From ace45af8a1e65e30c913e30f769200af15bf7113 Mon Sep 17 00:00:00 2001
From: Stephan Hageboeck <stephan.hageboeck@cern.ch>
Date: Thu, 16 Oct 2025 13:42:58 +0200
Subject: [PATCH 01/15] [Remove] Disable Windows, linux  and Mac14 builds

---
 .github/workflows/root-ci.yml | 22 +++++-----------------
 1 file changed, 5 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/root-ci.yml b/.github/workflows/root-ci.yml
index c7b7a82168116..95d07652db907 100644
--- a/.github/workflows/root-ci.yml
+++ b/.github/workflows/root-ci.yml
@@ -100,9 +100,9 @@ jobs:
         # Common configs: {Release,Debug,RelWithDebInfo)
         # Build options: https://root.cern/install/build_from_source/#all-build-options
         include:
-          - platform: mac14
-            arch: X64
-            overrides: ["CMAKE_CXX_STANDARD=20"]
+          # - platform: mac14
+          #   arch: X64
+          #   overrides: ["CMAKE_CXX_STANDARD=20"]
           - platform: mac15
             arch: ARM64
             overrides: ["CMAKE_CXX_STANDARD=23"]
@@ -231,13 +231,7 @@ jobs:
   build-windows:
     # For any event that is not a PR, the CI will always run. In PRs, the CI
     # can be skipped if the tag [skip-ci] or [skip ci] is written in the title.
-    if: |
-        (github.repository_owner == 'root-project' && github.event_name != 'pull_request') ||
-        (github.event_name == 'pull_request' && !(
-          contains(github.event.pull_request.title, '[skip-ci]') ||
-          contains(github.event.pull_request.title, '[skip ci]') ||
-          contains(github.event.pull_request.labels.*.name, 'skip ci')
-        ))
+    if: false
 
     permissions:
       contents: read
@@ -356,13 +350,7 @@ jobs:
   build-linux:
     # For any event that is not a PR, the CI will always run. In PRs, the CI
     # can be skipped if the tag [skip-ci] or [skip ci] is written in the title.
-    if: |
-        (github.repository_owner == 'root-project' && github.event_name != 'pull_request') ||
-        (github.event_name == 'pull_request' && !(
-          contains(github.event.pull_request.title, '[skip-ci]') ||
-          contains(github.event.pull_request.title, '[skip ci]') ||
-          contains(github.event.pull_request.labels.*.name, 'skip ci')
-        ))
+    if: false
 
     permissions:
       contents: read

From 5aabbe6a49aad60ec069012a381b42ac66d35afd Mon Sep 17 00:00:00 2001
From: Stephan Hageboeck <stephan.hageboeck@cern.ch>
Date: Thu, 16 Oct 2025 14:09:03 +0200
Subject: [PATCH 02/15] [CI] Allow for specifying config options overrides on
 the command line.

This will allow for simplifying the CI, since build option overrides can
be passed to build_root.py without text-file manipulations.
---
 .github/workflows/root-ci-config/build_root.py | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/root-ci-config/build_root.py b/.github/workflows/root-ci-config/build_root.py
index ed9303effd695..0ca40bbfa42b6 100755
--- a/.github/workflows/root-ci-config/build_root.py
+++ b/.github/workflows/root-ci-config/build_root.py
@@ -30,7 +30,6 @@
     die,
     github_log_group,
     is_macos,
-    load_config,
     subprocess_with_capture,
     subprocess_with_log,
     upload_file,
@@ -70,10 +69,12 @@ def main():
     # Load CMake options from .github/workflows/root-ci-config/buildconfig/[platform].txt
     this_script_dir = os.path.dirname(os.path.abspath(__file__))
 
+    override_dict = dict(arg.split("=") for arg in args.overrides)
     options_dict = {
-        **load_config(f'{this_script_dir}/buildconfig/global.txt'),
+        **build_utils.load_config(f"{this_script_dir}/buildconfig/global.txt"),
         # file below overwrites values from above
-        **load_config(f'{this_script_dir}/buildconfig/{args.platform}.txt')
+        **build_utils.load_config(f"{this_script_dir}/buildconfig/{args.platform}.txt"),
+        **override_dict,
     }
 
     options = build_utils.cmake_options_from_dict(options_dict)
@@ -193,6 +194,7 @@ def parse_args():
     parser.add_argument("--architecture",    default=None,      help="Windows only, target arch")
     parser.add_argument("--repository",      default="https://github.com/root-project/root.git",
                         help="url to repository")
+    parser.add_argument("--overrides",       default=None,      help="Override build options with these key-value pairs", nargs="*")
 
     args = parser.parse_args()
 

From 9acaa8878ab2a6ce4d2f7824dc5f3df859c471c8 Mon Sep 17 00:00:00 2001
From: Stephan Hageboeck <stephan.hageboeck@cern.ch>
Date: Thu, 16 Oct 2025 14:11:31 +0200
Subject: [PATCH 03/15] [CI] Draft a homebrew-based macCI.

- Choose login shell for all MacOS steps.
- Use homebrew and python-venv to install dependencies
- Use github checkout action to get the code
---
 .github/workflows/root-ci.yml | 34 ++++++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/root-ci.yml b/.github/workflows/root-ci.yml
index 95d07652db907..2bafdf9643f7e 100644
--- a/.github/workflows/root-ci.yml
+++ b/.github/workflows/root-ci.yml
@@ -92,6 +92,11 @@ jobs:
     permissions:
       contents: read
 
+    # Use login shells to have brew and java available
+    defaults:
+      run:
+        shell: bash -le {0}
+
     strategy:
       fail-fast: false
       matrix:
@@ -106,27 +111,48 @@ jobs:
           - platform: mac15
             arch: ARM64
             overrides: ["CMAKE_CXX_STANDARD=23"]
-          - platform: mac26
-            arch: ARM64
+          - platform: experimental-brew-ci
+            # arch: ARM64
+            overrides: ["CMAKE_CXX_STANDARD=23"]
+          # - platform: mac26
+          #   arch: ARM64
           - platform: mac-beta
             is_special: true
             arch: ARM64
 
     runs-on: # Using '[self-hosted, ..., ...]' does not work for some reason :)
       - self-hosted
-      - macOS
       - ${{ matrix.arch }}
       - ${{ matrix.platform }}
 
     name: |
-      ${{ matrix.platform }} ${{ matrix.arch }} 
+      ${{ matrix.platform }} ${{ matrix.arch }}
       ${{ (github.event_name != 'schedule' && github.event_name != 'workflow_dispatch' && join( matrix.overrides, ', ' )) || '' }}
 
     steps:
+      - name: Cleanup
+        run: rm -rf ${github.workspace}/{src,build}
+
       - name: Checkout
         uses: actions/checkout@v4
         with:
           ref: ${{ inputs.ref_name }}
+          path: src/
+
+      - name: Update brew packages
+        run: |
+            brew update
+            echo "Installing deps: $(brew deps --direct --include-build root)"
+            brew install ccache googletest pyenv $(brew deps --direct --include-build root)
+            brew upgrade
+
+      - name: Set up python venv
+        run: |
+          python3 -m venv ROOT_CI
+          source ROOT_CI/bin/activate
+          pip install --upgrade pip
+          pip install -r ${{ github.workspace }}/src/requirements.txt
+          echo PATH=$PATH >> $GITHUB_ENV
 
       - name: Apply option overrides from matrix for this job for non-release builds
         if: ${{ github.event_name != 'schedule' && github.event_name != 'workflow_dispatch' && matrix.overrides != NaN }}

From 4d127318a7ecff76335e8b686452305e23055825 Mon Sep 17 00:00:00 2001
From: Stephan Hageboeck <stephan.hageboeck@cern.ch>
Date: Thu, 16 Oct 2025 14:12:17 +0200
Subject: [PATCH 04/15] [CI][NFC] Remove stray whitespaces.

---
 .github/workflows/root-ci-config/build_root.py |  2 +-
 .github/workflows/root-ci.yml                  | 12 ++++++------
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/root-ci-config/build_root.py b/.github/workflows/root-ci-config/build_root.py
index 0ca40bbfa42b6..b0b9058367a63 100755
--- a/.github/workflows/root-ci-config/build_root.py
+++ b/.github/workflows/root-ci-config/build_root.py
@@ -257,7 +257,7 @@ def git_pull(directory: str, repository: str, branch: str):
             returncode = subprocess_with_log(f"""
                 git clone --branch {branch} --single-branch {repository} "{targetdir}"
             """)
-        
+
         if returncode == 0:
             return
 
diff --git a/.github/workflows/root-ci.yml b/.github/workflows/root-ci.yml
index 2bafdf9643f7e..2627a4fbd7a37 100644
--- a/.github/workflows/root-ci.yml
+++ b/.github/workflows/root-ci.yml
@@ -185,7 +185,7 @@ jobs:
 
       - name: Set up curl CA bundle for Davix to work with https
         run: 'echo SSL_CERT_FILE=/opt/local/share/curl/curl-ca-bundle.crt >> $GITHUB_ENV'
-        
+
       - name: Pull Request Build
         shell: bash -leo pipefail {0}
         if: github.event_name == 'pull_request'
@@ -193,7 +193,7 @@ jobs:
           HOME: /Users/sftnight
           INCREMENTAL: ${{ !contains(github.event.pull_request.labels.*.name, 'clean build') && !matrix.platform == 'mac15' && !matrix.platform == 'mac26'}}
           GITHUB_PR_ORIGIN: ${{ github.event.pull_request.head.repo.clone_url }}
-        run: ".github/workflows/root-ci-config/build_root.py 
+        run: ".github/workflows/root-ci-config/build_root.py
                     --buildtype       RelWithDebInfo
                     --incremental     $INCREMENTAL
                     --base_ref        ${{ github.base_ref }}
@@ -207,7 +207,7 @@ jobs:
       - name: Workflow dispatch
         shell: bash -leo pipefail {0}
         if: ${{ github.event_name == 'workflow_dispatch' && !matrix.is_special }}
-        run: ".github/workflows/root-ci-config/build_root.py 
+        run: ".github/workflows/root-ci-config/build_root.py
                     --buildtype      ${{ inputs.buildtype }}
                     --platform       ${{ matrix.platform }}
                     --incremental    ${{ inputs.incremental }}
@@ -219,7 +219,7 @@ jobs:
       - name: Nightly build
         shell: bash -leo pipefail {0}
         if:   github.event_name == 'schedule'
-        run: ".github/workflows/root-ci-config/build_root.py 
+        run: ".github/workflows/root-ci-config/build_root.py
                     --buildtype      Release
                     --platform       ${{ matrix.platform }}
                     --incremental    false
@@ -230,7 +230,7 @@ jobs:
       - name: Update build cache after push to release branch
         shell: bash -leo pipefail {0}
         if:   github.event_name == 'push'
-        run: ".github/workflows/root-ci-config/build_root.py 
+        run: ".github/workflows/root-ci-config/build_root.py
                     --buildtype      RelWithDebInfo
                     --platform       ${{ matrix.platform }}
                     --incremental    false
@@ -436,7 +436,7 @@ jobs:
             is_special: true
             property: "Fedora pydebug"
             overrides: ["CMAKE_CXX_STANDARD=23"]
-          # Disable GPU builds until the DNS problem is solved  
+          # Disable GPU builds until the DNS problem is solved
           # - image: ubuntu2404-cuda
           #   is_special: true
           #   property: gpu

From ec83ed93721062de682e7eeaabc2d082e5ab934a Mon Sep 17 00:00:00 2001
From: Stephan Hageboeck <stephan.hageboeck@cern.ch>
Date: Thu, 16 Oct 2025 14:26:21 +0200
Subject: [PATCH 05/15] [CI] Move overrides from dedicated github step to
 configure step.

Now that overrides can be passed as arguments to the configure script,
no further modifications of text files are required.
---
 .github/workflows/root-ci.yml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/root-ci.yml b/.github/workflows/root-ci.yml
index 2627a4fbd7a37..fa677fff071c2 100644
--- a/.github/workflows/root-ci.yml
+++ b/.github/workflows/root-ci.yml
@@ -193,6 +193,7 @@ jobs:
           HOME: /Users/sftnight
           INCREMENTAL: ${{ !contains(github.event.pull_request.labels.*.name, 'clean build') && !matrix.platform == 'mac15' && !matrix.platform == 'mac26'}}
           GITHUB_PR_ORIGIN: ${{ github.event.pull_request.head.repo.clone_url }}
+          OVERRIDES: ${{ join( matrix.overrides, ' ') }}
         run: ".github/workflows/root-ci-config/build_root.py
                     --buildtype       RelWithDebInfo
                     --incremental     $INCREMENTAL
@@ -202,7 +203,8 @@ jobs:
                     --head_ref        refs/pull/${{ github.event.pull_request.number }}/head:${{ github.event.pull_request.head.ref }}
                     --head_sha        ${{ github.event.pull_request.head.sha }}
                     --repository      ${{ github.server_url }}/${{ github.repository }}
-                    --platform        ${{ matrix.platform }}"
+                    --platform        ${{ matrix.platform }}
+                    --overrides       $GLOBAL_OVERRIDES $OVERRIDES"
 
       - name: Workflow dispatch
         shell: bash -leo pipefail {0}
@@ -230,13 +232,16 @@ jobs:
       - name: Update build cache after push to release branch
         shell: bash -leo pipefail {0}
         if:   github.event_name == 'push'
+        env:
+          OVERRIDES: ${{ join( matrix.overrides, ' ') }}
         run: ".github/workflows/root-ci-config/build_root.py
                     --buildtype      RelWithDebInfo
                     --platform       ${{ matrix.platform }}
                     --incremental    false
                     --base_ref       ${{ github.ref_name }}
                     --binaries       ${{ startsWith(github.ref, 'refs/tags/') }}
-                    --repository     ${{ github.server_url }}/${{ github.repository }}"
+                    --repository     ${{ github.server_url }}/${{ github.repository }}
+                    --overrides      $GLOBAL_OVERRIDES $OVERRIDES"
 
       - name: Upload test results
         if:   ${{ !cancelled() }}

From 9c945edf18b2c749e561da19902170eeb9068dfa Mon Sep 17 00:00:00 2001
From: Stephan Hageboeck <stephan.hageboeck@cern.ch>
Date: Thu, 16 Oct 2025 14:27:33 +0200
Subject: [PATCH 06/15] [TODO] Disable the text replacements for build-option
 overrides on Mac.

---
 .github/workflows/root-ci.yml | 19 +------------------
 1 file changed, 1 insertion(+), 18 deletions(-)

diff --git a/.github/workflows/root-ci.yml b/.github/workflows/root-ci.yml
index fa677fff071c2..8707f6bd08454 100644
--- a/.github/workflows/root-ci.yml
+++ b/.github/workflows/root-ci.yml
@@ -160,24 +160,7 @@ jobs:
           OVERRIDES: ${{ join( matrix.overrides, ' ') }}
           CONFIGFILE: '.github/workflows/root-ci-config/buildconfig/${{ matrix.platform }}.txt'
         shell: bash
-        run: |
-          set -x
-
-          echo '' >> "$CONFIGFILE"
-
-          for ENTRY in $GLOBAL_OVERRIDES $OVERRIDES; do
-              KEY=$( echo "$ENTRY" | cut -d '=' -f 1 )
-
-              # Add entry to file if not exists, otherwise replace
-
-              if grep -q "$KEY=" "$CONFIGFILE"; then
-                  sed -i "s/$KEY=.*\$/$ENTRY/" "$CONFIGFILE"
-              else
-                  echo "$ENTRY" >> "$CONFIGFILE"
-              fi
-          done
-
-          cat "$CONFIGFILE" || true
+        run: echo "Remember to set the following overrides GLOBAL=$GLOBAL_OVERRIDES LOCAL=$OVERRIDES"
 
       - uses: root-project/gcc-problem-matcher-improved@main
         with:

From 1eaa186d5d7da4d038228442f66bd0696594cbae Mon Sep 17 00:00:00 2001
From: Stephan Hageboeck <stephan.hageboeck@cern.ch>
Date: Thu, 16 Oct 2025 15:49:10 +0200
Subject: [PATCH 07/15] [CI] Update checkout action, go to default ref that
 triggered the PR.

---
 .github/workflows/root-ci.yml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.github/workflows/root-ci.yml b/.github/workflows/root-ci.yml
index 8707f6bd08454..edd7be8a5b5ec 100644
--- a/.github/workflows/root-ci.yml
+++ b/.github/workflows/root-ci.yml
@@ -282,9 +282,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.ref_name }}
+        uses: actions/checkout@v5
 
       - name: Pull Request Build
         if: github.event_name == 'pull_request'

From 88c668b157999f0a7da4e7509cd97e6a1b924b8e Mon Sep 17 00:00:00 2001
From: Stephan Hageboeck <stephan.hageboeck@cern.ch>
Date: Thu, 16 Oct 2025 16:14:11 +0200
Subject: [PATCH 08/15] fixup! [CI] Draft a homebrew-based macCI.

---
 .github/workflows/root-ci.yml | 38 +++++++++++++++++++----------------
 1 file changed, 21 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/root-ci.yml b/.github/workflows/root-ci.yml
index edd7be8a5b5ec..ae65d36fa1271 100644
--- a/.github/workflows/root-ci.yml
+++ b/.github/workflows/root-ci.yml
@@ -122,7 +122,7 @@ jobs:
 
     runs-on: # Using '[self-hosted, ..., ...]' does not work for some reason :)
       - self-hosted
-      - ${{ matrix.arch }}
+      - ${{ matrix.arch == null && 'self-hosted' || matrix.arch }}
       - ${{ matrix.platform }}
 
     name: |
@@ -131,7 +131,7 @@ jobs:
 
     steps:
       - name: Cleanup
-        run: rm -rf ${github.workspace}/{src,build}
+        run: rm -rf ${{ github.workspace }}/{src,build}
 
       - name: Checkout
         uses: actions/checkout@v4
@@ -140,6 +140,7 @@ jobs:
           path: src/
 
       - name: Update brew packages
+        if: ${{ matrix.platform == 'experimental-brew-ci' }}
         run: |
             brew update
             echo "Installing deps: $(brew deps --direct --include-build root)"
@@ -147,12 +148,14 @@ jobs:
             brew upgrade
 
       - name: Set up python venv
+        if: ${{ matrix.platform == 'experimental-brew-ci' }}
         run: |
-          python3 -m venv ROOT_CI
+          $(brew --prefix python)/bin/python3 -m venv ROOT_CI
           source ROOT_CI/bin/activate
+          echo PATH=$PATH >> $GITHUB_PATH
           pip install --upgrade pip
-          pip install -r ${{ github.workspace }}/src/requirements.txt
-          echo PATH=$PATH >> $GITHUB_ENV
+          cat ${{ github.workspace }}/src/requirements.txt | while read PACKAGE; do pip install -U "$PACKAGE"; done || true
+          pip install openstacksdk # TODO: Remove?
 
       - name: Apply option overrides from matrix for this job for non-release builds
         if: ${{ github.event_name != 'schedule' && github.event_name != 'workflow_dispatch' && matrix.overrides != NaN }}
@@ -170,24 +173,25 @@ jobs:
         run: 'echo SSL_CERT_FILE=/opt/local/share/curl/curl-ca-bundle.crt >> $GITHUB_ENV'
 
       - name: Pull Request Build
-        shell: bash -leo pipefail {0}
         if: github.event_name == 'pull_request'
         env:
           HOME: /Users/sftnight
           INCREMENTAL: ${{ !contains(github.event.pull_request.labels.*.name, 'clean build') && !matrix.platform == 'mac15' && !matrix.platform == 'mac26'}}
           GITHUB_PR_ORIGIN: ${{ github.event.pull_request.head.repo.clone_url }}
           OVERRIDES: ${{ join( matrix.overrides, ' ') }}
-        run: ".github/workflows/root-ci-config/build_root.py
-                    --buildtype       RelWithDebInfo
-                    --incremental     $INCREMENTAL
-                    --base_ref        ${{ github.base_ref }}
-                    --sha             ${{ github.sha }}
-                    --pull_repository ${{ github.event.pull_request.head.repo.clone_url }}
-                    --head_ref        refs/pull/${{ github.event.pull_request.number }}/head:${{ github.event.pull_request.head.ref }}
-                    --head_sha        ${{ github.event.pull_request.head.sha }}
-                    --repository      ${{ github.server_url }}/${{ github.repository }}
-                    --platform        ${{ matrix.platform }}
-                    --overrides       $GLOBAL_OVERRIDES $OVERRIDES"
+        run: |
+          source ROOT_CI/bin/activate
+          src/.github/workflows/root-ci-config/build_root.py  \
+                    --buildtype       RelWithDebInfo          \
+                    --incremental     $INCREMENTAL            \
+                    --base_ref        ${{ github.base_ref }}  \
+                    --sha             ${{ github.sha }}       \
+                    --pull_repository ${{ github.event.pull_request.head.repo.clone_url }}  \
+                    --head_ref        refs/pull/${{ github.event.pull_request.number }}/head:${{ github.event.pull_request.head.ref }}  \
+                    --head_sha        ${{ github.event.pull_request.head.sha }}         \
+                    --repository      ${{ github.server_url }}/${{ github.repository }} \
+                    --platform        ${{ matrix.platform }}                            \
+                    --overrides       $GLOBAL_OVERRIDES $OVERRIDES
 
       - name: Workflow dispatch
         shell: bash -leo pipefail {0}

From b3ca5fd8f2a305caec97fa1ebd97e2c8e489c549 Mon Sep 17 00:00:00 2001
From: Stephan Hageboeck <stephan.hageboeck@cern.ch>
Date: Fri, 17 Oct 2025 18:58:02 +0200
Subject: [PATCH 09/15] [CI] Switch on builtin_unuran for Macs.

Homebrew doesn't natively provide it, so it seems easier to use a
builtin.
---
 .github/workflows/root-ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/root-ci.yml b/.github/workflows/root-ci.yml
index ae65d36fa1271..fc7018a46d38b 100644
--- a/.github/workflows/root-ci.yml
+++ b/.github/workflows/root-ci.yml
@@ -113,7 +113,7 @@ jobs:
             overrides: ["CMAKE_CXX_STANDARD=23"]
           - platform: experimental-brew-ci
             # arch: ARM64
-            overrides: ["CMAKE_CXX_STANDARD=23"]
+            overrides: ["CMAKE_CXX_STANDARD=23", "builtin_unuran=On"]
           # - platform: mac26
           #   arch: ARM64
           - platform: mac-beta

From 9769df037fecee63bc77910460079a65bd111d57 Mon Sep 17 00:00:00 2001
From: Stephan Hageboeck <stephan.hageboeck@cern.ch>
Date: Fri, 17 Oct 2025 18:59:00 +0200
Subject: [PATCH 10/15] fixup! [CI] Draft a homebrew-based macCI.

---
 .../workflows/root-ci-config/build_root.py    | 19 ++++++++++++-------
 .../workflows/root-ci-config/build_utils.py   | 10 ++++++++++
 .github/workflows/root-ci.yml                 | 12 ++++++++----
 3 files changed, 30 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/root-ci-config/build_root.py b/.github/workflows/root-ci-config/build_root.py
index b0b9058367a63..b39d09fccbb51 100755
--- a/.github/workflows/root-ci-config/build_root.py
+++ b/.github/workflows/root-ci-config/build_root.py
@@ -30,6 +30,7 @@
     die,
     github_log_group,
     is_macos,
+    print_options_diff,
     subprocess_with_capture,
     subprocess_with_log,
     upload_file,
@@ -69,13 +70,17 @@ def main():
     # Load CMake options from .github/workflows/root-ci-config/buildconfig/[platform].txt
     this_script_dir = os.path.dirname(os.path.abspath(__file__))
 
-    override_dict = dict(arg.split("=") for arg in args.overrides)
-    options_dict = {
-        **build_utils.load_config(f"{this_script_dir}/buildconfig/global.txt"),
-        # file below overwrites values from above
-        **build_utils.load_config(f"{this_script_dir}/buildconfig/{args.platform}.txt"),
-        **override_dict,
-    }
+    options_dict = build_utils.load_config(f"{this_script_dir}/buildconfig/global.txt")
+    temp = dict(options_dict)
+    options_dict.update(build_utils.load_config(f"{this_script_dir}/buildconfig/{args.platform}.txt"))
+    print(f"Build options ({args.platform})")
+    print_options_diff(options_dict, temp)
+
+    print("Build options (CI override):", args.overrides)
+    if args.overrides is not None:
+        temp = dict(options_dict)
+        options_dict.update((arg.split("=") for arg in args.overrides))
+        print_options_diff(options_dict, temp)
 
     options = build_utils.cmake_options_from_dict(options_dict)
 
diff --git a/.github/workflows/root-ci-config/build_utils.py b/.github/workflows/root-ci-config/build_utils.py
index 68b9bb4968399..f8b54ac677f85 100755
--- a/.github/workflows/root-ci-config/build_utils.py
+++ b/.github/workflows/root-ci-config/build_utils.py
@@ -108,6 +108,16 @@ def print_warning(*values, **kwargs):
 def print_error(*values, **kwargs):
     print_fancy("Fatal error: ", *values, sgr=31, **kwargs)
 
+def print_options_diff(new, old):
+    """Print difference between build option dicts"""
+
+    for key in new:
+        try:
+            if new[key] != old[key]:
+                print(f"\t{key}:\t{old[key]} --> {new[key]}")
+        except:
+            print(f"\t{key}:\tNone --> {new[key]}")
+
 
 def subprocess_with_log(command: str) -> int:
     """Runs <command> in shell and appends <command> to log"""
diff --git a/.github/workflows/root-ci.yml b/.github/workflows/root-ci.yml
index fc7018a46d38b..1c0128acfe77f 100644
--- a/.github/workflows/root-ci.yml
+++ b/.github/workflows/root-ci.yml
@@ -152,10 +152,13 @@ jobs:
         run: |
           $(brew --prefix python)/bin/python3 -m venv ROOT_CI
           source ROOT_CI/bin/activate
-          echo PATH=$PATH >> $GITHUB_PATH
           pip install --upgrade pip
-          cat ${{ github.workspace }}/src/requirements.txt | while read PACKAGE; do pip install -U "$PACKAGE"; done || true
+          cat ${{ github.workspace }}/src/requirements.txt | while read PACKAGE; do
+            if [ -n "${PACKAGE%%#*}" ]; then
+              pip install -U "${PACKAGE%%#*}";
+          fi; done || true
           pip install openstacksdk # TODO: Remove?
+          echo $(pwd)/ROOT_CI/bin >> $GITHUB_PATH
 
       - name: Apply option overrides from matrix for this job for non-release builds
         if: ${{ github.event_name != 'schedule' && github.event_name != 'workflow_dispatch' && matrix.overrides != NaN }}
@@ -180,7 +183,8 @@ jobs:
           GITHUB_PR_ORIGIN: ${{ github.event.pull_request.head.repo.clone_url }}
           OVERRIDES: ${{ join( matrix.overrides, ' ') }}
         run: |
-          source ROOT_CI/bin/activate
+          echo $PATH
+          if [ -f ROOT_CI/bin/activate ]; then source ROOT_CI/bin/activate; fi
           src/.github/workflows/root-ci-config/build_root.py  \
                     --buildtype       RelWithDebInfo          \
                     --incremental     $INCREMENTAL            \
@@ -190,7 +194,7 @@ jobs:
                     --head_ref        refs/pull/${{ github.event.pull_request.number }}/head:${{ github.event.pull_request.head.ref }}  \
                     --head_sha        ${{ github.event.pull_request.head.sha }}         \
                     --repository      ${{ github.server_url }}/${{ github.repository }} \
-                    --platform        ${{ matrix.platform }}                            \
+                    --platform        ${{ matrix.platform == 'experimental-brew-ci' && 'mac15' || matrix.platform }}
                     --overrides       $GLOBAL_OVERRIDES $OVERRIDES
 
       - name: Workflow dispatch

From 835fabf19c73c1013f51bcc33aa30c566085b5a4 Mon Sep 17 00:00:00 2001
From: Stephan Hageboeck <stephan.hageboeck@cern.ch>
Date: Mon, 20 Oct 2025 15:24:01 +0200
Subject: [PATCH 11/15] Fix a format string.

---
 .github/workflows/root-ci-config/build_utils.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/root-ci-config/build_utils.py b/.github/workflows/root-ci-config/build_utils.py
index f8b54ac677f85..901a3a769f859 100755
--- a/.github/workflows/root-ci-config/build_utils.py
+++ b/.github/workflows/root-ci-config/build_utils.py
@@ -326,7 +326,7 @@ def remove_file_match_ext(directory: str, extension: str) -> str:
         extension (str): The regular expression pattern to match filenames against.
     """
     print_fancy(f"Removing gcda files from {directory}")
-    log.add(f"\nfind {directory} -name \*.gcda -exec rm {{}} \;")
+    log.add(f"\nfind {directory} -name \\*.gcda -exec rm {{}} \;")
     pattern = "." + extension
     count = 0
     for currentdir, _, files in os.walk(directory):

From 14e40881d044243f60f6b11d007d47a34f0bc80f Mon Sep 17 00:00:00 2001
From: Stephan Hageboeck <stephan.hageboeck@cern.ch>
Date: Mon, 20 Oct 2025 15:44:25 +0200
Subject: [PATCH 12/15] fixup! [CI] Draft a homebrew-based macCI.

---
 .github/workflows/root-ci.yml | 33 +++++++++++++++++++++------------
 1 file changed, 21 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/root-ci.yml b/.github/workflows/root-ci.yml
index 1c0128acfe77f..82fcdeb8407c1 100644
--- a/.github/workflows/root-ci.yml
+++ b/.github/workflows/root-ci.yml
@@ -95,7 +95,10 @@ jobs:
     # Use login shells to have brew and java available
     defaults:
       run:
-        shell: bash -le {0}
+        shell: bash -leo pipefail {0}
+
+    env:
+      VENV_DIR: ${{ github.workspace }}/ROOT_CI_VENV
 
     strategy:
       fail-fast: false
@@ -113,7 +116,7 @@ jobs:
             overrides: ["CMAKE_CXX_STANDARD=23"]
           - platform: experimental-brew-ci
             # arch: ARM64
-            overrides: ["CMAKE_CXX_STANDARD=23", "builtin_unuran=On"]
+            overrides: ["CMAKE_CXX_STANDARD=23", "builtin_unuran=On", "tmva-sofie=Off"]
           # - platform: mac26
           #   arch: ARM64
           - platform: mac-beta
@@ -131,7 +134,7 @@ jobs:
 
     steps:
       - name: Cleanup
-        run: rm -rf ${{ github.workspace }}/{src,build}
+        run: rm -rf ${{ github.workspace }}/build
 
