From 2f0f756d6dd8754822ef03ed14890064353bb04f Mon Sep 17 00:00:00 2001
From: YANG Zongze <yangzongze@gmail.com>
Date: Mon, 13 Jul 2026 16:40:43 +0800
Subject: [PATCH 1/2] CI: build PRs, key notebook cache on Firedrake version,
 weekly canary

The workflow only built on push to main and cached executed notebooks with
a key derived solely from requirements.txt. Since the jupyter cache only
re-executes notebooks whose code changed, updating the Firedrake image never
invalidated the cache: "testing against the latest image" silently reused
outputs produced by older Firedrake versions, and PRs were not built at all.

- build on pull_request (deploy still only on push to main)
- include the Firedrake version reported by the image in the cache key, so
  an image update re-executes the whole book
- weekly scheduled run without the cache as a full-rebuild canary for
  upstream API changes
- upload the error reports also when the build fails (that is when they
  matter); cancel superseded PR runs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/test.yml | 31 +++++++++++++++++++++++++++++--
 1 file changed, 29 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 60a9901..45cf1cb 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -4,6 +4,17 @@ on:
   push:
     branches:
       - main
+  pull_request:
+  # Weekly canary build: runs without the notebook cache, so every notebook
+  # is re-executed against the latest Firedrake image. A failure here warns
+  # about upstream API changes before they block real work.
+  schedule:
+    - cron: '0 3 * * 1'
+
+# Cancel superseded runs of the same PR/branch
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   build:
@@ -30,11 +41,24 @@ jobs:
           cd $GITHUB_WORKSPACE
           python3 -m pip install -r requirements.txt
 
+      - name: Get Firedrake version
+        id: firedrake
+        run: |
+          echo "version=$(python3 -c 'from importlib.metadata import version; print(version("firedrake"))')" >> "$GITHUB_OUTPUT"
+
+      # The jupyter cache only re-executes notebooks whose code changed, so
+      # the Firedrake version must be part of the key: when the image is
+      # updated, the whole book is re-executed instead of silently reusing
+      # outputs produced by an older Firedrake.
+      # Skipped for scheduled runs so the weekly canary is a full rebuild.
       - name: cache executed notebooks
+        if: github.event_name != 'schedule'
         uses: actions/cache@v4
         with:
           path: _build/.jupyter_cache
-          key: jupyter-book-cache-${{ hashFiles('requirements.txt') }}
+          key: jupyter-book-cache-fd${{ steps.firedrake.outputs.version }}-${{ hashFiles('requirements.txt') }}
+          restore-keys: |
+            jupyter-book-cache-fd${{ steps.firedrake.outputs.version }}-
 
       - name: Build HTML
         run: |
@@ -43,12 +67,15 @@ jobs:
           jupyter-book build ./
 
       - name: Upload reports
+        if: always()
         uses: actions/upload-artifact@v4
         with:
           name: reports
           path: _build/html/reports
+          if-no-files-found: ignore
 
       - name: publish html
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         uses: burnett01/rsync-deployments@7.0.2
         with:
           switches: -avzr --delete
@@ -57,4 +84,4 @@ jobs:
           remote_host: ${{ secrets.DEPLOY_HOST }}
           remote_port: ${{ secrets.DEPLOY_PORT }}
           remote_user: ${{ secrets.DEPLOY_USER }}
-          remote_key: ${{ secrets.DEPLOY_KEY }}
\ No newline at end of file
+          remote_key: ${{ secrets.DEPLOY_KEY }}

From 3760ab2d14aff0a194cb161ec82e94478193b41a Mon Sep 17 00:00:00 2001
From: YANG Zongze <yangzongze@gmail.com>
Date: Mon, 13 Jul 2026 16:42:11 +0800
Subject: [PATCH 2/2] CI: fail the build on warnings and notebook execution
 errors

jupyter-book exits 0 even when notebooks fail to execute (only a warning is
emitted), so the job was green regardless. The book currently builds with
zero warnings, so -W is safe; --keep-going still reports all warnings before
failing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/test.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 45cf1cb..704b211 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -64,7 +64,9 @@ jobs:
         run: |
           git config --global --add safe.directory $GITHUB_WORKSPACE
           cd $GITHUB_WORKSPACE
-          jupyter-book build ./
+          # -W turns warnings (including notebook execution failures, which
+          # jupyter-book otherwise only warns about) into a failed build
+          jupyter-book build -W --keep-going ./
 
       - name: Upload reports
         if: always()