Pin SWIG 4.4.1 across package builds

.github/workflows/macos.yml

@@ -85,7 +85,7 @@ jobs:
           # specific dependency set. A prefix fallback would mix them with a
           # different vcpkg baseline - that is how liblzma 5.8.2 artifacts ended
           # up beside a 5.8.3 install and hung dylibbundler on a missing dylib.
-          key: builds-${{ matrix.os }}-${{ matrix.arch }}-${{ hashFiles('shared/GdalCore.opt', 'osx/gdal-makefile', 'shared/common.mk', 'osx/vcpkg-makefile', 'shared/vcpkg.json', 'shared/vcpkg-configuration.json', 'shared/vcpkg-lock.json') }}
+          key: builds-${{ matrix.os }}-${{ matrix.arch }}-${{ hashFiles('ci/install-swig-unix.sh', 'osx/before-install.sh', 'shared/swig.lock', 'shared/GdalCore.opt', 'osx/gdal-makefile', 'shared/common.mk', 'osx/vcpkg-makefile', 'shared/vcpkg.json', 'shared/vcpkg-configuration.json', 'shared/vcpkg-lock.json') }}
 
       # Layer 3: .NET SDK packages
       - name: Cache .NET packages

.github/workflows/unix.yml

@@ -90,8 +90,8 @@ jobs:
             DOTNET_VERSION=${{ inputs.dotnet-version }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha,scope=gdalnetcore-${{ matrix.arch }}-${{ hashFiles('ci/Dockerfile.unix', 'shared/GdalCore.opt', 'unix/vcpkg-makefile', 'shared/vcpkg.json', 'shared/vcpkg-configuration.json', 'shared/vcpkg-lock.json') }}
-          cache-to: type=gha,scope=gdalnetcore-${{ matrix.arch }}-${{ hashFiles('ci/Dockerfile.unix', 'shared/GdalCore.opt', 'unix/vcpkg-makefile', 'shared/vcpkg.json', 'shared/vcpkg-configuration.json', 'shared/vcpkg-lock.json') }},mode=max
+          cache-from: type=gha,scope=gdalnetcore-${{ matrix.arch }}-${{ hashFiles('ci/Dockerfile.unix', 'ci/install-swig-unix.sh', 'shared/swig.lock', 'shared/GdalCore.opt', 'unix/vcpkg-makefile', 'shared/vcpkg.json', 'shared/vcpkg-configuration.json', 'shared/vcpkg-lock.json') }}
+          cache-to: type=gha,scope=gdalnetcore-${{ matrix.arch }}-${{ hashFiles('ci/Dockerfile.unix', 'ci/install-swig-unix.sh', 'shared/swig.lock', 'shared/GdalCore.opt', 'unix/vcpkg-makefile', 'shared/vcpkg.json', 'shared/vcpkg-configuration.json', 'shared/vcpkg-lock.json') }},mode=max
 
       - name: Build and push on local runner
         uses: docker/build-push-action@v5
@@ -109,8 +109,8 @@ jobs:
             DOTNET_VERSION=${{ inputs.dotnet-version }}
             DOTNET_INSTALL_DIR=/build/ci/cache/.dotnet
             VCPKG_DEFAULT_BINARY_CACHE=/build/ci/cache/vcpkg-archives/
-          cache-from: type=gha,scope=gdalnetcore-${{ matrix.arch }}-${{ hashFiles('ci/Dockerfile.unix', 'shared/GdalCore.opt', 'unix/vcpkg-makefile', 'shared/vcpkg.json', 'shared/vcpkg-configuration.json', 'shared/vcpkg-lock.json') }}
-          cache-to: type=gha,scope=gdalnetcore-${{ matrix.arch }}-${{ hashFiles('ci/Dockerfile.unix', 'shared/GdalCore.opt', 'unix/vcpkg-makefile', 'shared/vcpkg.json', 'shared/vcpkg-configuration.json', 'shared/vcpkg-lock.json') }},mode=max
+          cache-from: type=gha,scope=gdalnetcore-${{ matrix.arch }}-${{ hashFiles('ci/Dockerfile.unix', 'ci/install-swig-unix.sh', 'shared/swig.lock', 'shared/GdalCore.opt', 'unix/vcpkg-makefile', 'shared/vcpkg.json', 'shared/vcpkg-configuration.json', 'shared/vcpkg-lock.json') }}
+          cache-to: type=gha,scope=gdalnetcore-${{ matrix.arch }}-${{ hashFiles('ci/Dockerfile.unix', 'ci/install-swig-unix.sh', 'shared/swig.lock', 'shared/GdalCore.opt', 'unix/vcpkg-makefile', 'shared/vcpkg.json', 'shared/vcpkg-configuration.json', 'shared/vcpkg-lock.json') }},mode=max
 
