ci: fractional platform validation and exact-SHA release preflight

.github/workflows/_build.yml

@@ -3,6 +3,10 @@ name: Build
 on:
   workflow_call:
     inputs:
+      source-sha:
+        required: false
+        type: string
+        default: ""
       runs-on:
         required: true
         type: string
@@ -24,6 +28,17 @@ jobs:
         shell: bash
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.source-sha || github.sha }}
+      - name: Verify checkout SHA
+        env:
+          EXPECTED_SHA: ${{ inputs.source-sha || github.sha }}
+        run: |
+          [[ "$EXPECTED_SHA" =~ ^[0-9a-f]{40}$ ]]
+          if [[ "$GITHUB_EVENT_NAME" == workflow_dispatch ]]; then
+            test "$EXPECTED_SHA" = "$GITHUB_SHA"
+          fi
+          test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"
 
       - uses: astral-sh/setup-uv@v5
         with:
@@ -102,6 +117,10 @@ jobs:
           ls -lh src/fastled/bin/
 
       - name: Build wheel
+        env:
+          # setup.py rebuilds the bundled binary; keep that rebuild on the
+          # requested target, especially Windows ARM on an x64 runner.
+          FASTLED_RUST_TARGET: ${{ inputs.rust-target }}
         run: |
           PLAT_NAME=""
           case "${{ inputs.rust-target }}" in
@@ -129,15 +148,15 @@ jobs:
         if: always() && inputs.wheel-smoke
         uses: actions/upload-artifact@v4
         with:
-          name: wheel-smoke-screenshot-${{ inputs.runs-on }}-${{ inputs.rust-target || 'native' }}
+          name: smoke-wheel-screenshot-${{ inputs.runs-on }}-${{ inputs.rust-target || 'native' }}
           path: ${{ runner.temp }}/fastled-wheel-smoke/artifacts/*.png
           if-no-files-found: error
 
       - name: Upload installed wheel viewer log
         if: always() && inputs.wheel-smoke
         uses: actions/upload-artifact@v4
         with:
-          name: wheel-smoke-log-${{ inputs.runs-on }}-${{ inputs.rust-target || 'native' }}
+          name: smoke-wheel-log-${{ inputs.runs-on }}-${{ inputs.rust-target || 'native' }}
           path: ${{ runner.temp }}/fastled-wheel-smoke/artifacts/*.log
           if-no-files-found: warn
 
@@ -146,12 +165,14 @@ jobs:
         with:
           name: wheel-${{ inputs.runs-on }}-${{ inputs.rust-target || 'native' }}
           path: dist/*.whl
+          if-no-files-found: error
 
       - name: Upload binary
         uses: actions/upload-artifact@v4
         with:
           name: binary-${{ inputs.runs-on }}-${{ inputs.rust-target || 'native' }}
           path: src/fastled/bin/fastled*
+          if-no-files-found: error
 
       - name: Upload failure logs
         if: failure()

.github/workflows/_integration-test.yml

@@ -3,6 +3,10 @@ name: Integration Test
 on:
   workflow_call:
     inputs:
+      source-sha:
+        required: false
+        type: string
+        default: ""
       runs-on:
         required: true
         type: string
@@ -18,6 +22,17 @@ jobs:
       PYTHONIOENCODING: utf-8
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.source-sha || github.sha }}
+      - name: Verify checkout SHA
+        env:
+          EXPECTED_SHA: ${{ inputs.source-sha || github.sha }}
+        run: |
+          [[ "$EXPECTED_SHA" =~ ^[0-9a-f]{40}$ ]]
+          if [[ "$GITHUB_EVENT_NAME" == workflow_dispatch ]]; then
+            test "$EXPECTED_SHA" = "$GITHUB_SHA"
+          fi
+          test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"
 
       - uses: astral-sh/setup-uv@v5
         with:
@@ -40,9 +55,10 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ github.token }}
         with:
-          # No soldr version pin: keep in lockstep with _build.yml so all jobs
-          # resolve the same soldr/zccache version and share warm caches
-          # (see the pin rationale comment in _build.yml and #158).
+          # Windows ARM native tests hit 0.7.51's listener timeout and
+          # 0.7.53's pre-lock timeout. Try 0.9.21's embedded daemon; keep
+          # other runners and cross-builds on 0.7.51 (see #158).
+          version: ${{ inputs.runs-on == 'windows-11-arm' && '0.9.21' || '0.7.51' }}
           # cache-preset: foundation expands to build-cache: true +
           # target-cache: false + cargo-registry-cache: false +
           # prebuild-deps: soldr-cook (setup-soldr v0.9.17+, #251).
@@ -64,6 +80,20 @@ jobs:
       - name: Native Test Suite
         run: ./test
 
