Give macOS one CI job and stop building pull requests twice

macOS runners are the bottleneck of Progmasoft's CI: an organization
runs at most five macOS jobs at a time, shared by every repository, and a
pull request of Catch3 asked for about twenty of them. Every workflow
also listened to both push and pull_request, so each pull request ran
everything twice, once for its branch and once for the pull request.

macOS now has one job, as in the Tala compiler: macOS 26 on Apple
Silicon, Debug, C++17, with AddressSanitizer and UndefinedBehaviorSanitizer
over the most-tests preset, examples and extra tests. The C++14 and C++17,
Debug and Release matrix stays on Ubuntu and Fedora, where it already ran.
ThreadSanitizer, which ran only on macOS, moves to a new Ubuntu job.

The build systems that tested Windows and macOS (Bazel, Meson, Xmake,
Premake) test Windows and Ubuntu instead, with Clang, so their Unix side
is still covered and Linux is covered for the first time. The jobs that do
not depend on the platform leave macOS: CodeQL (build mode none), the
header and license checks, and native coverage, which now builds with
the Clang and LLVM tools of Ubuntu instead of those of Xcode.

Pushes build only devel; pull requests build their branches. The weekly
CodeQL schedule stays.

The required check "Bazel on macos-15" becomes "Bazel on ubuntu-26.04" in
the branch protection and the ruleset when this is merged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

10 files changed, 100 insertions, 85 deletions

diff --git a/.github/workflows/alternative-build-systems.yml b/.github/workflows/alternative-build-systems.yml
index ebb51d90..4ceaada8 100644
--- a/.github/workflows/alternative-build-systems.yml
+++ b/.github/workflows/alternative-build-systems.yml
@@ -1,6 +1,9 @@
 name: Alternative Build Systems
 
-on: [push, pull_request]
+on:
+  push:
+    branches: [devel]
+  pull_request:
 
 permissions:
   contents: read
@@ -12,7 +15,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-2025-vs2026, macos-15]
+        os: [windows-2025-vs2026, ubuntu-26.04]
 
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
@@ -38,7 +41,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-2022, macos-15]
+        os: [windows-2022, ubuntu-26.04]
 
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
@@ -66,11 +69,11 @@ jobs:
         run: build/premake/bin/Debug/ProgmasoftPropertyTests.exe
 
       - name: Generate and build Clang Makefiles
-        if: runner.os == 'macOS'
+        if: runner.os == 'Linux'
         run: |
-          premake5 gmake
+          premake5 gmake --cc=clang
           make -C build/premake config=debug -j 4
 
-      - name: Run property tests on macOS
-        if: runner.os == 'macOS'
+      - name: Run property tests on Linux
+        if: runner.os == 'Linux'
         run: build/premake/bin/Debug/ProgmasoftPropertyTests
diff --git a/.github/workflows/bazel-builds.yml b/.github/workflows/bazel-builds.yml
index 892145d8..4ff37e82 100644
--- a/.github/workflows/bazel-builds.yml
+++ b/.github/workflows/bazel-builds.yml
@@ -3,7 +3,10 @@
 
 name: Bazel Builds
 
-on: [push, pull_request]
+on:
+  push:
+    branches: [devel]
+  pull_request:
 
 permissions:
   contents: read
@@ -15,7 +18,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-2025-vs2026, macos-15]
+        os: [windows-2025-vs2026, ubuntu-26.04]
 
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
@@ -34,6 +37,8 @@ jobs:
         env:
           BAZEL_SH: C:\Program Files\Git\bin\bash.exe
 
-      - name: Run Progmasoft property tests on macOS
-        if: runner.os == 'macOS'
+      - name: Run Progmasoft property tests on Linux
+        if: runner.os == 'Linux'
         run: bazel test tests/Progmasoft:property_tests
+        env:
+          CC: clang
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index a0684b67..79039755 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -4,6 +4,7 @@
 name: CodeQL
 on:
   push:
+    branches: [devel]
   pull_request:
   schedule:
     - cron: '31 4 * * 1'
@@ -14,7 +15,7 @@ permissions:
 jobs:
   analyze:
     name: ${{ matrix.language }}
-    runs-on: macos-15
+    runs-on: ubuntu-26.04
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index eff8d70a..7e66593f 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -14,7 +14,7 @@ permissions:
 
 jobs:
   coverage:
-    runs-on: macos-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 40
     permissions:
       contents: read
@@ -22,6 +22,10 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      - name: Install Clang, LLVM tools, CMake and Ninja
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y clang llvm cmake ninja-build python3
       - name: Configure Clang coverage build
         run: >-
           cmake --preset basic-tests -G Ninja
@@ -36,8 +40,8 @@ jobs:
         run: ctest --test-dir build --output-on-failure -R '^(RunTests|Progmasoft::PropertyTests)$'
       - name: Export LLVM source coverage
         run: |
-          xcrun llvm-profdata merge -sparse build/tests/catch3-*.profraw -o catch3.profdata
-          xcrun llvm-cov export \
+          llvm-profdata merge -sparse build/tests/catch3-*.profraw -o catch3.profdata
+          llvm-cov export \
             -instr-profile=catch3.profdata \
             -format=lcov \
             build/tests/SelfTest \
@@ -55,7 +59,7 @@ jobs:
   codecov:
     needs: coverage
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       id-token: write
     steps:
diff --git a/.github/workflows/linux-builds.yml b/.github/workflows/linux-builds.yml
index 0e398d82..8597f658 100644
--- a/.github/workflows/linux-builds.yml
+++ b/.github/workflows/linux-builds.yml
@@ -4,7 +4,10 @@ name: Linux Builds
 # user of this framework: the current Ubuntu LTS, and Fedora in a container.
 # Both build with Clang, the compiler that project uses everywhere.
 
-on: [push, pull_request]
+on:
+  push:
+    branches: [devel]
+  pull_request:
 
 permissions:
   contents: read
@@ -49,6 +52,38 @@ jobs:
     - name: Test
       run: ctest --test-dir build -j
 
+  thread-sanitizer:
+    name: Ubuntu 26.04, C++17, ThreadSanitizer and UBSan
+    runs-on: ubuntu-26.04
+    timeout-minutes: 45
+
+    steps:
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      with:
+        persist-credentials: false
+
+    - name: Install Clang, CMake and Ninja
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y clang cmake ninja-build python3
+
+    - name: Configure with the sanitizers
+      env:
+        CXXFLAGS: -fsanitize=thread,undefined
+        LDFLAGS: -fsanitize=thread,undefined
+      run: |
+        cmake --preset basic-tests -GNinja \
+              -DCMAKE_BUILD_TYPE=Debug \
+              -DCMAKE_CXX_COMPILER=clang++ \
+              -DCMAKE_CXX_STANDARD=17 \
+              -DCATCH3_BUILD_EXTRA_TESTS=ON
+
+    - name: Build
+      run: cmake --build build
+
+    - name: Test
+      run: ctest --test-dir build -R ThreadSafetyTests
+
   fedora:
     name: Fedora 43, C++${{matrix.std}}, ${{matrix.build_type}}
     runs-on: ubuntu-26.04
diff --git a/.github/workflows/mac-builds.yml b/.github/workflows/mac-builds.yml
index 503492e7..c115bf00 100644
--- a/.github/workflows/mac-builds.yml
+++ b/.github/workflows/mac-builds.yml
@@ -1,6 +1,14 @@
 name: Mac Builds
 
-on: [push, pull_request]
+# macOS runners are few and shared by every Progmasoft repository, so macOS
+# gets one job, as in the Tala compiler: the newest macOS on Apple Silicon,
+# with AddressSanitizer and UndefinedBehaviorSanitizer. The other build
+# systems, the C++ standards and ThreadSanitizer run on Linux and Windows.
+
+on:
+  push:
+    branches: [devel]
+  pull_request:
 
 permissions:
   contents: read
@@ -11,24 +19,23 @@ env:
 
 jobs:
   build:
-    runs-on: ${{matrix.image}}
-    strategy:
-      fail-fast: false
-      matrix:
-        image: [macos-15, macos-26]
-        build_type: [Debug, Release]
-        std: [14, 17]
+    name: macOS 26, C++17, AddressSanitizer and UBSan
+    runs-on: macos-26
+    timeout-minutes: 60
 
     steps:
     - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         persist-credentials: false
 
