Pre-release bug-hunt fixes, llama.cpp b11815, the SYCL installers and a README audit

.github/buildcheck/natives.py

@@ -47,6 +47,8 @@
 SMOKE_EXCLUDED_OSES = ("Linux-Android",)
 # The job that re-uploads the Windows natives artifacts Authenticode-signed (CLAUDE.md, "Code signing").
 SIGN_JOB = "sign-windows-natives"
+# A job-level key sits at the four-space indent of the job body (`    if:`); a step's `if:` is deeper.
+JOB_CONDITION = re.compile(r"^    if:")
 SMOKE_EXCLUDED_TREES = ("Linux/s390x",)
 
 # `package` uploads each smoke set alone, as llama-smoke-<target>, for the smoke jobs; a matrix row
@@ -245,14 +247,25 @@ def check_signing(natives, jobs, uploads):
     or reads one of them -- `overwrite` deletes the artifact for a moment, so a build or test job still
     reading it would race (the Windows Java test job reads natives-cpu-windows-x86-64 through the
     reusable workflow's input). A Windows row without its step would ship that jar unsigned on a
-    signed run, which `--require-signed` in `package` then reports late."""
+    signed run, which `--require-signed` in `package` then reports late.
+
+    And the job carries no job-level `if:`: it must run on every run (a no-op without the switch,
+    gated step by step) rather than be skipped, because GitHub applies a skip to every job in the
+    dependency chain behind the skipped one, past any condition of the jobs in between -- the first
+    form was `if:`-skipped without the switch, `package` tolerated that with `!cancelled()` and ran
+    green, and the smoke sets, the report and both publish jobs behind `package` were skipped with
+    the run concluding "success" (run 38870889665, attempt 2)."""
     windows = [r["classifier"] for r in natives if tree(r).split("/")[0] == "Windows"]
     sign = jobs.get(SIGN_JOB)
     if sign is None:
         return [f"publish.yml has no `{SIGN_JOB}` job"] if windows else []
     signed = {c for c, uploaders in uploads.items() if SIGN_JOB in uploaders}
     failures = [f"publish.yml {SIGN_JOB} re-uploads (one per Windows row): missing {c}"
                 for c in sorted(set(windows) - signed)]
+    if any(JOB_CONDITION.match(line) for line in sign.lines):
+        failures.append(f"publish.yml {SIGN_JOB} carries a job-level `if:` -- the job must run on every run "
+                        f"(a no-op without the switch), never be skipped: a skipped job skips every job behind "
+                        f"`package` in the dependency chain, past any condition in between")
     failures += [f"publish.yml {SIGN_JOB} re-uploads natives-{c}, which is not a Windows row -- it would replace "
                  f"the build artifact of another platform with an unsigned copy"
                  for c in sorted(signed - set(windows))]

.github/buildcheck/tests/test_natives.py

@@ -186,6 +186,18 @@ def test_the_sign_job_re_uploads_every_windows_row_with_overwrite(self):
                           "error` would leave the unsigned build artifact in place when the download matched "
                           "nothing"] * len(WINDOWS))
 
+    def test_the_sign_job_carries_no_job_level_condition(self):
+        """A skipped sign job skips every job behind package (GitHub's dependency-chain rule), so the job
+        must run on every run; a step-level `if:` (the per-step gate on the switch) is what it uses."""
+        skipped = ["    if: github.event_name == 'workflow_dispatch' && inputs.sign_windows"] + sign_uploads()
+        self.assertEqual(natives.check_workflow(ROWS, jobs(sign=skipped)),
+                         ["publish.yml sign-windows-natives carries a job-level `if:` -- the job must run on every "
+                          "run (a no-op without the switch), never be skipped: a skipped job skips every job "
+                          "behind `package` in the dependency chain, past any condition in between"])
+        gated = [line for step in sign_uploads() for line in
+                 ([step, "        if: env.SIGN_WINDOWS == 'true'"] if step.startswith("      - ") else [step])]
+        self.assertEqual(natives.check_workflow(ROWS, jobs(sign=gated)), [])
+
     def test_the_sign_job_waits_for_every_reader_of_a_windows_artifact(self):
         # a job reading the artifact between the build and the signed re-upload would race the overwrite
         self.assertEqual(natives.check_workflow(ROWS, jobs(consumer_needs="[build]")),

.github/smoke-natives-jars.sh

@@ -54,8 +54,18 @@ classes="$(find "$TARGET" -maxdepth 1 -name 'llama-*.jar' | grep -E '/llama-[0-9
 mapfile -t natives < <(find "$TARGET" -maxdepth 1 -name 'llama-*.jar' ! -path "$classes" ! -name '*-sources.jar' \
     ! -name '*-javadoc.jar' ! -name '*-jar-with-dependencies.jar' | sort)
 [ "${#natives[@]}" -gt 0 ] || { echo "::error::no natives jars in $TARGET" >&2; exit 2; }
+# The classes jar is runnable: its manifest names ServerLauncher, which is what the README's
+# `jbang --deps <natives jar> net.ladenthin:llama:<v>` lines rely on (JBang runs a GAV through its
+# Main-Class). Read from the jar itself, not from the pom: the entry went missing once, with the
+# fat-jar assembly that used to carry it, and nothing noticed.
+main_class="$(unzip -p "$classes" META-INF/MANIFEST.MF | tr -d '\r' | sed -n 's/^Main-Class: //p')"
+[ "$main_class" = "net.ladenthin.llama.server.ServerLauncher" ] \
+    || { echo "::error::the classes jar $classes names '$main_class' as Main-Class, expected net.ladenthin.llama.server.ServerLauncher" >&2; exit 1; }
+echo "classes jar: $classes (Main-Class $main_class); ${#natives[@]} natives jars"
+# The consumer's classpath: the classes jar, every natives jar and the runtime dependencies. This
+# line went missing once (F269 replaced it with the Main-Class check above), and bash -n cannot see
+# an unbound variable: the first package job to reach this step after that died on `$path` below.
 path="$classes:$(IFS=:; echo "${natives[*]}"):$DEPS"
-echo "classes jar: $classes; ${#natives[@]} natives jars"
 
 run() {
     local label="$1"