From 17d1841f26893dd6ca64041eb26124736425bec3 Mon Sep 17 00:00:00 2001
From: Roman Sirokov <roman.sirokov@amd.com>
Date: Fri, 12 Jun 2026 15:17:32 +0300
Subject: [PATCH 1/2] ci: remove dup build step, gate acceptance on push, add
 CARGO_TARGET_DIR

---
 .github/workflows/ci.yml | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7f7f37c8..fe8adf8b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,6 +11,7 @@ permissions:
 
 env:
   CARGO_TERM_COLOR: always
+  CARGO_TARGET_DIR: target
 
 jobs:
   build-and-test:
@@ -34,9 +35,6 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-cargo-
 
-      - name: Build
-        run: cargo build --workspace --all-targets
-
       - name: Test
         run: cargo test --workspace --all-targets
 
@@ -61,6 +59,7 @@ jobs:
         run: python scripts/release_readiness.py --self-test
 
       - name: Acceptance install lifecycle
+        if: github.event_name == 'push'
         run: ./scripts/acceptance-install-upgrade-tui-uninstall.sh
 
   windows-build-and-test:
@@ -70,10 +69,6 @@ jobs:
 
       - uses: dtolnay/rust-toolchain@stable
 
-      - name: Build
-        shell: pwsh
-        run: cargo build --workspace --all-targets
-
       - name: Test
         shell: pwsh
         run: cargo test --workspace --all-targets

From 243b914ba932d97f88c0f3772fbee35a8044a9dd Mon Sep 17 00:00:00 2001
From: Roman Sirokov <roman.sirokov@amd.com>
Date: Fri, 12 Jun 2026 15:20:04 +0300
Subject: [PATCH 2/2] ci: skip vendored Codex recompile using
 ROCM_CODEX_PREBUILT_BINARY

build-vendored-codex.sh: when ROCM_CODEX_PREBUILT_BINARY is set, copy the
prebuilt binary directly instead of running a full Cargo build of the vendored
Codex workspace.

acceptance script: after the release build completes, export
ROCM_CODEX_PREBUILT_BINARY pointing at target/release/rocm-codex so that the
packaging step reuses the binary already on disk instead of triggering a second
multi-minute cold compile with separate dependency downloads.

ci.yml: on push builds, run the release build + codex once before the
acceptance step so the prebuilt binary is warm in the cache.
---
 .github/workflows/ci.yml                      |  6 +++
 ...cceptance-install-upgrade-tui-uninstall.sh | 18 +++++++++
 scripts/build-vendored-codex.sh               | 39 +++++++++++++++++++
 3 files changed, 63 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fe8adf8b..3f651a85 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,6 +38,12 @@ jobs:
       - name: Test
         run: cargo test --workspace --all-targets
 
+      - name: Pre-build release binaries and codex for acceptance step
+        if: github.event_name == 'push'
+        run: |
+          cargo build --release -p rocm -p rocmd -p rocm-engine-pytorch -p rocm-engine-llama-cpp -p rocm-engine-lemonade -p rocm-engine-atom -p rocm-engine-vllm -p rocm-engine-sglang
+          bash scripts/build-vendored-codex.sh release
+
       - name: Local no-fallback smoke
         run: python scripts/smoke_local.py --skip-build
 
diff --git a/scripts/acceptance-install-upgrade-tui-uninstall.sh b/scripts/acceptance-install-upgrade-tui-uninstall.sh
index 63290e11..862d6b4f 100755
--- a/scripts/acceptance-install-upgrade-tui-uninstall.sh
+++ b/scripts/acceptance-install-upgrade-tui-uninstall.sh
@@ -108,6 +108,24 @@ expect_failure() {
 echo "acceptance: build release binaries"
 (cd "${REPO_ROOT}" && cargo build --release -p rocm -p rocmd -p rocm-engine-pytorch -p rocm-engine-llama-cpp -p rocm-engine-lemonade -p rocm-engine-atom -p rocm-engine-vllm -p rocm-engine-sglang)
 
