One-click build-and-deploy for trusted compiler authors

[mattgodbolt]

Lets trusted compiler authors (Hana, Barry) build and deploy their compilers with a single "Run workflow" click, instead of build → wait → ask an admin to ce_install by hand.

How it works

• compilers.yaml entries can opt in with install: <ce_install pattern> (added for clang_hana and clang_barry; it's one field to extend to others).
• Their generated workflows gain an "Install to Compiler Explorer after a successful build" dispatch input, on by default, and an install job that calls the shared install workflow with the baked-in pattern — nothing for the author to type or get wrong.
• The install only runs for manual dispatches (scheduled builds keep flowing through the admin node's nightly install), and only when the build reports a fresh OK: the daily-build composite action now declares its status output, so SKIPPED (source unchanged) or failed builds never (re-)install. A stale-repo dispatch skips the build, and with it the install.
• install-compilers.yml becomes a reusable workflow (workflow_call) invoked by the generated jobs, keeping its manual dispatch with the enable_nightly/force options intact — both now defaulting off, since a bare pattern like gcc means something very different with nightly enabled. The build-triggered install passes enable_nightly: true, force: true explicitly (reinstalling a freshly built nightly is exactly the forced case). The pattern reaches the script via env vars with globbing disabled, so the input can't smuggle shell syntax.

Also

• Removed an accidental duplicate clang_hana entry (the generator wrote the same file twice).
• README rewritten for the new author flow; CLAUDE.md documents the field.

Behaviour note: the only manual-dispatch change is enable_nightly defaulting off (previously on) — installing a nightly by hand now needs the tickbox. An audit (org-wide code search + all local checkouts) found no script dispatching this workflow; the only reference was the README gh example, updated here.

Validation

Only the two opted-in generated workflows changed — all other build-daily-*.yml regenerate byte-identically. Pre-commit suite passes (yaml check, regeneration up-to-date, tests). An independent review verified the event/skip semantics against documented GitHub Actions behaviour: inputs is empty on schedule, the implicit success() check skips install when daily-build fails or is skipped, and job-level uses: ./… runs the called workflow at the caller's commit. Suggested end-to-end test: gh workflow run build-daily-clang_hana.yml and watch the build → install chain deploy hana-clang-trunk.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR adds an opt-in “one-click” build-and-deploy path for trusted compiler authors by extending the compiler generator to optionally append an install phase after a successful manual dispatch build, using a shared reusable install workflow.

Changes:

• Added an install: field to compilers.yaml and updated make_builds.py to generate dispatch inputs + an install job gated on manual dispatch + fresh OK build status.
• Converted install-compilers.yml into a reusable workflow (workflow_call) and simplified it to always perform the nightly forced install.
• Updated documentation (README + CLAUDE.md) and removed a duplicate clang_hana entry.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
README.md	Documents the new “build + optional install” author flow and updates the gh example.
make_builds.py	Generates dispatch input/output wiring and conditional install job for opted-in compilers.
compilers.yaml	Adds install: patterns for clang_hana and clang_barry and removes duplicate entry.
CLAUDE.md	Documents the new install: field and reusable install workflow.
.github/workflows/install-compilers.yml	Makes install workflow reusable (workflow_call) and always installs with nightly+force.
.github/workflows/build-daily-clang_hana.yml	Generated: adds install input, propagates build status output, and adds install job.
.github/workflows/build-daily-clang_barry.yml	Generated: adds install input, propagates build status output, and adds install job.
.github/actions/daily-build/action.yml	Exposes status as a composite action output for downstream job gating.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mattgodbolt]

Declining this one: it pattern-matches "unquoted expansion = injection" without asking what the injected thing could do that the actor can't already do.

The env-var + set -f handling is about shell injection — the input can't execute commands on the runner. Passing extra flags to ce_install is a far weaker capability, and one dispatchers legitimately have: everyone who can dispatch this workflow has write access (so could edit the workflow itself), and "arbitrary ce_install" is an accepted endpoint for this group — infra's sibling install.yml even treats flag-in-the-input as a feature, and it's been used that way in practice.

The suggested -- terminator also degrades the failure mode: today --force gcc in the box does what the author obviously meant; with -- it becomes a filter word matching nothing, i.e. a quiet no-op. The workflow_call path is unaffected either way — its patterns are literals from compilers.yaml, reviewed at PR time.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.