Tensor inference, opt-in vocal separation, GPU runtime, and cross-platform CI

.github/workflows/lame_pins.yml

@@ -0,0 +1,56 @@
+name: LAME Pin Update
+
+# Keeps assets/lame-pins.json in step with upstream LAME packages. The app reads
+# that file from master, so merging the pull request this opens is what updates
+# installed copies. It is never merged automatically: a changed hash is exactly
+# what a tampered upstream would look like, so a person confirms it first.
+
+on:
+  schedule:
+    - cron: "0 5 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update-pins:
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: master
+
+      - name: Refresh pins
+        run: python3 tools/update_lame_pins.py | tee pin-changes.txt
+
+      - name: Open pull request
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if git diff --quiet -- assets/lame-pins.json; then
+            echo "Pins are current."
+            exit 0
+          fi
+          branch=chore/lame-pins
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git switch -C "$branch"
+          git add assets/lame-pins.json
+          git commit -m "chore(util): refresh LAME download pins"
+          git push --force origin "$branch"
+          {
+            echo "Upstream LAME packages changed. Merging this updates the pins every installed copy uses."
+            echo
+            echo "Check each change against its source before merging. Windows (zip) changes have no independent confirmation."
+            echo
+            echo '```'
+            cat pin-changes.txt
+            echo '```'
+          } > pr-body.md
+          gh pr view "$branch" --json state -q .state 2>/dev/null | grep -q OPEN \
+            && gh pr edit "$branch" --body-file pr-body.md \
+            || gh pr create --base master --head "$branch" --title "chore(util): refresh LAME download pins" --body-file pr-body.md

.github/workflows/nightly_golden_eval.yml

@@ -1,6 +1,8 @@
 name: Nightly Golden Eval
 
 on:
+  push:
+    branches: [master, "feat/**"]
   schedule:
     - cron: "0 2 * * *"
   workflow_dispatch:
@@ -11,12 +13,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install Dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y libasound2-dev libjack-jackd2-dev libfreetype6-dev libfontconfig1-dev libx11-dev libxcomposite-dev libxcursor-dev libxext-dev libxinerama-dev libxrandr-dev libxrender-dev libwebkit2gtk-4.1-dev libgtk-3-dev libglu1-mesa-dev mesa-common-dev libcurl4-openssl-dev
+          sudo apt-get install -y ffmpeg libasound2-dev libjack-jackd2-dev libfreetype6-dev libfontconfig1-dev libx11-dev libxcomposite-dev libxcursor-dev libxext-dev libxinerama-dev libxrandr-dev libxrender-dev libwebkit2gtk-4.1-dev libgtk-3-dev libglu1-mesa-dev mesa-common-dev libcurl4-openssl-dev
 
       - name: Configure
         run: cmake -S . -B build-codex -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=ON -DBUILD_TOOLS=ON
@@ -39,7 +41,7 @@ jobs:
 
       - name: Upload Eval Artifacts
         if: success() || failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: nightly-golden-eval
           path: |

.github/workflows/onnx_native.yml

@@ -0,0 +1,95 @@
+name: Native ONNX Runtime CI
+
+on:
+  push:
+    branches: [main, "feat/**"]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: onnx-native-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  native-ort:
+    name: Native ORT (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-24.04
+            cmake_args: "-G Ninja"
+          - os: ubuntu-24.04-arm
+            cmake_args: "-G Ninja"
+          - os: windows-latest
+            cmake_args: "-A x64"
+          - os: macos-15
+            cmake_args: "-G Ninja"
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: Install Linux dependencies
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            build-essential cmake ninja-build pkg-config curl ffmpeg \
+            libasound2-dev libjack-jackd2-dev libfreetype6-dev libfontconfig1-dev \
+            libx11-dev libxcomposite-dev libxcursor-dev libxext-dev libxinerama-dev \
+            libxrandr-dev libxrender-dev libwebkit2gtk-4.1-dev libgtk-3-dev \
+            libglu1-mesa-dev mesa-common-dev libcurl4-openssl-dev
+
+      - name: Install macOS build tools
+        if: runner.os == 'macOS'
+        run: |
+          brew install ninja ffmpeg
+
+      - name: Install Windows dependencies
+        if: runner.os == 'Windows'
+        run: |
+          choco install ffmpeg --no-progress
+          echo "C:\ProgramData\chocolatey\bin" >> $env:GITHUB_PATH
+
+      - name: Cache fetched dependencies
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: build/_deps
+          key: deps-ort-1.30.0-${{ matrix.os }}-${{ runner.arch }}-${{ hashFiles('cmake/FetchOnnxRuntime.cmake', 'CMakeLists.txt') }}
+          restore-keys: |
+            deps-ort-1.30.0-${{ matrix.os }}-${{ runner.arch }}-
+
+      - name: Configure CMake
+        run: >
+          cmake -S . -B build
+          ${{ matrix.cmake_args }}
+          -DCMAKE_BUILD_TYPE=Release
+          -DENABLE_ONNX=ON
+          -DAUTOMIX_FETCH_ORT=ON
+          -DAUTOMIX_ORT_FLAVOR=cpu
+          -DBUILD_TESTING=ON
+          -DBUILD_TOOLS=ON
+
+      - name: Build
+        run: cmake --build build --config Release --parallel 3
+
+      - name: Run Tests (Full Suite)
+        run: ctest --test-dir build -C Release --output-on-failure
+
+      - name: HTTPS download smoke (Linux, curl)
+        if: runner.os == 'Linux'
+        run: |
+          set -euo pipefail
+          tools_bin="$(find build -type f -name automix_dev_tools -perm -u+x | head -n1)"
+          test -n "$tools_bin"
+          ok=0
+          for attempt in 1 2 3; do
+            if "$tools_bin" model browse --limit 1 --out browse.json; then
+              if python3 -c "import json,sys; d=json.load(open('browse.json')); sys.exit(0 if len(d)>=1 else 1)"; then ok=1; break; fi
+            fi
+            sleep 10
+          done
+          test "$ok" = 1