build(classic): switch supported toolchains to LLVM

.github/workflows/build-release-candidate.yml

@@ -50,8 +50,8 @@ permissions:
   packages: read
 
 env:
-  CLASSIC_LINUX_IMAGE: ghcr.io/atrinik/classic-build:1.16.0@sha256:e1c366dbf83ef987765ff913bbb193868314a139ae1e00cc134b22a3159464f2
-  WINDOWS_BUILD_CACHE_EPOCH: 1.16.0-4266256d4b4196241df6463e687dd286022e24e3bc46dfafb4f877744a731d69
+  CLASSIC_LINUX_IMAGE: ghcr.io/atrinik/classic-build:1.18.0@sha256:86d3c4182dc786db8ace56d9d8dc57ff4f14c1c4f517b728547626f576280449
+  WINDOWS_BUILD_CACHE_EPOCH: llvm-23.1.3-4af130578df18a1944880cd279c7f23afe9cc668-01065f081cdf843a6591abf25f2b27734103ab385c5aa003b2eeb9a3a1ca0e5a
 
 concurrency:
   group: >-
@@ -71,6 +71,10 @@ jobs:
       tag: ${{ steps.metadata.outputs.tag }}
       version: ${{ steps.metadata.outputs.version }}
       artifact_schema: ${{ steps.metadata.outputs.artifact_schema }}
+      compiler_image: ${{ steps.metadata.outputs.compiler_image }}
+      windows_image: ${{ steps.metadata.outputs.windows_image }}
+      windows_mode: ${{ steps.metadata.outputs.windows_mode }}
+      windows_cache_epoch: ${{ steps.metadata.outputs.windows_cache_epoch }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -108,8 +112,15 @@ jobs:
           artifact_schema=$(python3 build/release-automation/tools/release/release_artifacts.py \
             --print-source-schema --revision "${commit}" --source-root "${GITHUB_WORKSPACE}")
           [[ ${artifact_schema} == 1 || ${artifact_schema} == 2 || ${artifact_schema} == 3 ]]
+          compiler_image=$(python3 build/release-automation/tools/release/resolve_compiler_image.py \
+            --source-root "${GITHUB_WORKSPACE}" --revision "${commit}" \
+            --current-image "${CLASSIC_LINUX_IMAGE}")
+          python3 build/release-automation/tools/release/windows_producer.py \
+            --source-root "${GITHUB_WORKSPACE}" --revision "${commit}" \
+            --github-output "${GITHUB_OUTPUT}"
           {
             echo "artifact_schema=${artifact_schema}"
+            echo "compiler_image=${compiler_image}"
             echo "tag=${RELEASE_TAG}"
             echo "version=${RELEASE_VERSION}"
             echo "commit=${commit}"
@@ -176,6 +187,8 @@ jobs:
 
   sources:
     name: Build source packages and protocol wheel
+    env:
+      CLASSIC_LINUX_IMAGE: ${{ needs.metadata.outputs.compiler_image }}
     permissions:
       contents: read
     needs: metadata
@@ -266,11 +279,15 @@ jobs:
           name: discord-application-id-${{ inputs.tag }}
           path: build/discord-config
       - name: Prepare pinned Debian testing build and clean runtime
+        env:
+          RELEASE_REVISION: ${{ needs.metadata.outputs.commit }}
         run: |
+          debian_producer=$(python3 tools/ci/debian-client/historical_producer.py \
+            --source-root "${GITHUB_WORKSPACE}/candidate-source" --revision "${RELEASE_REVISION}")
           docker build --platform linux/amd64 --target build --tag classic-deb-build \
-            --file tools/ci/debian-client/Dockerfile tools/ci/debian-client
+            --file "${debian_producer}" tools/ci/debian-client
           docker build --platform linux/amd64 --target runtime --tag classic-deb-runtime \
-            --file tools/ci/debian-client/Dockerfile tools/ci/debian-client
+            --file "${debian_producer}" tools/ci/debian-client
           mkdir -p build/linux-package-evidence build/linux-packages build/discord-config
           docker image inspect classic-deb-build classic-deb-runtime \
             --format '{{.Id}}' > build/linux-package-evidence/images.txt
@@ -339,6 +356,8 @@ jobs:
 