+      - name: Capture Soldr failure diagnostics
+        if: failure() && inputs.runs-on == 'windows-11-arm'
+        continue-on-error: true
+        shell: pwsh
+        run: ./ci/capture_soldr_failure.ps1
+
+      - name: Upload Soldr failure diagnostics
+        if: failure() && inputs.runs-on == 'windows-11-arm'
+        uses: actions/upload-artifact@v4
+        with:
+          name: soldr-failure-diagnostics-integration-test-${{ inputs.runs-on }}-${{ github.run_attempt }}
+          path: soldr-failure-diagnostics/**
+          if-no-files-found: error
+
       - name: Upload failure logs
         if: failure()
         uses: actions/upload-artifact@v4

.github/workflows/_lint.yml

@@ -3,6 +3,10 @@ name: Lint
 on:
   workflow_call:
     inputs:
+      source-sha:
+        required: false
+        type: string
+        default: ""
       runs-on:
         required: true
         type: string
@@ -16,6 +20,17 @@ jobs:
         shell: bash
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.source-sha || github.sha }}
+      - name: Verify checkout SHA
+        env:
+          EXPECTED_SHA: ${{ inputs.source-sha || github.sha }}
+        run: |
+          [[ "$EXPECTED_SHA" =~ ^[0-9a-f]{40}$ ]]
+          if [[ "$GITHUB_EVENT_NAME" == workflow_dispatch ]]; then
+            test "$EXPECTED_SHA" = "$GITHUB_SHA"
+          fi
+          test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"
 
       - uses: astral-sh/setup-uv@v5
         with:

.github/workflows/_terminal-test.yml

@@ -14,6 +14,10 @@ name: Terminal Test
 on:
   workflow_call:
     inputs:
+      source-sha:
+        required: false
+        type: string
+        default: ""
       runs-on:
         required: true
         type: string
@@ -39,6 +43,17 @@ jobs:
       PYTHONIOENCODING: utf-8
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.source-sha || github.sha }}
+      - name: Verify checkout SHA
+        env:
+          EXPECTED_SHA: ${{ inputs.source-sha || github.sha }}
+        run: |
+          [[ "$EXPECTED_SHA" =~ ^[0-9a-f]{40}$ ]]
+          if [[ "$GITHUB_EVENT_NAME" == workflow_dispatch ]]; then
+            test "$EXPECTED_SHA" = "$GITHUB_SHA"
+          fi
+          test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"
 
       - uses: astral-sh/setup-uv@v5
         with:

.github/workflows/_unit-test.yml

@@ -3,6 +3,10 @@ name: Unit Test
 on:
   workflow_call:
     inputs:
+      source-sha:
+        required: false
+        type: string
+        default: ""
       runs-on:
         required: true
         type: string
@@ -18,6 +22,17 @@ jobs:
       PYTHONIOENCODING: utf-8
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.source-sha || github.sha }}
+      - name: Verify checkout SHA
+        env:
+          EXPECTED_SHA: ${{ inputs.source-sha || github.sha }}
+        run: |
+          [[ "$EXPECTED_SHA" =~ ^[0-9a-f]{40}$ ]]
+          if [[ "$GITHUB_EVENT_NAME" == workflow_dispatch ]]; then
+            test "$EXPECTED_SHA" = "$GITHUB_SHA"
+          fi
+          test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"
 
       - uses: astral-sh/setup-uv@v5
         with:
@@ -40,9 +55,10 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ github.token }}
         with:
-          # No soldr version pin: keep in lockstep with _build.yml so all jobs
-          # resolve the same soldr/zccache version and share warm caches
-          # (see the pin rationale comment in _build.yml and #158).
+          # Windows ARM native tests hit 0.7.51's listener timeout and
+          # 0.7.53's pre-lock timeout. Try 0.9.21's embedded daemon; keep
+          # other runners and cross-builds on 0.7.51 (see #158).
+          version: ${{ inputs.runs-on == 'windows-11-arm' && '0.9.21' || '0.7.51' }}
           # cache-preset: foundation expands to build-cache: true +
           # target-cache: false + cargo-registry-cache: false +
           # prebuild-deps: soldr-cook (setup-soldr v0.9.17+, #251).
@@ -64,6 +80,20 @@ jobs:
       - name: Unit Tests
         run: ./test
 
+      - name: Capture Soldr failure diagnostics
+        if: failure() && inputs.runs-on == 'windows-11-arm'
+        continue-on-error: true
+        shell: pwsh
+        run: ./ci/capture_soldr_failure.ps1
+
+      - name: Upload Soldr failure diagnostics
+        if: failure() && inputs.runs-on == 'windows-11-arm'
+        uses: actions/upload-artifact@v4
+        with:
+          name: soldr-failure-diagnostics-unit-test-${{ inputs.runs-on }}-${{ github.run_attempt }}
+          path: soldr-failure-diagnostics/**
+          if-no-files-found: error
+
       - name: Upload failure logs
         if: failure()
         uses: actions/upload-artifact@v4