Split the Ubuntu jobs into a PR set, a full set, and a nightly set

All ~100 Ubuntu jobs ran on every push to every pull request. They now
belong to three sets, chosen by each job's if: condition:

- PR set (16 configurations): every push to a pull request and every
  push. Together with the checks that always run, these jobs would
  have caught at least 92 % of the failing commits of Sep/Oct 2026.
- full set (73 configurations): after the PR set passed, on pushes and
  on pull requests with the "🚀 ready to merge" label.
- nightly set (10 configurations): Infer, Valgrind, coverage, icpc,
  icpx, nvhpc, CUDA, and ARM64; nightly on develop, on pushes to master
  and release/*, and by hand. A failed nightly run opens or updates an
  issue.

A matrix whose entries belong to different sets is split into one job
per set; the jobs share their steps through YAML anchors. No
configuration is removed: tools/ci_jobs/ci_jobs.py --compare lists 150
configurations before and after. The same tool checks in CI that every
job belongs to exactly one set, that the full set waits for the whole
PR set, and that the job table in quality_assurance.md is up to date.

The documentation describes the sets in a new section "How CI runs",
and the QA pipeline figure shows the new badges.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

.github/CONTRIBUTING.md

@@ -159,6 +159,10 @@ compiler workflows (Ubuntu, macOS, Windows); the documentation and license check
 [`tools/check_path_filters`](https://github.com/nlohmann/json/tree/develop/tools/check_path_filters) for the list of
 skipped files and what to do when a compiler job starts reading one of them.
 
+Most compiler jobs run only once a maintainer adds the label "🚀 ready to merge" to a pull request; until then, a
+smaller set of jobs runs on every push. See
+[How CI runs](https://json.nlohmann.me/community/quality_assurance/#how-ci-runs) for the sets and when they run.
+
 ### Amalgamate the source code
 
 The single-header files

.github/workflows/repository_checks.yml

@@ -2,7 +2,7 @@ name: Repository checks
 
 # Checks that concern files the compiler workflows (ubuntu.yml, macos.yml,
 # windows.yml) skip with their path filter: the documentation, the license
-# information, and the path filter itself. This workflow has no path filter.
+# information, and the CI configuration itself. This workflow has no path filter.
 on:
   push:
     branches:
@@ -20,7 +20,7 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  check_path_filters:
+  check_ci_configuration:
     runs-on: ubuntu-26.04
     steps:
       - name: Harden Runner
@@ -33,6 +33,11 @@ jobs:
           persist-credentials: false
       - name: Check the path filters of the compiler workflows
         run: python3 tools/check_path_filters/check_path_filters.py
+      - name: Check the job sets of the compiler workflows and their documentation
+        run: |
+          python3 -m venv venv
+          venv/bin/pip install --quiet -r tools/ci_jobs/requirements.txt
+          venv/bin/python tools/ci_jobs/ci_jobs.py
 
   ci_reuse_compliance:
     runs-on: ubuntu-26.04

.github/workflows/ubuntu.yml

@@ -7,6 +7,8 @@ on:
       - master
       - release/*
   pull_request:
+    # labeled: the "🚀 ready to merge" label starts the full set (see below)
+    types: [opened, synchronize, reopened, labeled]
     # Skip pull requests that change only files no job here reads. The list is checked by
     # tools/check_path_filters/check_path_filters.py (repository_checks.yml); change both together.
     paths:
@@ -26,17 +28,41 @@ on:
       # built by the swiftpm job (macos.yml)
       - 'docs/mkdocs/docs/integration/swift/**'
       - '.github/workflows/ubuntu.yml'
+  schedule:
+    # the nightly set (see below), on develop
+    - cron: '0 2 * * *'
   workflow_dispatch:
 
 permissions:
   contents: read
 
+# A run triggered by any other label gets a group of its own, so it does not
+# cancel the run of the last push; its jobs are skipped.
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  group: ${{ github.workflow }}-${{ github.event_name == 'schedule' && 'nightly' || github.ref || github.run_id }}${{ github.event.action == 'labeled' && github.event.label.name != '🚀 ready to merge' && format('-{0}', github.run_id) || '' }}
   cancel-in-progress: true
 
+# The jobs are split into three sets (see "How CI runs" in
+# docs/mkdocs/docs/community/quality_assurance.md):
+#
+# - PR set: every pull request push and every push; chosen because these jobs
+#   caught 92 % of the failing commits in Sep/Oct 2026.
+# - full set: after the PR set passed, on pushes and on pull requests with the
+#   "🚀 ready to merge" label; every remaining compiler, version and standard.
+# - nightly set: slow tools and rare compilers, nightly on develop, on pushes
+#   to master and release/*, and when started by hand.
+#
+# A matrix whose entries belong to different sets is split into one job per
+# set; the jobs share their steps through YAML anchors. tools/ci_jobs checks
+# that every job belongs to exactly one set.
+
 jobs:
+  ###########################################################################
+  # PR set
+  ###########################################################################
+
   ci_test_gcc:
+    if: &pr_set ${{ github.event_name != 'schedule' && (github.event.action != 'labeled' || github.event.label.name == '🚀 ready to merge') }}
     runs-on: ubuntu-latest
     container: gcc:latest
     steps:
@@ -51,6 +77,7 @@ jobs:
         run: cmake --build build --target ci_test_gcc
 
   ci_meson_install:
+    if: *pr_set
     runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -95,7 +122,342 @@ jobs:
           cmake -S tests/cmake_import/project -B build-import-split -DCMAKE_PREFIX_PATH=${{ github.workspace }}/install-split
           cmake --build build-import-split
 
