From 3a582c9f37a6d12d6e19fa380b70168b30dec3f8 Mon Sep 17 00:00:00 2001
From: Rui Luo <ruluo@nvidia.com>
Date: Fri, 23 Oct 2026 14:42:26 +0800
Subject: [PATCH 1/3] ci: run coverage pytest on main thread with larger stack

---
 .github/workflows/coverage.yml    |  2 +-
 ci/tools/run_pytest_with_stack.py | 97 ++++++++++++++++++++++++++-----
 2 files changed, 83 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index aee89d41f2d..448e13ad2ff 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -440,7 +440,7 @@ jobs:
           "$GITHUB_WORKSPACE/.venv/Scripts/pytest" -v --cov=./cuda --cov-append --cov-context=test --cov-config="$GITHUB_WORKSPACE/.coveragerc" "$GITHUB_WORKSPACE/cuda_pathfinder/tests"
 
       # Cython linetrace under coverage on Windows needs more stack than the
-      # default 1 MB thread size.  The helper runs pytest on an 8 MB thread.
+      # default 1 MB. The helper runs pytest on the main thread with 8 MB.
       - name: Run cuda.bindings tests (with 8MB stack)
         continue-on-error: true
         run: |
diff --git a/ci/tools/run_pytest_with_stack.py b/ci/tools/run_pytest_with_stack.py
index e1e1f782ba1..12abb49d766 100644
--- a/ci/tools/run_pytest_with_stack.py
+++ b/ci/tools/run_pytest_with_stack.py
@@ -4,24 +4,88 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-"""Run pytest on a thread with a larger stack size.
+"""Run pytest on Python's main thread with a larger stack.
 
-Cython linetrace instrumentation under coverage on Windows can exceed the
-default 1 MB thread stack.  This helper spawns a single worker thread with
-a configurable stack (default 8 MB) so the rest of the CI workflow stays
-readable.
+On Windows, start a temporary copy of the base Python executable with an
+8 MB PE stack reservation. This preserves the virtual environment without
+modifying the installed executable. Running pytest on the main thread lets
+CPython process pending calls used by CUDA graph cleanup.
 
 Usage:
     python run_pytest_with_stack.py [--stack-mb N] [--cwd DIR] [pytest args ...]
 """
 
 import argparse
-import concurrent.futures
 import os
+import struct
+import subprocess
 import sys
-import threading
+import tempfile
+from pathlib import Path
 
-import pytest
+
+def _python_with_stack(executable, stack_bytes):
+    """Return a PE executable image with at least the requested stack reserve."""
+    image = bytearray(executable.read_bytes())
+    if len(image) < 64 or image[:2] != b"MZ":
+        raise ValueError(f"Not a PE executable: {executable}")
+    pe_offset = struct.unpack_from("<I", image, 0x3C)[0]
+    if image[pe_offset : pe_offset + 4] != b"PE\0\0":
+        raise ValueError(f"Invalid PE signature: {executable}")
+    optional_offset = pe_offset + 24
+    if len(image) < optional_offset + 88:
+        raise ValueError(f"Truncated PE optional header: {executable}")
+    magic = struct.unpack_from("<H", image, optional_offset)[0]
+    if magic not in (0x10B, 0x20B):
+        raise ValueError(f"Unsupported PE optional header: {magic:#x}")
+    size_format = "<Q" if magic == 0x20B else "<I"
+    reserve_offset = optional_offset + 72
+    reserve = struct.unpack_from(size_format, image, reserve_offset)[0]
+    struct.pack_into(size_format, image, reserve_offset, max(reserve, stack_bytes))
+    return image
+
+
+def _run_windows(stack_mb, cwd, pytest_args):
+    # A venv's python.exe may be a redirector, so patch the base interpreter.
+    base_executable = Path(sys._base_executable)
+    image = _python_with_stack(base_executable, stack_mb * 1024 * 1024)
+    with tempfile.TemporaryDirectory(prefix="pytest-main-stack-") as directory:
+        executable = Path(directory) / "python.exe"
+        executable.write_bytes(image)
+        env = os.environ.copy()
+        env["__PYVENV_LAUNCHER__"] = sys.executable
+        env["PATH"] = str(base_executable.parent) + os.pathsep + env.get("PATH", "")
+        cmd = [str(executable), os.path.abspath(__file__), f"--stack-mb={stack_mb}"]
+        cmd.append("--stack-child")
+        if cwd:
+            cmd.extend(("--cwd", cwd))
+        cmd.extend(pytest_args)
+        return subprocess.call(cmd, env=env)  # noqa: S603 - trusted Python copy
+
+
+def _ensure_main_stack(stack_mb):
+    stack_bytes = stack_mb * 1024 * 1024
+    if sys.platform == "win32":
+        import ctypes
+
+        low, high = ctypes.c_size_t(), ctypes.c_size_t()
+        get_limits = ctypes.WinDLL("kernel32", use_last_error=True).GetCurrentThreadStackLimits
+        get_limits.argtypes = [
+            ctypes.POINTER(ctypes.c_size_t),
+            ctypes.POINTER(ctypes.c_size_t),
+        ]
+        get_limits.restype = None
+        get_limits(ctypes.byref(low), ctypes.byref(high))
+        actual = high.value - low.value
+        if actual < stack_bytes:
+            raise RuntimeError(f"Main thread stack is {actual} bytes, requested {stack_bytes}")
+        print(f"[stack-wrapper] main thread stack: {actual} bytes", flush=True)
+    else:
+        import resource
+
+        soft, hard = resource.getrlimit(resource.RLIMIT_STACK)
+        if soft != resource.RLIM_INFINITY and soft < stack_bytes:
+            resource.setrlimit(resource.RLIMIT_STACK, (stack_bytes, hard))
 