   client-appimage:
     name: Build and smoke Ubuntu-baseline AppImage
+    env:
+      CLASSIC_LINUX_IMAGE: ${{ needs.metadata.outputs.compiler_image }}
     # The runner retains Actions service/cache authority; candidate code must
     # never inherit it. Trusted caller scripts build/inspect on the host, while
     # candidate scripts and payloads execute only in offline, unprivileged
@@ -365,6 +384,7 @@ jobs:
           ref: ${{ needs.metadata.outputs.commit }}
           path: candidate-source
           persist-credentials: false
+          fetch-depth: 0
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: candidate-dependencies-${{ needs.metadata.outputs.tag }}
@@ -380,12 +400,26 @@ jobs:
           name: discord-application-id-${{ inputs.tag }}
           path: build/discord-config
       - name: Prepare pinned Ubuntu builder and clean runtime images
+        env:
+          RELEASE_REVISION: ${{ needs.metadata.outputs.commit }}
         run: |
           mkdir -p build/appimage-evidence build/appimage-packages build/discord-config
+          source_lock_path=$(mktemp "${RUNNER_TEMP}/classic-source-packaging-lock.XXXXXX")
+          trap 'rm -f "${source_lock_path}"' EXIT
+          python3 tools/release/resolve_compiler_image.py \
+            --source-root "${GITHUB_WORKSPACE}/candidate-source" --revision "${RELEASE_REVISION}" \
+            --current-image "${CLASSIC_LINUX_IMAGE}" --source-packaging-lock-output "${source_lock_path}" \
+            > build/appimage-evidence/compiler-image.txt
+          compiler_arguments=()
+          if test -s "${source_lock_path}"; then
+            compiler_arguments=(--source-packaging-lock "${source_lock_path}")
+          fi
           python3 tools/ci/appimage/prepare.py --output build/appimage-context \
+            --compiler-image "${CLASSIC_LINUX_IMAGE}" "${compiler_arguments[@]}" \
             > build/appimage-evidence/prepare.log 2>&1
           cp build/appimage-context/packaging.lock.json build/appimage-evidence/
           docker build --platform linux/amd64 --target build --tag classic-appimage-build \
+            --build-arg "ATRINIK_COMPILER_IMAGE=${CLASSIC_LINUX_IMAGE}" \
             --file build/appimage-context/Dockerfile build/appimage-context \
             > build/appimage-evidence/image-build.log 2>&1
           for runtime in ubuntu24 ubuntu26 debian13; do
@@ -456,12 +490,14 @@ jobs:
           RELEASE_REVISION: ${{ needs.metadata.outputs.commit }}
         run: |
           sudo apt-get update
-          sudo apt-get install --yes --no-install-recommends squashfs-tools binutils
+          sudo apt-get install --yes --no-install-recommends squashfs-tools llvm
+          test -x /usr/bin/llvm-readelf
           python3 tools/release/appimage.py \
             "build/appimage-packages/atrinik-classic-client-${RELEASE_VERSION}-linux-x86_64.AppImage" \
             "${RELEASE_VERSION}" \
             --revision "${RELEASE_REVISION}" \
             --source-root "${GITHUB_WORKSPACE}/candidate-source" \
+            --compiler-image "${CLASSIC_LINUX_IMAGE}" \
             > build/appimage-evidence/payload-validation.log 2>&1
       - name: Smoke in clean Ubuntu 24, Ubuntu 26, and Debian 13 runtimes
         env:
@@ -548,13 +584,23 @@ jobs:
 
