build-depends.yml

name: Build depends

on:
  workflow_call:
    inputs:
      build-target:
        description: "Target name as defined by matrix.sh"
        required: true
        type: string
      container-path:
        description: "Path to built container at registry"
        required: true
        type: string
      base-image-digest:
        description: "Short hash of the CI base image manifest for cache busting"
        required: true
        type: string
      runs-on:
        description: "Runner label to use (e.g., ubuntu-24.04 or ubuntu-24.04-arm)"
        required: true
        type: string
    outputs:
      key:
        description: "Key needed for restoring depends cache"
        value: ${{ jobs.check-cache.outputs.cache-key }}
      host:
        description: "Host triplet for this build target"
        value: ${{ jobs.check-cache.outputs.host }}
      dep-opts:
        description: "DEP_OPTS used to build depends"
        value: ${{ jobs.check-cache.outputs.dep-opts }}
      built-artifact:
        description: "Artifact holding freshly built depends (empty when restored from cache)"
        value: ${{ jobs.build.outputs.built-artifact }}
      sdk-artifact:
        description: "Artifact holding prepared SDKs (empty when restored from cache)"
        value: ${{ jobs.check-cache.outputs.sdk-artifact }}

jobs:
  check-cache:
    name: Check cache
    runs-on: ${{ inputs.runs-on }}
    outputs:
      cache-hit: ${{ steps.cache-check.outputs.cache-hit }}
      cache-key: ${{ steps.setup.outputs.cache-key }}
      cache-key-prefix: ${{ steps.setup.outputs.cache-key-prefix }}
      host: ${{ steps.setup.outputs.HOST }}
      dep-opts: ${{ steps.setup.outputs.DEP_OPTS }}
      sdk-artifact: ${{ steps.prepare-sdks.outputs.artifact }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          allow-unsafe-pr-checkout: true
          persist-credentials: false
          sparse-checkout: |
            ci/dash
            ci/test
            depends
            contrib/containers/ci/ci.Dockerfile
            contrib/containers/ci/ci-slim.Dockerfile
            contrib/containers/guix/scripts/setup-sdk

      - name: Compute cache key
        id: setup
        run: |
          BUILD_TARGET="${{ inputs.build-target }}"
          source ./ci/dash/matrix.sh
          echo "DEP_OPTS=${DEP_OPTS}" >> "${GITHUB_OUTPUT}"
          echo "HOST=${HOST}" >> "${GITHUB_OUTPUT}"
          echo "RUNNER_ARCH=$(uname -m)" >> "${GITHUB_OUTPUT}"
          DEP_HASH="$(echo -n "${BUILD_TARGET}" "${DEP_OPTS}" "${HOST}" | sha256sum | head -c 64)"
          echo "DEP_HASH=${DEP_HASH}" >> "${GITHUB_OUTPUT}"
          DOCKERFILE_HASH="${{ hashFiles('contrib/containers/ci/ci.Dockerfile', 'contrib/containers/ci/ci-slim.Dockerfile') }}"
          DEPENDS_INPUTS_HASH="${{ hashFiles('depends/Makefile', 'depends/funcs.mk', 'depends/gen_id', 'depends/config.guess', 'depends/config.sub', 'depends/config.site.in', 'depends/builders/**', 'depends/hosts/**', 'depends/packages/**', 'depends/patches/**') }}"
          CACHE_KEY_PREFIX="depends-${DOCKERFILE_HASH}-${{ inputs.base-image-digest }}-${{ inputs.runs-on }}-${{ inputs.build-target }}"
          CACHE_KEY="${CACHE_KEY_PREFIX}-${DEP_HASH}-${DEPENDS_INPUTS_HASH}"
          echo "cache-key-prefix=${CACHE_KEY_PREFIX}" >> "${GITHUB_OUTPUT}"
          echo "cache-key=${CACHE_KEY}" >> "${GITHUB_OUTPUT}"
          echo "Cache key: ${CACHE_KEY}"
        shell: bash

      - name: Check for cached depends
        id: cache-check
        uses: actions/cache@v5
        with:
          path: depends/built/${{ steps.setup.outputs.HOST }}
          key: ${{ steps.setup.outputs.cache-key }}
          lookup-only: true

      - name: Cache SDKs
        id: cache-sdk-check
        uses: actions/cache@v5
        if: inputs.build-target == 'mac'
        with:
          path: depends/SDKs
          key: depends-sdks-${{ hashFiles('depends/hosts/darwin.mk') }}
          restore-keys: depends-sdks-

      - name: Prepare SDKs
        id: prepare-sdks
        if: inputs.build-target == 'mac' && steps.cache-sdk-check.outputs.cache-hit != 'true'
        env:
          BUILD_TARGET: ${{ inputs.build-target }}
        run: |
          ./contrib/containers/guix/scripts/setup-sdk
          echo "artifact=depends-sdks-${BUILD_TARGET}" >> "${GITHUB_OUTPUT}"

      - name: Upload prepared SDKs
        # This originates in check-cache so both Build depends (when needed)
        # and Build source can use it even when a PR cannot save the cache.
        if: steps.prepare-sdks.outputs.artifact != ''
        uses: actions/upload-artifact@v6
        with:
          name: ${{ steps.prepare-sdks.outputs.artifact }}
          path: depends/SDKs
          compression-level: 0
          retention-days: 1
          overwrite: true

  build:
    name: Build depends
    needs: [check-cache]
    if: needs.check-cache.outputs.cache-hit != 'true'
    runs-on: ${{ inputs.runs-on }}
    outputs:
      built-artifact: depends-built-${{ inputs.build-target }}
    container:
      image: ${{ inputs.container-path }}
      options: --user root
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          allow-unsafe-pr-checkout: true
          persist-credentials: false

      - name: Restore depends sources
        uses: actions/cache/restore@v5
        with:
          path: depends/sources
          key: depends-sources-${{ hashFiles('depends/packages/*') }}
          restore-keys: depends-sources-

      - name: Restore SDKs cache
        id: sdk-cache
        uses: actions/cache/restore@v5
        if: inputs.build-target == 'mac'
        with:
          path: depends/SDKs
          key: depends-sdks-${{ hashFiles('depends/hosts/darwin.mk') }}
          restore-keys: depends-sdks-

      - name: Download prepared SDKs
        if: inputs.build-target == 'mac' && steps.sdk-cache.outputs.cache-hit != 'true' && needs.check-cache.outputs.sdk-artifact != ''
        uses: actions/download-artifact@v8
        with:
          name: ${{ needs.check-cache.outputs.sdk-artifact }}
          path: depends/SDKs

      - name: Check prepared SDKs are present
        if: inputs.build-target == 'mac' && steps.sdk-cache.outputs.cache-hit != 'true' && needs.check-cache.outputs.sdk-artifact == ''
        run: |
          echo "::error::SDK cache restore missed and no prepared SDK artifact was provided"
          exit 1
        shell: bash

      - name: Restore cached depends
        uses: actions/cache/restore@v5
        with:
          path: depends/built/${{ needs.check-cache.outputs.host }}
          key: ${{ needs.check-cache.outputs.cache-key }}
          restore-keys: |
            ${{ needs.check-cache.outputs.cache-key-prefix }}-

      - name: Build depends
        run: |
          export HOST="${{ needs.check-cache.outputs.host }}"
          env ${{ needs.check-cache.outputs.dep-opts }} make -j$(nproc) -C depends

      - name: Save depends cache
        # Cache tokens on untrusted triggers are read-only (GitHub change,
        # June 2026), so only trusted events can save the persistent cache
        # for later read-only restores.
        if: github.event_name != 'pull_request_target'
        uses: actions/cache/save@v5
        with:
          path: depends/built/${{ needs.check-cache.outputs.host }}
          key: ${{ needs.check-cache.outputs.cache-key }}

      - name: Upload built depends
        # Same-run handoff to build-src.yml for runs that cannot save the
        # cache. Uploaded on every fresh build (cache/save only warns when
        # the write is denied), so src jobs never depend on a save landing.
        uses: actions/upload-artifact@v6
        with:
          name: depends-built-${{ inputs.build-target }}
          path: depends/built/${{ needs.check-cache.outputs.host }}
          compression-level: 0
          retention-days: 1
          overwrite: true