From a79f00f504be9da837a9993ce4fbf158fdd6a841 Mon Sep 17 00:00:00 2001
From: Eric Berquist <ejberqu@sandia.gov>
Date: Fri, 30 Oct 2026 11:52:08 -0600
Subject: [PATCH 1/3] pre-commit: update versions

- maintained fork of actionlint
- add zizmor for security auditing of GitHub Actions workflows
---
 .github/actionlint.yaml |  5 +++++
 .pre-commit-config.yaml | 15 +++++++++++----
 2 files changed, 16 insertions(+), 4 deletions(-)
 create mode 100644 .github/actionlint.yaml

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000000..288ebd1cbe
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,5 @@
+---
+paths:
+  .github/workflows/**/*.{yml,yaml}:
+    ignore:
+      - 'at "uses" is not following the format "owner/repo/path/to/workflow.yml@ref" nor "./path/to/workflow.yml"'
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index c1320b334e..39d72731d3 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -6,10 +6,12 @@ repos:
       - id: check-hooks-apply
       - id: check-useless-excludes
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: "v5.0.0"
+    rev: "v6.0.0"
     hooks:
       - id: check-case-conflict
+      - id: check-json
       - id: check-merge-conflict
+      - id: check-yaml
       - id: trailing-whitespace
         # allow it in patches, data files, and test references
         exclude: |
@@ -24,9 +26,14 @@ repos:
               patch\.txt|
               \.xml
           )
-  - repo: https://github.com/rhysd/actionlint
-    rev: v1.7.7
+  - repo: https://github.com/kjanat/actionlint
+    rev: "v1.17.0"
     hooks:
       - id: actionlint
         additional_dependencies:
-          - "github.com/wasilibs/go-shellcheck/cmd/shellcheck@latest"
+          - "github.com/wasilibs/go-shellcheck/cmd/shellcheck@v0.11.1"
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.31.1
+    hooks:
+      - id: zizmor
+        args: [--no-progress, --persona=pedantic, --fix=all]

From fc582969af099f3c66312ebf584746d4f522d04c Mon Sep 17 00:00:00 2001
From: Eric Berquist <ejberqu@sandia.gov>
Date: Fri, 30 Oct 2026 11:55:07 -0600
Subject: [PATCH 2/3] GitHub Actions: switch from pre-commit to prek

The pre-commit action is no longer maintained.  prek itself is a
backward-compatible rewrite of the pre-commit tool that the maintained
prek-action calls.
---
 .github/workflows/pre-commit.yml | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 795bdfe386..6284aec4e5 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -6,13 +6,19 @@ on:
   workflow_call:
 
 concurrency:
-  group: style-${{github.ref}}-${{github.event.pull_request.number || github.run_number}}
+  group: pre-commit-${{github.workflow}}-${{github.ref}}-${{github.event.pull_request.number || github.run_number}}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   pre-commit:
-    runs-on: ubuntu-latest
+    name: Run pre-commit on current ref
+    runs-on: ubuntu-26.04
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-      - uses: pre-commit/action@v3.0.1
+      - name: Checkout the current ref
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Run pre-commit checks
+        uses: j178/prek-action@44924fe9ef4a6f88253c4b6b1bf11c689d3ce53d  # v3.1.0

From 5c723c02fb50e0d9911231d4edf03c0a306e22b2 Mon Sep 17 00:00:00 2001
From: Eric Berquist <ejberqu@sandia.gov>
Date: Fri, 30 Oct 2026 12:15:49 -0600
Subject: [PATCH 3/3] GitHub Actions: add Linux containers on free runners

Each job is located in test-matrix-github.yml with an additional condition for
if it is nightly only.  The PR entrypoint is ci.yml and the nightly entrypoint
is nightly.yml.  All jobs are based upon a reusable workflow, sst-ci-job.yml,
that is defined in sst-core.  Updates to how individual jobs are run must
first be merged to the devel branch there.

Additional changes:
- Add infrastructure for nightly testing, including nightly-only jobs and
  additional test suite categories
- Add infrastructure for "make dist" testing
- Use organization-level container registry for holding ccache caches instead
  of repository-level caches.