+# Resolve the prebuilt Codex binary location so packaging can skip a second
+# full compilation of the large vendored Codex workspace.  The binary is built
+# once during the main CI build step (which uses the same CARGO_TARGET_DIR)
+# and reused here.  If the binary is not present (e.g. first local run) the
+# packaging script will compile it normally.
+CODEX_CANDIDATE="${REPO_ROOT}/target/release/rocm-codex"
+if [[ -n "${CARGO_TARGET_DIR:-}" ]]; then
+  if [[ "${CARGO_TARGET_DIR}" = /* ]]; then
+    CODEX_CANDIDATE="${CARGO_TARGET_DIR}/release/rocm-codex"
+  else
+    CODEX_CANDIDATE="${REPO_ROOT}/${CARGO_TARGET_DIR}/release/rocm-codex"
+  fi
+fi
+if [[ -x "${CODEX_CANDIDATE}" ]]; then
+  export ROCM_CODEX_PREBUILT_BINARY="${CODEX_CANDIDATE}"
+  echo "acceptance: reusing prebuilt rocm-codex at ${CODEX_CANDIDATE}"
+fi
+
 echo "acceptance: generate signing key"
 openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out "${SIGNING_PRIVATE_KEY}" >/dev/null 2>&1 \
   || fail "failed to generate acceptance signing private key"
diff --git a/scripts/build-vendored-codex.sh b/scripts/build-vendored-codex.sh
index 0fe4792c..880d9c04 100644
--- a/scripts/build-vendored-codex.sh
+++ b/scripts/build-vendored-codex.sh
@@ -28,6 +28,45 @@ need_cmd() {
 
 need_cmd cargo
 
+# ---------------------------------------------------------------------------
+# Prebuilt binary fast path.
+#
+# Set ROCM_CODEX_PREBUILT_BINARY to an absolute path of an already-compiled
+# `codex` binary to skip the full Cargo build.  The binary is still installed
+# into the same ROCM_PROFILE_DIR location as the compiled one, so the rest of
+# the packaging pipeline is unaffected.
+#
+# In CI this lets the acceptance step reuse the binary that was produced by the
+# earlier release build step instead of compiling the large vendored Codex
+# workspace a second time.
+# ---------------------------------------------------------------------------
+if [[ -n "${ROCM_CODEX_PREBUILT_BINARY:-}" ]]; then
+  if [[ ! -f "${ROCM_CODEX_PREBUILT_BINARY}" ]]; then
+    echo "ROCM_CODEX_PREBUILT_BINARY is set but file not found: ${ROCM_CODEX_PREBUILT_BINARY}" >&2
+    exit 1
+  fi
+  if [[ -n "${CARGO_TARGET_DIR:-}" ]]; then
+    if [[ "${CARGO_TARGET_DIR}" = /* ]]; then
+      ROCM_TARGET_DIR="${CARGO_TARGET_DIR}"
+    else
+      ROCM_TARGET_DIR="${REPO_ROOT}/${CARGO_TARGET_DIR}"
+    fi
+  else
+    ROCM_TARGET_DIR="${REPO_ROOT}/target"
+  fi
+  if [[ -n "${TARGET_TRIPLE}" ]]; then
+    ROCM_PROFILE_DIR="${ROCM_TARGET_DIR}/${TARGET_TRIPLE}/${PROFILE}"
+  else
+    ROCM_PROFILE_DIR="${ROCM_TARGET_DIR}/${PROFILE}"
+  fi
+  mkdir -p "${ROCM_PROFILE_DIR}"
+  install -m 0755 "${ROCM_CODEX_PREBUILT_BINARY}" "${ROCM_PROFILE_DIR}/rocm-codex"
+  echo "using prebuilt vendored Codex binary"
+  echo "  source: ${ROCM_CODEX_PREBUILT_BINARY}"
+  echo "  installed wrapper binary: ${ROCM_PROFILE_DIR}/rocm-codex"
+  exit 0
+fi
+
 if [[ "$(uname -s)" == "Linux" ]]; then
   need_cmd pkg-config
   LOCAL_DEV_SYSROOT="${ROCM_CLI_PORTABLE_BUILD_DEPS_ROOT:-${REPO_ROOT}/.rocm-work/tools/wsl-build-deps}/root"