Added dimuon histograms for top/bottom halfs of MCH

.checkov.yml

@@ -0,0 +1,6 @@
+---
+# You can see all available properties here: https://github.com/bridgecrewio/checkov#configuration-using-a-config-file
+quiet: true
+skip-check:
+  - CKV_DOCKER_2
+  - CKV_GHA_7

.clang-format

@@ -24,6 +24,7 @@ ExperimentalAutoDetectBinPacking: false
 IndentCaseLabels: true
 IndentFunctionDeclarationAfterType: true
 IndentWidth:     2
+InsertNewlineAtEOF: true
 # It is broken on windows. Breaks all #include "header.h"
 ---
 Language:        Cpp

.github/dependabot.yml

@@ -0,0 +1,10 @@
+---
+# Dependabot configuration
+# Reference: https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "weekly"

.github/labeler.yml

@@ -0,0 +1,69 @@
+---
+alice3:
+  - changed-files:
+      - any-glob-to-any-file: ['ALICE3/**']
+
+common:
+  - changed-files:
+      - any-glob-to-any-file: ['Common/**']
+
+infrastructure:
+  - changed-files:
+      - any-glob-to-any-file:
+          - '.clang-format'
+          - '.clang-tidy'
+          - '.flake8'
+          - '.github/**'
+          - '.checkov.yml'
+          - '.mega-linter.yml'
+          - '.pre-commit-config.yaml'
+          - 'cmake/**'
+          - 'CODEOWNERS'
+          - 'CPPLINT.cfg'
+          - 'dependencies/**'
+          - 'packaging/**'
+          - 'pyproject.toml'
+
+datamodel:
+  - changed-files:
+      - any-glob-to-any-file: ['DataModel/**', '**/DataModel/**']
+
+dpg:
+  - changed-files:
+      - any-glob-to-any-file: ['DPG/**']
+
+pwgcf:
+  - changed-files:
+      - any-glob-to-any-file: ['PWGCF/**', '*/PWGCF/**']
+
+pwgdq:
+  - changed-files:
+      - any-glob-to-any-file: ['PWGDQ/**', '*/PWGDQ/**']
+
+pwgem:
+  - changed-files:
+      - any-glob-to-any-file: ['PWGEM/**', '*/PWGEM/**']
+
+pwghf:
+  - changed-files:
+      - any-glob-to-any-file: ['PWGHF/**', '*/PWGHF/**']
+
+pwgje:
+  - changed-files:
+      - any-glob-to-any-file: ['PWGJE/**', '*/PWGJE/**']
+
+pwglf:
+  - changed-files:
+      - any-glob-to-any-file: ['PWGLF/**', '*/PWGLF/**', 'PWGMM/**', '*/PWGMM/**']
+
+pwgud:
+  - changed-files:
+      - any-glob-to-any-file: ['PWGUD/**', '*/PWGUD/**']
+
+trigger:
+  - changed-files:
+      - any-glob-to-any-file: ['EventFiltering/**']
+
+tutorial:
+  - changed-files:
+      - any-glob-to-any-file: ['Tutorials/**']

.github/workflows/clean-test.yml

@@ -0,0 +1,51 @@
+---
+name: Clean PR checks
+
+'on':
+  workflow_dispatch:
+    inputs:
+      pr:
+        description: PR number in this repo to be cleaned
+        type: string   # can't use number here
+        required: true
+      message:
+        description: Human-readable message displayed on the new pending status
+        type: string
+        required: false
+        default: ''
+
+      # Warning: GitHub limits the total number of inputs to 10, so a maximum of
+      # 8 checks is allowed here!
+      # Warning: the check_* keys are magic and must consist of the string
+      # "check_" followed by the applicable check name exactly. The
+      # "description" field is only the human-readable label for the input.
+      'check_build/O2Physics/o2/macOS-arm':
+        description: build/O2Physics/o2/macOS-arm
+        type: boolean
+        default: true
+
+      'check_build/O2Physics/o2/macOS':
+        description: build/O2Physics/o2/macOS
+        type: boolean
+        default: true
+
+      'check_build/O2Physics/o2':
+        description: build/O2Physics/o2
+        type: boolean
+        default: true
+
+permissions: {}
+
+jobs:
+  clean:
+    name: Clean PR checks
+    uses: alisw/ali-bot/.github/workflows/clean-pr-checks.yml@master
+    with:
+      owner: ${{ github.event.repository.owner.login }}
+      repo: ${{ github.event.repository.name }}
+      pr: ${{ github.event.inputs.pr }}
+      message: ${{ github.event.inputs.message }}
+      checks: ${{ toJSON(github.event.inputs) }}
+    permissions:
+      pull-requests: read  # to get last commit for pr (octokit/graphql-action)
+      statuses: write      # for set-github-status

