ci: migrate primary CI jobs to ARM runners

Move depends-linux64 and its consumers (linux64, fuzz, sqlite, ubsan)
to ARM runners, making aarch64 the primary CI architecture. This
includes both build and test stages.

Drop the aarch64-linux cross-compile job (depends + src) and its
setup env script since we don't ship arm-linux-gnueabihf binaries
and now have native aarch64 coverage through the migrated jobs.

Jobs remaining on x86:
- nowallet (build + test): sole x86_64 native coverage
- mac, win64: cross-compile targets (x86 host)
- lint: architecture-independent

Update 00_setup_env_native_qt5.sh to dynamically detect HOST based
on the runner architecture instead of hardcoding x86_64.

Author: thepastaclaw

.github/workflows/build-depends.yml

@@ -11,10 +11,18 @@ on:
         description: "Path to built container at registry"
         required: true
         type: string
+      base-image-digest:
+        description: "Short hash of the CI base image manifest for cache busting"
+        required: true
+        type: string
       runs-on:
         description: "Runner label to use (e.g., ubuntu-24.04 or ubuntu-24.04-arm)"
         required: true
         type: string
+      effective-runs-on:
+        description: "Optional runner label override used to execute the workflow jobs"
+        required: false
+        type: string
     outputs:
       key:
         description: "Key needed for restoring depends cache"
@@ -29,15 +37,16 @@ on:
 jobs:
   check-cache:
     name: Check cache
-    runs-on: ${{ inputs.runs-on }}
+    runs-on: ${{ inputs.effective-runs-on || inputs.runs-on }}
     outputs:
       cache-hit: ${{ steps.cache-check.outputs.cache-hit }}
       cache-key: ${{ steps.setup.outputs.cache-key }}
+      cache-key-prefix: ${{ steps.setup.outputs.cache-key-prefix }}
       host: ${{ steps.setup.outputs.HOST }}
       dep-opts: ${{ steps.setup.outputs.DEP_OPTS }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           sparse-checkout: |
@@ -62,22 +71,24 @@ jobs:
           echo "DEP_HASH=${DEP_HASH}" >> "${GITHUB_OUTPUT}"
           DOCKERFILE_HASH="${{ hashFiles('contrib/containers/ci/ci.Dockerfile', 'contrib/containers/ci/ci-slim.Dockerfile') }}"
           PACKAGES_HASH="${{ hashFiles('depends/packages/*', 'depends/Makefile') }}"
-          CACHE_KEY="depends-${DOCKERFILE_HASH}-${{ inputs.runs-on }}-${{ inputs.build-target }}-${DEP_HASH}-${PACKAGES_HASH}"
+          CACHE_KEY_PREFIX="depends-${DOCKERFILE_HASH}-${{ inputs.base-image-digest }}-${{ inputs.runs-on }}-${{ inputs.build-target }}"
+          CACHE_KEY="${CACHE_KEY_PREFIX}-${DEP_HASH}-${PACKAGES_HASH}"
+          echo "cache-key-prefix=${CACHE_KEY_PREFIX}" >> "${GITHUB_OUTPUT}"
           echo "cache-key=${CACHE_KEY}" >> "${GITHUB_OUTPUT}"
           echo "Cache key: ${CACHE_KEY}"
         shell: bash
 
       - name: Check for cached depends
         id: cache-check
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: depends/built/${{ steps.setup.outputs.HOST }}
           key: ${{ steps.setup.outputs.cache-key }}
           lookup-only: true
 
       - name: Cache SDKs
         id: cache-sdk-check
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         if: inputs.build-target == 'mac'
         with:
           path: depends/SDKs
@@ -92,25 +103,25 @@ jobs:
     name: Build depends
     needs: [check-cache]
     if: needs.check-cache.outputs.cache-hit != 'true'
-    runs-on: ${{ inputs.runs-on }}
+    runs-on: ${{ inputs.effective-runs-on || inputs.runs-on }}
     container:
       image: ${{ inputs.container-path }}
       options: --user root
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Restore depends sources
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           path: depends/sources
           key: depends-sources-${{ hashFiles('depends/packages/*') }}
           restore-keys: depends-sources-
 
