backport: add CMake build system alongside Autotools

.github/workflows/build-src-cmake.yml

@@ -0,0 +1,149 @@
+name: Build source (CMake)
+
+on:
+  workflow_call:
+    inputs:
+      build-target:
+        description: "Target name as defined by inputs.sh"
+        required: true
+        type: string
+      container-path:
+        description: "Path to built container at registry"
+        required: true
+        type: string
+      depends-key:
+        description: "Key needed to access cached depends"
+        required: true
+        type: string
+      depends-host:
+        description: "Host triplet from depends build"
+        required: true
+        type: string
+      depends-dep-opts:
+        description: "DEP_OPTS used to build depends"
+        required: false
+        type: string
+        default: ""
+      depends-artifact:
+        description: "Artifact holding freshly built depends, used if the cache restore misses"
+        required: false
+        type: string
+        default: ""
+      runs-on:
+        description: "Runner label to use (e.g., ubuntu-24.04 or ubuntu-24.04-arm)"
+        required: true
+        type: string
+
+# Builds the tree with CMake on top of the depends prefix produced for the
+# Autotools jobs, which is what makes this a full-stack check: depends emits
+# toolchain.cmake, CMake consumes it, and the unit tests run against the
+# result, followed by a short functional smoke list. The full functional suite
+# stays with the Autotools jobs, so this job does not bundle artifacts.
+jobs:
+  build-src-cmake:
+    name: Build source (CMake)
+    runs-on: ${{ inputs.runs-on }}
+    container:
+      image: ${{ inputs.container-path }} # zizmor: ignore[unpinned-images] built earlier in this run by build-container.yml
+      options: --user root
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
+          fetch-depth: 50
+
+      - name: Initial setup
+        run: |
+          git config --global --add safe.directory "$PWD"
+        shell: bash
+
+      - name: Restore depends cache
+        id: depends-cache
+        uses: actions/cache/restore@v5
+        with:
+          path: depends/built/${{ inputs.depends-host }}
+          key: ${{ inputs.depends-key }}
+
+      - name: Download built depends
+        # Same-run handoff from build-depends.yml: pull_request_target runs
+        # have read-only cache tokens (GitHub change, June 2026), so freshly
+        # built depends arrive as an artifact instead of a cache entry. Also
+        # covers trusted runs whose cache save was denied (save only warns).
+        if: steps.depends-cache.outputs.cache-hit != 'true' && inputs.depends-artifact != ''
+        uses: actions/download-artifact@v8
+        with:
+          name: ${{ inputs.depends-artifact }}
+          path: depends/built/${{ inputs.depends-host }}
+
+      - name: Check built depends are present
+        if: steps.depends-cache.outputs.cache-hit != 'true' && inputs.depends-artifact == ''
+        run: |
+          echo "::error::Depends cache restore missed and no built depends artifact was provided"
+          exit 1
+        shell: bash
+
+      - name: Rebuild depends prefix
+        env:
+          DEPENDS_HOST: ${{ inputs.depends-host }}
+          DEP_OPTS: ${{ inputs.depends-dep-opts }}
+        run: |
+          # Use the HOST and DEP_OPTS from the depends build, not this build-target
+          # This ensures the build_id matches the cached packages, and it is what
+          # writes depends/${HOST}/toolchain.cmake.
+          # DEP_OPTS may contain shell-quoted values, e.g. CXX='clang++-19 -stdlib=libc++'
+          eval "DEP_OPTS_ARGS=(${DEP_OPTS})"
+          make -j$(nproc) -C depends HOST="${DEPENDS_HOST}" "${DEP_OPTS_ARGS[@]}"
+        shell: bash
+
+      - name: Restore ccache cache
+        uses: actions/cache/restore@v5
+        with:
+          path: |
+            /cache/ccache
+          key: ccache-${{ hashFiles('contrib/containers/ci/ci.Dockerfile', 'depends/packages/*') }}-${{ inputs.build-target }}-${{ github.sha }}
+          restore-keys: |
+            ccache-${{ hashFiles('contrib/containers/ci/ci.Dockerfile', 'depends/packages/*') }}-${{ inputs.build-target }}-
+
+      - name: Build source
+        env:
+          BUILD_TARGET: ${{ inputs.build-target }}
+        run: |
+          CCACHE_MAXSIZE="600M"
+          CACHE_DIR="/cache"
+          mkdir /output
+          BASE_OUTDIR="/output"
+          source ./ci/dash/matrix.sh
+          ./ci/dash/build_src_cmake.sh
+          ccache -X 9
+          ccache -c
+          du -hd0 "${BASE_OUTDIR}"
+        shell: bash
+
+      - name: Save ccache cache
+        if: |
+          github.event_name == 'push' &&
+          github.ref_name == github.event.repository.default_branch
+        uses: actions/cache/save@v5
+        with:
+          path: |
+            /cache/ccache
+          key: ccache-${{ hashFiles('contrib/containers/ci/ci.Dockerfile', 'depends/packages/*') }}-${{ inputs.build-target }}-${{ github.sha }}
+
+      - name: Run unit tests
+        env:
+          BUILD_TARGET: ${{ inputs.build-target }}
+        run: |
+          source ./ci/dash/matrix.sh
+          ./ci/dash/test_unittests_cmake.sh
+        shell: bash
+
+      - name: Run functional smoke tests
+        env:
+          BUILD_TARGET: ${{ inputs.build-target }}
+        run: |
+          source ./ci/dash/matrix.sh
+          ./ci/dash/test_integrationtests_cmake.sh
+        shell: bash