- Replace macOS 14 with 26
---
 .github/scripts/compilers.bash                |  80 ------
 .../scripts/core_autotools_noflags_nodeps.sh  |  44 ----
 .../elements_autotools_noflags_nodeps.sh      |  44 ----
 .../scripts/install_os_level_dependencies.sh  |  45 ----
 .github/workflows/build_and_test.yml          |  38 ---
 .github/workflows/ci.yml                      |  17 +-
 .github/workflows/free-macos-14.yml           |  89 -------
 .github/workflows/free-macos-15.yml           |  89 -------
 .github/workflows/nightly.yml                 |  26 ++
 .github/workflows/test-matrix-github.yml      | 228 ++++++++++++++++++
 .github/zizmor.yml                            |   9 +
 11 files changed, 274 insertions(+), 435 deletions(-)
 delete mode 100644 .github/scripts/compilers.bash
 delete mode 100755 .github/scripts/core_autotools_noflags_nodeps.sh
 delete mode 100755 .github/scripts/elements_autotools_noflags_nodeps.sh
 delete mode 100755 .github/scripts/install_os_level_dependencies.sh
 delete mode 100644 .github/workflows/build_and_test.yml
 delete mode 100644 .github/workflows/free-macos-14.yml
 delete mode 100644 .github/workflows/free-macos-15.yml
 create mode 100644 .github/workflows/nightly.yml
 create mode 100644 .github/workflows/test-matrix-github.yml
 create mode 100644 .github/zizmor.yml

diff --git a/.github/scripts/compilers.bash b/.github/scripts/compilers.bash
deleted file mode 100644
index 418d9b3dd7..0000000000
--- a/.github/scripts/compilers.bash
+++ /dev/null
@@ -1,80 +0,0 @@
-#!/bin/bash
-
-# compilers.bash: Common logic for compiling SST, specifically setting up
-# compiler environment variables.
-#
-# Note: some variables appear unused because this file is sourced, not
-# executed, in order to avoid polluting the environment.
-
-set -eo pipefail
-
-# To use this, the desired compiler must be registered with Spack (shown under
-# `spack compilers`).  However, it is not `spack load`ed into the environment,
-# but only its CC and CXX paths exported.
-source_compilers_nompi() {
-    local spack_compiler_spec="${1}"
-
-    # SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-    # TODO need to install Spack first.
-    # local compiler_paths
-    # compiler_paths="$(spack python "${SCRIPTDIR}"/spack_get_compilers.py --spec "${spack_compiler_spec}")"
-    # CC="$(echo "${compiler_paths}" | jq -r .c)"
-    # CXX="$(echo "${compiler_paths}" | jq -r .cxx)"
-    CC="$(command -v gcc)"
-    CXX="$(command -v g++)"
-    export CC
-    export CXX
-
-    if [[ -n "${CLANG_LIBCXX}" ]]; then
-        export CXXFLAGS="-stdlib=libc++"
-    fi
-
-    export CC
-    export CXX
-}
-
-source_compilers_mpi() {
-    local spack_compiler_spec="${1}"
-
-    source_compilers_nompi "${spack_compiler_spec}"
-
-    # local ompi_version="4.1.5"
-    # local ompi_loc
-    # shellcheck disable=SC2086
-    # TODO need to install Spack first.
-    # ompi_loc="$(spack location -i openmpi@${ompi_version} %${spack_compiler_spec})"
-    # export MPICC="${ompi_loc}"/bin/mpicc
-    # export MPICXX="${ompi_loc}"/bin/mpicxx
-    # export CPPFLAGS="-I${ompi_loc}/include"
-    MPICC="$(command -v mpicc)"
-    MPICXX="$(command -v mpicxx)"
-    export MPICC
-    export MPICXX
-}
-
-# delete '@' and '=' characters if present
-clean_suffix() {
-    local suffix="${1}"
-    local tmp="${suffix//@/}"
-    local cleaned="${tmp//=/}"
-    echo "${cleaned}"
-}
-
-# Handle the case where the Pin binary is on the path but the SST-specific
-# environment variable needed for the compile and link lines isn't present.