   client-windows:
     name: Build Windows client package
+    env:
+      WINDOWS_BUILD_IMAGE: ${{ needs.metadata.outputs.windows_image }}
+      WINDOWS_BUILD_CACHE_EPOCH: ${{ needs.metadata.outputs.windows_cache_epoch }}
     needs: [metadata, dependencies, gpu-shaders]
     runs-on: ubuntu-24.04
     timeout-minutes: 90
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.metadata.outputs.commit }}
+      - name: Check out trusted Windows producer selection
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          path: build/windows-automation
+          persist-credentials: false
+          sparse-checkout: tools/release/windows_producer.py
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: candidate-dependencies-${{ needs.metadata.outputs.tag }}
@@ -588,12 +634,19 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ github.token }}
-      - run: docker pull ghcr.io/atrinik/windows-build:1.16.0@sha256:4266256d4b4196241df6463e687dd286022e24e3bc46dfafb4f877744a731d69
+      - run: docker pull "${WINDOWS_BUILD_IMAGE}"
       - name: Build portable package from monorepo siblings
         env:
           RELEASE_VERSION: ${{ needs.metadata.outputs.version }}
+          RELEASE_REVISION: ${{ needs.metadata.outputs.commit }}
           DISCORD_CONFIG_FILE: ${{ inputs.rehearsal != true && '/workspace/build/discord-config/discord-application-id' || '' }}
         run: |
+          arguments_path=$(mktemp "${RUNNER_TEMP}/classic-windows-environment.XXXXXX")
+          trap 'rm -f "${arguments_path}"' EXIT
+          python3 build/windows-automation/tools/release/windows_producer.py \
+            --source-root "${GITHUB_WORKSPACE}" --revision "${RELEASE_REVISION}" \
+            --format docker-env > "${arguments_path}"
+          mapfile -t producer_environment < "${arguments_path}"
           docker run --rm \
             --network none \
             --user "$(id -u):$(id -g)" \
@@ -604,10 +657,10 @@ jobs:
             --env CCACHE_DIR=/workspace/client/build/ccache \
             --env CCACHE_MAXSIZE=500M \
             --env CCACHE_TEMPDIR=/tmp/atrinik-client-ccache \
-            --env PATH=/opt/mxe/.ccache/bin:/opt/mxe/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
+            "${producer_environment[@]}" \
             --volume "${GITHUB_WORKSPACE}:/workspace" \
             --workdir /workspace/client \
-            ghcr.io/atrinik/windows-build:1.16.0@sha256:4266256d4b4196241df6463e687dd286022e24e3bc46dfafb4f877744a731d69 \
+            "${WINDOWS_BUILD_IMAGE}" \
             bash -c \
               'set -euo pipefail
                ccache --zero-stats
@@ -623,13 +676,23 @@ jobs:
 