       - name: Restore SDKs cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         if: inputs.build-target == 'mac'
         with:
           path: depends/SDKs
@@ -119,20 +130,20 @@ jobs:
           fail-on-cache-miss: true
 
       - name: Restore cached depends
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           path: depends/built/${{ needs.check-cache.outputs.host }}
           key: ${{ needs.check-cache.outputs.cache-key }}
           restore-keys: |
-            depends-${{ hashFiles('contrib/containers/ci/ci.Dockerfile', 'contrib/containers/ci/ci-slim.Dockerfile') }}-${{ inputs.build-target }}-
+            ${{ needs.check-cache.outputs.cache-key-prefix }}-
 
       - name: Build depends
         run: |
           export HOST="${{ needs.check-cache.outputs.host }}"
           env ${{ needs.check-cache.outputs.dep-opts }} make -j$(nproc) -C depends
 
       - name: Save depends cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         with:
           path: depends/built/${{ needs.check-cache.outputs.host }}
           key: ${{ needs.check-cache.outputs.cache-key }}

.github/workflows/build.yml

@@ -29,6 +29,7 @@ jobs:
       use-blacksmith: ${{ steps.select-runner.outputs.use_blacksmith }}
       backlog-count: ${{ steps.select-runner.outputs.backlog_count }}
       decision-reason: ${{ steps.select-runner.outputs.decision_reason }}
+      base-image-digest: ${{ steps.base-image.outputs.digest }}
     steps:
       - name: Check skip environment variables
         id: skip-check
@@ -45,7 +46,7 @@ jobs:
 
       - name: Checkout code
         if: ${{ steps.skip-check.outputs.skip == 'false' }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Select runners
         id: select-runner
@@ -58,6 +59,26 @@ jobs:
         run: |
           python3 .github/workflows/select_dynamic_runner.py
 
+      - name: Get base image digest
+        id: base-image
+        if: ${{ steps.skip-check.outputs.skip == 'false' }}
+        run: |
+          # Fetch the canonical manifest digest for ubuntu:noble so the
+          # depends cache key changes when Canonical pushes base image
+          # updates (which may bump compiler versions).
+          # Falls back to "unknown" on failure so CI is not blocked.
+          TOKEN="$(curl -fsSL --max-time 10 \
+            'https://auth.docker.io/token?service=registry.docker.io&scope=repository:library/ubuntu:pull' \
+            | jq -r '.token')" || true
+          if [ -n "$TOKEN" ] && [ "$TOKEN" != "null" ]; then
+            DIGEST="$(curl -fsSL --max-time 10 \
+              -H "Authorization: Bearer $TOKEN" \
+              -H 'Accept: application/vnd.docker.distribution.manifest.list.v2+json' \
+              'https://registry-1.docker.io/v2/library/ubuntu/manifests/noble' \
+              -o /dev/null -D - | grep -i docker-content-digest | awk '{print $2}' | tr -d '\r' | sed 's/^sha256://')" || true
+          fi
+          echo "digest=${DIGEST:-unknown}" >> "$GITHUB_OUTPUT"
+
   cache-sources:
     name: Cache depends sources
     needs: [check-skip]
@@ -94,14 +115,15 @@ jobs:
     name: aarch64-linux-gnu
     uses: ./.github/workflows/build-depends.yml
     needs: [check-skip, container, cache-sources]
-    if: ${{ vars.SKIP_ARM_LINUX == '' }}
+    if: ${{ false && vars.SKIP_ARM_LINUX == '' }}
     with:
       build-target: aarch64-linux
       container-path: ${{ needs.container.outputs.path }}
+      base-image-digest: ${{ needs.check-skip.outputs.base-image-digest }}
       runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
 
   depends-linux64:
-    name: x86_64-pc-linux-gnu
+    name: linux64 (native)
     uses: ./.github/workflows/build-depends.yml
     needs: [check-skip, container, cache-sources]
     if: |
@@ -112,7 +134,9 @@ jobs:
     with:
       build-target: linux64
       container-path: ${{ needs.container.outputs.path }}
+      base-image-digest: ${{ needs.check-skip.outputs.base-image-digest }}
       runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
+      effective-runs-on: ${{ needs.check-skip.outputs['runner-arm64'] }}
 
   depends-linux64_multiprocess:
     name: linux64_multiprocess
@@ -124,6 +148,7 @@ jobs:
     with:
       build-target: linux64_multiprocess
       container-path: ${{ needs.container.outputs.path }}
+      base-image-digest: ${{ needs.check-skip.outputs.base-image-digest }}
       runs-on: ${{ needs.check-skip.outputs['runner-arm64'] }}
 
   depends-linux64_nowallet:
@@ -134,6 +159,7 @@ jobs:
     with:
       build-target: linux64_nowallet
       container-path: ${{ needs.container.outputs.path }}
+      base-image-digest: ${{ needs.check-skip.outputs.base-image-digest }}
       runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
 
   depends-mac:
@@ -144,6 +170,7 @@ jobs:
     with:
       build-target: mac
       container-path: ${{ needs.container.outputs.path }}
+      base-image-digest: ${{ needs.check-skip.outputs.base-image-digest }}
       runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
 
   depends-win64:
@@ -154,6 +181,7 @@ jobs:
     with:
       build-target: win64
       container-path: ${{ needs.container.outputs.path }}
+      base-image-digest: ${{ needs.check-skip.outputs.base-image-digest }}
       runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
 
   lint:
@@ -166,6 +194,7 @@ jobs:
 
   src-aarch64-linux:
     name: aarch64-linux-build
+    if: ${{ false }}
     uses: ./.github/workflows/build-src.yml
     needs: [check-skip, container, depends-aarch64-linux]
     with:
@@ -187,7 +216,7 @@ jobs:
       depends-key: ${{ needs.depends-linux64.outputs.key }}
       depends-host: ${{ needs.depends-linux64.outputs.host }}
       depends-dep-opts: ${{ needs.depends-linux64.outputs.dep-opts }}
-      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
+      runs-on: ${{ needs.check-skip.outputs['runner-arm64'] }}
 
   src-linux64_fuzz:
     name: linux64_fuzz-build
@@ -200,7 +229,7 @@ jobs:
       depends-key: ${{ needs.depends-linux64.outputs.key }}
       depends-host: ${{ needs.depends-linux64.outputs.host }}
       depends-dep-opts: ${{ needs.depends-linux64.outputs.dep-opts }}
-      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
+      runs-on: ${{ needs.check-skip.outputs['runner-arm64'] }}
 
   src-linux64_multiprocess:
     name: linux64_multiprocess-build
@@ -238,7 +267,7 @@ jobs:
       depends-key: ${{ needs.depends-linux64.outputs.key }}
       depends-host: ${{ needs.depends-linux64.outputs.host }}
       depends-dep-opts: ${{ needs.depends-linux64.outputs.dep-opts }}
-      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
+      runs-on: ${{ needs.check-skip.outputs['runner-arm64'] }}
 
   src-linux64_tsan:
     name: linux64_tsan-build
@@ -264,7 +293,7 @@ jobs:
       depends-key: ${{ needs.depends-linux64.outputs.key }}
       depends-host: ${{ needs.depends-linux64.outputs.host }}
       depends-dep-opts: ${{ needs.depends-linux64.outputs.dep-opts }}
-      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
+      runs-on: ${{ needs.check-skip.outputs['runner-arm64'] }}
 
   src-mac:
     name: mac-build
@@ -298,7 +327,7 @@ jobs:
       bundle-key: ${{ needs.src-linux64.outputs.key }}
       build-target: linux64
       container-path: ${{ needs.container-slim.outputs.path }}
-      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
+      runs-on: ${{ needs.check-skip.outputs['runner-arm64'] }}
 
   test-linux64_multiprocess:
     name: linux64_multiprocess-test
@@ -328,7 +357,7 @@ jobs:
       bundle-key: ${{ needs.src-linux64_sqlite.outputs.key }}
       build-target: linux64_sqlite
       container-path: ${{ needs.container-slim.outputs.path }}
-      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
+      runs-on: ${{ needs.check-skip.outputs['runner-arm64'] }}
 
   test-linux64_tsan:
     name: linux64_tsan-test
@@ -348,4 +377,4 @@ jobs:
       bundle-key: ${{ needs.src-linux64_ubsan.outputs.key }}
       build-target: linux64_ubsan
       container-path: ${{ needs.container-slim.outputs.path }}
-      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
+      runs-on: ${{ needs.check-skip.outputs['runner-arm64'] }}