-# if [[ -z "${INTEL_PIN_DIRECTORY}" ]]; then
-#     pinloc="$(command -v pin)"
-#     if [[ -n "${pinloc}" ]]; then
-#         INTEL_PIN_DIRECTORY="$(dirname "$(dirname "${pinloc}")")"
-#         export INTEL_PIN_DIRECTORY
-#     fi
-# fi
-
-bear_make_install() {
-    if command -v bear >& /dev/null; then
-        "$(command -v bear)" -- make install
-    else
-        make install
-    fi
-}
diff --git a/.github/scripts/core_autotools_noflags_nodeps.sh b/.github/scripts/core_autotools_noflags_nodeps.sh
deleted file mode 100755
index 6023ab25e2..0000000000
--- a/.github/scripts/core_autotools_noflags_nodeps.sh
+++ /dev/null
@@ -1,44 +0,0 @@
-#!/bin/bash
-
-# core_autotools_noflags_nodeps.sh: Compile and install core, using the
-# Autotools build system, without explicitly specifying any additional build
-# dependencies at configure time.
-
-# shellcheck disable=SC2086
-# https://web.archive.org/web/20230401201759/https://wiki.bash-hackers.org/scripting/debuggingtips#making_xtrace_more_useful
-export PS4='+(${BASH_SOURCE}:${LINENO}): ${FUNCNAME[0]:+${FUNCNAME[0]}(): }'
-set -x
-
-set -eo pipefail
-
-SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-source "${SCRIPTDIR}"/compilers.bash
-
-toolchain="${1}"
-
-source_compilers_mpi "${toolchain}"
-
-suffix="$(clean_suffix autotools_noflags_nodeps_${toolchain})"
-
-dir_src="${PWD}/sst-core"
-dir_build="${PWD}"/sst-core-build-${suffix}
-dir_install="${PWD}"/install_${suffix}
-
-\rm -rf "${dir_build}" || true
-\rm -rf "${dir_install}" || true
-
-pushd "${dir_src}"
-git clean -Xdf .
-./autogen.sh
-popd
-
-mkdir -p "${dir_build}"
-pushd "${dir_build}"
-
-INSTALL="$(command -v install) -p" "${dir_src}"/configure \
-       --prefix="${dir_install}"
-
-bear_make_install
-ln -fsv "${dir_build}"/compile_commands.json "${dir_src}"/compile_commands.json
-# no installation available
-# make html
diff --git a/.github/scripts/elements_autotools_noflags_nodeps.sh b/.github/scripts/elements_autotools_noflags_nodeps.sh
deleted file mode 100755
index fc69f16108..0000000000
--- a/.github/scripts/elements_autotools_noflags_nodeps.sh
+++ /dev/null
@@ -1,44 +0,0 @@
-#!/bin/bash
-
-# elements_autotools_noflags_nodeps.sh: TODO
-
-# shellcheck disable=SC2086
-# https://web.archive.org/web/20230401201759/https://wiki.bash-hackers.org/scripting/debuggingtips#making_xtrace_more_useful
-export PS4='+(${BASH_SOURCE}:${LINENO}): ${FUNCNAME[0]:+${FUNCNAME[0]}(): }'
-set -x
-
-set -eo pipefail
-
-SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-source "${SCRIPTDIR}"/compilers.bash
-
-toolchain="${1}"
-
-source_compilers_mpi "${toolchain}"
-
-suffix="$(clean_suffix autotools_noflags_nodeps_${toolchain})"
-
-dir_src="${PWD}"/sst-elements
-dir_build="${PWD}"/sst-elements-build-${suffix}
-dir_core="${PWD}"/install_${suffix}
-dir_install="${dir_core}"
-
-\rm -rf "${dir_build}" || true
-# \rm -rf "${dir_install}" || true
-
-pushd "${dir_src}"
-git clean -Xdf .