+  ci_static_analysis_ubuntu:
+    if: *pr_set
+    runs-on: ubuntu-26.04
+    strategy:
+      matrix:
+        target: [ci_cpplint]
+    steps: &static_analysis_ubuntu_steps
+      - name: Harden Runner
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+        with:
+          egress-policy: audit
+
+      - name: Install Valgrind
+        if: matrix.target == 'ci_test_valgrind'
+        run: sudo apt-get update ; sudo apt-get install -y valgrind
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Get latest CMake and ninja
+        uses: lukka/get-cmake@a89e43e22a96abafcd7a62db652a65ecd33052c9 # v4.4.4
+      - name: Run CMake
+        run: cmake -S . -B build -DJSON_CI=On
+      - name: Build
+        run: cmake --build build --target ${{ matrix.target }}
+
+  ci_static_analysis_clang:
+    if: *pr_set
+    runs-on: ubuntu-latest
+    container: silkeh/clang:22
+    strategy:
+      matrix:
+        target: [ci_test_clang, ci_clang_tidy, ci_test_clang_sanitizer, ci_single_binaries]
+    steps: &static_analysis_clang_steps
+      - name: Install git, clang-tools, iwyu (ci_single_binaries), and unzip
+        run: apt-get update ; apt-get install -y git clang-tools iwyu unzip
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Get latest CMake and ninja
+        uses: lukka/get-cmake@a89e43e22a96abafcd7a62db652a65ecd33052c9 # v4.4.4
+      - name: Run CMake
+        run: cmake -S . -B build -DJSON_CI=On
+      - name: Build
+        run: cmake --build build --target ${{ matrix.target }}
+
+  ci_cmake_options:
+    if: *pr_set
+    runs-on: ubuntu-latest
+    container: ubuntu:24.04
+    strategy:
+      matrix:
+        target: [ci_test_diagnostics, ci_test_diagnostic_positions, ci_test_noexceptions, ci_test_noglobaludls]
+    steps: &cmake_options_steps
+      - name: Install build-essential
+        run: apt-get update ; apt-get install -y build-essential unzip wget git
+      # the CMake 3.5.0 release binary that ci_cmake_flags downloads links
+      # against libidn.so.11, which Ubuntu 24.04 no longer ships
+      - name: Install libidn11 for CMake 3.5.0
+        if: matrix.target == 'ci_cmake_flags'
+        run: |
+          wget -q http://archive.ubuntu.com/ubuntu/pool/main/libi/libidn/libidn11_1.33-2.2ubuntu2_amd64.deb
+          dpkg -i libidn11_1.33-2.2ubuntu2_amd64.deb
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Get latest CMake and ninja
+        uses: lukka/get-cmake@a89e43e22a96abafcd7a62db652a65ecd33052c9 # v4.4.4
+      - name: Run CMake
+        run: cmake -S . -B build -DJSON_CI=On
+      - name: Build
+        run: cmake --build build --target ${{ matrix.target }}
+
+  ci_test_compilers_gcc_old:
+    if: *pr_set
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        compiler: ['4.8']
+    # official gcc:4.8/4.9/5/6 images fail to check out code (too old for
+    # actions/checkout); install the old compilers on top of official ubuntu:20.04
+    # instead, mirroring what the (now retired) custom json-ci image did.
+    container: ubuntu:20.04
+    steps: &compilers_gcc_old_steps
+      - name: Install g++-${{ matrix.compiler }}
+        run: |
+          export DEBIAN_FRONTEND=noninteractive
+          apt-get update
+          apt-get install -y --no-install-recommends software-properties-common ca-certificates gnupg make git
+          # add-apt-repository resolves the PPA through the Launchpad API,
+          # which intermittently times out or fails the team lookup (the plain
+          # "deb ..." sources below never hit Launchpad and never flake).
+          # Retry with backoff so a transient Launchpad blip does not fail CI.
+          for attempt in 1 2 3 4 5; do
+            add-apt-repository -y ppa:ubuntu-toolchain-r/test && break
+            echo "::warning::add-apt-repository ppa:ubuntu-toolchain-r/test failed (attempt ${attempt}/5); retrying"
+            sleep $((attempt * 10))
+          done
+          apt-add-repository -y "deb http://archive.ubuntu.com/ubuntu/ bionic main"
+          apt-add-repository -y "deb http://archive.ubuntu.com/ubuntu/ bionic universe"
+          apt-add-repository -y "deb http://archive.ubuntu.com/ubuntu/ xenial main"
+          apt-add-repository -y "deb http://archive.ubuntu.com/ubuntu/ xenial universe"
+          apt-add-repository -y "deb http://archive.ubuntu.com/ubuntu/ xenial-updates main"
+          apt-add-repository -y "deb http://archive.ubuntu.com/ubuntu/ xenial-updates universe"
+          apt-get update
+          apt-get install -y --no-install-recommends g++-${{ matrix.compiler }}
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Get latest CMake and ninja
+        uses: lukka/get-cmake@a89e43e22a96abafcd7a62db652a65ecd33052c9 # v4.4.4
+      - name: Run CMake
+        run: CXX=g++-${{ matrix.compiler }} cmake -S . -B build -DJSON_CI=On
+      - name: Build
+        run: cmake --build build --target ci_test_compiler_g++-${{ matrix.compiler }}
+
+  ci_test_compilers_clang:
+    if: *pr_set
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        compiler: ['3.4']
+    container: silkeh/clang:${{ matrix.compiler }}
+    steps: &compilers_clang_steps
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Get latest CMake and ninja
+        uses: lukka/get-cmake@a89e43e22a96abafcd7a62db652a65ecd33052c9 # v4.4.4
+      - name: Disable filesystem support (std::filesystem is unusable) for clang 7 / 8 / 9 / 10
+        run: echo "JSON_FORCED_GLOBAL_COMPILE_OPTIONS=-DJSON_HAS_FILESYSTEM=0;-DJSON_HAS_EXPERIMENTAL_FILESYSTEM=0" >> "$GITHUB_ENV"
+        if: ${{ matrix.compiler == '7' || matrix.compiler == '8' || matrix.compiler == '9' || matrix.compiler == '10' }}
+      - name: Run CMake
+        run: cmake -S . -B build -DJSON_CI=On
+      - name: Build
+        run: cmake --build build --target ci_test_compiler_default
+
+  ci_test_standards_gcc:
+    if: *pr_set
+    runs-on: ubuntu-latest
+    container: gcc:latest
+    strategy:
+      matrix:
+        standard: [26]
+    steps: &standards_gcc_steps
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Get latest CMake and ninja
+        uses: lukka/get-cmake@a89e43e22a96abafcd7a62db652a65ecd33052c9 # v4.4.4
+      - name: Run CMake
+        run: cmake -S . -B build -DJSON_CI=On
+      - name: Build
+        run: cmake --build build --target ci_test_gcc_cxx${{ matrix.standard }}
+
+  ci_test_standards_clang:
+    if: *pr_set
+    runs-on: ubuntu-latest
+    container: silkeh/clang:latest
+    strategy:
+      matrix:
+        standard: [26]
+        stdlib: [libcxx]
+    steps: &standards_clang_steps
+      - name: Install git and unzip
+        run: apt-get update ; apt-get install -y git unzip
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Get latest CMake and ninja
+        uses: lukka/get-cmake@a89e43e22a96abafcd7a62db652a65ecd33052c9 # v4.4.4
+      - name: Run CMake
+        run: cmake -S . -B build -DJSON_CI=On
+      - name: Build with libc++
+        run: cmake --build build --target ci_test_clang_libcxx_cxx${{ matrix.standard }}
+        if: ${{ matrix.stdlib == 'libcxx' }}
+      - name: Build with libstdc++
+        run: cmake --build build --target ci_test_clang_cxx${{ matrix.standard }}
+        if: ${{ matrix.stdlib == 'libstdcxx' }}
+
+  ci_emscripten:
+    if: *pr_set
+    runs-on: ubuntu-26.04
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+        with:
+          egress-policy: audit
+
+      - name: Install emscripten
+        uses: mymindstorm/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984 # v16
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Get latest CMake and ninja
+        uses: lukka/get-cmake@a89e43e22a96abafcd7a62db652a65ecd33052c9 # v4.4.4
+      - name: Run CMake
+        run: cmake -S . -B build -DCMAKE_TOOLCHAIN_FILE=$EMSDK/upstream/emscripten/cmake/Modules/Platform/Emscripten.cmake -GNinja
+      - name: Build
+        run: cmake --build build
+
+  ###########################################################################
+  # full set: starts after the PR set passed
+  ###########################################################################
+
+  ci_static_analysis_ubuntu_full:
+    needs: &pr_set_jobs [ci_test_gcc, ci_meson_install, ci_static_analysis_ubuntu, ci_static_analysis_clang, ci_cmake_options, ci_test_compilers_gcc_old, ci_test_compilers_clang, ci_test_standards_gcc, ci_test_standards_clang, ci_emscripten]
+    if: &full_set ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || contains(github.event.pull_request.labels.*.name, '🚀 ready to merge') }}
+    runs-on: ubuntu-26.04
+    strategy:
+      matrix:
+        target: [ci_test_single_header, ci_cppcheck, ci_reproducible_tests, ci_non_git_tests, ci_offline_testdata]
+    steps: *static_analysis_ubuntu_steps
+
+  ci_static_analysis_clang_full:
+    needs: *pr_set_jobs
+    if: *full_set
+    runs-on: ubuntu-latest
+    container: silkeh/clang:22
+    strategy:
+      matrix:
+        target: [ci_clang_analyze]
+    steps: *static_analysis_clang_steps
+
+  ci_cmake_options_full:
+    needs: *pr_set_jobs
+    if: *full_set
+    runs-on: ubuntu-latest
+    container: ubuntu:24.04
+    strategy:
+      matrix:
+        target: [ci_cmake_flags, ci_test_noimplicitconversions, ci_test_legacycomparison, ci_test_disableenumserialization, ci_test_disabletuplereferenceconversion, ci_test_skiplibraryversioncheck, ci_test_simdutf, ci_test_strict_nul_handling, ci_test_delete_deprecated_functions, ci_test_no_thread_local]
+    steps: *cmake_options_steps
+
+  ci_test_compilers_gcc_old_full:
+    needs: *pr_set_jobs
+    if: *full_set
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        compiler: ['4.9', '5', '6']
+    container: ubuntu:20.04
+    steps: *compilers_gcc_old_steps
+
+  ci_test_compilers_gcc_full:
+    needs: *pr_set_jobs
+    if: *full_set
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        # older GCC docker images (4, 5, 6) fail to check out code
+        compiler: ['7', '8', '9', '10', '11', '12', '13', '14', '15', '16', 'latest']
+    container: gcc:${{ matrix.compiler }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Get latest CMake and ninja
+        uses: lukka/get-cmake@a89e43e22a96abafcd7a62db652a65ecd33052c9 # v4.4.4
+      - name: Run CMake
+        run: cmake -S . -B build -DJSON_CI=On
+      - name: Build
+        run: cmake --build build --target ci_test_compiler_default
+
+  ci_test_compilers_clang_full:
+    needs: *pr_set_jobs
+    if: *full_set
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        compiler: ['3.5', '3.6', '3.7', '3.8', '3.9', '4', '5', '6', '7', '8', '9', '10', '11', '12', '13', '14', '15-bullseye', '16', '17', '18', '19', '20', '21', '22', 'latest']
+    container: silkeh/clang:${{ matrix.compiler }}
+    steps: *compilers_clang_steps
+
+  ci_test_standards_gcc_full:
+    needs: *pr_set_jobs
+    if: *full_set
+    runs-on: ubuntu-latest
+    container: gcc:latest
+    strategy:
+      matrix:
+        standard: [11, 14, 17, 20, 23]
+    steps: *standards_gcc_steps
+
+  ci_test_standards_clang_full:
+    needs: *pr_set_jobs
+    if: *full_set
+    runs-on: ubuntu-latest
+    container: silkeh/clang:latest
+    strategy:
+      matrix:
+        standard: [11, 14, 17, 20, 23, 26]
+        stdlib: [libcxx, libstdcxx]
+        exclude:
+          # in the PR set
+          - standard: 26
+            stdlib: libcxx
+    steps: *standards_clang_steps
+
+  ci_module_cpp20:
+    needs: *pr_set_jobs
+    if: *full_set
+    strategy:
+      matrix:
+        container: ['gcc:latest', 'silkeh/clang:latest']
+    runs-on: ubuntu-latest
+    container: ${{ matrix.container }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      # The module test uses `import std;`, which needs CMake's experimental
+      # import-std support. Its opt-in token is CMake-version-specific, so pin
+      # CMake to the version whose token is set in tests/module_cpp20/CMakeLists.txt.
+      - name: Get pinned CMake and ninja
+        uses: lukka/get-cmake@a89e43e22a96abafcd7a62db652a65ecd33052c9 # v4.4.4
+        with:
+          cmakeVersion: 4.3.4
+      # Clang: the std library module is provided by libc++ (the image's libstdc++
+      # ships none), and the image's libc++ module manifest has a broken relative
+      # path — repoint it at the real module sources.
+      - name: Use libc++ and fix its module manifest path (Clang)
+        if: matrix.container == 'silkeh/clang:latest'
+        run: |
+          echo "CXXFLAGS=-stdlib=libc++" >> "$GITHUB_ENV"
+          mkdir -p /usr/lib/share && ln -sf /usr/lib/llvm-*/share/libc++ /usr/lib/share/libc++
+      - name: Run CMake
+        run: cmake -S . -B build -DJSON_CI=On
+      - name: Build
+        run: cmake --build build --target ci_module_cpp20
+
+  ###########################################################################
+  # nightly set
+  ###########################################################################
+
   ci_infer:
+    if: &nightly_set ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref != 'refs/heads/develop') }}
     runs-on: ubuntu-26.04
     steps:
       - name: Harden Runner
@@ -124,76 +486,16 @@ jobs:
           path: ${{ github.workspace }}/build/build_infer/infer-out/report.txt
           if-no-files-found: ignore
 
-  ci_static_analysis_ubuntu:
+  ci_static_analysis_ubuntu_nightly:
+    if: *nightly_set
     runs-on: ubuntu-26.04
     strategy:
       matrix:
-        target: [ci_test_single_header, ci_cppcheck, ci_cpplint, ci_reproducible_tests, ci_non_git_tests, ci_offline_testdata, ci_test_valgrind]
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
-        with:
-          egress-policy: audit
-
-      - name: Install Valgrind
-        if: matrix.target == 'ci_test_valgrind'
-        run: sudo apt-get update ; sudo apt-get install -y valgrind
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@a89e43e22a96abafcd7a62db652a65ecd33052c9 # v4.4.4
-      - name: Run CMake
-        run: cmake -S . -B build -DJSON_CI=On
-      - name: Build
-        run: cmake --build build --target ${{ matrix.target }}
-
-  ci_static_analysis_clang:
-    runs-on: ubuntu-latest
-    container: silkeh/clang:22
-    strategy:
-      matrix:
-        target: [ci_test_clang, ci_clang_tidy, ci_test_clang_sanitizer, ci_clang_analyze, ci_single_binaries]
-    steps:
-      - name: Install git, clang-tools, iwyu (ci_single_binaries), and unzip
-        run: apt-get update ; apt-get install -y git clang-tools iwyu unzip
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@a89e43e22a96abafcd7a62db652a65ecd33052c9 # v4.4.4
-      - name: Run CMake
-        run: cmake -S . -B build -DJSON_CI=On
-      - name: Build
-        run: cmake --build build --target ${{ matrix.target }}
-
-  ci_cmake_options:
-    runs-on: ubuntu-latest
-    container: ubuntu:24.04
-    strategy:
-      matrix:
-        target: [ci_cmake_flags, ci_test_diagnostics, ci_test_diagnostic_positions, ci_test_noexceptions, ci_test_noimplicitconversions, ci_test_legacycomparison, ci_test_noglobaludls, ci_test_disableenumserialization, ci_test_disabletuplereferenceconversion, ci_test_skiplibraryversioncheck, ci_test_simdutf, ci_test_strict_nul_handling, ci_test_delete_deprecated_functions, ci_test_no_thread_local]
-    steps:
-      - name: Install build-essential
-        run: apt-get update ; apt-get install -y build-essential unzip wget git
-      # the CMake 3.5.0 release binary that ci_cmake_flags downloads links
-      # against libidn.so.11, which Ubuntu 24.04 no longer ships
-      - name: Install libidn11 for CMake 3.5.0
-        if: matrix.target == 'ci_cmake_flags'
-        run: |
-          wget -q http://archive.ubuntu.com/ubuntu/pool/main/libi/libidn/libidn11_1.33-2.2ubuntu2_amd64.deb
-          dpkg -i libidn11_1.33-2.2ubuntu2_amd64.deb
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@a89e43e22a96abafcd7a62db652a65ecd33052c9 # v4.4.4
-      - name: Run CMake
-        run: cmake -S . -B build -DJSON_CI=On
-      - name: Build
-        run: cmake --build build --target ${{ matrix.target }}
+        target: [ci_test_valgrind]
+    steps: *static_analysis_ubuntu_steps
 
   ci_test_coverage:
+    if: *nightly_set
     runs-on: ubuntu-26.04
     steps:
       - name: Harden Runner
@@ -227,128 +529,8 @@ jobs:
           path-to-lcov: ${{ github.workspace }}/build/json.info.filtered.noexcept
           fail-on-error: false
 