-    - name: Configure
+    - name: Configure with the sanitizers
+      env:
+        CXXFLAGS: -fsanitize=address,undefined
+        LDFLAGS: -fsanitize=address,undefined
       run: |
-        cmake --preset basic-tests -GNinja \
-              -DCMAKE_BUILD_TYPE=${{matrix.build_type}} \
-              -DCMAKE_CXX_STANDARD=${{matrix.std}} \
+        cmake --preset most-tests -GNinja \
+              -DCMAKE_BUILD_TYPE=Debug \
+              -DCMAKE_CXX_STANDARD=17 \
               -DCATCH3_BUILD_EXAMPLES=ON \
               -DCATCH3_BUILD_EXTRA_TESTS=ON
 
diff --git a/.github/workflows/mac-sanitizer-builds.yml b/.github/workflows/mac-sanitizer-builds.yml
deleted file mode 100644
index 21de70fb..00000000
--- a/.github/workflows/mac-sanitizer-builds.yml
+++ /dev/null
@@ -1,49 +0,0 @@
-name: Mac Sanitizer Builds
-
-on: [push, pull_request]
-
-permissions:
-  contents: read
-
-env:
-  CTEST_OUTPUT_ON_FAILURE: 1
-  CTEST_NO_TESTS_ACTION: error
-
-jobs:
-  build:
-    runs-on: ${{matrix.image}}
-    strategy:
-      fail-fast: false
-      matrix:
-        image: [macos-15, macos-26]
-        build_type: [Debug]
-        std: [17]
-        sanitizer: [thread, address]
-        include:
-          - sanitizer: thread
-            preset: basic-tests
-            filter: -R ThreadSafetyTests
-          - sanitizer: address
-            preset: most-tests
-            filter:
-
-    steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      with:
-        persist-credentials: false
-
-    - name: Configure with the selected sanitizers
-      env:
-        CXXFLAGS: -fsanitize=${{ matrix.sanitizer }},undefined
-        LDFLAGS: -fsanitize=${{ matrix.sanitizer }},undefined
-      run: |
-        cmake --preset ${{matrix.preset}} -GNinja \
-              -DCMAKE_BUILD_TYPE=${{matrix.build_type}} \
-              -DCMAKE_CXX_STANDARD=${{matrix.std}} \
-              -DCATCH3_BUILD_EXTRA_TESTS=ON
-
-    - name: Build
-      run: cmake --build build
-
-    - name: Test
-      run: ctest --test-dir build ${{matrix.filter}}
diff --git a/.github/workflows/meson-builds.yml b/.github/workflows/meson-builds.yml
index cf72718d..2fe2058a 100644
--- a/.github/workflows/meson-builds.yml
+++ b/.github/workflows/meson-builds.yml
@@ -1,6 +1,9 @@
 name: Meson Builds
 
-on: [push, pull_request]
+on:
+  push:
+    branches: [devel]
+  pull_request:
 
 permissions:
   contents: read
@@ -12,7 +15,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-2025-vs2026, macos-15]
+        os: [windows-2025-vs2026, ubuntu-26.04]
 
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
@@ -33,8 +36,8 @@ jobs:
           CXX: clang-cl
         run: meson setup build/meson --vsenv -Dtests=true -Dinstall=false
 
-      - name: Configure with Apple Clang on macOS
-        if: runner.os == 'macOS'
+      - name: Configure with Clang on Linux
+        if: runner.os == 'Linux'
         env:
           CC: clang
           CXX: clang++
diff --git a/.github/workflows/validate-header-guards.yml b/.github/workflows/validate-header-guards.yml
index 5641ce68..a8ba91ba 100644
--- a/.github/workflows/validate-header-guards.yml
+++ b/.github/workflows/validate-header-guards.yml
@@ -1,6 +1,9 @@
 name: Check header guards
 
-on: [push, pull_request]
+on:
+  push:
+    branches: [devel]
+  pull_request:
 
 permissions:
   contents: read
@@ -8,7 +11,7 @@ permissions:
 jobs:
   build:
     # Set the type of machine to run on
-    runs-on: macos-15
+    runs-on: ubuntu-26.04
     steps:
 
       - name: Checkout source code
diff --git a/.github/workflows/windows-simple-builds.yml b/.github/workflows/windows-simple-builds.yml
index 18e15b99..164ff839 100644
--- a/.github/workflows/windows-simple-builds.yml
+++ b/.github/workflows/windows-simple-builds.yml
@@ -1,6 +1,9 @@
 name: Windows Builds (Basic)
 
-on: [push, pull_request]
+on:
+  push:
+    branches: [devel]
+  pull_request:
 
 permissions:
   contents: read