.github/workflows/test-src.yml

@@ -49,7 +49,7 @@ jobs:
         with:
           path: |
             releases
-          key: releases-${{ hashFiles('ci/test/00_setup_env_native_qt5.sh', 'test/get_previous_releases.py') }}
+          key: releases-${{ runner.arch }}-${{ hashFiles('ci/test/00_setup_env_native_qt5.sh', 'test/get_previous_releases.py') }}
 
       - name: Run functional tests
         id: test

ci/dash/matrix.sh

@@ -16,9 +16,7 @@ export LSAN_OPTIONS="suppressions=${BASE_ROOT_DIR}/test/sanitizer_suppressions/l
 export TSAN_OPTIONS="suppressions=${BASE_ROOT_DIR}/test/sanitizer_suppressions/tsan:halt_on_error=1"
 export UBSAN_OPTIONS="suppressions=${BASE_ROOT_DIR}/test/sanitizer_suppressions/ubsan:print_stacktrace=1:halt_on_error=1:report_error_type=1"
 
-if [ "$BUILD_TARGET" = "aarch64-linux" ]; then
-  source ./ci/test/00_setup_env_aarch64.sh
-elif [ "$BUILD_TARGET" = "linux64" ]; then
+if [ "$BUILD_TARGET" = "linux64" ]; then
   source ./ci/test/00_setup_env_native_qt5.sh
 elif [ "$BUILD_TARGET" = "linux64_asan" ]; then
   source ./ci/test/00_setup_env_native_asan.sh

ci/dash/test_integrationtests.sh

@@ -23,7 +23,7 @@ export LD_LIBRARY_PATH=$DEPENDS_DIR/$HOST/lib
 if [ "$DOWNLOAD_PREVIOUS_RELEASES" = "true" ]; then
   echo "Downloading previous releases..."
   # shellcheck disable=SC2086
-  ./test/get_previous_releases.py -b -t "$PREVIOUS_RELEASES_DIR"
+  ./test/get_previous_releases.py -b -t "$PREVIOUS_RELEASES_DIR" ${PREVIOUS_RELEASES_TAGS:-}
 fi
 
 cd "build-ci/dashcore-$BUILD_TARGET"

ci/test/00_setup_env.sh

@@ -31,8 +31,31 @@ export MAKEJOBS=${MAKEJOBS:--j$(nproc)}
 export BASE_SCRATCH_DIR=${BASE_SCRATCH_DIR:-$BASE_ROOT_DIR/ci/scratch}
 # What host to compile for. See also ./depends/README.md
 # Tests that need cross-compilation export the appropriate HOST.
-# Tests that run natively guess the host
-export HOST=${HOST:-$("$BASE_ROOT_DIR/depends/config.guess")}
+# Tests that run natively detect the host based on architecture.
+# We use explicit triplets rather than config.guess to ensure they match
+# the triplets used by depends (e.g. aarch64-linux-gnu, not aarch64-unknown-linux-gnu).
+if [ -z "$HOST" ]; then
+  case "$(uname -m)" in
+    aarch64)
+      export HOST=aarch64-linux-gnu
+      ;;
+    x86_64)
+      export HOST=x86_64-pc-linux-gnu
+      ;;
+    *)
+      if command -v dpkg >/dev/null 2>&1; then
+        arch="$(dpkg --print-architecture)"
+        if [ "${arch}" = "arm64" ]; then
+          export HOST=aarch64-linux-gnu
+        elif [ "${arch}" = "amd64" ]; then
+          export HOST=x86_64-pc-linux-gnu
+        fi
+      fi
+      # Final fallback to config.guess
+      export HOST=${HOST:-$("$BASE_ROOT_DIR/depends/config.guess")}
+      ;;
+  esac
+fi
 # Whether to prefer BusyBox over GNU utilities
 export USE_BUSY_BOX=${USE_BUSY_BOX:-false}