.
+
+on:
+  push:
+    paths-ignore: [ "docs/**", "**/*.md" ]
+    branches:
+      - "master"
+      - "dev"
+  pull_request:
+    paths-ignore: [ "docs/**", "**/*.md" ]
+    branches: [ "master", "dev" ]
+  workflow_dispatch:
+
+# A new push to a PR cancels its older run. Pushes to branches, tags and
+# releases each get their own group, so none is ever queued or dropped.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  invariants:
+    name: Dead fuel moisture invariants
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      # No `lfs: true` here, unlike main.yml. The suite builds its fuel, wind,
+      # temperature and moisture layers in memory and needs no fixtures.
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Install Dependencies
+        run: |
+          sudo apt-get update -y
+          sudo apt-get install -y --no-install-recommends \
+            build-essential cmake python3 python3-pip python3-venv
+          # NetCDF C++ legacy API for the build, C base at runtime
+          sudo apt-get install -y --no-install-recommends \
+            libnetcdf-dev libnetcdf-c++4-dev
+
+      - name: Build and install pyforefire
+        # A venv keeps this clear of PEP 668 externally-managed system Python.
+        # pip's build isolation pulls scikit-build-core and pybind11 from
+        # pyproject.toml, and numpy comes in as a runtime dependency.
+        run: |
+          python3 -m venv .venv
+          ./.venv/bin/python -m pip install --upgrade pip
+          ./.venv/bin/python -m pip install .
+
+      - name: Check pyforefire imports
+        run: ./.venv/bin/python -c "import pyforefire; print(pyforefire.__file__)"
+
+      - name: Run dead fuel moisture invariants
+        run: ./.venv/bin/python tests/python/test_moisture_invariants.py
+
+      - name: Run the worker process runner test
+        run: ./.venv/bin/python tests/python/test_runner.py

.github/workflows/macos.yml

@@ -2,30 +2,48 @@ name: 🧪 Test Native (macOS)
 
 on:
   push:
+    paths-ignore: [ "docs/**", "**/*.md" ]
     branches:
       - brew
   pull_request:
-    branches: [ "master" ]  
+    paths-ignore: [ "docs/**", "**/*.md" ]
+    branches: [ "master", "dev" ]
   workflow_dispatch:
 
+# A new push to a PR cancels its older run. Pushes to branches, tags and
+# releases each get their own group, so none is ever queued or dropped.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   build-native-macos:
     runs-on: macos-latest
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
         with:
-          lfs: true
+          lfs: false # only tests/runff is needed, fetched below
+
+      - uses: ./.github/actions/lfs-runff
 
       - name: Make install script executable
         run: chmod +x ./install-forefire-osx.sh
 
       - name: Build ForeFire using macOS install script
+        # The LFS check would curl back the LFS files the step above skips.
+        env:
+          FOREFIRE_CHECK_LFS: "OFF"
         run: ./install-forefire-osx.sh
 
       - name: Check ForeFire version
         run: ./bin/forefire -v
 
+      # Also the check that the recorded rates of spread survive a different
+      # compiler and a different CPU.
+      - name: Run C++ unit tests
+        run: ctest --test-dir build --output-on-failure
+
       - name: Install Python test dependencies
         run: pip3 install --break-system-packages lxml xarray netCDF4
 

.github/workflows/main.yml

@@ -2,21 +2,31 @@ name: 🧪 Test Native (Linux)
 
 on:
   push:
+    paths-ignore: [ "docs/**", "**/*.md" ]
     branches:
       - "master"
-      # - "dev"
+      - "dev"
   pull_request:
-    branches: [ "master" ]
+    paths-ignore: [ "docs/**", "**/*.md" ]
+    branches: [ "master", "dev" ]
   workflow_dispatch:
 
+# A new push to a PR cancels its older run. Pushes to branches, tags and
+# releases each get their own group, so none is ever queued or dropped.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   build-native:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
         with:
-          lfs: true # we use LFS to store large files (e.g. data.nc)
+          lfs: false # only tests/runff is needed, fetched below
+
+      - uses: ./.github/actions/lfs-runff
 
       - name: Verify LFS test asset (data.nc)
         run: |
@@ -38,11 +48,24 @@ jobs:
           pip3 install --no-cache-dir lxml xarray netCDF4
 
       - name: ForeFire build
-        run: sudo bash ./install-forefire.sh -y
+        # The LFS check would curl back the LFS files the step above skips.
+        run: sudo env FOREFIRE_CHECK_LFS=OFF bash ./install-forefire.sh -y
 