       - name: Extract artifacts
         run: |

.github/workflows/windows.yml

@@ -83,7 +83,7 @@ jobs:
             !build-win/vcpkg/packages/
           # No restore-keys on purpose: see macos.yml. Restoring build outputs
           # by prefix mixes them with a different vcpkg baseline.
-          key: builds-${{ runner.os }}-${{ hashFiles('shared/GdalCore.opt', 'win/install.ps1', 'win/functions.psm1', 'win/partials.psm1', 'win/vcpkg-makefile.vc', 'shared/vcpkg.json', 'shared/vcpkg-configuration.json', 'shared/vcpkg-lock.json') }}
+          key: builds-${{ runner.os }}-${{ hashFiles('shared/swig.lock', 'shared/GdalCore.opt', 'win/install.ps1', 'win/functions.psm1', 'win/partials.psm1', 'win/vcpkg-makefile.vc', 'shared/vcpkg.json', 'shared/vcpkg-configuration.json', 'shared/vcpkg-lock.json') }}
 
       # Layer 3: .NET SDK packages
       - name: Cache .NET packages

ci/Dockerfile.unix

@@ -9,14 +9,19 @@ RUN apt-get update && apt-get install -y \
     curl zip unzip tar git wget \
     pkg-config \
     ninja-build \
-    autoconf libtool autoconf-archive libudev-dev \
+    autoconf libtool autoconf-archive libudev-dev libpcre2-dev \
     python3 python3-pip \
     libhdf4-dev libnetcdf-dev linux-libc-dev \
-    swig patchelf gettext bison flex \
+    patchelf gettext bison flex \
 # required for gdal
     default-libmysqlclient-dev && \
     rm -rf /var/lib/apt/lists/* && apt-get clean
 
+COPY ci/install-swig-unix.sh /tmp/install-swig-unix.sh
+COPY shared/swig.lock /tmp/swig.lock
+RUN chmod +x /tmp/install-swig-unix.sh && \
+    SWIG_LOCK_FILE=/tmp/swig.lock SWIG_INSTALL_PREFIX=/usr/local /tmp/install-swig-unix.sh
+
 # bookworm ships gcc 12 and autoconf 2.71, so the old apt-pin and the
 # autoconf-from-source build are gone. Assert the floor a base bump would break.
 RUN gcc -dumpversion | awk -F. '{ if ($1 < 12) { print "gcc >= 12 required, got " $0; exit 1 } }' && \

ci/Dockerfile.vcpkg

@@ -7,11 +7,16 @@ RUN apt-get update && apt-get install -y \
     curl zip unzip tar git wget \
     pkg-config \
     ninja-build \
-    autoconf libtool autoconf-archive libudev-dev \
+    autoconf libtool autoconf-archive libudev-dev libpcre2-dev \
     python3 python3-pip \
     linux-libc-dev \
     libhdf4-dev libnetcdf-dev linux-libc-dev \
-    swig patchelf
+    patchelf
+
+COPY ci/install-swig-unix.sh /tmp/install-swig-unix.sh
+COPY shared/swig.lock /tmp/swig.lock
+RUN chmod +x /tmp/install-swig-unix.sh && \
+    SWIG_LOCK_FILE=/tmp/swig.lock SWIG_INSTALL_PREFIX=/usr/local /tmp/install-swig-unix.sh
 
 # install cmake latest (--break-system-packages: PEP 668 on bookworm)
 RUN pip install cmake --upgrade --break-system-packages
@@ -41,4 +46,4 @@ set(VCPKG_CMAKE_SYSTEM_NAME Linux)" > custom-triplets/${BUILD_ARCH}-linux.cmake
 
 RUN cat custom-triplets/${BUILD_ARCH}-linux.cmake
 
-RUN ./vcpkg install hdf5:${BUILD_ARCH}-linux  --overlay-triplets=./custom-triplets --editable
+RUN ./vcpkg install hdf5:${BUILD_ARCH}-linux  --overlay-triplets=./custom-triplets --editable

ci/install-swig-unix.sh

@@ -0,0 +1,40 @@
+#!/bin/sh
+
+set -eu
+
+script_dir=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)
+SWIG_LOCK_FILE=${SWIG_LOCK_FILE:-"$script_dir/../shared/swig.lock"}
+SWIG_INSTALL_PREFIX=${SWIG_INSTALL_PREFIX:-/usr/local}
+
+IFS=' ' read -r SWIG_VERSION SWIG_SHA256 extra < "$SWIG_LOCK_FILE"
+if [ -n "${extra:-}" ] || ! echo "$SWIG_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$' || ! echo "$SWIG_SHA256" | grep -Eq '^[0-9a-f]{64}$'; then
+    echo "Invalid SWIG lock file: $SWIG_LOCK_FILE" >&2
+    exit 1
+fi
+
+work_dir=$(mktemp -d)
+trap 'rm -rf "$work_dir"' EXIT
+
+archive="$work_dir/swig-$SWIG_VERSION.tar.gz"
+curl --fail --location --silent --show-error --retry 3 \
+    "https://downloads.sourceforge.net/project/swig/swig/swig-$SWIG_VERSION/swig-$SWIG_VERSION.tar.gz" \
+    --output "$archive"
+
+if command -v sha256sum >/dev/null 2>&1; then
+    actual_sha256=$(sha256sum "$archive" | awk '{print $1}')
+else
+    actual_sha256=$(shasum -a 256 "$archive" | awk '{print $1}')
+fi
+
+if [ "$actual_sha256" != "$SWIG_SHA256" ]; then
+    echo "SWIG $SWIG_VERSION checksum mismatch: expected $SWIG_SHA256, got $actual_sha256" >&2
+    exit 1
+fi
+
+tar -xzf "$archive" -C "$work_dir"
+cd "$work_dir/swig-$SWIG_VERSION"
+./configure --prefix="$SWIG_INSTALL_PREFIX"
+make -j2
+make install
+
+"$SWIG_INSTALL_PREFIX/bin/swig" -version

osx/README.md

@@ -10,7 +10,8 @@
 ## Prerequisites
 
 1. Install [**homebrew**](https://docs.brew.sh/Installation) and [**macports**](https://www.macports.org/install.php) (for hdf4 hdf5 netcdf drivers).
-2. Install base packages with `./before-install.sh`
+2. Install base packages with `./before-install.sh`, then add the pinned SWIG to your shell:
+   `export PATH="$HOME/.local/swig/bin:$PATH"`
 3. Install [dotnet](https://dotnet.microsoft.com/en-us/download) to build Nuget packages
 
