cmake : update semver and release process [no ci] (#3996)

* cmake : update semver handling to be consistent with ggml/llama.cpp This commit modifies the semantic version handling to be consistent with how llama.cpp and ggml handle semver. This commit introdues a new example named test-cmake which is intended to be used to test the cmake configuration and installation. * ci : update release workflow to be consistent with llama.cpp work in progress... * ci : fix if statement in release.yml * ci : comment out all but one build in release.yml This is just for testing and this commit should not be included in the main PR later. * ci : use DEPLOY_KEY_RELEASE This commit updates the release and make-release workflows to use the DEPLOY_KEY_RELEASE secret. Two github ruleset have been imported. * ci : add github rulesets for releases These were retrived from llama.cpp and then imported into my fork for testing. If all works well they will be imported into whisper.cpp upstream as well. * fix move artifacts step * examples : use FetchContent for llama.cpp in talk-llama This commit updated the example talk-llama to remove the vendored llama.cpp and instead use FetchContent to pull it in from the upstream repo. * ci: add GGML_NATIVE=OFF to build-clang.yml This commit disables native CPU instructions from the ubuntu-22-clang job. The motivation for this is that currently it is possible that the running compiling llama.cpp (via ccache) might have support for cpu instructions that are not available on the target runner. Refs: https://github.com/ggml-org/whisper.cpp/actions/runs/32224048267/job/95980031403?pr=3996 * ci : add missing GGML_NATIVE=OFF to jobs * ci : add attestation for signed release artifacts This commit add attenstions of artifacts to the release workflow. After building the artifacts can be verified with the following command: ```console $ curl -sSL -o whisper-bin-ubuntu-x64.tar.gz \ https://github.com/danbev/whisper.cpp/releases/download/b4947/whisper-bin-ubuntu-x64.tar.gz $ gh attestation verify --repo danbev/whisper.cpp whisper-bin-ubuntu-x64.tar.gz Loaded digest sha256:722a6812263195d7ee2192b57fc64a6d6b09a6cdf2f55a152f793db27a651e31 for file://whisper-bin-ubuntu-x64.tar.gz Loaded 1 attestation from GitHub API The following policy criteria will be enforced: - Predicate type must match:................ https://slsa.dev/provenance/v1 - Source Repository Owner URI must match:... https://github.com/danbev - Source Repository URI must match:......... https://github.com/danbev/whisper.cpp - Subject Alternative Name must match regex: (?i)^https://github\.com/danbev/whisper\.cpp/ - OIDC Issuer must match:................... https://token.actions.githubusercontent.com ✓ Verification succeeded! The following 1 attestation matched the policy criteria - Attestation #1 - Build repo:..... danbev/whisper.cpp - Build workflow:. .github/workflows/release.yml@refs/heads/master - Signer repo:.... danbev/whisper.cpp - Signer workflow: .github/workflows/release.yml@refs/heads/master ``` * cmake : add WHISPER_USE_SYSTEM_LLAMA option [no ci] This commit adds a new CMake option WHISPER_USE_SYSTEM_LLAMA that allows the talk-llama example to use a system-installed llama.cpp library. Setting this will automatically also set WHISPER_USE_SYSTEM_GGML to ON and the system ggml library will be used in addition to the system llama.cpp. * ci : remove unused ccache step * Revert "ci : comment out all but one build in release.yml" This reverts commit 24b56776e1. * ci : set WHISPER_BUILD_IS_DEV=OFF in release.yml
2026-09-29 09:27:44 -05:00 · 2026-08-20 09:34:27 +02:00
parent 4834a2327d
commit 81c190560a
236 changed files with 594 additions and 93634 deletions
@@ -81,7 +81,8 @@ jobs:
              -DCMAKE_CXX_COMPILER=clang++ \
              -DCMAKE_C_COMPILER=clang \
              -DCMAKE_C_COMPILER_LAUNCHER=ccache \
-              -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
+              -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
+              -DGGML_NATIVE=OFF
            make
            ctest -L gh --output-on-failure'