-  ci_test_compilers_gcc_old:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        compiler: ['4.8', '4.9', '5', '6']
-    # official gcc:4.8/4.9/5/6 images fail to check out code (too old for
-    # actions/checkout); install the old compilers on top of official ubuntu:20.04
-    # instead, mirroring what the (now retired) custom json-ci image did.
-    container: ubuntu:20.04
-    steps:
-      - name: Install g++-${{ matrix.compiler }}
-        run: |
-          export DEBIAN_FRONTEND=noninteractive
-          apt-get update
-          apt-get install -y --no-install-recommends software-properties-common ca-certificates gnupg make git
-          # add-apt-repository resolves the PPA through the Launchpad API,
-          # which intermittently times out or fails the team lookup (the plain
-          # "deb ..." sources below never hit Launchpad and never flake).
-          # Retry with backoff so a transient Launchpad blip does not fail CI.
-          for attempt in 1 2 3 4 5; do
-            add-apt-repository -y ppa:ubuntu-toolchain-r/test && break
-            echo "::warning::add-apt-repository ppa:ubuntu-toolchain-r/test failed (attempt ${attempt}/5); retrying"
-            sleep $((attempt * 10))
-          done
-          apt-add-repository -y "deb http://archive.ubuntu.com/ubuntu/ bionic main"
-          apt-add-repository -y "deb http://archive.ubuntu.com/ubuntu/ bionic universe"
-          apt-add-repository -y "deb http://archive.ubuntu.com/ubuntu/ xenial main"
-          apt-add-repository -y "deb http://archive.ubuntu.com/ubuntu/ xenial universe"
-          apt-add-repository -y "deb http://archive.ubuntu.com/ubuntu/ xenial-updates main"
-          apt-add-repository -y "deb http://archive.ubuntu.com/ubuntu/ xenial-updates universe"
-          apt-get update
-          apt-get install -y --no-install-recommends g++-${{ matrix.compiler }}
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@a89e43e22a96abafcd7a62db652a65ecd33052c9 # v4.4.4
-      - name: Run CMake
-        run: CXX=g++-${{ matrix.compiler }} cmake -S . -B build -DJSON_CI=On
-      - name: Build
-        run: cmake --build build --target ci_test_compiler_g++-${{ matrix.compiler }}
-
-  ci_test_compilers_gcc:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        # older GCC docker images (4, 5, 6) fail to check out code
-        compiler: ['7', '8', '9', '10', '11', '12', '13', '14', '15', '16', 'latest']
-    container: gcc:${{ matrix.compiler }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@a89e43e22a96abafcd7a62db652a65ecd33052c9 # v4.4.4
-      - name: Run CMake
-        run: cmake -S . -B build -DJSON_CI=On
-      - name: Build
-        run: cmake --build build --target ci_test_compiler_default
-
-  ci_test_compilers_clang:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        compiler: ['3.4', '3.5', '3.6', '3.7', '3.8', '3.9', '4', '5', '6', '7', '8', '9', '10', '11', '12', '13', '14', '15-bullseye', '16', '17', '18', '19', '20', '21', '22', 'latest']
-    container: silkeh/clang:${{ matrix.compiler }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@a89e43e22a96abafcd7a62db652a65ecd33052c9 # v4.4.4
-      - name: Disable filesystem support (std::filesystem is unusable) for clang 7 / 8 / 9 / 10
-        run: echo "JSON_FORCED_GLOBAL_COMPILE_OPTIONS=-DJSON_HAS_FILESYSTEM=0;-DJSON_HAS_EXPERIMENTAL_FILESYSTEM=0" >> "$GITHUB_ENV"
-        if: ${{ matrix.compiler == '7' || matrix.compiler == '8' || matrix.compiler == '9' || matrix.compiler == '10' }}
-      - name: Run CMake
-        run: cmake -S . -B build -DJSON_CI=On
-      - name: Build
-        run: cmake --build build --target ci_test_compiler_default
-
-  ci_test_standards_gcc:
-    runs-on: ubuntu-latest
-    container: gcc:latest
-    strategy:
-      matrix:
-        standard: [11, 14, 17, 20, 23, 26]
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@a89e43e22a96abafcd7a62db652a65ecd33052c9 # v4.4.4
-      - name: Run CMake
-        run: cmake -S . -B build -DJSON_CI=On
-      - name: Build
-        run: cmake --build build --target ci_test_gcc_cxx${{ matrix.standard }}
-
-  ci_test_standards_clang:
-    runs-on: ubuntu-latest
-    container: silkeh/clang:latest
-    strategy:
-      matrix:
-        standard: [11, 14, 17, 20, 23, 26]
-        stdlib: [libcxx, libstdcxx]
-    steps:
-      - name: Install git and unzip
-        run: apt-get update ; apt-get install -y git unzip
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@a89e43e22a96abafcd7a62db652a65ecd33052c9 # v4.4.4
-      - name: Run CMake
-        run: cmake -S . -B build -DJSON_CI=On
-      - name: Build with libc++
-        run: cmake --build build --target ci_test_clang_libcxx_cxx${{ matrix.standard }}
-        if: ${{ matrix.stdlib == 'libcxx' }}
-      - name: Build with libstdc++
-        run: cmake --build build --target ci_test_clang_cxx${{ matrix.standard }}
-        if: ${{ matrix.stdlib == 'libstdcxx' }}
-
   ci_cuda_example:
+    if: *nightly_set
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -371,37 +553,8 @@ jobs:
       - name: Build
         run: cmake --build build --target ci_cuda_example
 
-  ci_module_cpp20:
-    strategy:
-      matrix:
-        container: ['gcc:latest', 'silkeh/clang:latest']
-    runs-on: ubuntu-latest
-    container: ${{ matrix.container }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      # The module test uses `import std;`, which needs CMake's experimental
-      # import-std support. Its opt-in token is CMake-version-specific, so pin
-      # CMake to the version whose token is set in tests/module_cpp20/CMakeLists.txt.
-      - name: Get pinned CMake and ninja
-        uses: lukka/get-cmake@a89e43e22a96abafcd7a62db652a65ecd33052c9 # v4.4.4
-        with:
-          cmakeVersion: 4.3.4
-      # Clang: the std library module is provided by libc++ (the image's libstdc++
-      # ships none), and the image's libc++ module manifest has a broken relative
-      # path — repoint it at the real module sources.
-      - name: Use libc++ and fix its module manifest path (Clang)
-        if: matrix.container == 'silkeh/clang:latest'
-        run: |
-          echo "CXXFLAGS=-stdlib=libc++" >> "$GITHUB_ENV"
-          mkdir -p /usr/lib/share && ln -sf /usr/lib/llvm-*/share/libc++ /usr/lib/share/libc++
-      - name: Run CMake
-        run: cmake -S . -B build -DJSON_CI=On
-      - name: Build
-        run: cmake --build build --target ci_module_cpp20
-
   ci_icpc:
+    if: *nightly_set
     runs-on: ubuntu-latest
     # Intel discontinued the classic icc/icpc compiler in oneAPI 2024.0; this is
     # Intel's own last officially published image that still includes it.
@@ -421,6 +574,7 @@ jobs:
         run: cmake --build build --target ci_icpc
 
   ci_icpx:
+    if: *nightly_set
     runs-on: ubuntu-latest
     container: intel/oneapi-hpckit:latest
     steps:
@@ -435,6 +589,7 @@ jobs:
         run: cmake --build build --target ci_icpx
 
   ci_nvhpc:
+    if: *nightly_set
     runs-on: ubuntu-latest
     container: nvcr.io/nvidia/nvhpc:25.5-devel-cuda12.9-ubuntu22.04
     steps:
@@ -448,29 +603,10 @@ jobs:
       - name: Build
         run: cmake --build build --target ci_nvhpc
 
-  ci_emscripten:
-    runs-on: ubuntu-26.04
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
-        with:
-          egress-policy: audit
-
-      - name: Install emscripten
-        uses: mymindstorm/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984 # v16
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@a89e43e22a96abafcd7a62db652a65ecd33052c9 # v4.4.4
-      - name: Run CMake
-        run: cmake -S . -B build -DCMAKE_TOOLCHAIN_FILE=$EMSDK/upstream/emscripten/cmake/Modules/Platform/Emscripten.cmake -GNinja
-      - name: Build
-        run: cmake --build build
-
   # Native Linux ARM64 runner with the latest GCC. The ubuntu-24.04-arm label is
   # only available for public repositories.
   ci_test_arm64:
+    if: *nightly_set
     runs-on: ubuntu-24.04-arm
     container: gcc:latest
     steps:
@@ -485,3 +621,33 @@ jobs:
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
         run: cmake --build build --target ci_test_compiler_default
+
+  # A failure of a scheduled run opens an issue, or comments on the open one.
+  nightly_report:
+    needs: [ci_infer, ci_static_analysis_ubuntu_nightly, ci_test_coverage, ci_cuda_example, ci_icpc, ci_icpx, ci_nvhpc, ci_test_arm64]
+    if: ${{ always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure') }}
+    runs-on: ubuntu-26.04
+    permissions:
+      issues: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+        with:
+          egress-policy: audit
+
+      - name: Open or update the nightly failure issue
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          WORKFLOW: ${{ github.workflow }}
+          SHA: ${{ github.sha }}
+        run: |
+          title="Nightly CI failure (${WORKFLOW})"
+          body="The nightly run of ${WORKFLOW} on ${SHA:0:10} failed: ${RUN_URL}"
+          number=$(gh issue list --state open --search "in:title \"${title}\"" --json number,title --jq "map(select(.title == \"${title}\")) | .[0].number // empty")
+          if [ -n "$number" ]; then
+            gh issue comment "$number" --body "$body"
+          else
+            gh issue create --title "$title" --body "$body"
+          fi

docs/mkdocs/docs/community/quality_assurance.md

@@ -13,6 +13,72 @@ describe each of them.
 
 <p class="nj-caption" markdown>The checks grouped by the stage at which they run, from push or pull request through the merge into develop to a release. The badge on each card says whether the check runs on every push or PR, on a schedule, or continuously.</p>
 
