Skip to content

Reuse OpenSSL and libffi builds across compatible Windows CI jobs - #1408

Draft
jjhelmus wants to merge 5 commits into
mainfrom
codex/reuse-windows-deps-in-ci
Draft

jjhelmus wants to merge 5 commits into
mainfrom
codex/reuse-windows-deps-in-ci

Conversation

@jjhelmus

Copy link
Copy Markdown
Contributor

Build OpenSSL and libffi once for each configuration shared by multiple Windows CPython jobs.
Archives are used only when its full fingerprint matches their source, target, toolchain, SDK, and build inputs.
A missing producer or cache entry falls back to a local build.
Cygwin is installed only when libffi needs to be built.

The full release matrix has 60 Windows CPython jobs, requiring 60 OpenSSL and libffi builds. This change reduces this to 7 of each, avoiding 53 builds. Based on previous build time for these libraries, this change is estimated to save ~7.5 hours of CI time for a full build matrix. Importantly this should speed up the ARM64 Windows builds which often take the longest, although the time for the first complete build is not significantly effected.

Identify dependency builds by their sources, patches, target, resolved
MSVC toolchain, SDK, and build flags. Keep Python 3.11's OpenSSL uplink
variant separate. For libffi, hash prepare_libffi.bat from the pinned
CPython source and restrict unrecognized scripts to that source archive.

Add commands to report archive paths or build a single dependency.
Reuse a matching archive when present and publish a fresh archive
atomically on a miss. Keep filenames short while matching against the
full fingerprint.
Emit one producer for each OpenSSL or libffi configuration shared by
multiple selected Windows builds. Group by target, runner, and
toolchain.
Keep the Python 3.11 OpenSSL uplink variant separate and group libffi
builds by the expected hash of CPython's preparation script.

Skip producers for dry runs and configurations with a single consumer.
Preserve the default Windows build on unlabeled pull requests.
Run dependency producers for configurations shared by multiple Windows
builds. Restore each archive using the fingerprint computed on the
consumer's runner, and build locally when a producer or cache restore
fails.

Install Cygwin only when libffi must be built. Discard partial restores
so an incomplete archive cannot be mistaken for a cache hit.
@jjhelmus jjhelmus closed this Oct 26, 2026
@jjhelmus jjhelmus added platform:windows Specific to the Windows platform arch:all Select all architectures build:all python:all Select all Python versions labels Oct 26, 2026
@jjhelmus jjhelmus reopened this Oct 26, 2026
@jjhelmus

Copy link
Copy Markdown
Contributor Author

Requiring the dependencies for all architectures and configurations to be built before starting any CPython build is not good. It delays initial results and limits parallelism. Working to break this block up into smaller tasks that can be depended on.

@jjhelmus

Copy link
Copy Markdown
Contributor Author

Compared to a recent merge, this saved ~5.5 hours of CI time but requires ~9 additional minutes for the first complete CPython build (~x2 time to first complete build).

The full Windows matrix makes every CPython job wait for all 14 OpenSSL
and libffi builds. Split the matrix into target and toolchain groups
and call a reusable workflow for each group.
Comment thread .github/workflows/windows.yml Fixed
@jjhelmus

Copy link
Copy Markdown
Contributor Author

By splitting dependency groups by architecture the CI time savings were similar but the first CPython build completed less than a minute after that in a reference run.

@jjhelmus jjhelmus removed the python:all Select all Python versions label Oct 26, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

arch:all Select all architectures build:all platform:windows Specific to the Windows platform

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants