_build-sdk.yml

name: Build SDK

on:
  workflow_call:
    inputs:
      version_tag:
        description: "Explicit version tag (e.g. v1.2.3-rc.1). Passed to the version action."
        required: false
        type: string
        default: ""
      upload_artifact:
        description: "Whether to upload SDK artifact"
        required: false
        type: boolean
        default: false
      extra_cmake_flags:
        description: "Additional CMake flags"
        required: false
        type: string
        default: ""

permissions:
  contents: read
  packages: read

# Derived toolchain images (matrix.container_image) are built by
# _build-toolchain-docker.yml; bumping the pinned tag there is the
# single upgrade point for Rust toolchain / apt layers.

jobs:
  build:
    name: ${{ matrix.platform }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: windows-arm64
            runner: windows-11-arm
            preset: arm64-windows-snapdragon-release
          - platform: linux-arm64
            runner: ubuntu-latest
            preset: arm64-linux-snapdragon-release
            container_image: docker.io/qualcomm/geniex-toolchain-linux:v0.1.0
          - platform: android-arm64
            runner: ubuntu-latest
            preset: arm64-android-snapdragon-release
            container_image: docker.io/qualcomm/geniex-toolchain-android:v0.1.0
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 120

    steps:
      - name: Configure Windows Git
        if: matrix.platform == 'windows-arm64'
        shell: cmd
        run: |
          echo C:\Program Files\Git\bin>>%GITHUB_PATH%
          git config --global core.longpaths true
          git config --global core.protectNTFS false
          git config --global core.fscache true
          git config --global core.preloadindex true

      # The geniex-qairt-plugin submodule pins a nested submodule (geniex-proc)
      # by SSH URL (git@github.com:...). CI authenticates over HTTPS with a PAT,
      # so rewrite SSH → HTTPS globally before checkout recurses into it.
      - name: Rewrite SSH submodule URLs to HTTPS
        shell: bash
        run: git config --global url."https://github.com/".insteadOf "git@github.com:"

      - name: Checkout source
        uses: actions/checkout@v7
        with:
          fetch-depth: 1
          submodules: recursive

      - name: Detect build version
        id: version
        uses: ./.github/actions/version
        with:
          version_tag: ${{ inputs.version_tag }}

      - name: Restore ccache
        uses: actions/cache@v6
        with:
          path: ${{ github.workspace }}/.ccache
          key: ccache-sdk-${{ matrix.platform }}-${{ github.sha }}
          restore-keys: ccache-sdk-${{ matrix.platform }}-

      # Cargo target dir lives under the workspace so it's reachable both
      # from the Windows runner and from the Linux/Android container
      # (mounted at /workspace). The key includes the Rust sources, not just
      # Cargo.lock/Cargo.toml: actions/cache restores files with a uniform
      # mtime, so cargo's mtime-based fingerprinting would otherwise reuse a
      # stale libgeniex_model.a after a source-only change (e.g. a new FFI
      # symbol), producing downstream undefined-reference link failures.
      # No restore-keys — a source change forces a clean rebuild instead of a
      # fuzzy restore that would re-trigger the staleness.
      - name: Restore cargo target
        uses: actions/cache@v6
        with:
          path: |
            sdk/model-manager/target
            ~/.cargo/registry/index
            ~/.cargo/registry/cache
            ~/.cargo/git/db
          key: cargo-sdk-${{ matrix.platform }}-${{ hashFiles('sdk/model-manager/Cargo.lock', 'sdk/model-manager/**/Cargo.toml', 'sdk/model-manager/crates/**/*.rs') }}

      # Toolchain identifier baked into the cmake-build cache key so a
      # runner-image / container-image bump (MSVC patch, clang/apt layer)
      # mints a fresh entry instead of reusing PCH/objects compiled
      # against the old toolchain.
      - name: Compute toolchain tag for cache key
        id: tc
        shell: bash
        env:
          CONTAINER_IMAGE: ${{ matrix.container_image }}
        run: |
          set -eu
          case "${{ matrix.platform }}" in
            windows-arm64) tag="winarm64-img-${ImageVersion:-unknown}" ;;
            *)             tag="container-${CONTAINER_IMAGE##*:}" ;;
          esac
          echo "tag=$tag" >>"$GITHUB_OUTPUT"
          echo "Toolchain tag for cache: $tag"

      # Cache the CMake build tree so ninja deps, ExternalProject stamps,
      # and link products survive across runs. hashFiles covers the
      # configure-time inputs; a change there mints a new entry, while
      # restore-keys lets unchanged-config runs reuse the previous tree.
      - name: Restore CMake build dir
        uses: actions/cache@v6
        with:
          path: sdk/build-${{ matrix.preset }}
          key: cmake-build-${{ matrix.platform }}-${{ steps.tc.outputs.tag }}-${{ hashFiles('sdk/CMakeLists.txt', 'sdk/**/CMakeLists.txt', 'sdk/CMakePresets.json', 'sdk/cmake/**', 'sdk/patches/**', '.gitmodules', 'third-party/**/CMakeLists.txt', 'third-party/**/*.cmake', 'third-party/**/cmake/**') }}-${{ github.sha }}
          restore-keys: cmake-build-${{ matrix.platform }}-${{ steps.tc.outputs.tag }}-${{ hashFiles('sdk/CMakeLists.txt', 'sdk/**/CMakeLists.txt', 'sdk/CMakePresets.json', 'sdk/cmake/**', 'sdk/patches/**', '.gitmodules', 'third-party/**/CMakeLists.txt', 'third-party/**/*.cmake', 'third-party/**/cmake/**') }}-

      # Restored cmake-build-* dirs carry FetchContent populate stamps
      # that point at source paths actions/checkout (clean: true) just
      # wiped from submodules — most notably sentencepiece's in-tree
      # third_party/abseil-cpp clone. Drop those stamps so cmake
      # re-populates instead of verifying a now-missing .git.
      - name: Purge stale FetchContent populate stamps
        shell: bash
        run: |
          set -eu
          dir="sdk/build-${{ matrix.preset }}"
          if [ -d "$dir" ]; then
            find "$dir" -type d -name "*-subbuild" -prune -print -exec rm -rf {} +
          fi

      # Linux/Android ccache lives in the toolchain container; host just
      # owns the dir so actions/cache can persist it.
      - name: Prepare ccache dir (Linux/Android)
        if: matrix.platform == 'linux-arm64' || matrix.platform == 'android-arm64'
        shell: bash
        run: mkdir -p "${{ github.workspace }}/.ccache"

      - name: Install and configure ccache (Windows)
        if: matrix.platform == 'windows-arm64'
        shell: powershell
        run: |
          if (-not (Get-Command ccache -ErrorAction SilentlyContinue)) {
            choco install ccache --no-progress -y
          }
          # $GITHUB_ENV only applies to later steps — set in-process too
          # so `ccache --max-size` below edits the workspace config.
          $env:CCACHE_DIR = "${{ github.workspace }}/.ccache"
          Add-Content $env:GITHUB_ENV "CCACHE_DIR=$env:CCACHE_DIR"
          # SLOPPINESS tolerates __DATE__/__TIME__ and mtime jitter that
          # llama.cpp / ggml sources trip over. CCACHE_BASEDIR is *not*
          # set: workspace paths on the self-hosted Windows runner are
          # stable, and changing it would invalidate every existing
          # entry (different hash input).
          Add-Content $env:GITHUB_ENV "CCACHE_SLOPPINESS=time_macros,include_file_mtime,include_file_ctime"
          ccache --max-size=5G

      - name: Setup Snapdragon SDKs
        if: matrix.platform == 'windows-arm64'
        uses: ./.github/actions/setup-snapdragon-sdks

      - name: Configure HTP signing cert
        if: matrix.platform == 'windows-arm64'
        shell: powershell
        env:
          HEXAGON_HTP_CERT_PFX: ${{ secrets.HEXAGON_HTP_CERT_PFX }}
        run: |
          $ErrorActionPreference = "Stop"
          if (-not $env:HEXAGON_HTP_CERT_PFX) {
            Write-Warning "HEXAGON_HTP_CERT_PFX secret is unavailable (expected on fork PRs); building unsigned HTP skels."
            exit 0
          }
          $dst = "$env:RUNNER_TEMP\ggml-htp-v1.pfx"
          [IO.File]::WriteAllBytes($dst, [Convert]::FromBase64String($env:HEXAGON_HTP_CERT_PFX))
          Add-Content -Path $env:GITHUB_ENV -Value "HEXAGON_HTP_CERT=$dst"
          Write-Host "HEXAGON_HTP_CERT=$dst"

      - name: Build SDK (cross-compile in toolchain container)
        if: matrix.platform != 'windows-arm64'
        shell: bash
        env:
          GENIEX_VERSION: ${{ steps.version.outputs.version }}
          EXTRA_CMAKE_FLAGS: ${{ inputs.extra_cmake_flags }}
          PRESET: ${{ matrix.preset }}
          CONTAINER_IMAGE: ${{ matrix.container_image }}
        run: |
          set -euo pipefail
          # Runs as root because the image's rust/apt layers were built
          # as root; chown back to the runner UID so upload-artifact /
          # cache can read the tree.
          uid="$(id -u)"
          gid="$(id -g)"
          docker run --rm \
            -v "${{ github.workspace }}:/workspace" \
            -w /workspace \
            -e GENIEX_VERSION \
            -e EXTRA_CMAKE_FLAGS \
            -e PRESET \
            -e CCACHE_DIR=/workspace/.ccache \
            -e CCACHE_SLOPPINESS=time_macros,include_file_mtime,include_file_ctime \
            -e HOST_UID="$uid" \
            -e HOST_GID="$gid" \
            --platform linux/amd64 \
            "$CONTAINER_IMAGE" \
            bash -eux -c '
              git config --global --add safe.directory "*"
              cmake -S sdk --preset "$PRESET" \
                -DGENIEX_VERSION="$GENIEX_VERSION" \
                -DCMAKE_C_COMPILER_LAUNCHER=ccache \
                -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
                $EXTRA_CMAKE_FLAGS
              cmake --build "sdk/build-$PRESET" -j "$(nproc)"
              cmake --install "sdk/build-$PRESET" --prefix sdk/pkg-geniex
              ccache -s -v || true
              chown -R "$HOST_UID:$HOST_GID" sdk .ccache || true
            '

      - name: Setup VS toolchain (Windows)
        if: matrix.platform == 'windows-arm64'
        uses: ./.github/actions/setup-vcvars

      - name: Build SDK (Windows)
        if: matrix.platform == 'windows-arm64'
        shell: powershell
        env:
          GENIEX_VERSION: ${{ steps.version.outputs.version }}
          PRESET: ${{ matrix.preset }}
        run: |
          $ErrorActionPreference = "Stop"
          $BuildDir = "sdk/build-$env:PRESET"

          # Source vcvars into this process so cmake's child processes
          # (clang, ninja, inf2cat.exe) inherit PATH/INCLUDE/LIB for the
          # Windows SDK — same semantics as `call vcvars && cmake`.
          $envDump = cmd /c "`"$env:VCVARS_BAT`" $env:VCVARS_ARGS && set"
          foreach ($line in $envDump) {
            if ($line -match "^(.+?)=(.*)$") {
              [Environment]::SetEnvironmentVariable($matches[1], $matches[2], "Process")
            }
          }
          $env:PATH = "$env:LLVM_BIN;$env:PATH"

          # Pass the cert path explicitly: GGML_HEXAGON_HTP_CERT is a cached
          # PATH, so a restored build dir keeps a prior run's value and an
          # empty env alone won't clear it — on a fork PR (no secret) that
          # leaves signing on and signtool fails on the missing .pfx.
          cmake -S sdk --preset $env:PRESET -B $BuildDir --log-level=VERBOSE `
            "-DGENIEX_VERSION=$env:GENIEX_VERSION" `
            "-DGGML_HEXAGON_HTP_CERT=$env:HEXAGON_HTP_CERT" `
            -DCMAKE_C_COMPILER_LAUNCHER=ccache `
            -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
          if ($LASTEXITCODE -ne 0) { throw "cmake configure failed: $LASTEXITCODE" }

          cmake --build $BuildDir -j $([Environment]::ProcessorCount)
          if ($LASTEXITCODE -ne 0) { throw "cmake --build failed: $LASTEXITCODE" }

          cmake --install $BuildDir --prefix sdk/pkg-geniex
          if ($LASTEXITCODE -ne 0) { throw "cmake install failed: $LASTEXITCODE" }

      # On Linux/Android ccache runs inside the container; only the on-disk
      # size is visible from the host. Never fail the job on a stats read.
      - name: ccache stats (Linux/Android)
        if: matrix.platform == 'linux-arm64' || matrix.platform == 'android-arm64'
        shell: bash
        run: du -sh "${{ github.workspace }}/.ccache" 2>/dev/null || true

      - name: ccache stats (Windows)
        if: matrix.platform == 'windows-arm64'
        shell: powershell
        run: ccache --show-stats --verbose; $true

      - name: Upload SDK artifact
        if: inputs.upload_artifact
        uses: actions/upload-artifact@v7
        with:
          name: sdk-${{ matrix.platform }}
          path: sdk/pkg-geniex/
          retention-days: 1