+## How CI runs
+
+Not every job runs for every change. The compiler jobs on Ubuntu are split into three sets, so a pull request gets fast
+feedback and the long jobs run when they matter:
+
+| Set         | When it runs                                                                                                      | What it contains                                                                                                                                                                       |
+|-------------|-------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| PR set      | every push to a pull request, and every push to `develop`, `master`, and `release/*`                              | GCC and Clang with all warnings, Clang-Tidy, sanitizers, IWYU, cpplint, the oldest and newest GCC and Clang, common CMake options, Meson, Emscripten; with the checks that always run, they would have caught at least 92 % of the failing commits of September and October 2026 |
+| full set    | after the PR set passed: on pull requests with the label :rocket: ready to merge, and on every push                | every other compiler, version, C++ standard, and CMake option, the Clang Static Analyzer, Cppcheck, and the C++20 module tests                                                         |
+| nightly set | every night on `develop`, on every push to `master` and `release/*`, and when started by hand                      | Infer, Valgrind, coverage, the Intel and NVIDIA compilers, CUDA, and ARM64; a failure opens an issue                                                                                    |
+
+The jobs on macOS and Windows, the documentation and license checks, and the amalgamation check run on every push and
+pull request. A pull request that changes only the documentation, Markdown files, GitHub metadata, or license files
+skips the compiler workflows (see [`tools/check_path_filters`](https://github.com/nlohmann/json/tree/develop/tools/check_path_filters)).
+
+A maintainer adds the label :rocket: ready to merge when a pull request is ready; the full set then runs, and again on
+every later push to that pull request. A pull request is merged only when the full set passed.
+
+??? abstract "Jobs of the compiler workflows and their sets"
+
+    The table is generated by [`tools/ci_jobs`](https://github.com/nlohmann/json/tree/develop/tools/ci_jobs), which
+    also checks in CI that it is up to date and that every job belongs to exactly one set.
+
+    <!-- ci_jobs: begin -->
+    | Set | Workflow | Job | Configurations |
+    |-----|----------|-----|----------------|
+    | PR set | ubuntu.yml | `ci_test_gcc` | - |
+    | PR set | ubuntu.yml | `ci_meson_install` | - |
+    | PR set | ubuntu.yml | `ci_static_analysis_ubuntu` | ci_cpplint |
+    | PR set | ubuntu.yml | `ci_static_analysis_clang` | ci_test_clang; ci_clang_tidy; ci_test_clang_sanitizer; ci_single_binaries |
+    | PR set | ubuntu.yml | `ci_cmake_options` | ci_test_diagnostics; ci_test_diagnostic_positions; ci_test_noexceptions; ci_test_noglobaludls |
+    | PR set | ubuntu.yml | `ci_test_compilers_gcc_old` | 4.8 |
+    | PR set | ubuntu.yml | `ci_test_compilers_clang` | 3.4 |
+    | PR set | ubuntu.yml | `ci_test_standards_gcc` | 26 |
+    | PR set | ubuntu.yml | `ci_test_standards_clang` | 26, libcxx |
+    | PR set | ubuntu.yml | `ci_emscripten` | - |
+    | full set | ubuntu.yml | `ci_static_analysis_ubuntu_full` | ci_test_single_header; ci_cppcheck; ci_reproducible_tests; ci_non_git_tests; ci_offline_testdata |
+    | full set | ubuntu.yml | `ci_static_analysis_clang_full` | ci_clang_analyze |
+    | full set | ubuntu.yml | `ci_cmake_options_full` | ci_cmake_flags; ci_test_noimplicitconversions; ci_test_legacycomparison; ci_test_disableenumserialization; ci_test_disabletuplereferenceconversion; ci_test_skiplibraryversioncheck; ci_test_simdutf; ci_test_strict_nul_handling; ci_test_delete_deprecated_functions; ci_test_no_thread_local |
+    | full set | ubuntu.yml | `ci_test_compilers_gcc_old_full` | 4.9; 5; 6 |
+    | full set | ubuntu.yml | `ci_test_compilers_gcc_full` | 7; 8; 9; 10; 11; 12; 13; 14; 15; 16; latest |
+    | full set | ubuntu.yml | `ci_test_compilers_clang_full` | 3.5; 3.6; 3.7; 3.8; 3.9; 4; 5; 6; 7; 8; 9; 10; 11; 12; 13; 14; 15-bullseye; 16; 17; 18; 19; 20; 21; 22; latest |
+    | full set | ubuntu.yml | `ci_test_standards_gcc_full` | 11; 14; 17; 20; 23 |
+    | full set | ubuntu.yml | `ci_test_standards_clang_full` | 11, libcxx; 11, libstdcxx; 14, libcxx; 14, libstdcxx; 17, libcxx; 17, libstdcxx; 20, libcxx; 20, libstdcxx; 23, libcxx; 23, libstdcxx; 26, libstdcxx |
+    | full set | ubuntu.yml | `ci_module_cpp20` | gcc:latest; silkeh/clang:latest |
+    | nightly set | ubuntu.yml | `ci_infer` | - |
+    | nightly set | ubuntu.yml | `ci_static_analysis_ubuntu_nightly` | ci_test_valgrind |
+    | nightly set | ubuntu.yml | `ci_test_coverage` | - |
+    | nightly set | ubuntu.yml | `ci_cuda_example` | 11.8.0; 12.1.1; 12.6.3 |
+    | nightly set | ubuntu.yml | `ci_icpc` | - |
+    | nightly set | ubuntu.yml | `ci_icpx` | - |
+    | nightly set | ubuntu.yml | `ci_nvhpc` | - |
+    | nightly set | ubuntu.yml | `ci_test_arm64` | - |
+    | every push and PR | macos.yml | `macos-15` | 16.0; 16.1; 16.2; 16.3; 16.4; 26.0.1; 26.1.1; 26.2; 26.3 |
+    | every push and PR | macos.yml | `macos-26` | 26.4.1; 26.5; 26.6 |
+    | every push and PR | macos.yml | `xcode_standards` | 11; 14; 17; 20; 23; 26 |
+    | every push and PR | macos.yml | `swiftpm` | - |
+    | every push and PR | windows.yml | `mingw` | x64; x86 |
+    | every push and PR | windows.yml | `msvc` | Debug, Win32, default; Debug, Win32, latest; Debug, x64, default; Debug, x64, latest; Release, Win32, default; Release, Win32, latest; Release, x64, default; Release, x64, latest |
+    | every push and PR | windows.yml | `msvc-vs2026` | Debug, Win32, default; Debug, Win32, latest; Debug, x64, default; Debug, x64, latest; Release, Win32, default; Release, Win32, latest; Release, x64, default; Release, x64, latest |
+    | every push and PR | windows.yml | `msvc-arm64` | Debug; Release |
+    | every push and PR | windows.yml | `clang` | 11.0.1; 12.0.1; 13.0.1; 14.0.6; 15.0.7; 16.0.6; 18.1.8; 19.1.7; 20.1.8 |
+    | every push and PR | windows.yml | `clang-cl` | Win32; x64 |
+    | every push and PR | windows.yml | `ci_module_cpp20` | - |
+    <!-- ci_jobs: end -->
+
 ## C++ language compliance and compiler compatibility
 
 !!! success "Requirement: Compiler support"

