From f7a5e14d8a9de0f873649484c73d3463c8c91bde Mon Sep 17 00:00:00 2001
From: Nathan Lu <lunathan2005@gmail.com>
Date: Fri, 31 Jul 2026 18:39:54 -0400
Subject: [PATCH] ci(release): make release SDK builds hermetic (skip cross-run
 caches)

Release artifacts should not depend on cross-run mutable caches
(ccache, cargo target, restored ninja tree); the cargo cache comment in
this file records one stale-artifact incident already. hermetic
defaults to false, so only the release build pays the clean-build cost.

Signed-off-by: Nathan Lu <lunathan2005@gmail.com>
---
 .github/workflows/_build-sdk.yml | 14 ++++++++++++++
 .github/workflows/release.yml    |  6 ++++++
 2 files changed, 20 insertions(+)

diff --git a/.github/workflows/_build-sdk.yml b/.github/workflows/_build-sdk.yml
index b8091b161..2a948ce28 100644
--- a/.github/workflows/_build-sdk.yml
+++ b/.github/workflows/_build-sdk.yml
@@ -18,6 +18,17 @@ on:
         required: false
         type: string
         default: ""
+      hermetic:
+        description: >-
+          Build from clean state: skip every cross-run cache restore (ccache,
+          cargo target, CMake build tree). Release builds set this so shipped
+          binaries can never be assembled from stale cached outputs — the same
+          uniform-mtime hazard documented on the cargo cache below applies to
+          the ninja build tree, whose cache key hashes only configure inputs,
+          not the C/C++ sources.
+        required: false
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -79,6 +90,7 @@ jobs:
           version_tag: ${{ inputs.version_tag }}
 
       - name: Restore ccache
+        if: ${{ !inputs.hermetic }}
         uses: actions/cache@v6
         with:
           path: ${{ github.workspace }}/.ccache
@@ -95,6 +107,7 @@ jobs:
       # No restore-keys — a source change forces a clean rebuild instead of a
       # fuzzy restore that would re-trigger the staleness.
       - name: Restore cargo target
+        if: ${{ !inputs.hermetic }}
         uses: actions/cache@v6
         with:
           path: |
@@ -127,6 +140,7 @@ jobs:
       # configure-time inputs; a change there mints a new entry, while
       # restore-keys lets unchanged-config runs reuse the previous tree.
       - name: Restore CMake build dir
+        if: ${{ !inputs.hermetic }}
         uses: actions/cache@v6
         with:
           path: sdk/build-${{ matrix.preset }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 86832b5f6..d1c873e4e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -83,6 +83,12 @@ jobs:
     with:
       version_tag: ${{ needs.resolve-tag.outputs.tag }}
       upload_artifact: true
+      # Release artifacts must be built from clean state, never assembled from
+      # restored ccache / cargo / ninja-tree caches: actions/cache restores
+      # uniform mtimes, so a restored build tree can defeat ninja's staleness
+      # detection and `cmake --install` then ships outputs compiled from an
+      # older commit under the new tag (see qualcomm/GenieX#1266).
+      hermetic: true
 
   build-android-aar:
     name: build-android-aar