ci: broaden Singularity job rules, refactor user_spack_environment script, tighten .sif artifact retention

.gitlab-ci.yml

@@ -523,7 +523,26 @@ eic:
         echo "No size limit configured for ${FULLNAME}, skipping check." ;
       fi
 
+.user_spack_environment_commands:
+  variables:
+    USER_SPACK_ENVIRONMENT_COMMANDS: >-
+      source /opt/spack/share/spack/setup-env.sh &&
+      spack env activate --create edm4eic &&
+      spack add edm4eic@git.main cxxstd=20 &&
+      spack concretize &&
+      spack install --only dependencies edm4eic &&
+      spack install --verbose &&
+      ls -al $HOME/spack/linux-*/compiler-wrapper-*/libexec/spack/gcc/g++ &&
+      ls -al $HOME/spack/linux-*/edm4eic-*/include/edm4eic/EDM4eicVersion.h &&
+      ls $HOME/spack/
+
+.user_spack_environment:
+  extends: .user_spack_environment_commands
+  script:
+    - /bin/bash -lc "${USER_SPACK_ENVIRONMENT_COMMANDS}"
+
 user_spack_environment:
+  extends: .user_spack_environment
   stage: benchmarks
   rules:
     # Skip for epic or EICrecon trigger
@@ -543,16 +562,33 @@ user_spack_environment:
             PLATFORM: linux/amd64
   image:
     name: ${CI_REGISTRY_IMAGE}/eic_ci:${INTERNAL_TAG}-default
+
+user_spack_environment:singularity:
+  extends: .user_spack_environment_commands
+  stage: benchmarks
+  rules:
+    # Skip for epic or EICrecon trigger
+    - if: '$CI_PIPELINE_SOURCE == "trigger" && $GITHUB_REPOSITORY != "eic/containers"'
+      when: never
+    - when: always
+  needs:
+    - job: version
+    - job: eic
+      parallel:
+        matrix:
+          - BUILD_IMAGE: eic_
+            ENV: ci
+            BUILD_TYPE: default
+            BUILDER_IMAGE: debian_stable_base
+            RUNTIME_IMAGE: debian_stable_base
+            PLATFORM: linux/amd64
+  image:
+    name: ${SINGULARITY_IMAGE}
+    entrypoint: [""]
   script:
-    - source /opt/spack/share/spack/setup-env.sh
-    - spack env activate --create edm4eic
-    - spack add edm4eic@git.main cxxstd=20
-    - spack concretize
-    - spack install --only dependencies edm4eic
-    - spack install --verbose
-    - ls -al $HOME/spack/linux-*/compiler-wrapper-*/libexec/spack/gcc/g++
-    - ls -al $HOME/spack/linux-*/edm4eic-*/include/edm4eic/EDM4eicVersion.h
-    - ls $HOME/spack/
+    - mkdir build
+    - singularity pull build/eic_ci.sif docker://${CI_REGISTRY_IMAGE}/eic_ci:${INTERNAL_TAG}-default
+    - singularity exec build/eic_ci.sif /bin/bash -lc "${USER_SPACK_ENVIRONMENT_COMMANDS}"
 
 .cuda:
   stage: benchmarks
@@ -590,11 +626,24 @@ cuda:torch:
   stage: deploy
   interruptible: true
   rules:
-    - if: '$CI_COMMIT_BRANCH == "master" && $CI_PIPELINE_SOURCE != "trigger"'
+    # Skip for external repository triggers (e.g. EICrecon-triggered pipelines)
+    - if: '$CI_PIPELINE_SOURCE == "trigger" && $GITHUB_REPOSITORY != "eic/containers"'
+      when: never
+    - if: '$CI_COMMIT_BRANCH == "master"'
+      when: on_success
+    - if: '$CI_COMMIT_BRANCH =~ /^v[0-9]+\.[0-9]+-(alpha|beta|stable)/'
+      when: on_success
+    - if: '$CI_COMMIT_BRANCH =~ /^v[0-9]+\.[0-9]+-[a-z]+-(alpha|beta|stable)/'
+      when: on_success
+    - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+/'
+      when: on_success
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
       when: on_success
     - when: never
   artifacts:
-      expire_in: 1 days
+      # Short retention for disk space efficiency; .sif files are several GB each.
+      # MR and default runs only need the artifact for immediate verification.
+      expire_in: 2 hours
       paths:
         - build/${BUILD_IMAGE}.sif
   script:
@@ -624,6 +673,11 @@ eic_xl:singularity:nightly:
   variables:
     BUILD_TYPE: nightly
     BUILD_IMAGE: eic_xl
+  artifacts:
+    # Override retention: eic-shell/install.py downloads this artifact after pipeline completion.
+    expire_in: 1 days
+    paths:
+      - build/${BUILD_IMAGE}.sif
   needs:
     - job: version
     - job: eic