 
 def main():
@@ -30,24 +94,27 @@ def main():
         "--stack-mb",
         type=int,
         default=8,
-        help="Thread stack size in megabytes (default: 8)",
+        help="Main thread stack size in megabytes (default: 8)",
     )
     parser.add_argument(
         "--cwd",
         default=None,
         help="Working directory for the test run",
     )
+    parser.add_argument("--stack-child", action="store_true", help=argparse.SUPPRESS)
     args, pytest_args = parser.parse_known_args()
+    if args.stack_mb <= 0:
+        parser.error("--stack-mb must be positive")
+
+    if sys.platform == "win32" and not args.stack_child:
+        sys.exit(_run_windows(args.stack_mb, args.cwd, pytest_args))
 
+    _ensure_main_stack(args.stack_mb)
     if args.cwd:
         os.chdir(args.cwd)
+    import pytest
 
-    threading.stack_size(args.stack_mb * 1024 * 1024)
-
-    with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
-        code = pool.submit(pytest.main, pytest_args).result()
-
-    sys.exit(code)
+    sys.exit(pytest.main(pytest_args))
 
 
 if __name__ == "__main__":

From 9a73fa83140eb0b72f8f9620ad2df34fb48914fb Mon Sep 17 00:00:00 2001
From: Rui Luo <ruluo@nvidia.com>
Date: Fri, 23 Oct 2026 15:17:43 +0800
Subject: [PATCH 2/3] ci: keep manual PR coverage runs from deploying

---
 .github/workflows/coverage.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 448e13ad2ff..f0bd243f24e 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -581,7 +581,11 @@ jobs:
     # GitHub discards prerequisite artifacts on a new run attempt. If only this
     # job fails, use "Re-run all jobs" so coverage recreates its payload.
     needs: combine-and-deploy
-    if: ${{ needs.combine-and-deploy.result == 'success' && github.repository_owner == 'nvidia' }}
+    # Manual runs on PR mirror branches should not publish over main's report.
+    if: >-
+      needs.combine-and-deploy.result == 'success' &&
+      github.repository_owner == 'nvidia' &&
+      github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     permissions:
       contents: write

From 05cfa54bf111441fcae00ea7dd3f2b4af0e02645 Mon Sep 17 00:00:00 2001
From: Rui Luo <ruluo@nvidia.com>
Date: Tue, 3 Nov 2026 13:55:39 +0800
Subject: [PATCH 3/3] ci: fix Windows coverage test stacks

---
 .github/workflows/coverage.yml        | 13 +++-
 ci/tools/run_pytest_with_stack.py     | 57 ++----------------
 ci/tools/set_windows_python_stack.ps1 | 85 +++++++++++++++++++++++++++
 3 files changed, 102 insertions(+), 53 deletions(-)
 create mode 100644 ci/tools/set_windows_python_stack.ps1

diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 9ffda254021..475701ff2d8 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -386,6 +386,15 @@ jobs:
           python-version: ${{ env.PY_VER }}
           venv: .venv
 
+      # This job installs a separate Python from the wheel-build job. Give its
+      # main thread and test subprocesses enough stack for coverage-built bindings.
+      - name: Raise the test interpreter's stack reserve to 8 MiB
+        shell: powershell
+        run: |
+          $basePy = & .venv/Scripts/python.exe -c "import sys; print(sys._base_executable)"
+          if ($LASTEXITCODE -ne 0) { throw "Could not locate base Python executable" }
+          & ./ci/tools/set_windows_python_stack.ps1 -Executable $basePy -ReserveBytes 8388608
+
       - name: Set up mini CTK
         uses: ./.github/actions/fetch_ctk
         continue-on-error: false
@@ -435,8 +444,8 @@ jobs:
           cd "${{ steps.install-root.outputs.INSTALL_ROOT }}"
           "$GITHUB_WORKSPACE/.venv/Scripts/pytest" -v --cov=./cuda --cov-append --cov-context=test --cov-config="$GITHUB_WORKSPACE/.coveragerc" "$GITHUB_WORKSPACE/cuda_pathfinder/tests"
 
-      # Cython linetrace under coverage on Windows needs more stack than the
-      # default 1 MB. The helper runs pytest on the main thread with 8 MB.
+      # The patched interpreter gives pytest's main thread and subprocesses
+      # 8 MiB; the helper gives threads created during pytest the same stack.
       - name: Run cuda.bindings tests (with 8MB stack)
         continue-on-error: true
         run: |
diff --git a/ci/tools/run_pytest_with_stack.py b/ci/tools/run_pytest_with_stack.py
index 12abb49d766..a1fb2ef53ce 100644
--- a/ci/tools/run_pytest_with_stack.py
+++ b/ci/tools/run_pytest_with_stack.py
@@ -6,10 +6,10 @@
 
 """Run pytest on Python's main thread with a larger stack.
 
-On Windows, start a temporary copy of the base Python executable with an
-8 MB PE stack reservation. This preserves the virtual environment without
-modifying the installed executable. Running pytest on the main thread lets
-CPython process pending calls used by CUDA graph cleanup.
+The Windows coverage workflow first raises the base interpreter's PE stack
+reserve to 8 MB, covering the main thread and test subprocesses. Set the
+stack size for threads started during pytest to match. Running pytest on the
+main thread lets CPython process pending calls used by CUDA graph cleanup.
 
 Usage:
     python run_pytest_with_stack.py [--stack-mb N] [--cwd DIR] [pytest args ...]
@@ -17,50 +17,8 @@
 
 import argparse
 import os
-import struct
-import subprocess
 import sys
-import tempfile
-from pathlib import Path
-
-
-def _python_with_stack(executable, stack_bytes):
-    """Return a PE executable image with at least the requested stack reserve."""
-    image = bytearray(executable.read_bytes())
-    if len(image) < 64 or image[:2] != b"MZ":
-        raise ValueError(f"Not a PE executable: {executable}")
-    pe_offset = struct.unpack_from("<I", image, 0x3C)[0]
-    if image[pe_offset : pe_offset + 4] != b"PE\0\0":
-        raise ValueError(f"Invalid PE signature: {executable}")
-    optional_offset = pe_offset + 24
-    if len(image) < optional_offset + 88:
-        raise ValueError(f"Truncated PE optional header: {executable}")
-    magic = struct.unpack_from("<H", image, optional_offset)[0]
-    if magic not in (0x10B, 0x20B):
-        raise ValueError(f"Unsupported PE optional header: {magic:#x}")
-    size_format = "<Q" if magic == 0x20B else "<I"
-    reserve_offset = optional_offset + 72
-    reserve = struct.unpack_from(size_format, image, reserve_offset)[0]
-    struct.pack_into(size_format, image, reserve_offset, max(reserve, stack_bytes))
-    return image
-
-
-def _run_windows(stack_mb, cwd, pytest_args):
-    # A venv's python.exe may be a redirector, so patch the base interpreter.
-    base_executable = Path(sys._base_executable)
-    image = _python_with_stack(base_executable, stack_mb * 1024 * 1024)
-    with tempfile.TemporaryDirectory(prefix="pytest-main-stack-") as directory:
-        executable = Path(directory) / "python.exe"
-        executable.write_bytes(image)
-        env = os.environ.copy()
-        env["__PYVENV_LAUNCHER__"] = sys.executable
-        env["PATH"] = str(base_executable.parent) + os.pathsep + env.get("PATH", "")
-        cmd = [str(executable), os.path.abspath(__file__), f"--stack-mb={stack_mb}"]
-        cmd.append("--stack-child")
-        if cwd:
-            cmd.extend(("--cwd", cwd))
-        cmd.extend(pytest_args)
-        return subprocess.call(cmd, env=env)  # noqa: S603 - trusted Python copy
+import threading
 
 
 def _ensure_main_stack(stack_mb):
@@ -101,15 +59,12 @@ def main():
         default=None,
         help="Working directory for the test run",
     )
-    parser.add_argument("--stack-child", action="store_true", help=argparse.SUPPRESS)
     args, pytest_args = parser.parse_known_args()
     if args.stack_mb <= 0:
         parser.error("--stack-mb must be positive")
 