docs/mkdocs/docs/images/qa_pipeline.svg

@@ -1,26 +1,31 @@
-<svg class="nj-fig nj-exceptions-qa nj-exceptions-qa--wide" viewBox="0 0 760 808" role="img" aria-labelledby="nj-qa-title-w nj-qa-desc-w" xmlns="http://www.w3.org/2000/svg">
+<svg class="nj-fig nj-exceptions-qa nj-exceptions-qa--wide" viewBox="0 0 760 862" role="img" aria-labelledby="nj-qa-title-w nj-qa-desc-w" xmlns="http://www.w3.org/2000/svg">
 <title id="nj-qa-title-w">Quality assurance pipeline</title>
-<desc id="nj-qa-desc-w">Every push or pull request starts these checks in parallel: Build matrix (every push / PR): 50+ compilers: G&#8203;CC, Clang, M&#8203;SVC, AppleClang, Intel, NVIDIA, ... C++11, 14, 17, 20, 23, and 26 libc++ and libstdc++ warnings: Clang -Weverything, G&#8203;CC 300+ warnings; Unit tests (doctest) (every push / PR): every public A&#8203;PI function every exception id and message all Unicode code points single header and split headers custom number, string, array, and object types; Coverage (every push / PR): unit tests cover all lines of the code base; Static analysis (every push / PR, scheduled): Clang-Tidy, Cppcheck, Infer Clang Static Analyzer (52 checkers), I&#8203;WYU, Codacy CodeQL, Semgrep, Flawfinder (also scheduled); Dynamic analysis (every push / PR): runtime assertions Valgrind (Memcheck) address and undefined behavior sanitizers, integer overflow, nullability violations; Fuzzing (every PR, continuous): CIFuzz on every pull request OSS-Fuzz: billions of inputs every crash fixed with a reproducing unit test; Style (every push / PR): Artistic Style (astyle), enforced in the C&#8203;I cpplint with 61 rules; Docs and examples (every push / PR, scheduled): every documentation example is tested; changed output fails site built with warnings as errors; links checked regularly (scheduled); Integration, supply chain (every push / PR, scheduled): CMake 3.5, 3.31.6, and 4.0.0 Meson, Swift Package Manager dependency review on every PR Dependabot daily, OpenSSF Scorecard, R&#8203;EUSE. When they pass, the change is merged into develop; a release is made only when no vulnerability alert is open.</desc>
+<desc id="nj-qa-desc-w">A push or pull request starts these checks; the badges say when each runs: Build matrix (every push / PR, before merge): 50+ compilers: G&#8203;CC, Clang, M&#8203;SVC, AppleClang, Intel, NVIDIA, ... C++11, 14, 17, 20, 23, and 26 libc++ and libstdc++ warnings: Clang -Weverything, G&#8203;CC 300+ warnings a subset on every push and PR, all before merge; Intel, NVIDIA, C&#8203;UDA, and ARM64 nightly; Unit tests (doctest) (every push / PR): every public A&#8203;PI function every exception id and message all Unicode code points single header and split headers custom number, string, array, and object types; Coverage (nightly): unit tests cover all lines of the code base; Static analysis (every push / PR, scheduled): Clang-Tidy, Cppcheck, Infer Clang Static Analyzer (52 checkers), I&#8203;WYU, Codacy CodeQL, Semgrep, Flawfinder (also scheduled); Infer nightly; Dynamic analysis (every push / PR, nightly): runtime assertions Valgrind (Memcheck), nightly address and undefined behavior sanitizers, integer overflow, nullability violations; Fuzzing (every PR, continuous): CIFuzz on every pull request OSS-Fuzz: billions of inputs every crash fixed with a reproducing unit test; Style (every push / PR): Artistic Style (astyle), enforced in the C&#8203;I cpplint with 61 rules; Docs and examples (every push / PR, scheduled): every documentation example is tested; changed output fails site built with warnings as errors; links checked regularly (scheduled); Integration, supply chain (every push / PR, scheduled): CMake 3.5, 3.31.6, and 4.0.0 Meson, Swift Package Manager dependency review on every PR Dependabot daily, OpenSSF Scorecard, R&#8203;EUSE. When they pass, the change is merged into develop; a release is made only when no vulnerability alert is open.</desc>
 <defs><marker id="nj-qa-arrow-w" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto"><path class="fg-head" d="M0 1 L10 5 L0 9 z"/></marker></defs>
-<rect class="nj-exceptions-groupbox" x="12" y="70" width="736" height="594" rx="12"/>
+<rect class="nj-exceptions-groupbox" x="12" y="70" width="736" height="648" rx="12"/>
 <rect class="nj-exceptions-stage" x="265" y="8" width="230" height="34" rx="17"/>
 <text class="nj-exceptions-stagetext" x="380" y="30">push or pull request</text>
 <line class="nj-exceptions-edge" x1="380" y1="42" x2="380" y2="68" marker-end="url(#nj-qa-arrow-w)"/>
 <text class="nj-exceptions-group" x="26" y="94">checks, run in parallel on GitHub Actions and AppVeyor</text>
 <g class="nj-exceptions-card">
-<rect class="nj-exceptions-box" x="26" y="110" width="228" height="184" rx="8"/>
+<rect class="nj-exceptions-box" x="26" y="110" width="228" height="238" rx="8"/>
 <text class="nj-exceptions-ctitle" x="40" y="135">Build matrix</text>
 <rect class="nj-exceptions-badge nj-exceptions-badge--push" x="40" y="146" width="110.5" height="20" rx="10"/>
 <text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="95.25" y="160">every push / PR</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="156.5" y="146" width="91.6" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="202.3" y="160">before merge</text>
 <text class="nj-exceptions-line" x="40" y="188">50+ compilers: G&#8203;CC, Clang, M&#8203;SVC,</text>
 <text class="nj-exceptions-line" x="40" y="206">AppleClang, Intel, NVIDIA, ...</text>
 <text class="nj-exceptions-line" x="40" y="224">C++11, 14, 17, 20, 23, and 26</text>
 <text class="nj-exceptions-line" x="40" y="242">libc++ and libstdc++</text>
 <text class="nj-exceptions-line" x="40" y="260">warnings: Clang -Weverything,</text>
 <text class="nj-exceptions-line" x="40" y="278">G&#8203;CC 300+ warnings</text>
+<text class="nj-exceptions-line" x="40" y="296">a subset on every push and PR,</text>
+<text class="nj-exceptions-line" x="40" y="314">all before merge; Intel, NVIDIA,</text>
+<text class="nj-exceptions-line" x="40" y="332">C&#8203;UDA, and ARM64 nightly</text>
 </g>
 <g class="nj-exceptions-card">
-<rect class="nj-exceptions-box" x="266" y="110" width="228" height="184" rx="8"/>
+<rect class="nj-exceptions-box" x="266" y="110" width="228" height="238" rx="8"/>
 <text class="nj-exceptions-ctitle" x="280" y="135">Unit tests (doctest)</text>
 <rect class="nj-exceptions-badge nj-exceptions-badge--push" x="280" y="146" width="110.5" height="20" rx="10"/>
 <text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="335.25" y="160">every push / PR</text>
@@ -32,209 +37,218 @@
 <text class="nj-exceptions-line" x="280" y="278">and object types</text>
 </g>
 <g class="nj-exceptions-card">
-<rect class="nj-exceptions-box" x="506" y="110" width="228" height="184" rx="8"/>
+<rect class="nj-exceptions-box" x="506" y="110" width="228" height="238" rx="8"/>
 <text class="nj-exceptions-ctitle" x="520" y="135">Coverage</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="520" y="146" width="110.5" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="575.25" y="160">every push / PR</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--sched" x="520" y="146" width="60.1" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--sched" x="550.05" y="160">nightly</text>
 <text class="nj-exceptions-line" x="520" y="188">unit tests cover all lines</text>
 <text class="nj-exceptions-line" x="520" y="206">of the code base</text>
 </g>
 <g class="nj-exceptions-card">
-<rect class="nj-exceptions-box" x="26" y="306" width="228" height="166" rx="8"/>
-<text class="nj-exceptions-ctitle" x="40" y="331">Static analysis</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="40" y="342" width="110.5" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="95.25" y="356">every push / PR</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--sched" x="156.5" y="342" width="72.7" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--sched" x="192.85" y="356">scheduled</text>
-<text class="nj-exceptions-line" x="40" y="384">Clang-Tidy, Cppcheck, Infer</text>
-<text class="nj-exceptions-line" x="40" y="402">Clang Static Analyzer (52</text>
-<text class="nj-exceptions-line" x="40" y="420">checkers), I&#8203;WYU, Codacy</text>
-<text class="nj-exceptions-line" x="40" y="438">CodeQL, Semgrep, Flawfinder</text>
-<text class="nj-exceptions-line" x="40" y="456">(also scheduled)</text>
+<rect class="nj-exceptions-box" x="26" y="360" width="228" height="166" rx="8"/>
+<text class="nj-exceptions-ctitle" x="40" y="385">Static analysis</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="40" y="396" width="110.5" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="95.25" y="410">every push / PR</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--sched" x="156.5" y="396" width="72.7" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--sched" x="192.85" y="410">scheduled</text>
+<text class="nj-exceptions-line" x="40" y="438">Clang-Tidy, Cppcheck, Infer</text>
+<text class="nj-exceptions-line" x="40" y="456">Clang Static Analyzer (52</text>
+<text class="nj-exceptions-line" x="40" y="474">checkers), I&#8203;WYU, Codacy</text>
+<text class="nj-exceptions-line" x="40" y="492">CodeQL, Semgrep, Flawfinder</text>
+<text class="nj-exceptions-line" x="40" y="510">(also scheduled); Infer nightly</text>
 </g>
 <g class="nj-exceptions-card">
-<rect class="nj-exceptions-box" x="266" y="306" width="228" height="166" rx="8"/>
-<text class="nj-exceptions-ctitle" x="280" y="331">Dynamic analysis</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="280" y="342" width="110.5" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="335.25" y="356">every push / PR</text>
-<text class="nj-exceptions-line" x="280" y="384">runtime assertions</text>
-<text class="nj-exceptions-line" x="280" y="402">Valgrind (Memcheck)</text>
-<text class="nj-exceptions-line" x="280" y="420">address and undefined behavior</text>
-<text class="nj-exceptions-line" x="280" y="438">sanitizers, integer overflow,</text>
-<text class="nj-exceptions-line" x="280" y="456">nullability violations</text>
+<rect class="nj-exceptions-box" x="266" y="360" width="228" height="166" rx="8"/>
+<text class="nj-exceptions-ctitle" x="280" y="385">Dynamic analysis</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="280" y="396" width="110.5" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="335.25" y="410">every push / PR</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--sched" x="396.5" y="396" width="60.1" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--sched" x="426.55" y="410">nightly</text>
+<text class="nj-exceptions-line" x="280" y="438">runtime assertions</text>
+<text class="nj-exceptions-line" x="280" y="456">Valgrind (Memcheck), nightly</text>
+<text class="nj-exceptions-line" x="280" y="474">address and undefined behavior</text>
+<text class="nj-exceptions-line" x="280" y="492">sanitizers, integer overflow,</text>
+<text class="nj-exceptions-line" x="280" y="510">nullability violations</text>
 </g>
 <g class="nj-exceptions-card">
-<rect class="nj-exceptions-box" x="506" y="306" width="228" height="166" rx="8"/>
-<text class="nj-exceptions-ctitle" x="520" y="331">Fuzzing</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="520" y="342" width="66.4" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="553.2" y="356">every PR</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--cont" x="592.4" y="342" width="79" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--cont" x="631.9" y="356">continuous</text>
-<text class="nj-exceptions-line" x="520" y="384">CIFuzz on every pull request</text>
-<text class="nj-exceptions-line" x="520" y="402">OSS-Fuzz: billions of inputs</text>
-<text class="nj-exceptions-line" x="520" y="420">every crash fixed with a</text>
-<text class="nj-exceptions-line" x="520" y="438">reproducing unit test</text>
+<rect class="nj-exceptions-box" x="506" y="360" width="228" height="166" rx="8"/>
+<text class="nj-exceptions-ctitle" x="520" y="385">Fuzzing</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="520" y="396" width="66.4" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="553.2" y="410">every PR</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--cont" x="592.4" y="396" width="79" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--cont" x="631.9" y="410">continuous</text>
+<text class="nj-exceptions-line" x="520" y="438">CIFuzz on every pull request</text>
+<text class="nj-exceptions-line" x="520" y="456">OSS-Fuzz: billions of inputs</text>
+<text class="nj-exceptions-line" x="520" y="474">every crash fixed with a</text>
+<text class="nj-exceptions-line" x="520" y="492">reproducing unit test</text>
 </g>
 <g class="nj-exceptions-card">
-<rect class="nj-exceptions-box" x="26" y="484" width="228" height="166" rx="8"/>
-<text class="nj-exceptions-ctitle" x="40" y="509">Style</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="40" y="520" width="110.5" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="95.25" y="534">every push / PR</text>
-<text class="nj-exceptions-line" x="40" y="562">Artistic Style (astyle),</text>
-<text class="nj-exceptions-line" x="40" y="580">enforced in the C&#8203;I</text>
-<text class="nj-exceptions-line" x="40" y="598">cpplint with 61 rules</text>
+<rect class="nj-exceptions-box" x="26" y="538" width="228" height="166" rx="8"/>
+<text class="nj-exceptions-ctitle" x="40" y="563">Style</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="40" y="574" width="110.5" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="95.25" y="588">every push / PR</text>
+<text class="nj-exceptions-line" x="40" y="616">Artistic Style (astyle),</text>
+<text class="nj-exceptions-line" x="40" y="634">enforced in the C&#8203;I</text>
+<text class="nj-exceptions-line" x="40" y="652">cpplint with 61 rules</text>
 </g>
 <g class="nj-exceptions-card">
-<rect class="nj-exceptions-box" x="266" y="484" width="228" height="166" rx="8"/>
-<text class="nj-exceptions-ctitle" x="280" y="509">Docs and examples</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="280" y="520" width="110.5" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="335.25" y="534">every push / PR</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--sched" x="396.5" y="520" width="72.7" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--sched" x="432.85" y="534">scheduled</text>
-<text class="nj-exceptions-line" x="280" y="562">every documentation example is</text>
-<text class="nj-exceptions-line" x="280" y="580">tested; changed output fails</text>
-<text class="nj-exceptions-line" x="280" y="598">site built with warnings</text>
-<text class="nj-exceptions-line" x="280" y="616">as errors; links checked</text>
-<text class="nj-exceptions-line" x="280" y="634">regularly (scheduled)</text>
+<rect class="nj-exceptions-box" x="266" y="538" width="228" height="166" rx="8"/>
+<text class="nj-exceptions-ctitle" x="280" y="563">Docs and examples</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="280" y="574" width="110.5" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="335.25" y="588">every push / PR</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--sched" x="396.5" y="574" width="72.7" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--sched" x="432.85" y="588">scheduled</text>
+<text class="nj-exceptions-line" x="280" y="616">every documentation example is</text>
+<text class="nj-exceptions-line" x="280" y="634">tested; changed output fails</text>
+<text class="nj-exceptions-line" x="280" y="652">site built with warnings</text>
+<text class="nj-exceptions-line" x="280" y="670">as errors; links checked</text>
+<text class="nj-exceptions-line" x="280" y="688">regularly (scheduled)</text>
 </g>
 <g class="nj-exceptions-card">
-<rect class="nj-exceptions-box" x="506" y="484" width="228" height="166" rx="8"/>
-<text class="nj-exceptions-ctitle" x="520" y="509">Integration, supply chain</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="520" y="520" width="110.5" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="575.25" y="534">every push / PR</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--sched" x="636.5" y="520" width="72.7" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--sched" x="672.85" y="534">scheduled</text>
-<text class="nj-exceptions-line" x="520" y="562">CMake 3.5, 3.31.6, and 4.0.0</text>
-<text class="nj-exceptions-line" x="520" y="580">Meson, Swift Package Manager</text>
-<text class="nj-exceptions-line" x="520" y="598">dependency review on every PR</text>
-<text class="nj-exceptions-line" x="520" y="616">Dependabot daily, OpenSSF</text>
-<text class="nj-exceptions-line" x="520" y="634">Scorecard, R&#8203;EUSE</text>
+<rect class="nj-exceptions-box" x="506" y="538" width="228" height="166" rx="8"/>
+<text class="nj-exceptions-ctitle" x="520" y="563">Integration, supply chain</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="520" y="574" width="110.5" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="575.25" y="588">every push / PR</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--sched" x="636.5" y="574" width="72.7" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--sched" x="672.85" y="588">scheduled</text>
+<text class="nj-exceptions-line" x="520" y="616">CMake 3.5, 3.31.6, and 4.0.0</text>
+<text class="nj-exceptions-line" x="520" y="634">Meson, Swift Package Manager</text>
+<text class="nj-exceptions-line" x="520" y="652">dependency review on every PR</text>
+<text class="nj-exceptions-line" x="520" y="670">Dependabot daily, OpenSSF</text>
+<text class="nj-exceptions-line" x="520" y="688">Scorecard, R&#8203;EUSE</text>
 </g>
-<line class="nj-exceptions-edge" x1="380" y1="664" x2="380" y2="690" marker-end="url(#nj-qa-arrow-w)"/>
-<rect class="nj-exceptions-stage nj-exceptions-stage--merge" x="265" y="692" width="230" height="34" rx="17"/>
-<text class="nj-exceptions-stagetext" x="380" y="714">merge into develop</text>
-<line class="nj-exceptions-edge" x1="380" y1="726" x2="380" y2="752" marker-end="url(#nj-qa-arrow-w)"/>
-<rect class="nj-exceptions-stage nj-exceptions-stage--merge" x="230" y="754" width="300" height="46" rx="23"/>
-<text class="nj-exceptions-stagetext" x="380" y="776">release</text>
-<text class="nj-exceptions-stagesub" x="380" y="792">no open vulnerability alert</text>
+<line class="nj-exceptions-edge" x1="380" y1="718" x2="380" y2="744" marker-end="url(#nj-qa-arrow-w)"/>
+<rect class="nj-exceptions-stage nj-exceptions-stage--merge" x="265" y="746" width="230" height="34" rx="17"/>
+<text class="nj-exceptions-stagetext" x="380" y="768">merge into develop</text>
+<line class="nj-exceptions-edge" x1="380" y1="780" x2="380" y2="806" marker-end="url(#nj-qa-arrow-w)"/>
+<rect class="nj-exceptions-stage nj-exceptions-stage--merge" x="230" y="808" width="300" height="46" rx="23"/>
+<text class="nj-exceptions-stagetext" x="380" y="830">release</text>
+<text class="nj-exceptions-stagesub" x="380" y="846">no open vulnerability alert</text>
 </svg>
-<svg class="nj-fig nj-exceptions-qa nj-exceptions-qa--narrow" viewBox="0 0 360 1786" role="img" aria-labelledby="nj-qa-title-n nj-qa-desc-n" xmlns="http://www.w3.org/2000/svg">
+<svg class="nj-fig nj-exceptions-qa nj-exceptions-qa--narrow" viewBox="0 0 360 1840" role="img" aria-labelledby="nj-qa-title-n nj-qa-desc-n" xmlns="http://www.w3.org/2000/svg">
 <title id="nj-qa-title-n">Quality assurance pipeline</title>