.github/workflows/codeowner-self-approval.yml

@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   approve:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     # Only run if the PR author enabled auto-merge, not someone else.
     # Also run if a new approval was created, as this affects whether we can
     # auto-approve. There is a risk of infinite loops here, though -- when we

.github/workflows/labeler.yml

@@ -0,0 +1,122 @@
+---
+name: "Pull Request Labeler"
+'on':
+  pull_request_target:
+    types: [opened, synchronize, reopened, edited]
+permissions: read-all
+
+jobs:
+  labeler:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    outputs:
+      labels: ${{ steps.labeler.outputs.all-labels }}
+    steps:
+      - name: Label the PR
+        id: labeler
+        uses: actions/labeler@v5
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          sync-labels: true
+  title-prefix-checker:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    needs: labeler
+    steps:
+      - name: Check the PR title prefix
+        id: check-prefix
+        env:
+          title: ${{ github.event.pull_request.title }}
+          labels: ${{ needs.labeler.outputs.labels }}
+        shell: python
+        run: |
+          import os
+          import re
+          import sys
+          title = os.environ['title']
+          labels = os.environ['labels']
+          tags = {
+              "infrastructure": "Infrastructure",
+              "common": "Common",
+              "alice3": "ALICE3",
+              "pwgcf": "PWGCF",
+              "pwgdq": "PWGDQ",
+              "pwgem": "PWGEM",
+              "pwghf": "PWGHF",
+              "pwgje": "PWGJE",
+              "pwglf": "PWGLF",
+              "pwgud": "PWGUD",
+              "dpg": "DPG",
+              "trigger": "Trigger",
+              "tutorial": "Tutorial",
+          }
+          print(f'PR title: "{title}"')
+          print(f'PR labels: "{labels}"')
+          tags_relevant = [tags[label] for label in tags if label in labels.split(",")]
+          print("Relevant title tags:", ",".join(tags_relevant))
+          passed = True
+          prefix_good = ",".join(tags_relevant)
+          prefix_good = f"[{prefix_good}] "
+          print(f"Generated prefix: {prefix_good}")
+          replace_title = 0
+          title_new = title
+          # If there is a prefix which contains a known tag, check it for correct tags, and reformat it if needed.
+          # If there is a prefix which does not contain any known tag, add the tag prefix.
+          # If there is no prefix, add the tag prefix.
+          if match := re.match(r"\[?(\w[\w, /\+-]+)[\]:]+ ", title):
+              prefix_title = match.group(1)
+              words_prefix_title = prefix_title.replace(",", " ").replace("/", " ").split()
+              title_stripped = title[len(match.group()) :]
+              print(f'PR title prefix: "{prefix_title}" -> tags: {words_prefix_title}')
+              print(f'Stripped PR title: "{title_stripped}"')
+              if any(tag in words_prefix_title for tag in tags.values()):
+                  for tag in tags.values():
+                      if tag in tags_relevant and tag not in words_prefix_title:
+                          print(f'::error::Relevant tag "{tag}" not found in the prefix of the PR title.')
+                          passed = False
+                      if tag not in tags_relevant and tag in words_prefix_title:
+                          print(f'::error::Irrelevant tag "{tag}" found in the prefix of the PR title.')
+                          passed = False
+                  # Format a valid prefix.
+                  if passed:
+                      prefix_good = ",".join(w for w in prefix_title.replace(",", " ").split() if w)
+                      prefix_good = f"[{prefix_good}] "
+                      print(f"::notice::Reformatted prefix: {prefix_good}")
+                      if match.group() != prefix_good:
+                          replace_title = 1
+                          title_new = prefix_good + title_stripped
+              else:
+                  print("::warning::No known tags found in the prefix.")
+                  if tags_relevant:
+                      replace_title = 1
+                      title_new = prefix_good + title
+          else:
+              print("::warning::No valid prefix found in the PR title.")
+              if tags_relevant:
+                  replace_title = 1
+                  title_new = prefix_good + title
+          if not passed:
+              print("::error::Problems were found in the PR title prefix.")
+              print('::notice::Use the form "tags: title" or "[tags] title".')
+              sys.exit(1)
+          if replace_title:
+              print("::warning::The PR title prefix with tags needs to be added or adjusted.")
+              print(f'::warning::New title: "{title_new}".')
+          else:
+              print("::notice::The PR title prefix is fine.")
+          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as fh:
+              print(f"replace={replace_title}", file=fh)
+              print(f"title={title_new}", file=fh)
+      - name: Fix the PR title prefix
+        if: ${{ steps.check-prefix.outputs.replace == 1 }}
+        uses: the-wright-jamie/Update-PR-Info-Action@v1.1.0
+        with:
+          repo-token: "${{ secrets.GITHUB_TOKEN }}"
+          base-branch-regex: master
+          error-on-fail: false
+          title-template: "${{ steps.check-prefix.outputs.title }}"
+          title-update-action: replace