.github/workflows/build.yml

@@ -227,6 +227,7 @@ jobs:
     if: |
       vars.SKIP_LINUX64 == '' ||
       vars.SKIP_LINUX64_ASAN == '' ||
+      vars.SKIP_LINUX64_CMAKE == '' ||
       vars.SKIP_LINUX64_FUZZ == '' ||
       vars.SKIP_LINUX64_SQLITE == ''
     with:
@@ -340,6 +341,20 @@ jobs:
       runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
     secrets: *remote-ccache-auth
 
+  src-linux64_cmake:
+    name: linux64_cmake-build
+    uses: ./.github/workflows/build-src-cmake.yml
+    needs: [check-skip, container, depends-linux64]
+    if: ${{ vars.SKIP_LINUX64_CMAKE == '' }}
+    with:
+      build-target: linux64_cmake
+      container-path: ${{ needs.container.outputs.path }}
+      depends-key: ${{ needs.depends-linux64.outputs.key }}
+      depends-host: ${{ needs.depends-linux64.outputs.host }}
+      depends-dep-opts: ${{ needs.depends-linux64.outputs.dep-opts }}
+      depends-artifact: ${{ needs.depends-linux64.outputs.built-artifact }}
+      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
+
   src-linux64_fuzz:
     name: linux64_fuzz-build
     uses: ./.github/workflows/build-src.yml
@@ -519,7 +534,7 @@ jobs:
     name: Prune old ccache generations
     # Each develop push saves a new ccache/ctcache entry per target; keep only
     # the newest so the 10 GB repository cache stops evicting fresh ones.
-    needs: [src-aarch64-linux, src-linux64, src-linux64_asan, src-linux64_fuzz, src-linux64_multiprocess, src-linux64_nowallet, src-linux64_sqlite, src-linux64_tsan, src-mac, src-win64]
+    needs: [src-aarch64-linux, src-linux64, src-linux64_asan, src-linux64_cmake, src-linux64_fuzz, src-linux64_multiprocess, src-linux64_nowallet, src-linux64_sqlite, src-linux64_tsan, src-mac, src-win64]
     if: |
       !cancelled() &&
       github.event_name == 'push' &&

.gitignore

@@ -3,6 +3,11 @@
 todo.txt
 reset-files.bash
 
+# Build subdirectories.
+/*build*
+!/build-aux
+!/build_msvc
+
 *.tar.gz
 
 *.exe