@@ -63,6 +63,7 @@ jobs:
        run: |
          sysctl -a
          cmake -B build -G Xcode \
+            -DGGML_NATIVE=OFF \
            -DGGML_METAL_USE_BF16=ON \
            -DGGML_METAL_EMBED_LIBRARY=ON \
            -DWHISPER_BUILD_EXAMPLES=OFF \
@@ -43,6 +43,6 @@ jobs:
          HF_TOKEN: ${{ secrets.HF_TOKEN }}
        run: |
          ./models/download-ggml-model.sh tiny.en
-          cmake -B build -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
+          cmake -B build -DGGML_NATIVE=OFF -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
          cmake --build build --config Release
          ./build/bin/whisper-quantize models/ggml-tiny.en.bin models/ggml-tiny.en-q4_0.bin q4_0
@@ -85,7 +85,7 @@ jobs:
          export CCACHE_COMPILERCHECK="string:$(icpx --version 2>&1 | head -1)"
          mkdir build
          cd build
-          cmake -DGGML_SYCL=ON -DCMAKE_C_COMPILER=icx -DCMAKE_CXX_COMPILER=icpx \
+          cmake -DGGML_SYCL=ON -DGGML_NATIVE=OFF -DCMAKE_C_COMPILER=icx -DCMAKE_CXX_COMPILER=icpx \
            -DCMAKE_C_COMPILER_LAUNCHER=ccache \
            -DCMAKE_CXX_COMPILER_LAUNCHER=ccache ..
          cmake --build . --config Release -j $(nproc)
@@ -144,7 +144,7 @@ jobs:
          export CCACHE_COMPILERCHECK="string:$(icpx --version 2>&1 | head -1)"
          mkdir build
          cd build
-          cmake -DGGML_SYCL_F16=ON -DCMAKE_C_COMPILER=icx -DCMAKE_CXX_COMPILER=icpx \
+          cmake -DGGML_SYCL_F16=ON -DGGML_NATIVE=OFF -DCMAKE_C_COMPILER=icx -DCMAKE_CXX_COMPILER=icpx \
            -DCMAKE_C_COMPILER_LAUNCHER=ccache \
            -DCMAKE_CXX_COMPILER_LAUNCHER=ccache ..
          cmake --build . --config Release -j $(nproc)
@@ -0,0 +1,88 @@
+name: Make Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      commit:
+        description: 'Commit SHA to release (empty = branch HEAD)'
+        required: false
+        default: ''
+        type: string
+      dry_run:
+        description: 'Dry run - validate without creating the tag'
+        required: true
+        type: boolean
+        default: true
+
+env:
+  GH_TOKEN: ${{ github.token }}
+
+permissions:
+  contents: write
+
+jobs:
+  make-release:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          ref: ${{ inputs.commit != '' && inputs.commit || github.ref_name }}
+          fetch-depth: 0
+          ssh-key: ${{ secrets.DEPLOY_KEY_RELEASE }}
+
+      - name: Run release checks
+        id: checks
+        run: bash scripts/make-release-checks.sh ${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}
+        env:
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          RELEASE_BRANCH: ${{ github.ref_name }}
+
+      - name: Create release tag
+        if: ${{ github.event.inputs.dry_run == 'false' }}
+        run: |
+          VERSION="${{ steps.checks.outputs.version }}"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag -a "${VERSION}" -m "Release ${VERSION}"
+          git push origin "${VERSION}"
+          echo "Created and pushed tag ${VERSION}"
+
+      - name: Generate release description
+        id: desc
+        run: bash scripts/make-release-desc.sh "${{ steps.checks.outputs.version }}"
+        env:
+          GITHUB_REPOSITORY: ${{ github.repository }}
+
+      - name: Create release
+        if: ${{ github.event.inputs.dry_run == 'false' }}
+        uses: ggml-org/action-create-release@v1
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        with:
+          tag_name: ${{ steps.checks.outputs.version }}
+          # TODO: remove the prerelease flag once the semantic versioning workflow is ready
+          # ref: https://github.com/ggml-org/ggml/discussions/1579
+          prerelease: true
+          body: |
+            > [!NOTE]
+            > Semantic versioning is still work in progress.
+            > More info can be found in https://github.com/ggml-org/ggml/discussions/1579
+
+            ${{ steps.desc.outputs.nightly }}
+
+            ## ${{ steps.desc.outputs.changelog_title }}
+
+            ${{ steps.desc.outputs.changelog }}
+
+      - name: Dry run summary
+        if: ${{ github.event.inputs.dry_run == 'true' }}
+        run: |
+          if [[ "${{ steps.checks.outputs.checks_passed }}" == "true" ]]; then
+            echo "Dry run complete - all checks passed."
+            echo "Would have created tag: ${{ steps.checks.outputs.version }}"
+          else
+            echo "::error::Dry run found release check failures. A release tag would not be created."
+            exit 1
+          fi
@@ -1,10 +1,14 @@
 name: Release