   server-windows:
     name: Build Windows server package
+    env:
+      WINDOWS_BUILD_IMAGE: ${{ needs.metadata.outputs.windows_image }}
+      WINDOWS_BUILD_CACHE_EPOCH: ${{ needs.metadata.outputs.windows_cache_epoch }}
     needs: [metadata, dependencies]
     runs-on: ubuntu-24.04
     timeout-minutes: 180
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.metadata.outputs.commit }}
+      - name: Check out trusted Windows producer selection
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          path: build/windows-automation
+          persist-credentials: false
+          sparse-checkout: tools/release/windows_producer.py
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: candidate-dependencies-${{ needs.metadata.outputs.tag }}
@@ -653,11 +716,18 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ github.token }}
-      - run: docker pull ghcr.io/atrinik/windows-build:1.16.0@sha256:4266256d4b4196241df6463e687dd286022e24e3bc46dfafb4f877744a731d69
+      - run: docker pull "${WINDOWS_BUILD_IMAGE}"
       - name: Build portable package from monorepo siblings
         env:
           RELEASE_VERSION: ${{ needs.metadata.outputs.version }}
+          RELEASE_REVISION: ${{ needs.metadata.outputs.commit }}
         run: |
+          arguments_path=$(mktemp "${RUNNER_TEMP}/classic-windows-environment.XXXXXX")
+          trap 'rm -f "${arguments_path}"' EXIT
+          python3 build/windows-automation/tools/release/windows_producer.py \
+            --source-root "${GITHUB_WORKSPACE}" --revision "${RELEASE_REVISION}" \
+            --format docker-env > "${arguments_path}"
+          mapfile -t producer_environment < "${arguments_path}"
           docker run --rm \
             --network none \
             --user "$(id -u):$(id -g)" \
@@ -667,10 +737,10 @@ jobs:
             --env CCACHE_DIR=/workspace/server/build/ccache \
             --env CCACHE_MAXSIZE=500M \
             --env CCACHE_TEMPDIR=/tmp/atrinik-server-ccache \
-            --env PATH=/opt/mxe/.ccache/bin:/opt/mxe/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
+            "${producer_environment[@]}" \
             --volume "${GITHUB_WORKSPACE}:/workspace" \
             --workdir /workspace/server \
-            ghcr.io/atrinik/windows-build:1.16.0@sha256:4266256d4b4196241df6463e687dd286022e24e3bc46dfafb4f877744a731d69 \
+            "${WINDOWS_BUILD_IMAGE}" \
             bash -c \
               'set -euo pipefail
                ccache --zero-stats
@@ -727,6 +797,8 @@ jobs:
 
   candidate:
     name: Validate complete release candidate
+    env:
+      CLASSIC_LINUX_IMAGE: ${{ needs.metadata.outputs.compiler_image }}
     if: >-
       always() &&
       needs.metadata.result == 'success' &&
@@ -753,6 +825,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.metadata.outputs.commit }}
+          fetch-depth: 0
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           pattern: release-*-${{ needs.metadata.outputs.tag }}
@@ -762,14 +835,32 @@ jobs:
         if: needs.metadata.outputs.artifact_schema == '3'
         run: |
           sudo apt-get update
-          sudo apt-get install --yes --no-install-recommends squashfs-tools binutils
+          sudo apt-get install --yes --no-install-recommends squashfs-tools llvm
+          test -x /usr/bin/llvm-readelf
+      - name: Check out the trusted compiler-image resolver
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          path: build/ci-automation
+          persist-credentials: false
+          sparse-checkout: tools/release/resolve_compiler_image.py
       - name: Validate and index the complete candidate
-        run: >-
-          python3 tools/release/finalize_artifacts.py
-          --version '${{ needs.metadata.outputs.version }}'
-          --revision '${{ needs.metadata.outputs.commit }}'
-          --source-epoch '${{ needs.metadata.outputs.source_epoch }}'
-          --directory build/release
+        env:
+          RELEASE_VERSION: ${{ needs.metadata.outputs.version }}
+          RELEASE_REVISION: ${{ needs.metadata.outputs.commit }}
+          RELEASE_SOURCE_EPOCH: ${{ needs.metadata.outputs.source_epoch }}
+        run: |
+          arguments_path=$(mktemp "${RUNNER_TEMP}/classic-compiler-arguments.XXXXXX")
+          trap 'rm -f "${arguments_path}"' EXIT
+          python3 build/ci-automation/tools/release/resolve_compiler_image.py \
+            --source-root "${GITHUB_WORKSPACE}" --revision "${RELEASE_REVISION}" \
+            --current-image "${CLASSIC_LINUX_IMAGE}" --source-finalizer-arguments \
+            > "${arguments_path}"
+          mapfile -t compiler_arguments < "${arguments_path}"
+          python3 tools/release/finalize_artifacts.py \
+            --version "${RELEASE_VERSION}" --revision "${RELEASE_REVISION}" \
+            --source-epoch "${RELEASE_SOURCE_EPOCH}" --directory build/release \
+            "${compiler_arguments[@]}"
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: complete-release-candidate-${{ needs.metadata.outputs.tag }}