From eafd90fbad32e0ab24e5fdd01d8c4482a69908f6 Mon Sep 17 00:00:00 2001
From: Hananel Hazan <Hananel@Hazan.org.il>
Date: Fri, 2 Oct 2026 08:39:54 -0400
Subject: [PATCH] ci: use CPU torch on GitHub runners to stop random
 CUDA-preload segfault

The cu130 torch build pinned in poetry.lock sometimes segfaults in
torch._preload_cuda_lib on GPU-less runners (seen on master 7cac0c3 and
Dependabot PRs #804/#805). After poetry install, reinstall the same
torch/torchvision versions from the CPU wheel index and assert the
build has no CUDA.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/scripts/use_cpu_torch.sh    | 17 +++++++++++++++++
 .github/workflows/python-app.yml    |  1 +
 .github/workflows/pythonpackage.yml |  1 +
 3 files changed, 19 insertions(+)
 create mode 100755 .github/scripts/use_cpu_torch.sh

diff --git a/.github/scripts/use_cpu_torch.sh b/.github/scripts/use_cpu_torch.sh
new file mode 100755
index 00000000..02d27861
--- /dev/null
+++ b/.github/scripts/use_cpu_torch.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# CI runners have no GPU. The CUDA torch build pinned in poetry.lock sometimes
+# segfaults while preloading its CUDA libraries on these runners, so swap in the
+# CPU build of the same torch/torchvision versions after `poetry install`.
+# Usage: use_cpu_torch.sh <python command>, e.g. "python" or "poetry run python".
+set -euo pipefail
+PY=${1:-python}
+
+# Read versions from package metadata; importing torch here could crash.
+pins=$($PY - <<'EOF'
+from importlib.metadata import version
+print(" ".join(f"{p}=={version(p).split('+')[0]}" for p in ("torch", "torchvision")))
+EOF
+)
+$PY -m pip install --no-deps --force-reinstall \
+    --index-url https://download.pytorch.org/whl/cpu $pins
+$PY -c "import torch; assert torch.version.cuda is None, torch.__version__; print('torch', torch.__version__)"
diff --git a/.github/workflows/python-app.yml b/.github/workflows/python-app.yml
index 18d29384..f2e960b7 100644
--- a/.github/workflows/python-app.yml
+++ b/.github/workflows/python-app.yml
@@ -35,6 +35,7 @@ jobs:
         pip install flake8 pytest
         # if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
         poetry install
+        .github/scripts/use_cpu_torch.sh python
     - name: Lint with flake8
       run: |
         # stop the build if there are Python syntax errors or undefined names
diff --git a/.github/workflows/pythonpackage.yml b/.github/workflows/pythonpackage.yml
index 689080d4..da5e81e7 100644
--- a/.github/workflows/pythonpackage.yml
+++ b/.github/workflows/pythonpackage.yml
@@ -28,6 +28,7 @@ jobs:
     - name: Install dependencies
       run: |
         poetry install
+        .github/scripts/use_cpu_torch.sh "poetry run python"
     - name: Format with black
       run: |
         poetry run black .