+# Builds dev releases (b* tags) when manually dispatched with create_release: true.
+# Run this as a verification build before making a release (see make-release.yml).
+# Pushing a v* tag does not trigger this workflow; releases are made via make-release.yml.
+
 on:
  workflow_dispatch:
    inputs:
      create_release:
-        description: 'Create new release'
+        description: 'Create new developer release'
        required: true
        type: boolean
      pre_release_tag:
@@ -12,13 +16,10 @@ on:
        required: false
        type: string

-  push:
-    tags:
-      - 'v*'
-
 env:
  BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
  VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"
+  WHISPER_BUILD_IS_DEV: OFF

 concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
@@ -26,6 +27,8 @@ concurrency:

 permissions:
  contents: write  # for creating release
+  id-token: write
+  attestations: write

 jobs:
  determine-tag:
@@ -55,18 +58,10 @@ jobs:
          echo "BRANCH_NAME: ${{ env.BRANCH_NAME }}"
          echo "CUSTOM_TAG: $CUSTOM_TAG"

-          if [[ "${{ github.ref_type }}" == "tag" ]]; then
-            echo "Using pushed tag name"
-            TAG_NAME="${{ github.ref_name }}"
-            SHOULD_RELEASE="true"
-          elif [[ -n "$CUSTOM_TAG" ]]; then
+          if [[ -n "$CUSTOM_TAG" ]]; then
            echo "Using custom tag"
            TAG_NAME="${CUSTOM_TAG}"
            SHOULD_RELEASE="true"
-          elif [[ "${{ github.event.inputs.create_release }}" == "true" ]]; then
-            echo "Manual release requested"
-            SHOULD_RELEASE="true"
-            TAG_NAME="b${BUILD_NUMBER}"
          elif [[ "${{ env.BRANCH_NAME }}" == "master" ]]; then
            echo "Using master branch format"
            TAG_NAME="b${BUILD_NUMBER}"
@@ -78,6 +73,11 @@ jobs:
            SHOULD_RELEASE="false"
          fi

+          if [[ "${{ github.event.inputs.create_release }}" == "true" ]]; then
+            echo "Manual release requested"
+            SHOULD_RELEASE="true"
+          fi
+
          echo "Final tag name: $TAG_NAME"
          echo "Should release: $SHOULD_RELEASE"
          echo "name=$TAG_NAME" >> $GITHUB_OUTPUT
@@ -119,6 +119,7 @@ jobs:
            -DCMAKE_BUILD_WITH_INSTALL_RPATH=ON \
            -DGGML_BACKEND_DL=ON \
            -DGGML_NATIVE=OFF \
+            -DWHISPER_BUILD_IS_DEV=${{ env.WHISPER_BUILD_IS_DEV }} \
            ${{ matrix.build == 'x64' && '-DGGML_CPU_ALL_VARIANTS=ON' || '-DGGML_CPU_ARM_ARCH=armv8-a' }}
          cmake --build build --config Release -j $(nproc)