.github/workflows/mega-linter.yml

@@ -23,13 +23,12 @@ jobs:
     steps:
       # Git Checkout
       - name: Checkout Code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           # Checkout the HEAD of the PR instead of the merge commit.
-          # This may include unrelated files if the PR branch is not up to date with the upstream.
-          # ref: ${{ github.event.pull_request.head.sha }}
-          # Checkout the merge commit.
-          ref: refs/pull/${{ github.event.number }}/merge
+          ref: ${{ github.event.pull_request.head.sha }}
+          # Checkout the merge commit. (If a fixing PR is made, it will include also missing commits from upstream.)
+          # ref: refs/pull/${{ github.event.number }}/merge
           fetch-depth: 0
           # So we can use secrets.ALIBUILD_GITHUB_TOKEN to push later.
           persist-credentials: false
@@ -39,7 +38,7 @@ jobs:
         id: ml
         # You can override MegaLinter flavor used to have faster performances
         # More info at https://megalinter.io/flavors/
-        uses: oxsecurity/megalinter@v7
+        uses: oxsecurity/megalinter@v8.5.0
         env:
           # All available variables are described in documentation:
           # https://megalinter.io/configuration/
@@ -48,6 +47,16 @@ jobs:
           VALIDATE_ALL_CODEBASE: false
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      # Upload MegaLinter artifacts
+      - name: Archive production artifacts
+        uses: actions/upload-artifact@v4
+        if: success() || failure()
+        with:
+          name: MegaLinter reports
+          path: |
+            megalinter-reports
+            mega-linter.log
+
       # Create or delete the cleanup branch
       - name: Update cleanup branch
         if: ${{ github.event.repository.owner.login == 'AliceO2Group' }}

.github/workflows/o2-linter.yml

@@ -0,0 +1,61 @@
+---
+# Find issues in O2 code
+name: O2 linter
+
+"on": [pull_request_target, push]
+permissions: {}
+env:
+  BRANCH_MAIN: master
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  o2-linter:
+    name: O2 linter
+    runs-on: ubuntu-24.04
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Set branches
+        run: |
+          if [[ "${{ github.event_name }}" == "push" ]]; then
+            branch_head="${{ github.ref }}"
+            branch_base="${{ env.BRANCH_MAIN }}"
+          else
+            branch_head="refs/pull/${{ github.event.pull_request.number }}/merge"
+            branch_base="${{ github.event.pull_request.base.ref }}"
+          fi
+          echo BRANCH_HEAD="$branch_head" >> "$GITHUB_ENV"
+          echo BRANCH_BASE="$branch_base" >> "$GITHUB_ENV"
+      - name: Checkout Code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.BRANCH_HEAD }}
+          fetch-depth: 0 # needed to get the full history
+      - name: Run tests
+        id: linter
+        run: |
+          # Diff against the common ancestor of the source (head) branch and the target (base) branch.
+          echo "Diffing ${{ env.BRANCH_HEAD }} against ${{ env.BRANCH_BASE }}."
+          readarray -t files < <(git diff --diff-filter d --name-only origin/${{ env.BRANCH_BASE }}...)
+          if [ ${#files[@]} -eq 0 ]; then
+              echo "::notice::No files to lint."
+              echo "linter_ran=0" >> "$GITHUB_OUTPUT"
+              exit 0
+          fi
+          echo "linter_ran=1" >> "$GITHUB_OUTPUT"
+          [[ "${{ github.event_name }}" == "pull_request_target" ]] && options="-g"
+          # shellcheck disable=SC2086 # Ignore unquoted options.
+          python3 Scripts/o2_linter.py $options "${files[@]}"
+          echo "Tip: If you allow actions in your fork repository, O2 linter will run when you push commits."
+      - name: Comment PR
+        if: (success() || failure()) && (github.event_name == 'pull_request_target' && steps.linter.outputs.linter_ran == 1)
+        uses: thollander/actions-comment-pull-request@v3
+        with:
+          comment-tag: o2-linter
+          message: "**O2 linter results:**
+            ❌ ${{ steps.linter.outputs.n_issues }} errors,
+            ⚠️ ${{ steps.linter.outputs.n_tolerated }} warnings,
+            🔕 ${{ steps.linter.outputs.n_disabled }} disabled"

.github/workflows/stale.yml

@@ -12,7 +12,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v1
+      - uses: actions/stale@v9
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           stale-pr-message: 'This PR has not been updated in the last 30 days. Is it still needed? Unless further action is taken, it will be closed in 5 days.'