-<desc id="nj-qa-desc-n">Every push or pull request starts these checks in parallel: Build matrix (every push / PR): 50+ compilers: G&#8203;CC, Clang, M&#8203;SVC, AppleClang, Intel, NVIDIA, ... C++11, 14, 17, 20, 23, and 26 libc++ and libstdc++ warnings: Clang -Weverything, G&#8203;CC 300+ warnings; Unit tests (doctest) (every push / PR): every public A&#8203;PI function every exception id and message all Unicode code points single header and split headers custom number, string, array, and object types; Coverage (every push / PR): unit tests cover all lines of the code base; Static analysis (every push / PR, scheduled): Clang-Tidy, Cppcheck, Infer Clang Static Analyzer (52 checkers), I&#8203;WYU, Codacy CodeQL, Semgrep, Flawfinder (also scheduled); Dynamic analysis (every push / PR): runtime assertions Valgrind (Memcheck) address and undefined behavior sanitizers, integer overflow, nullability violations; Fuzzing (every PR, continuous): CIFuzz on every pull request OSS-Fuzz: billions of inputs every crash fixed with a reproducing unit test; Style (every push / PR): Artistic Style (astyle), enforced in the C&#8203;I cpplint with 61 rules; Docs and examples (every push / PR, scheduled): every documentation example is tested; changed output fails site built with warnings as errors; links checked regularly (scheduled); Integration, supply chain (every push / PR, scheduled): CMake 3.5, 3.31.6, and 4.0.0 Meson, Swift Package Manager dependency review on every PR Dependabot daily, OpenSSF Scorecard, R&#8203;EUSE. When they pass, the change is merged into develop; a release is made only when no vulnerability alert is open.</desc>
+<desc id="nj-qa-desc-n">A push or pull request starts these checks; the badges say when each runs: Build matrix (every push / PR, before merge): 50+ compilers: G&#8203;CC, Clang, M&#8203;SVC, AppleClang, Intel, NVIDIA, ... C++11, 14, 17, 20, 23, and 26 libc++ and libstdc++ warnings: Clang -Weverything, G&#8203;CC 300+ warnings a subset on every push and PR, all before merge; Intel, NVIDIA, C&#8203;UDA, and ARM64 nightly; Unit tests (doctest) (every push / PR): every public A&#8203;PI function every exception id and message all Unicode code points single header and split headers custom number, string, array, and object types; Coverage (nightly): unit tests cover all lines of the code base; Static analysis (every push / PR, scheduled): Clang-Tidy, Cppcheck, Infer Clang Static Analyzer (52 checkers), I&#8203;WYU, Codacy CodeQL, Semgrep, Flawfinder (also scheduled); Infer nightly; Dynamic analysis (every push / PR, nightly): runtime assertions Valgrind (Memcheck), nightly address and undefined behavior sanitizers, integer overflow, nullability violations; Fuzzing (every PR, continuous): CIFuzz on every pull request OSS-Fuzz: billions of inputs every crash fixed with a reproducing unit test; Style (every push / PR): Artistic Style (astyle), enforced in the C&#8203;I cpplint with 61 rules; Docs and examples (every push / PR, scheduled): every documentation example is tested; changed output fails site built with warnings as errors; links checked regularly (scheduled); Integration, supply chain (every push / PR, scheduled): CMake 3.5, 3.31.6, and 4.0.0 Meson, Swift Package Manager dependency review on every PR Dependabot daily, OpenSSF Scorecard, R&#8203;EUSE. When they pass, the change is merged into develop; a release is made only when no vulnerability alert is open.</desc>
 <defs><marker id="nj-qa-arrow-n" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto"><path class="fg-head" d="M0 1 L10 5 L0 9 z"/></marker></defs>
-<rect class="nj-exceptions-groupbox" x="12" y="70" width="336" height="1572" rx="12"/>
+<rect class="nj-exceptions-groupbox" x="12" y="70" width="336" height="1626" rx="12"/>
 <rect class="nj-exceptions-stage" x="65" y="8" width="230" height="34" rx="17"/>
 <text class="nj-exceptions-stagetext" x="180" y="30">push or pull request</text>
 <line class="nj-exceptions-edge" x1="180" y1="42" x2="180" y2="68" marker-end="url(#nj-qa-arrow-n)"/>
 <text class="nj-exceptions-group" x="26" y="94">checks, run in parallel</text>
 <g class="nj-exceptions-card">
-<rect class="nj-exceptions-box" x="26" y="110" width="308" height="184" rx="8"/>
+<rect class="nj-exceptions-box" x="26" y="110" width="308" height="238" rx="8"/>
 <text class="nj-exceptions-ctitle" x="40" y="135">Build matrix</text>
 <rect class="nj-exceptions-badge nj-exceptions-badge--push" x="40" y="146" width="110.5" height="20" rx="10"/>
 <text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="95.25" y="160">every push / PR</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="156.5" y="146" width="91.6" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="202.3" y="160">before merge</text>
 <text class="nj-exceptions-line" x="40" y="188">50+ compilers: G&#8203;CC, Clang, M&#8203;SVC,</text>
 <text class="nj-exceptions-line" x="40" y="206">AppleClang, Intel, NVIDIA, ...</text>
 <text class="nj-exceptions-line" x="40" y="224">C++11, 14, 17, 20, 23, and 26</text>
 <text class="nj-exceptions-line" x="40" y="242">libc++ and libstdc++</text>
 <text class="nj-exceptions-line" x="40" y="260">warnings: Clang -Weverything,</text>
 <text class="nj-exceptions-line" x="40" y="278">G&#8203;CC 300+ warnings</text>
+<text class="nj-exceptions-line" x="40" y="296">a subset on every push and PR,</text>
+<text class="nj-exceptions-line" x="40" y="314">all before merge; Intel, NVIDIA,</text>
+<text class="nj-exceptions-line" x="40" y="332">C&#8203;UDA, and ARM64 nightly</text>
 </g>
 <g class="nj-exceptions-card">
-<rect class="nj-exceptions-box" x="26" y="306" width="308" height="184" rx="8"/>
-<text class="nj-exceptions-ctitle" x="40" y="331">Unit tests (doctest)</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="40" y="342" width="110.5" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="95.25" y="356">every push / PR</text>
-<text class="nj-exceptions-line" x="40" y="384">every public A&#8203;PI function</text>
-<text class="nj-exceptions-line" x="40" y="402">every exception id and message</text>
-<text class="nj-exceptions-line" x="40" y="420">all Unicode code points</text>
-<text class="nj-exceptions-line" x="40" y="438">single header and split headers</text>
-<text class="nj-exceptions-line" x="40" y="456">custom number, string, array,</text>
-<text class="nj-exceptions-line" x="40" y="474">and object types</text>
+<rect class="nj-exceptions-box" x="26" y="360" width="308" height="184" rx="8"/>
+<text class="nj-exceptions-ctitle" x="40" y="385">Unit tests (doctest)</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="40" y="396" width="110.5" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="95.25" y="410">every push / PR</text>
+<text class="nj-exceptions-line" x="40" y="438">every public A&#8203;PI function</text>
+<text class="nj-exceptions-line" x="40" y="456">every exception id and message</text>
+<text class="nj-exceptions-line" x="40" y="474">all Unicode code points</text>
+<text class="nj-exceptions-line" x="40" y="492">single header and split headers</text>
+<text class="nj-exceptions-line" x="40" y="510">custom number, string, array,</text>
+<text class="nj-exceptions-line" x="40" y="528">and object types</text>
 </g>
 <g class="nj-exceptions-card">
-<rect class="nj-exceptions-box" x="26" y="502" width="308" height="112" rx="8"/>
-<text class="nj-exceptions-ctitle" x="40" y="527">Coverage</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="40" y="538" width="110.5" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="95.25" y="552">every push / PR</text>
-<text class="nj-exceptions-line" x="40" y="580">unit tests cover all lines</text>
-<text class="nj-exceptions-line" x="40" y="598">of the code base</text>
+<rect class="nj-exceptions-box" x="26" y="556" width="308" height="112" rx="8"/>
+<text class="nj-exceptions-ctitle" x="40" y="581">Coverage</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--sched" x="40" y="592" width="60.1" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--sched" x="70.05" y="606">nightly</text>
+<text class="nj-exceptions-line" x="40" y="634">unit tests cover all lines</text>
+<text class="nj-exceptions-line" x="40" y="652">of the code base</text>
 </g>
 <g class="nj-exceptions-card">
-<rect class="nj-exceptions-box" x="26" y="626" width="308" height="166" rx="8"/>
-<text class="nj-exceptions-ctitle" x="40" y="651">Static analysis</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="40" y="662" width="110.5" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="95.25" y="676">every push / PR</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--sched" x="156.5" y="662" width="72.7" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--sched" x="192.85" y="676">scheduled</text>
-<text class="nj-exceptions-line" x="40" y="704">Clang-Tidy, Cppcheck, Infer</text>
-<text class="nj-exceptions-line" x="40" y="722">Clang Static Analyzer (52</text>
-<text class="nj-exceptions-line" x="40" y="740">checkers), I&#8203;WYU, Codacy</text>
-<text class="nj-exceptions-line" x="40" y="758">CodeQL, Semgrep, Flawfinder</text>
-<text class="nj-exceptions-line" x="40" y="776">(also scheduled)</text>
+<rect class="nj-exceptions-box" x="26" y="680" width="308" height="166" rx="8"/>
+<text class="nj-exceptions-ctitle" x="40" y="705">Static analysis</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="40" y="716" width="110.5" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="95.25" y="730">every push / PR</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--sched" x="156.5" y="716" width="72.7" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--sched" x="192.85" y="730">scheduled</text>
+<text class="nj-exceptions-line" x="40" y="758">Clang-Tidy, Cppcheck, Infer</text>
+<text class="nj-exceptions-line" x="40" y="776">Clang Static Analyzer (52</text>
+<text class="nj-exceptions-line" x="40" y="794">checkers), I&#8203;WYU, Codacy</text>
+<text class="nj-exceptions-line" x="40" y="812">CodeQL, Semgrep, Flawfinder</text>
+<text class="nj-exceptions-line" x="40" y="830">(also scheduled); Infer nightly</text>
 </g>
 <g class="nj-exceptions-card">
-<rect class="nj-exceptions-box" x="26" y="804" width="308" height="166" rx="8"/>
-<text class="nj-exceptions-ctitle" x="40" y="829">Dynamic analysis</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="40" y="840" width="110.5" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="95.25" y="854">every push / PR</text>
-<text class="nj-exceptions-line" x="40" y="882">runtime assertions</text>
-<text class="nj-exceptions-line" x="40" y="900">Valgrind (Memcheck)</text>
-<text class="nj-exceptions-line" x="40" y="918">address and undefined behavior</text>
-<text class="nj-exceptions-line" x="40" y="936">sanitizers, integer overflow,</text>
-<text class="nj-exceptions-line" x="40" y="954">nullability violations</text>
+<rect class="nj-exceptions-box" x="26" y="858" width="308" height="166" rx="8"/>
+<text class="nj-exceptions-ctitle" x="40" y="883">Dynamic analysis</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="40" y="894" width="110.5" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="95.25" y="908">every push / PR</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--sched" x="156.5" y="894" width="60.1" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--sched" x="186.55" y="908">nightly</text>
+<text class="nj-exceptions-line" x="40" y="936">runtime assertions</text>
+<text class="nj-exceptions-line" x="40" y="954">Valgrind (Memcheck), nightly</text>
+<text class="nj-exceptions-line" x="40" y="972">address and undefined behavior</text>
+<text class="nj-exceptions-line" x="40" y="990">sanitizers, integer overflow,</text>
+<text class="nj-exceptions-line" x="40" y="1008">nullability violations</text>
 </g>
 <g class="nj-exceptions-card">
-<rect class="nj-exceptions-box" x="26" y="982" width="308" height="148" rx="8"/>
-<text class="nj-exceptions-ctitle" x="40" y="1007">Fuzzing</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="40" y="1018" width="66.4" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="73.2" y="1032">every PR</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--cont" x="112.4" y="1018" width="79" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--cont" x="151.9" y="1032">continuous</text>
-<text class="nj-exceptions-line" x="40" y="1060">CIFuzz on every pull request</text>
-<text class="nj-exceptions-line" x="40" y="1078">OSS-Fuzz: billions of inputs</text>
-<text class="nj-exceptions-line" x="40" y="1096">every crash fixed with a</text>
-<text class="nj-exceptions-line" x="40" y="1114">reproducing unit test</text>
+<rect class="nj-exceptions-box" x="26" y="1036" width="308" height="148" rx="8"/>
+<text class="nj-exceptions-ctitle" x="40" y="1061">Fuzzing</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="40" y="1072" width="66.4" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="73.2" y="1086">every PR</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--cont" x="112.4" y="1072" width="79" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--cont" x="151.9" y="1086">continuous</text>
+<text class="nj-exceptions-line" x="40" y="1114">CIFuzz on every pull request</text>
+<text class="nj-exceptions-line" x="40" y="1132">OSS-Fuzz: billions of inputs</text>
+<text class="nj-exceptions-line" x="40" y="1150">every crash fixed with a</text>
+<text class="nj-exceptions-line" x="40" y="1168">reproducing unit test</text>
 </g>
 <g class="nj-exceptions-card">
-<rect class="nj-exceptions-box" x="26" y="1142" width="308" height="130" rx="8"/>
-<text class="nj-exceptions-ctitle" x="40" y="1167">Style</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="40" y="1178" width="110.5" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="95.25" y="1192">every push / PR</text>
-<text class="nj-exceptions-line" x="40" y="1220">Artistic Style (astyle),</text>
-<text class="nj-exceptions-line" x="40" y="1238">enforced in the C&#8203;I</text>
-<text class="nj-exceptions-line" x="40" y="1256">cpplint with 61 rules</text>
+<rect class="nj-exceptions-box" x="26" y="1196" width="308" height="130" rx="8"/>
+<text class="nj-exceptions-ctitle" x="40" y="1221">Style</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="40" y="1232" width="110.5" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="95.25" y="1246">every push / PR</text>
+<text class="nj-exceptions-line" x="40" y="1274">Artistic Style (astyle),</text>
+<text class="nj-exceptions-line" x="40" y="1292">enforced in the C&#8203;I</text>
+<text class="nj-exceptions-line" x="40" y="1310">cpplint with 61 rules</text>
 </g>
 <g class="nj-exceptions-card">
-<rect class="nj-exceptions-box" x="26" y="1284" width="308" height="166" rx="8"/>
-<text class="nj-exceptions-ctitle" x="40" y="1309">Docs and examples</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="40" y="1320" width="110.5" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="95.25" y="1334">every push / PR</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--sched" x="156.5" y="1320" width="72.7" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--sched" x="192.85" y="1334">scheduled</text>
-<text class="nj-exceptions-line" x="40" y="1362">every documentation example is</text>
-<text class="nj-exceptions-line" x="40" y="1380">tested; changed output fails</text>
-<text class="nj-exceptions-line" x="40" y="1398">site built with warnings</text>
-<text class="nj-exceptions-line" x="40" y="1416">as errors; links checked</text>
-<text class="nj-exceptions-line" x="40" y="1434">regularly (scheduled)</text>
+<rect class="nj-exceptions-box" x="26" y="1338" width="308" height="166" rx="8"/>
+<text class="nj-exceptions-ctitle" x="40" y="1363">Docs and examples</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="40" y="1374" width="110.5" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="95.25" y="1388">every push / PR</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--sched" x="156.5" y="1374" width="72.7" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--sched" x="192.85" y="1388">scheduled</text>
+<text class="nj-exceptions-line" x="40" y="1416">every documentation example is</text>
+<text class="nj-exceptions-line" x="40" y="1434">tested; changed output fails</text>
+<text class="nj-exceptions-line" x="40" y="1452">site built with warnings</text>
+<text class="nj-exceptions-line" x="40" y="1470">as errors; links checked</text>
+<text class="nj-exceptions-line" x="40" y="1488">regularly (scheduled)</text>
 </g>
 <g class="nj-exceptions-card">
-<rect class="nj-exceptions-box" x="26" y="1462" width="308" height="166" rx="8"/>
-<text class="nj-exceptions-ctitle" x="40" y="1487">Integration, supply chain</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="40" y="1498" width="110.5" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="95.25" y="1512">every push / PR</text>
-<rect class="nj-exceptions-badge nj-exceptions-badge--sched" x="156.5" y="1498" width="72.7" height="20" rx="10"/>
-<text class="nj-exceptions-badgetext nj-exceptions-badgetext--sched" x="192.85" y="1512">scheduled</text>
-<text class="nj-exceptions-line" x="40" y="1540">CMake 3.5, 3.31.6, and 4.0.0</text>
-<text class="nj-exceptions-line" x="40" y="1558">Meson, Swift Package Manager</text>
-<text class="nj-exceptions-line" x="40" y="1576">dependency review on every PR</text>
-<text class="nj-exceptions-line" x="40" y="1594">Dependabot daily, OpenSSF</text>
-<text class="nj-exceptions-line" x="40" y="1612">Scorecard, R&#8203;EUSE</text>
+<rect class="nj-exceptions-box" x="26" y="1516" width="308" height="166" rx="8"/>
+<text class="nj-exceptions-ctitle" x="40" y="1541">Integration, supply chain</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--push" x="40" y="1552" width="110.5" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--push" x="95.25" y="1566">every push / PR</text>
+<rect class="nj-exceptions-badge nj-exceptions-badge--sched" x="156.5" y="1552" width="72.7" height="20" rx="10"/>
+<text class="nj-exceptions-badgetext nj-exceptions-badgetext--sched" x="192.85" y="1566">scheduled</text>
+<text class="nj-exceptions-line" x="40" y="1594">CMake 3.5, 3.31.6, and 4.0.0</text>
+<text class="nj-exceptions-line" x="40" y="1612">Meson, Swift Package Manager</text>
+<text class="nj-exceptions-line" x="40" y="1630">dependency review on every PR</text>
+<text class="nj-exceptions-line" x="40" y="1648">Dependabot daily, OpenSSF</text>
+<text class="nj-exceptions-line" x="40" y="1666">Scorecard, R&#8203;EUSE</text>
 </g>
-<line class="nj-exceptions-edge" x1="180" y1="1642" x2="180" y2="1668" marker-end="url(#nj-qa-arrow-n)"/>
-<rect class="nj-exceptions-stage nj-exceptions-stage--merge" x="65" y="1670" width="230" height="34" rx="17"/>
-<text class="nj-exceptions-stagetext" x="180" y="1692">merge into develop</text>
-<line class="nj-exceptions-edge" x1="180" y1="1704" x2="180" y2="1730" marker-end="url(#nj-qa-arrow-n)"/>
-<rect class="nj-exceptions-stage nj-exceptions-stage--merge" x="30" y="1732" width="300" height="46" rx="23"/>
-<text class="nj-exceptions-stagetext" x="180" y="1754">release</text>
-<text class="nj-exceptions-stagesub" x="180" y="1770">no open vulnerability alert</text>
+<line class="nj-exceptions-edge" x1="180" y1="1696" x2="180" y2="1722" marker-end="url(#nj-qa-arrow-n)"/>
+<rect class="nj-exceptions-stage nj-exceptions-stage--merge" x="65" y="1724" width="230" height="34" rx="17"/>
+<text class="nj-exceptions-stagetext" x="180" y="1746">merge into develop</text>
+<line class="nj-exceptions-edge" x1="180" y1="1758" x2="180" y2="1784" marker-end="url(#nj-qa-arrow-n)"/>
+<rect class="nj-exceptions-stage nj-exceptions-stage--merge" x="30" y="1786" width="300" height="46" rx="23"/>
+<text class="nj-exceptions-stagetext" x="180" y="1808">release</text>
+<text class="nj-exceptions-stagesub" x="180" y="1824">no open vulnerability alert</text>
 </svg>

docs/mkdocs/scripts/figures/qa_pipeline.py

@@ -22,19 +22,24 @@ P = "nj-exceptions-"
 TRIGGERS = {
     "push": ("every push / PR", "push"),
     "pr": ("every PR", "push"),
+    "merge": ("before merge", "push"),
+    "nightly": ("nightly", "sched"),
     "sched": ("scheduled", "sched"),
     "cont": ("continuous", "cont"),
 }
 
 # title, triggers, lines (at most 31 characters, so they fit a card of the three-column drawing)
 LANES = [
-    ("Build matrix", ["push"], [
+    ("Build matrix", ["push", "merge"], [
         "50+ compilers: GCC, Clang, MSVC,",
         "AppleClang, Intel, NVIDIA, ...",
         "C++11, 14, 17, 20, 23, and 26",
         "libc++ and libstdc++",
         "warnings: Clang -Weverything,",
         "GCC 300+ warnings",
+        "a subset on every push and PR,",
+        "all before merge; Intel, NVIDIA,",
+        "CUDA, and ARM64 nightly",
     ]),
     ("Unit tests (doctest)", ["push"], [
         "every public API function",
@@ -44,7 +49,7 @@ LANES = [
         "custom number, string, array,",
         "and object types",
     ]),
-    ("Coverage", ["push"], [
+    ("Coverage", ["nightly"], [
         "unit tests cover all lines",
         "of the code base",
     ]),
@@ -53,11 +58,11 @@ LANES = [
         "Clang Static Analyzer (52",
         "checkers), IWYU, Codacy",
         "CodeQL, Semgrep, Flawfinder",
-        "(also scheduled)",
+        "(also scheduled); Infer nightly",
     ]),
-    ("Dynamic analysis", ["push"], [
+    ("Dynamic analysis", ["push", "nightly"], [
         "runtime assertions",
-        "Valgrind (Memcheck)",
+        "Valgrind (Memcheck), nightly",
         "address and undefined behavior",
         "sanitizers, integer overflow,",
         "nullability violations",
@@ -178,7 +183,7 @@ def drawing(W, cols, suffix):
     defs = ('<defs><marker id="%s" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto">'
             '<path class="fg-head" d="M0 1 L10 5 L0 9 z"/></marker></defs>' % mid)
     tid, did = "nj-qa-title-" + suffix, "nj-qa-desc-" + suffix
-    desc = ("Every push or pull request starts these checks in parallel: " +
+    desc = ("A push or pull request starts these checks; the badges say when each runs: " +
             "; ".join("%s (%s): %s" % (t, ", ".join(TRIGGERS[k][0] for k in trig), " ".join(lines)) for t, trig, lines in LANES) +
             ". When they pass, the change is merged into develop; a release is made only when no vulnerability alert is open.")
     out = ['<svg class="nj-fig %sqa %sqa--%s" viewBox="0 0 %d %d" role="img" aria-labelledby="%s %s" xmlns="http://www.w3.org/2000/svg">'

tools/check_path_filters/check_path_filters.py

@@ -69,6 +69,10 @@ KNOWN_REFERENCES = [
     ('tests/src/make_test_data_available.hpp', 'README.md', 'a file of the external test data repository'),
     ('tools/check_build_options/check_build_options.py', 'docs/', 'builds the path of package_managers.md, which '
                                                                   'PATHS includes'),
+    ('tools/ci_jobs/ci_jobs.py', 'docs/mkdocs/docs/community/quality_assurance.md',
+     'checks the job table; runs in repository_checks.yml, which has no path filter'),
+    ('tools/ci_jobs/ci_jobs.py', '.github/workflows/repository_checks.yml', 'read by --compare, a manual check'),
+    ('tools/ci_jobs/ci_jobs.py', '.github/workflows/check_amalgamation.yml', 'read by --compare, a manual check'),
 ]
 