       - name: Checkout
         uses: actions/checkout@v4
@@ -143,22 +146,23 @@ jobs:
         if: ${{ matrix.platform == 'experimental-brew-ci' }}
         run: |
             brew update
-            echo "Installing deps: $(brew deps --direct --include-build root)"
-            brew install ccache googletest pyenv $(brew deps --direct --include-build root)
-            brew upgrade
+            brew install ccache googletest openjdk pyenv
+            echo "Installing official brew deps: $(brew deps --direct --include-build root)"
+            brew install $(brew deps --direct --include-build root)
+            java --version
 
       - name: Set up python venv
         if: ${{ matrix.platform == 'experimental-brew-ci' }}
         run: |
-          $(brew --prefix python)/bin/python3 -m venv ROOT_CI
-          source ROOT_CI/bin/activate
+          $(brew --prefix python)/bin/python3 -m venv ${VENV_DIR}
+          source ${VENV_DIR}/bin/activate
           pip install --upgrade pip
           cat ${{ github.workspace }}/src/requirements.txt | while read PACKAGE; do
             if [ -n "${PACKAGE%%#*}" ]; then
               pip install -U "${PACKAGE%%#*}";
           fi; done || true
           pip install openstacksdk # TODO: Remove?
-          echo $(pwd)/ROOT_CI/bin >> $GITHUB_PATH
+          echo ${VENV_DIR}/bin >> $GITHUB_PATH
 
       - name: Apply option overrides from matrix for this job for non-release builds
         if: ${{ github.event_name != 'schedule' && github.event_name != 'workflow_dispatch' && matrix.overrides != NaN }}
@@ -173,7 +177,12 @@ jobs:
           build-directory: /Users/sftnight/ROOT-CI/src/
 
       - name: Set up curl CA bundle for Davix to work with https
-        run: 'echo SSL_CERT_FILE=/opt/local/share/curl/curl-ca-bundle.crt >> $GITHUB_ENV'
+        run: |
+          for cert in /opt/homebrew/opt/ca-certificates/share/ca-certificates/cacert.pem /opt/local/share/curl/curl-ca-bundle.crt; do
+            if [ -f ${cert} ]; then
+              echo "SSL_CERT_FILE=${cert}" >> $GITHUB_ENV
+            fi
+          done
 
       - name: Pull Request Build
         if: github.event_name == 'pull_request'
@@ -184,7 +193,7 @@ jobs:
           OVERRIDES: ${{ join( matrix.overrides, ' ') }}
         run: |
           echo $PATH
-          if [ -f ROOT_CI/bin/activate ]; then source ROOT_CI/bin/activate; fi
+          if [ -f ${VENV_DIR}/bin/activate ]; then source ${VENV_DIR}/bin/activate; fi
           src/.github/workflows/root-ci-config/build_root.py  \
                     --buildtype       RelWithDebInfo          \
                     --incremental     $INCREMENTAL            \
@@ -194,7 +203,7 @@ jobs:
                     --head_ref        refs/pull/${{ github.event.pull_request.number }}/head:${{ github.event.pull_request.head.ref }}  \
                     --head_sha        ${{ github.event.pull_request.head.sha }}         \
                     --repository      ${{ github.server_url }}/${{ github.repository }} \
-                    --platform        ${{ matrix.platform == 'experimental-brew-ci' && 'mac15' || matrix.platform }}
+                    --platform        ${{ matrix.platform == 'experimental-brew-ci' && 'mac15' || matrix.platform }} \
                     --overrides       $GLOBAL_OVERRIDES $OVERRIDES
 
       - name: Workflow dispatch

From 779180eb2e8ab6a8b509c451c9115f0da595d48a Mon Sep 17 00:00:00 2001
From: Stephan Hageboeck <stephan.hageboeck@cern.ch>
Date: Wed, 22 Oct 2025 13:40:19 +0200
Subject: [PATCH 13/15] [Remove] Set environment variables for debug logging.

---
 .github/workflows/root-ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/root-ci.yml b/.github/workflows/root-ci.yml
index 82fcdeb8407c1..b40fe1b5807e2 100644
--- a/.github/workflows/root-ci.yml
+++ b/.github/workflows/root-ci.yml
@@ -72,6 +72,8 @@ env:
   OS_INTERFACE: 'public'
   OS_REGION_NAME: 'cern'
   GLOBAL_OVERRIDES: 'asserts=ON LLVM_ENABLE_ASSERTIONS=ON'
+  ACTIONS_RUNNER_DEBUG: true
+  ACTIONS_STEP_DEBUG: true
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}

From 3c6b73c47ee34460f40169d8765beeb74edacbf6 Mon Sep 17 00:00:00 2001
From: Stephan Hageboeck <stephan.hageboeck@cern.ch>
Date: Wed, 22 Oct 2025 13:44:42 +0200
Subject: [PATCH 14/15] [CI] Import openstack only where necessary.

build_root.py could be run locally without access to openstack if no
uploads of build caches are attempted. Here, all openstack-related
imports are moved to the function that actually does the upload, so the
rest of the script can be run standalone.
---
 .github/workflows/root-ci-config/build_root.py  | 15 ++++++++-------
 .github/workflows/root-ci-config/build_utils.py |  3 +--
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/root-ci-config/build_root.py b/.github/workflows/root-ci-config/build_root.py
index b39d09fccbb51..ef5f1bfa2eac2 100755
--- a/.github/workflows/root-ci-config/build_root.py
+++ b/.github/workflows/root-ci-config/build_root.py
@@ -24,7 +24,6 @@
 import time
 
 import build_utils
-import openstack
 from build_utils import (
     calc_options_hash,
     die,
@@ -39,12 +38,6 @@
 S3CONTAINER = 'ROOT-build-artifacts'  # Used for uploads
 S3URL = 'https://s3.cern.ch/swift/v1/' + S3CONTAINER  # Used for downloads
 
-try:
-    CONNECTION = openstack.connect(cloud='envvars')
-except Exception as exc:
-    print("Failed to open the S3 connection:", exc, file=sys.stderr)
-    CONNECTION = None
-
 WINDOWS = (os.name == 'nt')
 WORKDIR = (os.environ['HOME'] + '/ROOT-CI') if not WINDOWS else 'C:/ROOT-CI'
 COMPRESSIONLEVEL = 6 if not WINDOWS else 1
@@ -340,6 +333,14 @@ def archive_and_upload(archive_name, prefix):
         targz.add("src")
         targz.add("build")
 
+    try:
+        import openstack
+        CONNECTION = openstack.connect(cloud='envvars')
+    except Exception as exc:
+        print("Failed to open the S3 connection:", exc, file=sys.stderr)
+        CONNECTION = None
+
+
     upload_file(
         connection=CONNECTION,
         container=S3CONTAINER,
diff --git a/.github/workflows/root-ci-config/build_utils.py b/.github/workflows/root-ci-config/build_utils.py
index 901a3a769f859..47b1893ec8246 100755
--- a/.github/workflows/root-ci-config/build_utils.py
+++ b/.github/workflows/root-ci-config/build_utils.py
@@ -14,7 +14,6 @@
 from shutil import which
 from typing import Callable, Dict
 
-from openstack.connection import Connection
 from requests import get
 
 
@@ -238,7 +237,7 @@ def calc_options_hash(options: str) -> str:
         options_and_defines += sp_result.stdout
     return sha1(options_and_defines.encode('utf-8')).hexdigest()
 
-def upload_file(connection: Connection, container: str, dest_object: str, src_file: str) -> None:
+def upload_file(connection, container: str, dest_object: str, src_file: str) -> None:
     print(f"Attempting to upload {src_file} to {dest_object}")
 
     if not os.path.exists(src_file):

From 735a13aae17976c88a31e4d81c35dcf05d84d962 Mon Sep 17 00:00:00 2001
From: Stephan Hageboeck <stephan.hageboeck@cern.ch>
Date: Thu, 23 Oct 2025 11:56:25 +0200
Subject: [PATCH 15/15] fixup! [CI] Draft a homebrew-based macCI.

---
 .github/workflows/root-ci.yml | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/root-ci.yml b/.github/workflows/root-ci.yml
index b40fe1b5807e2..fc7473a7e629a 100644
--- a/.github/workflows/root-ci.yml
+++ b/.github/workflows/root-ci.yml
@@ -119,6 +119,9 @@ jobs:
           - platform: experimental-brew-ci
             # arch: ARM64
             overrides: ["CMAKE_CXX_STANDARD=23", "builtin_unuran=On", "tmva-sofie=Off"]
+          - platform: experimental-brew-ci-2
+            # arch: ARM64
+            overrides: ["CMAKE_CXX_STANDARD=23", "builtin_unuran=On", "tmva-sofie=Off"]
           # - platform: mac26
           #   arch: ARM64
           - platform: mac-beta
@@ -145,16 +148,16 @@ jobs:
           path: src/
 
       - name: Update brew packages
-        if: ${{ matrix.platform == 'experimental-brew-ci' }}
+        if: ${{ contains(matrix.platform, 'experimental-brew-ci') }}
         run: |
             brew update
-            brew install ccache googletest openjdk pyenv
+            brew install ccache googletest openjdk pyenv python3
             echo "Installing official brew deps: $(brew deps --direct --include-build root)"
             brew install $(brew deps --direct --include-build root)
             java --version
 
       - name: Set up python venv
-        if: ${{ matrix.platform == 'experimental-brew-ci' }}
+        if: ${{ contains(matrix.platform, 'experimental-brew-ci') }}
         run: |
           $(brew --prefix python)/bin/python3 -m venv ${VENV_DIR}
           source ${VENV_DIR}/bin/activate
@@ -205,7 +208,7 @@ jobs:
                     --head_ref        refs/pull/${{ github.event.pull_request.number }}/head:${{ github.event.pull_request.head.ref }}  \
                     --head_sha        ${{ github.event.pull_request.head.sha }}         \
                     --repository      ${{ github.server_url }}/${{ github.repository }} \
-                    --platform        ${{ matrix.platform == 'experimental-brew-ci' && 'mac15' || matrix.platform }} \
+                    --platform        ${{ contains(matrix.platform, 'experimental-brew-ci') && 'mac15' || matrix.platform }} \
                     --overrides       $GLOBAL_OVERRIDES $OVERRIDES
 
       - name: Workflow dispatch