@@ -175,6 +176,7 @@ jobs:
          -DBUILD_SHARED_LIBS=ON
          -DWHISPER_SDL2=${{ matrix.sdl2 }}
          -DGGML_NATIVE=OFF
+          -DWHISPER_BUILD_IS_DEV=${{ env.WHISPER_BUILD_IS_DEV }}
          ${{ matrix.arch == 'x64' && '-DGGML_BACKEND_DL=ON -DGGML_CPU_ALL_VARIANTS=ON' || '-DGGML_BMI2=OFF' }}

      - name: Build
@@ -224,7 +226,7 @@ jobs:
              Compress-Archive -Path "build/bin/${{ matrix.build }}" -DestinationPath "whisper-bin-${{ matrix.arch }}.zip"

      - name: Upload binaries
-        if: matrix.sdl2 == 'ON' && ${{ needs.determine-tag.outputs.should_release }}
+        if: ${{ matrix.sdl2 == 'ON' && needs.determine-tag.outputs.should_release == 'true' }}
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: whisper-bin-${{ matrix.arch }}.zip
@@ -290,6 +292,7 @@ jobs:
          -DBLAS_INCLUDE_DIRS="$env:GITHUB_WORKSPACE/OpenBLAS-${{matrix.blasver}}/include"
          -DWHISPER_SDL2=${{ matrix.sdl2 }}
          -DGGML_NATIVE=OFF
+          -DWHISPER_BUILD_IS_DEV=${{ env.WHISPER_BUILD_IS_DEV }}
          ${{ matrix.arch == 'x64' && '-DGGML_BACKEND_DL=ON -DGGML_CPU_ALL_VARIANTS=ON' || '-DGGML_BMI2=OFF' }}

      - name: Build
@@ -311,7 +314,7 @@ jobs:
              Compress-Archive -Path "build/bin/${{ matrix.build }}" -DestinationPath "whisper-blas-bin-${{ matrix.arch }}.zip"

      - name: Upload binaries
-        if: matrix.blas == 'ON' && matrix.sdl2 == 'ON' && ${{ needs.determine-tag.outputs.should_release }}
+        if: ${{ matrix.blas == 'ON' && matrix.sdl2 == 'ON' && needs.determine-tag.outputs.should_release == 'true' }}
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: whisper-blas-bin-${{ matrix.arch }}.zip
@@ -497,6 +500,7 @@ jobs:
            -DCMAKE_CUDA_FLAGS="%CUDA_FLAGS%" ^
            -DGGML_BACKEND_DL=ON ^
            -DGGML_NATIVE=OFF ^
+            -DWHISPER_BUILD_IS_DEV=${{ env.WHISPER_BUILD_IS_DEV }} ^
            -DGGML_CPU_ALL_VARIANTS=ON
          set /A NINJA_JOBS=%NUMBER_OF_PROCESSORS%-1
          cmake --build build --config ${{ matrix.build }} -j %NUMBER_OF_PROCESSORS%
@@ -520,7 +524,7 @@ jobs:
              Compress-Archive -Path "build/bin/${{ matrix.build }}" -DestinationPath "whisper-cublas-${{ matrix.cuda-toolkit }}-bin-${{ matrix.arch }}.zip"