-    if sys.platform == "win32" and not args.stack_child:
-        sys.exit(_run_windows(args.stack_mb, args.cwd, pytest_args))
-
     _ensure_main_stack(args.stack_mb)
+    threading.stack_size(args.stack_mb * 1024 * 1024)
     if args.cwd:
         os.chdir(args.cwd)
     import pytest
diff --git a/ci/tools/set_windows_python_stack.ps1 b/ci/tools/set_windows_python_stack.ps1
new file mode 100644
index 00000000000..dd6b9a90379
--- /dev/null
+++ b/ci/tools/set_windows_python_stack.ps1
@@ -0,0 +1,85 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$Executable,
+
+    [Parameter(Mandatory = $true)]
+    [UInt64]$ReserveBytes
+)
+
+$ErrorActionPreference = "Stop"
+
+if (-not $env:RUNNER_TEMP) {
+    throw "RUNNER_TEMP is required"
+}
+$path = [IO.Path]::GetFullPath($Executable)
+$installRoot = [IO.Path]::GetFullPath((Join-Path $env:RUNNER_TEMP "setup-hardened-python/interpreters"))
+if (-not $path.StartsWith($installRoot + [IO.Path]::DirectorySeparatorChar, [StringComparison]::OrdinalIgnoreCase)) {
+    throw "Refusing to modify Python outside $installRoot`: $path"
+}
+
+$image = [IO.File]::ReadAllBytes($path)
+if ($image.Length -lt 64 -or $image[0] -ne 0x4d -or $image[1] -ne 0x5a) {
+    throw "Not a PE executable: $path"
+}
+$peOffset = [BitConverter]::ToInt32($image, 0x3c)
+if ($peOffset -lt 64 -or $peOffset -gt $image.Length - 24 -or
+    $image[$peOffset] -ne 0x50 -or $image[$peOffset + 1] -ne 0x45 -or
+    $image[$peOffset + 2] -ne 0 -or $image[$peOffset + 3] -ne 0) {
+    throw "Invalid PE header: $path"
+}
+$optionalOffset = $peOffset + 24
+$optionalSize = [BitConverter]::ToUInt16($image, $peOffset + 20)
+if ($optionalSize -lt 2 -or $optionalOffset + $optionalSize -gt $image.Length) {
+    throw "Truncated PE optional header: $path"
+}
+$magic = [BitConverter]::ToUInt16($image, $optionalOffset)
+if ($magic -eq 0x20b) {
+    $width = 8
+} elseif ($magic -eq 0x10b) {
+    $width = 4
+    if ($ReserveBytes -gt [UInt32]::MaxValue) {
+        throw "Stack reserve is too large for a 32-bit PE executable"
+    }
+} else {
+    throw "Unsupported PE optional header: $magic"
+}
+if ($optionalSize -lt 72 + $width) {
+    throw "PE optional header does not contain a stack reserve: $path"
+}
+
+$reserveOffset = $optionalOffset + 72
+$current = if ($width -eq 8) {
+    [BitConverter]::ToUInt64($image, $reserveOffset)
+} else {
+    [BitConverter]::ToUInt32($image, $reserveOffset)
+}
+if ($current -lt $ReserveBytes) {
+    $replacement = if ($width -eq 8) {
+        [BitConverter]::GetBytes($ReserveBytes)
+    } else {
+        [BitConverter]::GetBytes([UInt32]$ReserveBytes)
+    }
+    $stream = [IO.File]::Open($path, [IO.FileMode]::Open, [IO.FileAccess]::ReadWrite, [IO.FileShare]::None)
+    try {
+        $stream.Position = $reserveOffset
+        $stream.Write($replacement, 0, $width)
+        $stream.Flush()
+    } finally {
+        $stream.Dispose()
+    }
+}
+
+$updated = [IO.File]::ReadAllBytes($path)
+$actual = if ($width -eq 8) {
+    [BitConverter]::ToUInt64($updated, $reserveOffset)
+} else {
+    [BitConverter]::ToUInt32($updated, $reserveOffset)
+}
+if ($actual -lt $ReserveBytes) {
+    throw "Stack reserve verification failed: $actual < $ReserveBytes"
+}
+Write-Output "[stack-reserve] $path`: $current -> $actual bytes"