-./autogen.sh
-popd
-
-mkdir -p "${dir_build}"
-pushd "${dir_build}"
-
-[ -n "${INTEL_PIN_DIRECTORY}" ] && PIN_TEXT="--with-pin=${INTEL_PIN_DIRECTORY}" || PIN_TEXT="--without-pin"
-INSTALL="$(command -v install) -p" "${dir_src}"/configure \
-       "${PIN_TEXT}" \
-       --prefix="${dir_install}" \
-       --with-sst-core="${dir_core}"
-
-bear_make_install
-ln -fsv "${dir_build}"/compile_commands.json "${dir_src}"/compile_commands.json
diff --git a/.github/scripts/install_os_level_dependencies.sh b/.github/scripts/install_os_level_dependencies.sh
deleted file mode 100755
index d379e21c79..0000000000
--- a/.github/scripts/install_os_level_dependencies.sh
+++ /dev/null
@@ -1,45 +0,0 @@
-#!/bin/bash
-
-# install_os_level_dependencies.sh: Install dependencies at the operating
-# system level needed for GitHub Actions CI runs.
-
-set -euo pipefail
-
-export DEBIAN_FRONTEND=noninteractive
-if command -v brew; then
-    brew install \
-         autoconf \
-         automake \
-         ccache \
-         coreutils \
-         doxygen \
-         libtool \
-         ncurses \
-         open-mpi \
-         pygments
-    python -m pip install blessings
-elif command -v dnf >/dev/null 2>&1; then
-    dnf upgrade -y
-elif command -v apt-get; then
-    sudo apt-get -y update
-    sudo apt-get -y install \
-         autoconf \
-         automake \
-         doxygen \
-         libopenmpi-dev \
-         libtool-bin \
-         python3-blessings \
-         python3-pygments
-elif command -v pacman >/dev/null 2>&1; then
-    pacman -Syu --noconfirm
-    pacman -S --noconfirm \
-           autoconf \
-           automake \
-           ccache \
-           gcc \
-           make \
-           ncurses \
-           openmpi \
-           python \
-           wget
-fi
diff --git a/.github/workflows/build_and_test.yml b/.github/workflows/build_and_test.yml
deleted file mode 100644
index 25920f30a2..0000000000
--- a/.github/workflows/build_and_test.yml
+++ /dev/null
@@ -1,38 +0,0 @@
----
-name: sst-core build/install/test
-
-# yamllint disable-line rule:truthy
-on:
-  workflow_call:
-
-concurrency:
-  group: build-and-test-${{github.ref}}-${{github.event.pull_request.number || github.run_number}}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  # Jobs depend on the output of pre-checks to run.
-  # Cancels new workflows if prior runs were successful (same tree hash)
-  pre-checks:
-    runs-on: ubuntu-24.04
-    # actions: write needed by skip-duplicate-actions
-    permissions:
-      actions: write
-    outputs:
-      should_skip: ${{ steps.skip_check.outputs.should_skip }}
-    steps:
-      - id: skip_check
-        uses: fkirc/skip-duplicate-actions@f75f66ce1886f00957d99748a42c724f4330bdcf # v5.3.1
-        with:
-          skip_after_successful_duplicate: 'true'
-  macos-14:
-    needs: pre-checks
-    if: ${{ needs.pre-checks.outputs.should_skip != 'true' }}
-    uses:
-      ./.github/workflows/free-macos-14.yml
-  macos-15:
-    needs: pre-checks
-    if: ${{ needs.pre-checks.outputs.should_skip != 'true' }}
-    uses:
-      ./.github/workflows/free-macos-15.yml
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6cf2e8afc4..90d6a63854 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,35 +3,40 @@ name: ci
 
 # yamllint disable-line rule:truthy
 on:
+  # Branches in this repository get tested through their pull requests.