      - name: Upload binaries
-        if: ${{ needs.determine-tag.outputs.should_release }}
+        if: ${{ needs.determine-tag.outputs.should_release == 'true' }}
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: whisper-cublas-${{ matrix.cuda-toolkit }}-bin-${{ matrix.arch }}.zip
@@ -552,6 +556,7 @@ jobs:
          cmake -G Xcode .. \
            -DGGML_METAL_USE_BF16=ON \
            -DGGML_METAL_EMBED_LIBRARY=ON \
+            -DWHISPER_BUILD_IS_DEV=${{ env.WHISPER_BUILD_IS_DEV }} \
            -DWHISPER_BUILD_EXAMPLES=OFF \
            -DWHISPER_BUILD_TESTS=OFF \
            -DWHISPER_BUILD_SERVER=OFF \
@@ -577,14 +582,14 @@ jobs:
          zip --symlinks -r whisper-${{ needs.determine-tag.outputs.tag_name }}-xcframework.zip build-apple/whisper.xcframework

      - name: Upload artifacts
-        if: ${{ needs.determine-tag.outputs.should_release }}
+        if: ${{ needs.determine-tag.outputs.should_release == 'true' }}
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          path: whisper-${{ needs.determine-tag.outputs.tag_name }}-xcframework.zip
          name: whisper-${{ needs.determine-tag.outputs.tag_name }}-xcframework.zip

  release:
-    if: ${{ github.event.inputs.create_release == 'true' || github.event.inputs.pre_release_tag != '' || startsWith(github.ref, 'refs/tags/v') }}
+    if: ${{ github.event.inputs.create_release == 'true' || github.event.inputs.pre_release_tag != '' }}

    runs-on: ubuntu-latest

@@ -602,12 +607,7 @@ jobs:
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          fetch-depth: 0
-
-      - name: ccache
-        uses: ggml-org/ccache-action@v1.2.21
-        with:
-          key: release
-          evict-old-files: 1d
+          ssh-key: ${{ secrets.DEPLOY_KEY_RELEASE }}

      # Downloads all the artifacts from the previous jobs
      - name: Download artifacts
@@ -615,10 +615,29 @@ jobs:
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
        with:
          path: ./artifact
+          merge-multiple: true

      - name: Move artifacts
        id: move_artifacts
-        run: mkdir -p ./artifact/release && mv ./artifact/*/*.zip ./artifact/release && mv ./artifact/*/*.tar.gz ./artifact/release 2>/dev/null || true
+        run: |
+          mkdir -p ./release
+          mv -v ./artifact/*.zip ./release 2>/dev/null || true
+          mv -v ./artifact/*.tar.gz ./release 2>/dev/null || true
+
+      - name: Attest release artifacts
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
+        with:
+          subject-path: 'release/*'
+
+      - name: Create and push git tag
+        run: |
+          TAG="${{ needs.determine-tag.outputs.tag_name }}"
+          if git rev-parse -q --verify "refs/tags/${TAG}" >/dev/null 2>&1; then
+            echo "Tag ${TAG} already exists, skipping creation"
+          else
+            git tag "${TAG}"
+            git push origin "${TAG}"
+          fi

      - name: Create release
        id: create_release
@@ -627,8 +646,6 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{ needs.determine-tag.outputs.tag_name }}
-          prerelease: ${{ github.event.inputs.pre_release_tag != '' }}
-          draft: true

      - name: Upload release
        id: upload_release
@@ -639,7 +656,7 @@ jobs:
            const path = require('path');
            const fs = require('fs');
            const release_id = '${{ steps.create_release.outputs.id }}';
-            for (let file of await fs.readdirSync('./artifact/release')) {
+            for (let file of await fs.readdirSync('./release')) {
              if (path.extname(file) === '.zip' || file.endsWith('.tar.gz')) {
                console.log('uploadReleaseAsset', file);
                await github.repos.uploadReleaseAsset({
@@ -647,7 +664,7 @@ jobs:
                  repo: context.repo.repo,
                  release_id: release_id,
                  name: file,
-                  data: await fs.readFileSync(`./artifact/release/${file}`)
+                  data: await fs.readFileSync(`./release/${file}`)
                });
              }
            }