Ship a managed Vulkan whisper-server for Linux x64

.github/workflows/whisper-vulkan.yml

@@ -0,0 +1,189 @@
+name: whisper.cpp Vulkan bundle
+
+on:
+  pull_request:
+    paths:
+      - packaging/whisper-vulkan/**
+      - .github/workflows/whisper-vulkan.yml
+      - dikte/ggml.py
+      - tests/test_ggml.py
+      - tests/test_packaging.py
+      - README.md
+      - README.tr.md
+  workflow_dispatch:
+    inputs:
+      whisper_version:
+        description: Upstream whisper.cpp version (without v)
+        required: true
+        default: "1.9.3"
+        type: string
+      whisper_commit:
+        description: Peeled commit SHA for that reviewed upstream tag
+        required: true
+        default: "371b5a7561823ab2bb32142d2751e35e7534727b"
+        type: string
+      publish:
+        description: Publish a Dikte dependency release
+        required: true
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+concurrency:
+  group: whisper-vulkan-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+env:
+  WHISPER_VERSION: ${{ inputs.whisper_version || '1.9.3' }}
+  WHISPER_COMMIT: ${{ inputs.whisper_commit || '371b5a7561823ab2bb32142d2751e35e7534727b' }}
+  MANAGED_WHISPER_SHA256: c25ca76504144da488eb74441390a7b9aa7ce547e5f2f391cbd831253c9b54d8
+
+jobs:
+  build:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    steps:
+      - name: Check out Dikte
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+
+      - name: Check out pinned whisper.cpp source
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          repository: ggml-org/whisper.cpp
+          ref: ${{ env.WHISPER_COMMIT }}
+          path: vendor/whisper.cpp
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Validate source coordinates
+        shell: bash
+        run: |
+          set -euo pipefail
+          [[ "$WHISPER_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
+          [[ "$WHISPER_COMMIT" =~ ^[0-9a-f]{40}$ ]]
+
+      - name: Verify source version and commit
+        shell: bash
+        run: |
+          set -euo pipefail
+          test "$(git -C vendor/whisper.cpp rev-parse HEAD)" = "$WHISPER_COMMIT"
+          git -C vendor/whisper.cpp fetch --depth=1 origin \
+            "refs/tags/v$WHISPER_VERSION:refs/tags/v$WHISPER_VERSION"
+          test "$(git -C vendor/whisper.cpp rev-list -n1 "v$WHISPER_VERSION")" = "$WHISPER_COMMIT"
+          echo "SOURCE_DATE_EPOCH=$(git -C vendor/whisper.cpp show -s --format=%ct HEAD)" >> "$GITHUB_ENV"
+
+      - name: Build pinned build environment
+        run: docker build --pull=false -f packaging/whisper-vulkan/Dockerfile.build -t dikte-whisper-builder packaging/whisper-vulkan
+
+      - name: Build deterministic archive
+        run: |
+          docker run --rm \
+            -e WHISPER_VERSION -e WHISPER_COMMIT -e SOURCE_DATE_EPOCH \
+            -v "$PWD/vendor/whisper.cpp:/src:ro" \
+            -v "$PWD/packaging/whisper-vulkan:/packaging:ro" \
+            -v "$PWD/work:/work" \
+            dikte-whisper-builder \
+            bash /packaging/build-package.sh
+          mkdir -p dist
+          cp work/out/whisper-bin-ubuntu-vulkan-x64.* dist/
+
+      - name: Verify reviewed archive digest
+        shell: bash
+        run: |
+          read -r actual _ < dist/whisper-bin-ubuntu-vulkan-x64.tar.gz.sha256
+          test "$actual" = "$MANAGED_WHISPER_SHA256"
+
+      - name: Validate archive and ELF contract
+        run: OUT_DIR=dist packaging/whisper-vulkan/validate-package.sh
+
+      - name: Schema-validate CycloneDX 1.6 SBOM
+        run: |
+          docker run --rm \
+            -v "$PWD/dist/whisper-bin-ubuntu-vulkan-x64.cdx.json:/sbom.json:ro" \
+            cyclonedx/cyclonedx-cli@sha256:252c2e26f468c25fea1e63ecde1bc3198ad6e9dbb57f5ed3236bddcb2281b3a7 \
+            validate --input-file /sbom.json --input-format json \
+            --input-version v1_6 --fail-on-errors
+
+      - name: CPU fallback smoke test (no Vulkan loader)
+        run: OUT_DIR=dist packaging/whisper-vulkan/smoke-runtime.sh cpu
+
+      - name: Vulkan plugin-load smoke test (Mesa llvmpipe)
+        run: OUT_DIR=dist packaging/whisper-vulkan/smoke-runtime.sh vulkan
+
+      - name: Upload reviewed outputs
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: whisper-bin-ubuntu-vulkan-x64
+          path: dist/*
+          if-no-files-found: error
+          retention-days: 14
+
+  publish:
+    if: >-
+      github.event_name == 'workflow_dispatch' && inputs.publish &&
+      github.ref == 'refs/heads/master'
+    needs: build
+    runs-on: ubuntu-22.04
+    environment: dependency-release
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+      artifact-metadata: write
+    steps:
+      - name: Download the exact tested outputs
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: whisper-bin-ubuntu-vulkan-x64
+          path: dist
+
+      - name: Verify digest sidecar
+        run: (cd dist && sha256sum --check whisper-bin-ubuntu-vulkan-x64.tar.gz.sha256)
+
+      - name: Attest build provenance
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
+        with:
+          subject-path: dist/whisper-bin-ubuntu-vulkan-x64.tar.gz
+
+      - name: Attest SBOM to archive
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
+        with:
+          subject-path: dist/whisper-bin-ubuntu-vulkan-x64.tar.gz
+          sbom-path: dist/whisper-bin-ubuntu-vulkan-x64.cdx.json
+
+      - name: Publish dependency release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: whisper.cpp-v${{ inputs.whisper_version }}
+          RELEASE_TITLE: whisper.cpp v${{ inputs.whisper_version }} Vulkan bundle
+          RELEASE_NOTES: >-
+            Pinned source: ggml-org/whisper.cpp@${{ inputs.whisper_commit }}.
+            Verify with: gh attestation verify
+            whisper-bin-ubuntu-vulkan-x64.tar.gz
+            --repo ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            echo "refusing to replace existing release $RELEASE_TAG" >&2
+            exit 1
+          fi
+          if gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$RELEASE_TAG" >/dev/null 2>&1; then
+            echo "refusing to replace existing tag $RELEASE_TAG" >&2
+            exit 1
+          fi
+          gh api --method POST "repos/$GITHUB_REPOSITORY/git/refs" \
+            -f ref="refs/tags/$RELEASE_TAG" \
+            -f sha="$GITHUB_SHA" >/dev/null
+          test "$(gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$RELEASE_TAG" \
+            --jq .object.sha)" = "$GITHUB_SHA"
+          gh release create "$RELEASE_TAG" dist/* \
+            --repo "$GITHUB_REPOSITORY" \
+            --verify-tag \
+            --prerelease \
+            --latest=false \
+            --title "$RELEASE_TITLE" \
+            --notes "$RELEASE_NOTES"