[CI] Switch pre-commit to a new scheme (intel#10720)

Use pull_request trigger (instead of pull_request_target) for
everything except AWS CUDA E2E testing. The latter has to go to a
separate workflow (workflow_run) in order to have access to the AWS EC
key kept as a github secret.

As part of the changes, I also stopped using matrix generator for the
pre-commit task. Instead, the matrix is written directly inside the
task's .yml file. The only minor difference in the behavior is that
driver installation happens on an image with previous driver installed,
not on a system without any driver.

.github/workflows/sycl_precommit_aws.yml

@@ -1,8 +1,15 @@
 name: E2E on AWS CUDA
+# We have to keep pre-commit AWS CUDA testing in a separate workflow because we
+# need access to AWS secret and that isn't available on pull_request jobs for
+# PRs from forks. And github's "require approval for all outside collaborators"
+# is bypassed on pull_request_target.
+#
+# Also, we use commit status and not check suite/run (which, in theory, is more
+# powerful) due to https://github.com/orgs/community/discussions/24616.
 
 on:
   workflow_run:
-    workflows: [SYCL Experimental Pre-Commit]
+    workflows: [SYCL Pre Commit on Linux]
     types:
       - completed
 

.github/workflows/sycl_precommit_linux.yml

@@ -1,11 +1,13 @@
 name: SYCL Pre Commit on Linux
 
 on:
-  pull_request_target:
+  # We rely on "Fork pull request workflows from outside collaborators" -
+  # "Require approval for all outside collaborators" at
+  # https://github.com/intel/llvm/settings/actions for security.
+  pull_request:
     branches:
     - sycl
     - sycl-devops-pr/**
-    - llvmspirv_pulldown
     # Do not run builds if changes are only in the following locations
     paths-ignore:
     - '.github/ISSUE_TEMPLATE/**'
@@ -15,32 +17,19 @@ on:
     - 'clang/docs/**'
     - '**.md'
     - '**.rst'
-    # Changes in CI won't have any effect with pull_request_target
-    - '.github/workflows'
-    # For CI-related files we explicitly skip all the jobs below even if there
-    # were other (non-ignored) files modified in this PR.
-    - 'devops/*/**'
-
-permissions:
-  contents: read
 
 jobs:
   detect_changes:
     uses: ./.github/workflows/sycl_detect_changes.yml
 
   lint:
-    needs: [detect_changes]
-    if: |
-      github.event.pull_request.head.repo.full_name == 'intel/llvm' ||
-      !contains(needs.detect_changes.outputs.filters, 'ci')
     runs-on: [Linux, build]
     container:
       image: ghcr.io/intel/llvm/sycl_ubuntu2204_nightly:no-drivers
       options: -u 1001:1001
     steps:
     - uses: actions/checkout@v3
       with:
-        ref: ${{ github.base_ref }}
         sparse-checkout: |
           devops/actions/cached_checkout
           devops/actions/clang-format
@@ -61,36 +50,55 @@ jobs:
       with:
         path: src
 
-  # This job generates matrix of tests for SYCL End-to-End tests
-  test_matrix:
-    needs: [detect_changes]
-    if: |
-      github.event.pull_request.head.repo.full_name == 'intel/llvm' ||
-      !contains(needs.detect_changes.outputs.filters, 'ci')
-    name: Generate Test Matrix
-    uses: ./.github/workflows/sycl_gen_test_matrix.yml
-    with:
-      ref: ${{ github.event.pull_request.head.sha }}
-      lts_config: "hip_amdgpu;lin_intel;esimd_emu;cuda_aws"
-
-  linux_default:
-    name: Linux
-    # Only build and test patches, that have passed all linter checks, because
-    # the next commit is likely to be a follow-up on that job.
-    needs: [lint, test_matrix, detect_changes]
+  build:
+    needs: [lint, detect_changes]
     if: |
       always()
       && (success() || contains(github.event.pull_request.labels.*.name, 'ignore-lint'))
-      && (github.event.pull_request.head.repo.full_name == 'intel/llvm'
-          || !contains(needs.detect_changes.outputs.filters, 'ci'))
-    uses: ./.github/workflows/sycl_linux_build_and_test.yml
-    secrets: inherit
+    uses: ./.github/workflows/sycl_linux_build.yml
     with:
-      build_ref: ${{ github.event.pull_request.head.sha }}
-      merge_ref: ${{ github.event.pull_request.base.sha }}
+      build_ref: ${{ github.sha }}
+      merge_ref: ''
       build_cache_root: "/__w/"
       build_artifact_suffix: "default"
       build_cache_suffix: "default"
-      lts_matrix: ${{ needs.test_matrix.outputs.lts_lx_matrix }}
-      lts_aws_matrix: ${{ needs.test_matrix.outputs.lts_aws_matrix }}
       changes: ${{ needs.detect_changes.outputs.filters }}
+
+  test:
+    needs: [build, detect_changes]
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: ESIMD Emu
+            runner: '["Linux", "x86-cpu"]'
+            image: ghcr.io/intel/llvm/ubuntu2204_build:latest
+            image_options: -u 1001
+            target_devices: ext_intel_esimd_emulator:gpu
+          - name: AMD/HIP
+            runner: '["Linux", "amdgpu"]'
+            image: ghcr.io/intel/llvm/ubuntu2204_build:latest
+            image_options: -u 1001 --device=/dev/dri --device=/dev/kfd
+            target_devices: ext_oneapi_hip:gpu
+          - name: Intel
+            runner: '["Linux", "gen12"]'
+            image: ghcr.io/intel/llvm/ubuntu2204_intel_drivers:latest
+            image_options: -u 1001 --device=/dev/dri --privileged --cap-add SYS_ADMIN
+            target_devices: ext_oneapi_level_zero:gpu;opencl:gpu;opencl:cpu
+            reset_gpu: ${{ contains(needs.detect_changes.outputs.filters, 'drivers') }}
+    uses: ./.github/workflows/sycl_linux_run_tests.yml
+    with:
+      name: ${{ matrix.name }}
+      runner: ${{ matrix. runner }}
+      image: ${{ matrix.image }}
+      image_options: ${{ matrix.image_options }}
+      target_devices: ${{ matrix.target_devices }}
+      reset_gpu: ${{ matrix.reset_gpu }}
+
+      ref: ${{ github.sha }}
+      merge_ref: ''
+
+      sycl_toolchain_artifact: sycl_linux_default
+      sycl_toolchain_archive: ${{ needs.build.outputs.artifact_archive_name }}
+      sycl_toolchain_decompress_command: ${{ needs.build.outputs.artifact_decompress_command }}
+