chore: migrate repo to qualcomm/nexa-sdk and fix CI

- migrate repo URLs and go module path from qcom-ai-hub to qualcomm
- point geniex-qairt submodule to qualcomm/geniex-qairt-plugin (nested
  geniex-proc now resolves to qualcomm over HTTPS)
- split PATs: GH_PAT (submodule checkout) vs GHCR_PAT (qcom-ai-hub
  toolchain images)
- map CI runner labels to GitHub-hosted runners; linux arm64 build/test
  on ubuntu-24.04-arm
- disable org/external publish jobs (docker/testpypi/maven-central)

Author: RemiliaForever

.github/workflows/_build-cli.yml

@@ -30,9 +30,9 @@ jobs:
       matrix:
         include:
           - platform: windows-arm64
-            runner: windows-arm64
+            runner: windows-11-arm
           - platform: linux-arm64
-            runner: linux-arm64
+            runner: ubuntu-24.04-arm
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
 

.github/workflows/_build-docker.yml

@@ -21,7 +21,7 @@ on:
         description: "Fully-qualified image reference without tag (release-only)."
         required: false
         type: string
-        default: ghcr.io/qcom-ai-hub/geniex-cli
+        default: ghcr.io/qualcomm/geniex-cli
       tag:
         description: "Image tag to publish, e.g. v1.2.3 (required when push=true)."
         required: false
@@ -117,29 +117,29 @@ jobs:
           file "${tarball}"
           tar -tf "${tarball}" | head -10
 
-      # Enterprise policy blocks GITHUB_TOKEN from creating org packages,
-      # so login with GH_PAT (user-scoped, SAML-authorized).
-      - name: Log in to GHCR (crane)
-        if: inputs.push
-        shell: bash
-        env:
-          GHCR_USER: ${{ github.actor }}
-          GHCR_TOKEN: ${{ secrets.GH_PAT }}
-        run: |
-          set -euo pipefail
-          echo "${GHCR_TOKEN}" | crane auth login ghcr.io -u "${GHCR_USER}" --password-stdin
-
-      - name: Push image to GHCR
-        if: inputs.push
-        shell: bash
-        env:
-          IMAGE: ${{ inputs.image }}
-          IMAGE_REF: ${{ env.IMAGE_REF }}
-          IS_PRERELEASE: ${{ inputs.is_prerelease }}
-        run: |
-          set -euo pipefail
-          crane push bazel-bin/cli/release/linux/geniex-cli-docker.tar "${IMAGE_REF}"
-          # Prereleases must not clobber the floating :latest tag.
-          if [[ "${IS_PRERELEASE}" != "true" ]]; then
-            crane tag "${IMAGE_REF}" latest
-          fi
+      # # Enterprise policy blocks GITHUB_TOKEN from creating org packages,
+      # # so login with GH_PAT (user-scoped, SAML-authorized).
+      # - name: Log in to GHCR (crane)
+      #   if: inputs.push
+      #   shell: bash
+      #   env:
+      #     GHCR_USER: ${{ github.actor }}
+      #     GHCR_TOKEN: ${{ secrets.GH_PAT }}
+      #   run: |
+      #     set -euo pipefail
+      #     echo "${GHCR_TOKEN}" | crane auth login ghcr.io -u "${GHCR_USER}" --password-stdin
+      #
+      # - name: Push image to GHCR
+      #   if: inputs.push
+      #   shell: bash
+      #   env:
+      #     IMAGE: ${{ inputs.image }}
+      #     IMAGE_REF: ${{ env.IMAGE_REF }}
+      #     IS_PRERELEASE: ${{ inputs.is_prerelease }}
+      #   run: |
+      #     set -euo pipefail
+      #     crane push bazel-bin/cli/release/linux/geniex-cli-docker.tar "${IMAGE_REF}"
+      #     # Prereleases must not clobber the floating :latest tag.
+      #     if [[ "${IS_PRERELEASE}" != "true" ]]; then
+      #       crane tag "${IMAGE_REF}" latest
+      #     fi

