build: bump LLVM to 21

.claude/hooks/check-dockerfile-heredoc-strict.sh

@@ -3,6 +3,7 @@
 # Source: CLAUDE.md - "Dockerfile RUN heredocs use set -euo pipefail"
 set -euo pipefail
 
+CLAUDE_FILE_PATH=$(jq -r '.tool_input.file_path // empty')
 [[ -z "$CLAUDE_FILE_PATH" ]] && exit 0
 
 case "$(basename "$CLAUDE_FILE_PATH")" in

.claude/hooks/check-lint-registration.sh

@@ -3,6 +3,7 @@
 # Also flags stale entries (files listed in lint.sh that no longer exist).
 set -euo pipefail
 
+CLAUDE_FILE_PATH=$(jq -r '.tool_input.file_path // empty')
 [[ -z "$CLAUDE_FILE_PATH" ]] && exit 0
 
 cd "$(git rev-parse --show-toplevel)" || exit 1

.claude/hooks/check-shell-strict-mode.sh

@@ -1,7 +1,9 @@
 #!/bin/bash
 # PostToolUse hook: Ensure shell scripts contain 'set -euo pipefail'.
 # Exception: lint.sh uses 'set -uo pipefail' (omits -e for non-fail-fast design).
+set -euo pipefail
 
+CLAUDE_FILE_PATH=$(jq -r '.tool_input.file_path // empty')
 [[ -z "$CLAUDE_FILE_PATH" ]] && exit 0
 
 case "$(basename "$CLAUDE_FILE_PATH")" in

.claude/hooks/check-trailing-whitespace.sh

@@ -3,6 +3,7 @@
 # Markdown exception: trailing two spaces after text (line break) is allowed.
 set -euo pipefail
 
+CLAUDE_FILE_PATH=$(jq -r '.tool_input.file_path // empty')
 [[ -z "$CLAUDE_FILE_PATH" ]] && exit 0
 
 # Skip binary files

.claude/hooks/check-unicode-lookalikes.sh

@@ -4,6 +4,7 @@
 # Intentional Unicode (e.g., box-drawing chars in terminal output) is NOT matched.
 set -euo pipefail
 
+CLAUDE_FILE_PATH=$(jq -r '.tool_input.file_path // empty')
 [[ -z "$CLAUDE_FILE_PATH" ]] && exit 0
 
 case "$(basename "$CLAUDE_FILE_PATH")" in

.claude/hooks/check-workflow-expressions.sh

@@ -4,7 +4,9 @@
 #
 # Checks for ${{ github.* }} on lines inside run: blocks. These should be
 # replaced with shell env vars (e.g., $GITHUB_REF) set via the step's env: key.
+set -euo pipefail
 
+CLAUDE_FILE_PATH=$(jq -r '.tool_input.file_path // empty')
 [[ -z "$CLAUDE_FILE_PATH" ]] && exit 0
 
 case "$(basename "$CLAUDE_FILE_PATH")" in
@@ -15,13 +17,13 @@ esac
 # Use awk to find ${{ github.* }} only inside run: blocks.
 # Track indentation to detect when a run: block ends.
 violations=$(awk '
-  /^[[:space:]]+run:[[:space:]]*[|>]/ {
+  /^[[:space:]]+(-[[:space:]]+)?run:[[:space:]]*[|>]/ {
     in_run = 1
     match($0, /^[[:space:]]*/)
     run_indent = RLENGTH
     next
   }
-  /^[[:space:]]+run:[[:space:]]*[^|>]/ {
+  /^[[:space:]]+(-[[:space:]]+)?run:[[:space:]]*[^|>]/ {
     # Single-line run: value
     if ($0 ~ /\$\{\{[[:space:]]*github\./) print NR": "$0
     next

.claude/hooks/lint-changed-file.sh

@@ -3,6 +3,7 @@
 # Delegates to lint.sh --file for consistent linter args.
 set -euo pipefail
 
+CLAUDE_FILE_PATH=$(jq -r '.tool_input.file_path // empty')
 [[ -z "$CLAUDE_FILE_PATH" ]] && exit 0
 
 cd "$(git rev-parse --show-toplevel)" || exit 1

.github/workflows/CI.yml

@@ -7,7 +7,7 @@ permissions:
 
 env:
   DOCKER_BUILDKIT: 1
-  LLVM_VER: "20"
+  LLVM_VER: "21"
   # Uncomment to cap ninja parallelism (reduces peak memory for cold LLVM builds)
   # NINJA_MAX_JOBS: "2"
 

Dockerfile

@@ -26,7 +26,7 @@ set -euo pipefail
 EOC
 
 ARG PHASED_BUILD=true
-ARG LLVM_VER=20
+ARG LLVM_VER=21
 # Clone LLVM repo. A shallow clone is faster, but pulling a cached repository is faster yet
 # cd inside heredoc script; WORKDIR can't replace it
 # RUN --mount=type=cache,target=/git <<EO
@@ -108,7 +108,11 @@ set -euo pipefail
 
   # Configure the build
   # LLVM >= 20: openmp moved from PROJECTS to RUNTIMES (hard error in LLVM 21)
-  if [ "${LLVM_VER}" -ge 20 ]; then
+  # LLVM >= 21: flang/runtime split into flang-rt subproject; build via RUNTIMES
+  if [ "${LLVM_VER}" -ge 21 ]; then
+    LLVM_PROJECTS="flang;clang;clang-tools-extra;mlir"
+    LLVM_RUNTIMES="compiler-rt;openmp;flang-rt"
+  elif [ "${LLVM_VER}" -ge 20 ]; then
     LLVM_PROJECTS="flang;clang;clang-tools-extra;mlir"
     LLVM_RUNTIMES="compiler-rt;openmp"
   else
@@ -147,9 +151,16 @@ set -euo pipefail
     tools/flang/install
     install-flang-libraries install-flang-headers "$FLANG_BIN_TARGET" install-flang-cmake-exports
     install-flangFrontend install-flangFrontendTool
-    install-FortranCommon install-FortranDecimal install-FortranEvaluate install-FortranLower
-    install-FortranParser install-FortranRuntime install-FortranSemantics
+    install-FortranDecimal install-FortranEvaluate install-FortranLower
+    install-FortranParser install-FortranSemantics
   )
+  # LLVM >= 21 renamed FortranCommon -> FortranSupport, and FortranRuntime moved
+  # to the flang-rt subproject (built via install-runtimes).
+  if [ "${LLVM_VER}" -ge 21 ]; then
+    FLANG_TARGETS+=(install-FortranSupport)
+  else
+    FLANG_TARGETS+=(install-FortranCommon install-FortranRuntime)
+  fi
 
   # Use install-runtimes (aggregate target) because individual runtime install
   # targets (e.g. install-omp) aren't forwarded from the ExternalProject sub-build.
@@ -210,7 +221,7 @@ RUN <<EOC
 #!/usr/bin/env bash
 set -euo pipefail
   if [ "${LLVM_VER}" -ge 20 ]; then
-    # LLVM >= 20: flang binary is versioned (flang-20) with a 'flang' symlink;
+    # LLVM >= 20: flang binary is versioned (flang-${LLVM_VER}) with a 'flang' symlink;
     # use -L to follow symlinks so find matches both the real file and the symlink
     FLANG="$(find -L /tmp/llvm -name flang -type f)"
     if [ -z "$FLANG" ]; then
@@ -301,7 +312,7 @@ ENV OMPI_ALLOW_RUN_AS_ROOT_CONFIRM=1
 # http://tau.uoregon.edu/tau.tgz
 # http://fs.paratools.com/tau-mirror/tau.tgz
 # http://fs.paratools.com/tau-nightly.tgz
-ARG LLVM_VER=20
+ARG LLVM_VER=21
 # hadolint ignore=DL3003
 RUN --mount=type=cache,id=ccache-tau,target=/home/salt/ccache <<EOC
 #!/usr/bin/env bash