[bernardladenthin]

The release run of v6.0.0 (40238595195) failed in Build WebUI assets (shared):

tools/ui/package-lock.json is d4f8f7d8…, the WebUI license texts were generated from ca12fa34…

Cause: the texts in llama/legal/natives/webui-npm were generated from a Windows checkout of llama.cpp (core.autocrlf), so LOCKFILE.sha256 recorded the digest of the CRLF lockfile. CI's Linux checkout of the same commit (6050b467, b11887) has LF: git show 6050b467c:tools/ui/package-lock.json | sha256sum = d4f8f7d8…, the CRLF working copy = ca12fa34…. Same lockfile, so the package list and the texts are right; only the recorded digest was wrong. Every snapshot run passed this check with a warning (--warn-only outside refs/tags/v*), so the release run was the first to stop. Nothing was published: every native build waits for build-webui.

Changes

• webuilicenses.lockfile_digest hashes the lockfile with LF line ends; LOCKFILE.sha256 records d4f8f7d8…. New test: CRLF and LF give the same digest (red without the fix).
• The check fails on every run; --warn-only is removed from the CLI and from build-webui.
• New workflow webui-licenses.yml: the same check on every pull request and push -- sparse checkout of tools/ui at the pin, no npm, contents: read. Publish runs of pull requests are usually cancelled at the start gate, so build-webui alone would still only catch it in a dispatch.
• CLAUDE.md (build-check table) and the bump runbook say so.

Local: the check against the pinned tools/ui passes (CRLF working copy, i.e. the case that broke); buildcheck tests 98, the same 3 Windows-local failures as on main; YAML of both workflows parses; run scripts 135 parse; release gate, templates, check-natives.py clean. The other refs/tags/v conditions in publish.yml are USE_CACHE and check-snapshot/check-tag only.

After the merge (owner): nothing of 6.0.0 was published, so move the tag to the merge commit and dispatch again:

git push origin :refs/tags/v6.0.0
git tag -f -a v6.0.0 <merge commit> -m "v6.0.0"
git push origin v6.0.0

🤖 Generated with Claude Code

https://claude.ai/code/session_01VszvDmRRPP1UcwozsUMY1L

[coderabbitai]

Caution

Review failed

The pull request is closed.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud