Build vendored artifacts in CI (#37127)

* Build vendored artifacts in CI

* parallel

* deterministic

* fix up

* fix gitignores

* lil more

* lil more consistency

.github/workflows/vendor_third_party.yaml

@@ -0,0 +1,51 @@
+name: vendor third_party
+
+on:
+  workflow_dispatch:
+
+jobs:
+  build:
+    if: github.ref != 'refs/heads/master'
+    strategy:
+      matrix:
+        os: [ubuntu-24.04, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        submodules: true
+    - name: Build
+      run: third_party/build.sh
+    - name: Package artifacts
+      run: |
+        git add -A third_party/
+        git diff --cached --name-only -- third_party/ | tar -cf /tmp/third_party_build.tar -T -
+    - uses: actions/upload-artifact@v4
+      with:
+        name: third-party-${{ runner.os }}
+        path: /tmp/third_party_build.tar
+
+  commit:
+    needs: build
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+    - uses: actions/checkout@v6
+    - uses: actions/download-artifact@v4
+      with:
+        path: /tmp/artifacts
+    - name: Commit vendored libraries
+      run: |
+        for f in /tmp/artifacts/*/third_party_build.tar; do
+          tar xf "$f"
+        done
+        git add third_party/
+        if git diff --cached --quiet; then
+          echo "No changes to commit"
+          exit 0
+        fi
+        git config user.name "github-actions[bot]"
+        git config user.email "github-actions[bot]@users.noreply.github.com"
+        git commit -m "third_party: rebuild vendor libraries"
+        git push

third_party/acados/.gitignore

@@ -1,5 +1,9 @@
 acados_repo/
-lib
+/lib
 !x86_64/
 !larch64/
 !aarch64/
+!Darwin/
+!*.so
+!*.so.*
+!*.dylib

third_party/acados/acados_template/gnsf/__init__.py

@@ -0,0 +1 @@
+

third_party/acados/build.sh

@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
 set -e
 
+export SOURCE_DATE_EPOCH=0
+export ZERO_AR_DATE=1
+
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
 
 ARCHNAME="x86_64"

third_party/acados/x86_64/lib/libacados.so

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:821ce18f417d211c4845b60482d465b809f90dc7d04f023d652d8221e87679b1
-size 553544
+oid sha256:05a1ba3cf37fa929cdd56f892608b2f89c35a05ef1b07fedb86b2f0d76607263
+size 540488

third_party/acados/x86_64/lib/libblasfeo.so

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:3feea7927d004064bbc5a13c3287467669ce801cb0a3c616cf9e089816da5a0b
-size 2155088
+oid sha256:c0bf22898d9c59b672d3d0961f5f4c804b9957478125d99eb297de3091bedd15
+size 2416112

third_party/acados/x86_64/lib/libhpipm.so

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:a042716f515913786581dff39799eb71fc66caddfa18b1c9f0d54f00c1568fd2
-size 1572648
+oid sha256:5b6875fb47940764d4ebb916c2373cb0e04929229feb654b290676c28d48fa9d
+size 1531024

third_party/acados/x86_64/lib/libqpOASES_e.so.3.1

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:a6abea4815e3f03cff06fe8a9602e97f9acf102f18f803571460a94595b93be4
-size 262824
+oid sha256:04be908c3f707e5c968022b9cdd79ab75ae7af46e7fa019ceee98f854ddd3f64
+size 262464

third_party/acados/x86_64/t_renderer

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:7a360d4b53826b91ada3358156d44a14d497bdd8ace88707fd4b386ed6d194c7
-size 17503920
+oid sha256:a53ae46650c4df5b0ddb87a658f59a0422e41743e8bc2d822da0aefd1d280791
+size 5088536

third_party/build.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+
+# Reproducible builds: pin timestamps to epoch
+export SOURCE_DATE_EPOCH=0
+export ZERO_AR_DATE=1
+
+pids=()
+names=()
+logs=()
+
+for script in "$DIR"/*/build.sh; do
+  [ -f "$script" ] || continue
+  name=$(basename "$(dirname "$script")")
+  log=$(mktemp)
+  names+=("$name")
+  logs+=("$log")
+  (cd "$(dirname "$script")" && bash "$(basename "$script")") >"$log" 2>&1 &
+  pids+=($!)
+done
+
+failed=0
+for i in "${!pids[@]}"; do
+  echo "--- ${names[$i]} ---"
+  if wait "${pids[$i]}"; then
+    echo "OK"
+  else
+    echo "FAILED (exit $?)"
+    failed=1
+  fi
+  cat "${logs[$i]}"
+  rm -f "${logs[$i]}"
+  echo
+done
+
+[ $failed -ne 0 ] && exit $failed
+
+# Repack ar archives with deterministic headers (zero timestamps/uid/gid)
+# Skip foreign-platform archives that ar can't read (e.g. Mach-O on Linux)
+while IFS= read -r -d '' lib; do
+  tmpdir=$(mktemp -d)
+  lib=$(realpath "$lib")
+  if (cd "$tmpdir" && ar x "$lib" 2>/dev/null); then
+    (cd "$tmpdir" && ar Drcs repacked.a * && mv repacked.a "$lib")
+  fi
+  rm -rf "$tmpdir"
+done < <(find "$DIR" -name '*.a' \
+  \( -path '*/x86_64/*' -o -path '*/Darwin/*' -o -path '*/larch64/*' -o -path '*/aarch64/*' \) \
+  -print0)
+
+echo -e "\033[32mAll third_party builds succeeded.\033[0m"

third_party/libyuv/.gitignore

@@ -1 +1,2 @@
-libyuv/
+/libyuv/
+!*.a

third_party/libyuv/build.sh

@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
 set -e
 
+export SOURCE_DATE_EPOCH=0
+export ZERO_AR_DATE=1
+
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
 
 ARCHNAME=$(uname -m)

third_party/libyuv/larch64/lib/libyuv.a

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:320bef5a75a62dd2731a496040921d5000f1ed237ae70fd7aeb6c010a1534363
+oid sha256:adafce26582e425164df7af36253ce58e3ed1dba9965650745c93bd96e42e976
 size 462482

third_party/libyuv/x86_64/include

@@ -1 +0,0 @@
-../include

third_party/libyuv/x86_64/lib/libyuv.a

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:e21a3bd8df01cf4ce5461e7bf6654239196036c3f829255145265c7bf31a791d
-size 511974
+oid sha256:00f9759c67c6fa21657fabde9e096478ea5809716989599f673f638f039431e5
+size 504790

third_party/raylib/.gitignore

@@ -1,3 +1,4 @@
 /raylib_repo/
 /raylib_python_repo/
 /wheel/
+!*.a

third_party/raylib/Darwin/libraylib.a

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:7ffe1fc6497f0c111fc507988e94fd29ce4db53a4876dc82ab9267895ad82584
-size 6515352
+oid sha256:fd045c1d4bca5c9b2ad044ea730826ff6cedeef0b64451b123717b136f1cd702
+size 6392532

third_party/raylib/build.sh

@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
 set -e
 
+export SOURCE_DATE_EPOCH=0
+export ZERO_AR_DATE=1
+
 SUDO=""
 
 # Use sudo if not root

third_party/raylib/larch64/libraylib.a

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:91e9a07513e84f7b553da01b34b24e12fe7130131ef73ebdb3dac3b838db815b
+oid sha256:f760af8b4693cf60e3760341e5275890d78d933da2354c4bad0572ec575b970a
 size 2001860

third_party/raylib/x86_64/libraylib.a

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:f0b8f59758fe1291be82a8bda7a7ca05629c7addb0683936dd404ed08e19e143
-size 2769684
+oid sha256:3c928e849b51b04d8e3603cd649184299efed0e9e0fb02201612b967b31efd73
+size 2771092