build-depends.yml

name: Build depends

on:
  workflow_call:
    inputs:
      build-target:
        description: "Target name as defined by matrix.sh"
        required: true
        type: string
      container-path:
        description: "Path to built container at registry"
        required: true
        type: string
      base-image-digest:
        description: "Short hash of the CI base image manifest for cache busting"
        required: true
        type: string
      runs-on:
        description: "Runner label to use (e.g., ubuntu-24.04 or ubuntu-24.04-arm)"
        required: true
        type: string
      runs-on-check:
        description: "Runner label for the check-cache job; any arch, see runs-on-arch"
        required: true
        type: string
      runs-on-arch:
        description: "Machine arch (uname -m) of the runs-on runner, so check-cache (which may run on another arch) computes the same HOST the build runner would"
        required: false
        default: x86_64
        type: string
      runs-on-build:
        description: "Runner label for the build job if not runs-on; runs-on still names the cache key, so either one saves the entry every consumer of this target restores"
        required: false
        default: ""
        type: string
    outputs:
      key:
        description: "Key needed for restoring depends cache"
        value: ${{ jobs.check-cache.outputs.cache-key }}
      host:
        description: "Host triplet for this build target"
        value: ${{ jobs.check-cache.outputs.host }}
      dep-opts:
        description: "DEP_OPTS used to build depends"
        value: ${{ jobs.check-cache.outputs.dep-opts }}
      built-artifact:
        description: "Artifact holding freshly built depends (empty when restored from cache)"
        value: ${{ jobs.build.outputs.built-artifact }}

jobs:
  check-cache:
    name: Check cache
    runs-on: ${{ inputs.runs-on-check }}
    outputs:
      cache-hit: ${{ steps.cache-check.outputs.cache-hit }}
      cache-key: ${{ steps.setup.outputs.cache-key }}
      cache-key-prefix: ${{ steps.setup.outputs.cache-key-prefix }}
      host: ${{ steps.setup.outputs.HOST }}
      dep-opts: ${{ steps.setup.outputs.DEP_OPTS }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          allow-unsafe-pr-checkout: true
          persist-credentials: false
          sparse-checkout: |
            ci/dash
            ci/test
            depends
            contrib/containers/ci/ci.Dockerfile
            contrib/containers/ci/ci-slim.Dockerfile

      - name: Compute cache key
        id: setup
        env:
          BUILD_TARGET: ${{ inputs.build-target }}
          BASE_IMAGE_DIGEST: ${{ inputs.base-image-digest }}
          RUNS_ON: ${{ inputs.runs-on }}
          # This job may not run on the build runner's arch, so name that arch
          # for the targets whose HOST follows the machine (see ci/test).
          DEPENDS_ARCH: ${{ inputs.runs-on-arch }}
        run: |
          source ./ci/dash/matrix.sh
          echo "DEP_OPTS=${DEP_OPTS}" >> "${GITHUB_OUTPUT}"
          echo "HOST=${HOST}" >> "${GITHUB_OUTPUT}"
          echo "RUNNER_ARCH=$(uname -m)" >> "${GITHUB_OUTPUT}"
          DEP_HASH="$(echo -n "${BUILD_TARGET}" "${DEP_OPTS}" "${HOST}" | sha256sum | head -c 64)"
          echo "DEP_HASH=${DEP_HASH}" >> "${GITHUB_OUTPUT}"
          DOCKERFILE_HASH="${{ hashFiles('contrib/containers/ci/ci.Dockerfile', 'contrib/containers/ci/ci-slim.Dockerfile') }}"
          DEPENDS_INPUTS_HASH="${{ hashFiles('depends/Makefile', 'depends/funcs.mk', 'depends/gen_id', 'depends/config.guess', 'depends/config.sub', 'depends/config.site.in', 'depends/builders/**', 'depends/hosts/**', 'depends/packages/**', 'depends/patches/**') }}"
          CACHE_KEY_PREFIX="depends-${DOCKERFILE_HASH}-${BASE_IMAGE_DIGEST}-${RUNS_ON}-${BUILD_TARGET}"
          CACHE_KEY="${CACHE_KEY_PREFIX}-${DEP_HASH}-${DEPENDS_INPUTS_HASH}"
          echo "cache-key-prefix=${CACHE_KEY_PREFIX}" >> "${GITHUB_OUTPUT}"
          echo "cache-key=${CACHE_KEY}" >> "${GITHUB_OUTPUT}"
          echo "Cache key: ${CACHE_KEY}"
        shell: bash

      - name: Check for cached depends
        id: cache-check
        uses: actions/cache@v5
        with:
          path: depends/built/${{ steps.setup.outputs.HOST }}
          key: ${{ steps.setup.outputs.cache-key }}
          lookup-only: true

  build:
    name: Build depends
    needs: [check-cache]
    if: needs.check-cache.outputs.cache-hit != 'true'
    runs-on: ${{ inputs.runs-on-build || inputs.runs-on }}
    outputs:
      built-artifact: depends-built-${{ inputs.build-target }}
    container:
      image: ${{ inputs.container-path }} # zizmor: ignore[unpinned-images] built earlier in this run by build-container.yml
      options: --user root
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          allow-unsafe-pr-checkout: true
          persist-credentials: false

      - name: Check depends host matches this runner
        # check-cache computed HOST from runs-on-arch; fail loudly if the
        # runner that builds disagrees instead of caching for the wrong host.
        env:
          BUILD_TARGET: ${{ inputs.build-target }}
          EXPECTED_HOST: ${{ needs.check-cache.outputs.host }}
        run: |
          source ./ci/dash/matrix.sh
          if [ "${HOST}" != "${EXPECTED_HOST}" ]; then
            echo "::error::Build runner computes HOST=${HOST} but check-cache used ${EXPECTED_HOST}; fix runs-on-arch for ${BUILD_TARGET}"
            exit 1
          fi
        shell: bash

      - name: Restore depends sources
        uses: actions/cache/restore@v5
        with:
          path: depends/sources
          key: depends-sources-${{ hashFiles('depends/packages/*') }}
          restore-keys: depends-sources-

      - name: Restore cached depends
        uses: actions/cache/restore@v5
        with:
          path: depends/built/${{ needs.check-cache.outputs.host }}
          key: ${{ needs.check-cache.outputs.cache-key }}
          restore-keys: |
            ${{ needs.check-cache.outputs.cache-key-prefix }}-

      - name: Build depends
        env:
          HOST: ${{ needs.check-cache.outputs.host }}
          DEP_OPTS: ${{ needs.check-cache.outputs.dep-opts }}
        run: |
          # DEP_OPTS may contain shell-quoted values, e.g. CXX='clang++-19 -stdlib=libc++'
          eval "DEP_OPTS_ARGS=(${DEP_OPTS})"
          env "${DEP_OPTS_ARGS[@]}" make -j$(nproc) -C depends
        shell: bash

      - name: Save depends cache
        # Cache tokens on untrusted triggers are read-only (GitHub change,
        # June 2026), so only trusted events can save the persistent cache
        # for later read-only restores.
        if: github.event_name != 'pull_request_target'
        uses: actions/cache/save@v5
        with:
          path: depends/built/${{ needs.check-cache.outputs.host }}
          key: ${{ needs.check-cache.outputs.cache-key }}

      - name: Upload built depends
        # Same-run handoff to build-src.yml for runs that cannot save the
        # cache. Uploaded on every fresh build (cache/save only warns when
        # the write is denied), so src jobs never depend on a save landing.
        uses: actions/upload-artifact@v6
        with:
          name: depends-built-${{ inputs.build-target }}
          path: depends/built/${{ needs.check-cache.outputs.host }}
          compression-level: 0
          retention-days: 1
          overwrite: true