 ### **1. Environment**

osx/before-install.sh

@@ -4,7 +4,15 @@ set -e
 
 # requirements for CI runner
 brew install make pkg-config autoconf automake \
-    autoconf-archive swig libtool dylibbundler gsed bison
+    autoconf-archive pcre2 libtool dylibbundler gsed bison
+
+swig_prefix="${RUNNER_TEMP:-$HOME/.local}/swig"
+SWIG_INSTALL_PREFIX="$swig_prefix" "$(dirname "$0")/../ci/install-swig-unix.sh"
+export PATH="$swig_prefix/bin:$PATH"
+
+if [ -n "${GITHUB_PATH:-}" ]; then
+  echo "$swig_prefix/bin" >> "$GITHUB_PATH"
+fi
 
 # Install pipx without upgrading python dependencies
 brew install --ignore-dependencies pipx || python3 -m pip install --user pipx

shared/swig.lock

@@ -0,0 +1 @@
+4.4.1 40162a706c56f7592d08fd52ef5511cb7ac191f3593cf07306a0a554c6281fcf

unix/README.md

@@ -22,7 +22,8 @@ I'm compiling on **Debian 12 (2023) with GLIBC 2.36 (2022)**. Note that the buil
 ### **2. Base packages**. VCPKG and pipeline scripts won't work without them:
 
 ```bash
-sudo apt-get install g++ make cmake git curl zip unzip tar pkg-config linux-headers-amd64 autoconf automake python3 autoconf-archive swig patchelf 
+./before-install.sh
+export PATH="$HOME/.local/swig/bin:$PATH"
 ```
 
 ### 3. **Install .NET**

unix/before-install.sh

@@ -3,4 +3,12 @@ set -e
 sudo apt-get update
 sudo apt-get install g++ make cmake git curl \
       zip unzip tar pkg-config linux-headers-generic libltdl-dev \
-      autoconf automake python3 autoconf-archive swig patchelf bison -y
+      autoconf automake python3 autoconf-archive libpcre2-dev patchelf bison -y
+
+swig_prefix="${RUNNER_TEMP:-$HOME/.local}/swig"
+SWIG_INSTALL_PREFIX="$swig_prefix" "$(dirname "$0")/../ci/install-swig-unix.sh"
+export PATH="$swig_prefix/bin:$PATH"
+
+if [ -n "${GITHUB_PATH:-}" ]; then
+      echo "$swig_prefix/bin" >> "$GITHUB_PATH"
+fi

win/functions.psm1

@@ -180,8 +180,26 @@ function Install-PwshModuleRequirements {
         Install-Module -Name Choco -Scope CurrentUser -Force
     } 
 
-    if (!(Get-Command "swig" -ErrorAction SilentlyContinue)) {
-        exec { choco install -y --no-progress --force swig }
+    $swigLockPath = Join-Path $PSScriptRoot "../shared/swig.lock"
+    $swigLock = (Get-Content -Raw $swigLockPath).Trim() -split '\s+'
+    if ($swigLock.Count -ne 2 -or $swigLock[0] -notmatch '^\d+\.\d+\.\d+$' -or $swigLock[1] -notmatch '^[0-9a-f]{64}$') {
+        throw "Invalid SWIG lock file: $swigLockPath"
+    }
+    $requiredSwigVersion = $swigLock[0]
+    $installedSwigVersion = if (Get-Command "swig" -ErrorAction SilentlyContinue) {
+        $versionMatch = (& swig -version | Select-String -Pattern 'SWIG Version ([0-9.]+)').Matches
+        if ($versionMatch.Count -gt 0) {
+            $versionMatch[0].Groups[1].Value
+        }
+    }
+
+    if ($installedSwigVersion -ne $requiredSwigVersion) {
+        exec { choco install -y --no-progress --force --allow-downgrade swig --version $requiredSwigVersion }
+    }
+
+    $installedSwigVersion = (& swig -version | Select-String -Pattern 'SWIG Version ([0-9.]+)').Matches[0].Groups[1].Value
+    if ($installedSwigVersion -ne $requiredSwigVersion) {
+        throw "SWIG $requiredSwigVersion is required, but $installedSwigVersion is active."
     }
 }