       - name: Check ForeFire version
         run: ./bin/forefire -v
 
+      # The unit tests are built by install-forefire.sh along with everything
+      # else (FOREFIRE_BUILD_TESTS defaults on outside wheel builds), so this
+      # only has to run them. They cover the propagation and flux models one
+      # call at a time, which is what runff below cannot reach: it exercises a
+      # single case through Rothermel.
+      - name: Run C++ unit tests
+        run: |
+          # The build step above runs under sudo, so build/ is root-owned and
+          # ctest cannot create build/Testing/Temporary as the runner user.
+          sudo chown -R "$(id -u):$(id -g)" build
+          ctest --test-dir build --output-on-failure
+
       - name: Add Build/Runtime Diagnostics
         run: |
           echo "--- ForeFire Linkage ---"
@@ -56,4 +79,13 @@ jobs:
       - name: Run 'runff' Test Script
         run: |
           cd tests/runff
-          bash ff-run.bash # Execute the complete test logic script
+          bash ff-run.bash # Execute the complete test logic script
+
+      # The only coverage for ANNPropagationModel and BMapLoggerForANNTraining:
+      # both read a .ffann network in their constructor and abort without one,
+      # so the unit suite cannot reach them. ANN_test is built by the step
+      # above, since FOREFIRE_BUILD_TOOLS defaults on outside wheel builds.
+      - name: Run 'runANN' Test Script
+        run: |
+          cd tests/runANN
+          bash run.bash

.github/workflows/sanitizers.yml

@@ -0,0 +1,96 @@
+name: 🧼 Sanitizers (Linux)
+
+# AddressSanitizer over both test paths: the unit suite, which constructs and
+# destroys every propagation and flux model one call at a time, and runff,
+# which runs a full simulation with a reload and NetCDF and KML output.
+#
+# This is a blocking check from the day it lands, which is only possible
+# because ForeFire reports zero ASan errors today — no use-after-free, no
+# overflow, no double free, on either path. There is no backlog to clear
+# first, and the point of turning it on now is to keep it that way. See #162.
+#
+# Leaks are blocking for the unit suite. They were not when this job landed —
+# nothing owned a PropagationModel, so ASan reported every one as leaked, about
+# 4.7 MB in all. #159 gave the models, the propagative layer and two orphaned
+# constant-layer arrays an owner, which took the unit suite to zero, so the
+# gate went on. runff still leaks ~200 kB on paths the unit suite does not
+# reach, so its leak check stays informational until those are found too.
+#
+# A separate workflow rather than a job in main.yml because it needs its own
+# build: install-forefire.sh builds with -O3 -flto -fomit-frame-pointer, which
+# is the opposite of what a sanitizer wants.
+
+on:
+  push:
+    paths-ignore: [ "docs/**", "**/*.md" ]
+    branches:
+      - "master"
+      - "dev"
+  pull_request:
+    paths-ignore: [ "docs/**", "**/*.md" ]
+    branches: [ "master", "dev" ]
+  workflow_dispatch:
+
+# A new push to a PR cancels its older run. Pushes to branches, tags and
+# releases each get their own group, so none is ever queued or dropped.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  address-sanitizer:
+    name: AddressSanitizer
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          lfs: false # only tests/runff is needed, fetched below
+
+      - uses: ./.github/actions/lfs-runff
+
+      - name: Install Dependencies
+        run: |
+          sudo apt-get update -y
+          sudo apt-get install -y --no-install-recommends \
+            build-essential cmake python3 python3-pip
+          sudo apt-get install -y --no-install-recommends \
+            libnetcdf-dev libnetcdf-c++4-dev
+          pip3 install --no-cache-dir --break-system-packages lxml xarray netCDF4
+
+      - name: Build with AddressSanitizer
+        # FOREFIRE_SANITIZE also switches the compile flags to -g -O1
+        # -fno-omit-frame-pointer, so the stack traces are readable.
+        run: |
+          cmake -S . -B build-asan -DFOREFIRE_SANITIZE=address -DFOREFIRE_CHECK_LFS=OFF
+          cmake --build build-asan -j"$(nproc)"
+
+      # Leaks are blocking here: the unit suite reports none since the model
+      # and layer ownership fix in #159, and this is what keeps it that way.
+      - name: Unit tests under ASan
+        env:
+          ASAN_OPTIONS: detect_leaks=1
+        run: ctest --test-dir build-asan --output-on-failure
+
+      # runff still leaks about 200 kB over 783 allocations, on paths a single
+      # simulation reaches and the unit suite does not, so its leak check stays
+      # informational below. Errors are blocking here as they always were.
+      - name: runff under ASan
+        env:
+          ASAN_OPTIONS: detect_leaks=0
+        run: |
+          cd tests/runff
+          bash ff-run.bash
+
+      # Informational only, and only for runff now. Keeps the figure visible so
+      # the remaining ownership gaps can be found and this can join the gate.
+      - name: runff leak report (informational)
+        continue-on-error: true
+        env:
+          ASAN_OPTIONS: detect_leaks=1
+        run: |
+          echo "::group::runff leaks"
+          cd tests/runff
+          bash ff-run.bash || true
+          echo "::endgroup::"