 

tools/ci_jobs/README.md

@@ -0,0 +1,27 @@
+# ci_jobs
+
+The compiler jobs of [`ubuntu.yml`](../../.github/workflows/ubuntu.yml) are split into three sets, chosen by each job's
+`if:` condition (see [How CI runs](https://json.nlohmann.me/community/quality_assurance/#how-ci-runs)):
+
+- **PR set**: every push to a pull request, and every push to `develop`, `master`, and `release/*`;
+- **full set**: after the PR set passed, on pull requests with the label "🚀 ready to merge" and on every push;
+- **nightly set**: every night on `develop`, on every push to `master` and `release/*`, and when started by hand.
+
+A matrix whose entries belong to different sets is split into one job per set: the full-set job gets the suffix
+`_full`, the nightly-set job `_nightly`, and both share their steps with the PR-set job through YAML anchors.
+
+[`ci_jobs.py`](ci_jobs.py) checks that
+
+- every job of `ubuntu.yml` has the `if:` condition of exactly one set (the conditions are in `SETS`),
+- every full-set job waits for (`needs:`) exactly the PR set, and `nightly_report` for exactly the nightly set, and
+- the job table in [`quality_assurance.md`](../../docs/mkdocs/docs/community/quality_assurance.md) is up to date.
+
+```shell
+python3 -m venv venv && venv/bin/pip install -r tools/ci_jobs/requirements.txt
+venv/bin/python tools/ci_jobs/ci_jobs.py                       # check
+venv/bin/python tools/ci_jobs/ci_jobs.py --markdown            # print the job table for the documentation
+venv/bin/python tools/ci_jobs/ci_jobs.py --compare origin/develop  # list configurations added or removed since develop
+```
+
+Use `--compare` when changing the workflows: a configuration that disappears fails it, so no compiler, version, or
+standard is dropped by accident when jobs are split, merged, or moved between sets.

tools/ci_jobs/ci_jobs.py

@@ -0,0 +1,230 @@
+#!/usr/bin/env python3
+"""List and check the jobs of the compiler workflows and the set each job belongs to.
+
+The jobs of a tiered workflow (ubuntu.yml) belong to one of three sets, chosen
+by the job's `if:` condition:
+
+- PR set: every pull request push and every push,
+- full set: after the PR set passed, on pushes and on pull requests with the
+  "🚀 ready to merge" label,
+- nightly set: nightly on develop, on pushes to master and release/*, and when
+  started by hand.
+
+The jobs of the other workflows run on every push and pull request.
+
+The script checks that every job of a tiered workflow belongs to exactly one
+set, that the full set waits for the whole PR set, that the nightly report
+waits for the whole nightly set, and that the job table in
+docs/mkdocs/docs/community/quality_assurance.md is up to date.
+
+  --markdown       print the job table for the documentation
+  --compare REF    list the configurations (job and matrix values) added or
+                   removed since the git revision REF; fails if one was removed
+"""
+
+import argparse
+import collections
+import itertools
+import os
+import re
+import subprocess  # nosec B404
+import sys
+
+import yaml
+
+REPO_ROOT = os.path.normpath(os.path.join(sys.path[0], '..', '..'))
+DOCS = 'docs/mkdocs/docs/community/quality_assurance.md'
+BEGIN, END = '<!-- ci_jobs: begin -->', '<!-- ci_jobs: end -->'
+
+WORKFLOWS = ['.github/workflows/ubuntu.yml', '.github/workflows/macos.yml', '.github/workflows/windows.yml']
+TIERED = ['.github/workflows/ubuntu.yml']
+# --compare also counts the jobs of these workflows, so a job moved between workflows is not a removed one
+COMPARED = WORKFLOWS + ['.github/workflows/repository_checks.yml', '.github/workflows/check_amalgamation.yml']
+
+LABEL = '🚀 ready to merge'
+SETS = collections.OrderedDict([
+    ('PR set', "${{ github.event_name != 'schedule' && (github.event.action != 'labeled' || "
+               "github.event.label.name == '" + LABEL + "') }}"),
+    ('full set', "${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || "
+                 "contains(github.event.pull_request.labels.*.name, '" + LABEL + "') }}"),
+    ('nightly set', "${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || "
+                    "(github.event_name == 'push' && github.ref != 'refs/heads/develop') }}"),
+])
+UNTIERED = 'every push and PR'
+REPORT_JOB = 'nightly_report'
+
+# a job split by set keeps its name and gets one of these suffixes
+SUFFIXES = {'full set': '_full', 'nightly set': '_nightly'}
+
+
+def read(root, path, ref=None):
+    if ref is None:
+        with open(os.path.join(root, path), encoding='utf-8') as f:
+            return f.read()
+    # fixed command; ref is a git revision given on the command line
+    return subprocess.check_output(['git', 'show', '{}:{}'.format(ref, path)], cwd=root,  # nosec B603, B607
+                                   stderr=subprocess.DEVNULL).decode('utf-8')
+
+
+def add_include(combos, keys, inc):
+    """Apply one include entry: extend the matching configurations, or add it as a new one."""
+    matching = [c for c in combos if all(c[k] == v for k, v in inc.items() if k in keys)]
+    for c in matching:
+        c.update({k: v for k, v in inc.items() if k not in keys})
+    if not matching:
+        combos.append(dict(inc))
+
+
+def expand(matrix):
+    """Return the configurations of a job's strategy.matrix like GitHub Actions does."""
+    if not matrix:
+        return [{}]
+    keys = [k for k in matrix if k not in ('include', 'exclude')]
+    combos = [dict(zip(keys, values)) for values in itertools.product(*(matrix[k] for k in keys))] if keys else []
+    for ex in matrix.get('exclude') or []:
+        combos = [c for c in combos if any(c.get(k) != v for k, v in ex.items())]
+    for inc in matrix.get('include') or []:
+        add_include(combos, keys, inc)
+    return combos
+
+
+def jobs_of(root, workflow, ref=None):
+    """Yield (job id, set, list of configurations) for every job of a workflow."""
+    data = yaml.safe_load(read(root, workflow, ref))
+    for job_id, job in data['jobs'].items():
+        condition = job.get('if')
+        job_set = UNTIERED if condition is None else next((s for s, c in SETS.items() if c == condition), None)
+        matrix = (job.get('strategy') or {}).get('matrix')
+        yield job_id, job_set, job, expand(matrix)
+
+
+def base_id(job_id, job_set):
+    suffix = SUFFIXES.get(job_set)
+    return job_id[:-len(suffix)] if suffix and job_id.endswith(suffix) else job_id
+
+
+def label(config):
+    return ', '.join(str(v) for k, v in config.items() if k != 'os' or len(config) == 1)
+
+
+def configurations(root, ref=None):
+    """Return a Counter of (job name without set suffix, configuration) over the compared workflows."""
+    result = collections.Counter()
+    for workflow in COMPARED:
+        try:
+            jobs = list(jobs_of(root, workflow, ref))
+        except (OSError, subprocess.CalledProcessError):
+            continue  # the workflow does not exist in this revision
+        for job_id, job_set, _, configs in jobs:
+            if job_id == REPORT_JOB:
+                continue
+            for c in configs:
+                result[(base_id(job_id, job_set), tuple(sorted((k, str(v)) for k, v in c.items())))] += 1
+    return result
+
+
+def markdown(root):
+    rows = []
+    order = list(SETS) + [UNTIERED]
+    for workflow in WORKFLOWS:
+        for job_id, job_set, _, configs in jobs_of(root, workflow):
+            if job_id == REPORT_JOB:
+                continue
+            labels = [label(c) for c in configs if c]
+            rows.append((order.index(job_set) if job_set in order else len(order), os.path.basename(workflow), job_id,
+                         job_set or 'no set', '; '.join(labels) or '-'))
+    rows.sort(key=lambda r: (r[0], r[1]))
+    lines = ['| Set | Workflow | Job | Configurations |', '|-----|----------|-----|----------------|']
+    lines += ['| {} | {} | `{}` | {} |'.format(s, w, j, c) for _, w, j, s, c in rows]
+    return lines
+
+
+def check_sets(workflow, jobs):
+    """Return the errors in the sets of a tiered workflow's jobs and the jobs of each set."""
+    errors = []
+    by_set = collections.defaultdict(set)
+    for job_id, job_set, _, _ in jobs:
+        if job_id == REPORT_JOB:
+            continue
+        if job_set in SETS:
+            by_set[job_set].add(job_id)
+        else:
+            errors.append('{}: job {} has an if: condition of no set; use one of the conditions in '
+                          'tools/ci_jobs/ci_jobs.py'.format(workflow, job_id))
+    return errors, by_set
+
+
+def check_needs(workflow, jobs, by_set):
+    """Return the errors in the needs: of a tiered workflow's jobs."""
+    required = {'full set': by_set['PR set'], 'PR set': set(), 'nightly set': set()}
+    errors = []
+    for job_id, job_set, job, _ in jobs:
+        needs = job.get('needs') or []
+        needs = {needs} if isinstance(needs, str) else set(needs)
+        expected = by_set['nightly set'] if job_id == REPORT_JOB else required.get(job_set, needs)
+        if needs != expected:
+            errors.append('{}: job {} must need exactly: {}'.format(workflow, job_id, ', '.join(sorted(expected)) or 'no job'))
+    return errors
+
+
+def check_docs(root):
+    """Return an error if the job table in the documentation is not up to date."""
+    text = read(root, DOCS)
+    block = re.search(re.escape(BEGIN) + r'\n(.*?)\n[ \t]*' + re.escape(END), text, re.S)
+    if not block:
+        return ['{}: markers {} and {} not found'.format(DOCS, BEGIN, END)]
+    indent = re.match(r'[ \t]*', block.group(1)).group(0)
+    if block.group(1) != '\n'.join(indent + line for line in markdown(root)):
+        return ['{}: the job table is out of date; replace it with the output of '
+                'python3 tools/ci_jobs/ci_jobs.py --markdown'.format(DOCS)]
+    return []
+
+
+def check(root):
+    errors = []
+    for workflow in TIERED:
+        jobs = list(jobs_of(root, workflow))
+        set_errors, by_set = check_sets(workflow, jobs)
+        errors += set_errors + check_needs(workflow, jobs, by_set)
+    errors += check_docs(root)
+
+    for e in errors:
+        print(e)
+    if not errors:
+        counts = collections.Counter()
+        for workflow in WORKFLOWS:
+            for job_id, job_set, _, configs in jobs_of(root, workflow):
+                if job_id != REPORT_JOB:
+                    counts[job_set] += len(configs)
+        print('CI jobs OK: ' + ', '.join('{} {}'.format(n, s) for s, n in counts.items()))
+    return 1 if errors else 0
+
+
+def compare(root, ref):
+    before, after = configurations(root, ref), configurations(root)
+    removed, added = before - after, after - before
+    for title, diff in (('removed', removed), ('added', added)):
+        for job, config in sorted(diff.elements()):
+            print('{}: {} ({})'.format(title, job, ', '.join('{}={}'.format(k, v) for k, v in config)))
+    print('{} configurations before, {} after; {} removed, {} added'.format(
+        sum(before.values()), sum(after.values()), sum(removed.values()), sum(added.values())))
+    return 1 if removed else 0
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument('--root', default=REPO_ROOT, help='repository root')
+    group = parser.add_mutually_exclusive_group()
+    group.add_argument('--markdown', action='store_true', help='print the job table for the documentation')
+    group.add_argument('--compare', metavar='REF', help='list the configurations added or removed since REF')
+    args = parser.parse_args()
+    if args.markdown:
+        print('\n'.join(markdown(args.root)))
+        return 0
+    if args.compare:
+        return compare(args.root, args.compare)
+    return check(args.root)
+
+
+if __name__ == '__main__':
+    sys.exit(main())

tools/ci_jobs/requirements.txt

@@ -0,0 +1 @@
+PyYAML==6.0.3