.github/workflows/_build-sdk.yml

@@ -35,7 +35,7 @@ jobs:
       matrix:
         include:
           - platform: windows-arm64
-            runner: windows-arm64
+            runner: windows-11-arm
             preset: arm64-windows-snapdragon-release
           - platform: linux-arm64
             runner: ubuntu-latest
@@ -59,6 +59,13 @@ jobs:
           git config --global core.fscache true
           git config --global core.preloadindex true
 
+      # The geniex-qairt-plugin submodule pins a nested submodule (geniex-proc)
+      # by SSH URL (git@github.com:...). CI authenticates over HTTPS with a PAT,
+      # so rewrite SSH → HTTPS globally before checkout recurses into it.
+      - name: Rewrite SSH submodule URLs to HTTPS
+        shell: bash
+        run: git config --global url."https://github.com/".insteadOf "git@github.com:"
+
       - name: Checkout source
         uses: actions/checkout@v6
         with:
@@ -186,16 +193,17 @@ jobs:
           Add-Content -Path $env:GITHUB_ENV -Value "HEXAGON_HTP_CERT=$dst"
           Write-Host "HEXAGON_HTP_CERT=$dst"
 
-      # Derived toolchain images live in a private GHCR package. GH_PAT
-      # is used because enterprise policy blocks GITHUB_TOKEN from org
-      # package pulls (same pattern as _build-docker.yml).
+      # Derived toolchain images live in a private GHCR package under the
+      # qcom-ai-hub org; GHCR_PAT (qcom account) has pull access there.
+      # A PAT is required because enterprise policy blocks GITHUB_TOKEN
+      # from org package pulls (same pattern as _build-docker.yml).
       - name: Log in to GHCR
         if: matrix.platform == 'linux-arm64' || matrix.platform == 'android-arm64'
         uses: docker/login-action@v4
         with:
           registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GH_PAT }}
+          username: hongzhic_QCOM
+          password: ${{ secrets.GHCR_PAT }}
 
       - name: Build SDK (cross-compile in toolchain container)
         if: matrix.platform != 'windows-arm64'

.github/workflows/_build-toolchain-docker.yml

@@ -12,8 +12,8 @@ name: Build Toolchain Docker
 #     tag equals the git tag minus the `toolchain-` prefix.
 #
 # Image names:
-#   ghcr.io/qcom-ai-hub/geniex-toolchain-linux:<version>
-#   ghcr.io/qcom-ai-hub/geniex-toolchain-android:<version>
+#   ghcr.io/qualcomm/geniex-toolchain-linux:<version>
+#   ghcr.io/qualcomm/geniex-toolchain-android:<version>
 #
 # We intentionally do NOT publish a :latest tag - _build-sdk.yml pins an
 # exact semantic version so upstream changes cannot silently affect SDK
@@ -54,10 +54,10 @@ jobs:
         include:
           - platform: linux
             dockerfile: .github/docker/toolchain-linux.Dockerfile
-            image: ghcr.io/qcom-ai-hub/geniex-toolchain-linux
+            image: ghcr.io/qualcomm/geniex-toolchain-linux
           - platform: android
             dockerfile: .github/docker/toolchain-android.Dockerfile
-            image: ghcr.io/qcom-ai-hub/geniex-toolchain-android
+            image: ghcr.io/qualcomm/geniex-toolchain-android
 
     steps:
       - name: Checkout source

.github/workflows/_test.yml

@@ -45,7 +45,11 @@ jobs:
       fail-fast: false
       matrix:
         platform: ${{ fromJSON(inputs.platforms) }}
-    runs-on: ${{ matrix.platform }}
+    # platform is the canonical id (matches sdk-<platform> artifacts and the
+    # windows-arm64 step conditions below); map it to a real runner label.
+    # linux tests run the arm64 SDK binary, so they need an arm64 host
+    # (ubuntu-24.04-arm), not the x86 ubuntu-latest.
+    runs-on: ${{ matrix.platform == 'windows-arm64' && 'windows-11-arm' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 45
     env:
       # Surface SDK-side trace logs to stderr in every cell so a failed

.github/workflows/docs.yml

@@ -51,7 +51,7 @@ jobs:
     timeout-minutes: 5
     environment:
       name: github-pages
-      url: https://qcom-ai-hub.github.io/geniex/
+      url: https://qualcomm.github.io/nexa-sdk/
     steps:
       - id: deployment
         uses: actions/deploy-pages@v4