   push:
+    branches:
+      - devel
   pull_request:
     types:
       - opened
       - synchronize
 
 concurrency:
-  group: ci-${{github.ref}}-${{github.event.pull_request.number || github.run_number}}
+  group: ci-${{github.workflow}}-${{github.ref}}-${{github.event.pull_request.number || github.run_number}}
   cancel-in-progress: true
 
 permissions: {}
 
 jobs:
   prechecks:
-    uses: ./.github/workflows/pre-commit.yml
+    uses: $/.github/workflows/pre-commit.yml
   all-prechecks:
     needs: [prechecks]
-    runs-on: ubuntu-24.04
+    name: CI precheck success
+    runs-on: ubuntu-26.04
     steps:
       - name: Success
         run: "true"
   tests:
     needs: [all-prechecks]
-    uses: ./.github/workflows/build_and_test.yml
+    uses: $/.github/workflows/test-matrix-github.yml
     permissions:
-      actions: write
+      packages: write # to save ccache in ghcr.io
   all-tests:
     needs: [tests]
-    runs-on: ubuntu-24.04
+    name: CI success
+    runs-on: ubuntu-26.04
     steps:
       - name: Success
         run: "true"
diff --git a/.github/workflows/free-macos-14.yml b/.github/workflows/free-macos-14.yml
deleted file mode 100644
index 2f50b939f9..0000000000
--- a/.github/workflows/free-macos-14.yml
+++ /dev/null
@@ -1,89 +0,0 @@
----
-name: Build/test on macOS 14
-
-on:
-  workflow_call:
-
-permissions: {}
-
-jobs:
-  macos-14:
-    runs-on: macos-14
-    steps:
-
-      - name: Clone core
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          path: sst-core
-          persist-credentials: false
-          ref: devel
-          repository: sstsimulator/sst-core
-
-      - name: Clone elements
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          path: sst-elements
-          persist-credentials: false
-
-      - name: Install system-level dependencies
-        run: |
-          sst-core/.github/scripts/install_os_level_dependencies.sh
-
-      - name: Install and configure ccache
-        uses: hendrikmuhs/ccache-action@63069e3931dedbf3b63792097479563182fe70d1  # v1.2
-        with:
-          append-timestamp: false
-          create-symlink: true
-          key: >-
-            ccache-${{ github.job }}
-          max-size: "2GB"
-          verbose: 2
-
-      - name: Set environment variables
-        run: |
-          MAKEFLAGS="-j$(nproc)"
-          echo "MAKEFLAGS=${MAKEFLAGS}" >> "${GITHUB_ENV}"
-          echo "TERM=dumb" >> "${GITHUB_ENV}"
-
-      - name: Pin Python version
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c  # v6.0.0
-        with:
-          python-version: '3.9'
-
-      - name: Compile core
-        run: |
-          # TODO the argument does nothing as long as Spack is unavailable
-          sst-core/.github/scripts/core_autotools_noflags_nodeps.sh gcc
-
-      - name: Test core
-        run: |
-          install_autotools_noflags_nodeps_gcc/bin/sst-test-core
-
-      - name: Save sst_test_outputs after core tests
-        uses: actions/upload-artifact@v4
-        with:
-          name: sst_test_outputs_core_free-macos-14
-          path: sst_test_outputs
-          compression-level: 9
-          if-no-files-found: error
-          retention-days: 5
-        if: ${{ !cancelled() }}
-
-      - name: Compile elements
-        run: |
-          # TODO the argument does nothing as long as Spack is unavailable
-          sst-core/.github/scripts/elements_autotools_noflags_nodeps.sh gcc
-
-      - name: Test elements
-        run: |
-          install_autotools_noflags_nodeps_gcc/bin/sst-test-elements
-
-      - name: Save sst_test_outputs after elements tests
-        uses: actions/upload-artifact@v4
-        with:
-          name: sst_test_outputs_elements_free-macos-14
-          path: sst_test_outputs
-          compression-level: 9
-          if-no-files-found: error
-          retention-days: 5
-        if: ${{ !cancelled() }}
diff --git a/.github/workflows/free-macos-15.yml b/.github/workflows/free-macos-15.yml
deleted file mode 100644
index 904aae7875..0000000000
--- a/.github/workflows/free-macos-15.yml
+++ /dev/null
@@ -1,89 +0,0 @@
----
-name: Build/test on macOS 15
-
-on:
-  workflow_call:
-
-permissions: {}
-
-jobs:
-  macos-15:
-    runs-on: macos-15
-    steps:
-
-      - name: Clone core
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          path: sst-core
-          persist-credentials: false
-          ref: devel
-          repository: sstsimulator/sst-core
-
-      - name: Clone elements
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          path: sst-elements
-          persist-credentials: false
-
-      - name: Install system-level dependencies
-        run: |
-          sst-core/.github/scripts/install_os_level_dependencies.sh
-
-      - name: Install and configure ccache
-        uses: hendrikmuhs/ccache-action@63069e3931dedbf3b63792097479563182fe70d1  # v1.2
-        with:
-          append-timestamp: false
-          create-symlink: true
-          key: >-
-            ccache-${{ github.job }}
-          max-size: "2GB"
-          verbose: 2
-
-      - name: Set environment variables
-        run: |
-          MAKEFLAGS="-j$(nproc)"
-          echo "MAKEFLAGS=${MAKEFLAGS}" >> "${GITHUB_ENV}"
-          echo "TERM=dumb" >> "${GITHUB_ENV}"
-
-      - name: Pin Python version
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c  # v6.0.0
-        with:
-          python-version: '3.13'
-
-      - name: Compile core
-        run: |
-          # TODO the argument does nothing as long as Spack is unavailable
-          sst-core/.github/scripts/core_autotools_noflags_nodeps.sh gcc
-
-      - name: Test core
-        run: |
-          install_autotools_noflags_nodeps_gcc/bin/sst-test-core
-
-      - name: Save sst_test_outputs after core tests
-        uses: actions/upload-artifact@v4
-        with:
-          name: sst_test_outputs_core_free-macos-15
-          path: sst_test_outputs
-          compression-level: 9
-          if-no-files-found: error
-          retention-days: 5
-        if: ${{ !cancelled() }}
-
-      - name: Compile elements
-        run: |
-          # TODO the argument does nothing as long as Spack is unavailable
-          sst-core/.github/scripts/elements_autotools_noflags_nodeps.sh gcc
-
-      - name: Test elements
-        run: |
-          install_autotools_noflags_nodeps_gcc/bin/sst-test-elements
-
-      - name: Save sst_test_outputs after elements tests
-        uses: actions/upload-artifact@v4
-        with:
-          name: sst_test_outputs_elements_free-macos-15
-          path: sst_test_outputs
-          compression-level: 9
-          if-no-files-found: error
-          retention-days: 5
-        if: ${{ !cancelled() }}
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
new file mode 100644
index 0000000000..851569ee8c
--- /dev/null
+++ b/.github/workflows/nightly.yml
@@ -0,0 +1,26 @@
+---
+# Run the tests in the "pr" and "nightly" categories on devel, with more
+# jobs than PR CI (see test-matrix-github.yml).  Like a push to devel, it saves
+# the ccache.
+name: nightly
+
+# yamllint disable-line rule:truthy
+on:
+  # Scheduled runs use the default branch, devel.
+  schedule:
+    - cron: '0 7 * * *'
+  workflow_dispatch:
+
+concurrency:
+  group: nightly-${{github.workflow}}-${{github.ref}}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  tests:
+    uses: $/.github/workflows/test-matrix-github.yml
+    permissions:
+      packages: write # to save ccache in ghcr.io
+    with:
+      test-categories: pr nightly
diff --git a/.github/workflows/test-matrix-github.yml b/.github/workflows/test-matrix-github.yml
new file mode 100644
index 0000000000..6dab54f385
--- /dev/null
+++ b/.github/workflows/test-matrix-github.yml
@@ -0,0 +1,228 @@
+---
+name: sst-elements build/install/test on free runners
+
+# yamllint disable-line rule:truthy
+on:
+  workflow_call:
+    inputs:
+      test-categories:
+        description: >-
+          Space-separated test categories; jobs that only run nightly need
+          "nightly" in it
+        default: pr
+        type: string
+
+concurrency:
+  group: test-matrix-github-${{github.workflow}}-${{github.ref}}-${{github.event.pull_request.number || github.run_number}}
+  cancel-in-progress: true
+
+permissions: {}
+
+# Jobs that build the same configuration share a ccache-key, and only one of
+# them must save it; check this when adding or removing jobs.
+#
+# Because sst-ci-job.yml comes from the devel branch of sst-core, changes must
+# merge there before sst-elements can use it.  It is unpinned to prevent
+# falling out of step with the sst-core@devel scripts it calls.
+jobs:
+  rocky8-mpi-mr-2:
+    uses: sstsimulator/sst-core/.github/workflows/sst-ci-job.yml@devel
+    permissions:
+      packages: write # to save ccache
+    with:
+      runs-on: ubuntu-26.04
+      test-categories: ${{ inputs.test-categories }}
+      image: rockylinux/rockylinux:8
+      test-ranks: 2
+      ccache-key: rocky8-mpi-gcc
+      ccache-save: true
+      artifact-name: rocky8-mpi-mr-2
+  rocky9-mpi:
+    uses: sstsimulator/sst-core/.github/workflows/sst-ci-job.yml@devel
+    permissions:
+      packages: write # to save ccache
+    with:
+      runs-on: ubuntu-26.04
+      test-categories: ${{ inputs.test-categories }}
+      image: rockylinux/rockylinux:9
+      ccache-key: rocky9-mpi-gcc
+      ccache-save: true
+      artifact-name: rocky9-mpi
+  rocky9-mpi-clang:
+    uses: sstsimulator/sst-core/.github/workflows/sst-ci-job.yml@devel
+    permissions:
+      packages: write # to save ccache
+    with:
+      runs-on: ubuntu-26.04
+      test-categories: ${{ inputs.test-categories }}
+      image: rockylinux/rockylinux:9
+      toolchain: clang
+      ccache-key: rocky9-mpi-clang
+      ccache-save: true
+      artifact-name: rocky9-mpi-clang
+  rocky9-mpi-make-dist:
+    uses: sstsimulator/sst-core/.github/workflows/sst-ci-job.yml@devel
+    permissions:
+      packages: write # to save ccache
+    with:
+      runs-on: ubuntu-26.04
+      test-categories: ${{ inputs.test-categories }}
+      image: rockylinux/rockylinux:9
+      make-dist: true
+      ccache-key: rocky9-mpi-gcc
+      artifact-name: rocky9-mpi-make-dist
+  rocky9-mpi-mr-2:
+    uses: sstsimulator/sst-core/.github/workflows/sst-ci-job.yml@devel
+    permissions:
+      packages: write # to save ccache
+    with:
+      runs-on: ubuntu-26.04
+      test-categories: ${{ inputs.test-categories }}
+      image: rockylinux/rockylinux:9
+      test-ranks: 2
+      ccache-key: rocky9-mpi-gcc
+      artifact-name: rocky9-mpi-mr-2
+  rocky9-mpi-mr-2-mt-2:
+    uses: sstsimulator/sst-core/.github/workflows/sst-ci-job.yml@devel
+    permissions:
+      packages: write # to save ccache
+    with:
+      runs-on: ubuntu-26.04
+      test-categories: ${{ inputs.test-categories }}
+      image: rockylinux/rockylinux:9
+      test-ranks: 2
+      test-threads: 2
+      ccache-key: rocky9-mpi-gcc
+      artifact-name: rocky9-mpi-mr-2-mt-2
+  rocky9-mpi-mt-2:
+    uses: sstsimulator/sst-core/.github/workflows/sst-ci-job.yml@devel
+    permissions:
+      packages: write # to save ccache
+    with:
+      runs-on: ubuntu-26.04
+      test-categories: ${{ inputs.test-categories }}
+      image: rockylinux/rockylinux:9
+      test-threads: 2
+      ccache-key: rocky9-mpi-gcc
+      artifact-name: rocky9-mpi-mt-2
+  rocky9-nompi:
+    uses: sstsimulator/sst-core/.github/workflows/sst-ci-job.yml@devel
+    permissions:
+      packages: write # to save ccache
+    with:
+      runs-on: ubuntu-26.04
+      test-categories: ${{ inputs.test-categories }}
+      image: rockylinux/rockylinux:9
+      mpi: false
+      ccache-key: rocky9-nompi-gcc
+      ccache-save: true
+      artifact-name: rocky9-nompi
+  # Left out in favor of rocky10-nompi while we debug OpenMPI 5
+  #
+  # rocky10-mpi-mr-2:
+  #   uses: sstsimulator/sst-core/.github/workflows/sst-ci-job.yml@devel
+  #   permissions:
+  #     packages: write # to save ccache
+  #   with:
+  #     runs-on: ubuntu-26.04
+  #     test-categories: ${{ inputs.test-categories }}
+  #     image: rockylinux/rockylinux:10
+  #     test-ranks: 2
+  #     ccache-key: rocky10-mpi-gcc
+  #     ccache-save: true
+  #     artifact-name: rocky10-mpi-mr-2
+  rocky10-mpi:
+    uses: sstsimulator/sst-core/.github/workflows/sst-ci-job.yml@devel
+    permissions:
+      packages: write # to save ccache
+    with:
+      runs-on: ubuntu-26.04
+      test-categories: ${{ inputs.test-categories }}
+      image: rockylinux/rockylinux:10
+      ccache-key: rocky10-mpi-gcc
+      ccache-save: true
+      artifact-name: rocky10-mpi
+  ubuntu2404-mpi:
+    uses: sstsimulator/sst-core/.github/workflows/sst-ci-job.yml@devel
+    permissions:
+      packages: write # to save ccache
+    with:
+      runs-on: ubuntu-26.04
+      test-categories: ${{ inputs.test-categories }}
+      image: ubuntu:24.04
+      ccache-key: ubuntu2404-mpi-gcc
+      ccache-save: true
+      artifact-name: ubuntu2404-mpi
+  ubuntu2604-mpi:
+    uses: sstsimulator/sst-core/.github/workflows/sst-ci-job.yml@devel
+    permissions:
+      packages: write # to save ccache
+    with:
+      runs-on: ubuntu-26.04
+      test-categories: ${{ inputs.test-categories }}
+      image: ubuntu:26.04
+      ccache-key: ubuntu2604-mpi-gcc
+      ccache-save: true
+      artifact-name: ubuntu2604-mpi
+  macos-15:
+    uses: sstsimulator/sst-core/.github/workflows/sst-ci-job.yml@devel
+    permissions:
+      packages: write # to save ccache
+    with:
+      runs-on: macos-15
+      test-categories: ${{ inputs.test-categories }}
+      python-version: '3.14'
+      ccache-key: macos-15
+      ccache-save: true
+      artifact-name: macos-15
+  macos-26:
+    uses: sstsimulator/sst-core/.github/workflows/sst-ci-job.yml@devel
+    permissions:
+      packages: write # to save ccache
+    with:
+      runs-on: macos-26
+      test-categories: ${{ inputs.test-categories }}
+      python-version: '3.14'
+      ccache-key: macos-26
+      ccache-save: true
+      artifact-name: macos-26
+  # The jobs below run only in the nightly workflow.
+  rocky9-mpi-mr-4:
+    if: ${{ contains(inputs.test-categories, 'nightly') }}
+    uses: sstsimulator/sst-core/.github/workflows/sst-ci-job.yml@devel
+    permissions:
+      packages: write # to save ccache
+    with:
+      runs-on: ubuntu-26.04
+      test-categories: ${{ inputs.test-categories }}
+      image: rockylinux/rockylinux:9
+      test-ranks: 4
+      ccache-key: rocky9-mpi-gcc
+      artifact-name: rocky9-mpi-mr-4
+  rocky9-mpi-mt-4:
+    if: ${{ contains(inputs.test-categories, 'nightly') }}
+    uses: sstsimulator/sst-core/.github/workflows/sst-ci-job.yml@devel
+    permissions:
+      packages: write # to save ccache
+    with:
+      runs-on: ubuntu-26.04
+      test-categories: ${{ inputs.test-categories }}
+      image: rockylinux/rockylinux:9
+      test-threads: 4
+      ccache-key: rocky9-mpi-gcc
+      artifact-name: rocky9-mpi-mt-4
+  rocky9-mpi-mr-3-mt-2:
+    if: ${{ contains(inputs.test-categories, 'nightly') }}
+    uses: sstsimulator/sst-core/.github/workflows/sst-ci-job.yml@devel
+    permissions:
+      packages: write # to save ccache
+    with:
+      runs-on: ubuntu-26.04
+      test-categories: ${{ inputs.test-categories }}
+      image: rockylinux/rockylinux:9
+      test-ranks: 3
+      test-threads: 2
+      # 6 PEs on a runner with 4 hardware threads
+      test-oversubscribe: true
+      ccache-key: rocky9-mpi-gcc
+      artifact-name: rocky9-mpi-mr-3-mt-2
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000000..4df02dce01
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,9 @@
+---
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        # sst-ci-job.yml follows sst-core@devel on purpose; see the comment
+        # in test-matrix-github.yml.
+        "sstsimulator/sst-core/*": ref-pin
+        "*": hash-pin