fix(ci): read the runner image instead of interpolating an empty string

`${{ env.ImageOS }}` and `${{ env.ImageVersion }}` have expanded to nothing
since the line was written. The `env` expression context holds only what a
workflow, job or step `env:` block put there; the runner sets these two into
its own process environment, where `run:` steps see them and `${{ env.… }}`
does not. The repository's own cache list shows the result — three consecutive
hyphens where the image should be:

    whisper-stt-build-darwin-arm64---2ca5d2c75aac59ca…

So the cache was keyed on the tag and the CMakeLists hash alone, and the exact
failure the comment above it predicts — a restored tree with dead absolute SDK
paths, "No rule to make target …libz.tbd" — was never actually guarded against.
A shell step reads the values and both the key and the restore-keys prefix use
its output. `shell: bash` is not decorative: this matrix includes
windows-latest, whose default shell has no `${VAR:-default}`.

Second, unrelated to the key but proven by the same cache list's neighbours:
`on.push` had `paths:` and no `branches:`, so a tag push matched. Publishing
`v0.0.0-onnxruntime-1.27.1` started a four-platform whisper build for a tag
that touches none of these files. `branches: ['**']` excludes tags while
keeping every branch, which is how this workflow is used.

Closes #596

Author: Etienne Lescot

.github/workflows/build-whisper-stt.yml

@@ -16,6 +16,13 @@ name: Build whisper-stt binaries
 on:
   workflow_dispatch:
   push:
+    # ALL branches, NO tags. `paths:` alone also matches a tag push, and it has:
+    # publishing `v0.0.0-onnxruntime-1.27.1` started a four-platform whisper build
+    # for a tag that touched none of these files. Listing `branches` is what
+    # excludes tags; `'**'` keeps every branch working, which is the point of this
+    # workflow — contributors push a branch to get binaries built.
+    branches:
+      - "**"
     paths:
       - "scripts/build-whisper-stt.sh"
       - "electron/native/whisper-stt/**"
@@ -139,6 +146,23 @@ jobs:
           "${VCPKG_ROOT_DIR}/vcpkg" install spirv-headers:x64-windows
           echo "CMAKE_PREFIX_PATH=${VCPKG_ROOT_DIR}/installed/x64-windows" >> "$GITHUB_ENV"
 
+      # `${{ env.ImageOS }}` DOES NOT WORK, and it fails silently — the `env`
+      # expression context holds only what a workflow/job/step `env:` block put
+      # there, and the runner sets ImageOS/ImageVersion into its own process
+      # environment instead. Written that way, both halves expanded to the empty
+      # string and the cache below was keyed on the tag and the CMakeLists hash
+      # alone, for every platform, for as long as the line existed: the repo's
+      # own cache list read `whisper-stt-build-darwin-arm64---<hash>`. Reading
+      # them here in a shell is what actually gets their values.
+      #
+      # `shell: bash` is required, not decorative: this matrix includes
+      # windows-latest, where the default shell is PowerShell and `${VAR:-default}`
+      # is not syntax. GitHub ships bash on the Windows image.
+      - name: Read the runner image
+        id: image
+        shell: bash
+        run: echo "tag=${ImageOS:-unknown}-${ImageVersion:-unknown}" >> "$GITHUB_OUTPUT"
+
       - name: Cache whisper.cpp build tree
         uses: actions/cache@v6
         with:
@@ -151,15 +175,15 @@ jobs:
           # bump there invalidates the cache instead of silently reusing a stale
           # FetchContent checkout; falls back to the newest cache for the same
           # platform + runner image on a miss so incremental compilation still
-          # helps. The runner image version ($ImageOS/$ImageVersion) is part of
+          # helps. The runner image version (read by the step above) is part of
           # the key AND the restore-keys prefix because CMake bakes absolute
           # toolchain paths (e.g. the Xcode SDK's libz.tbd) into the cached build
           # tree — when GitHub rolls the image's Xcode/SDK, those paths vanish and
           # a restored tree fails with "No rule to make target …libz.tbd". Scoping
           # the cache to the image version auto-busts it on every toolchain roll.
-          key: whisper-stt-build-${{ matrix.tag }}-${{ env.ImageOS }}-${{ env.ImageVersion }}-${{ hashFiles('electron/native/whisper-stt/CMakeLists.txt') }}
+          key: whisper-stt-build-${{ matrix.tag }}-${{ steps.image.outputs.tag }}-${{ hashFiles('electron/native/whisper-stt/CMakeLists.txt') }}
           restore-keys: |
-            whisper-stt-build-${{ matrix.tag }}-${{ env.ImageOS }}-${{ env.ImageVersion }}-
+            whisper-stt-build-${{ matrix.tag }}-${{ steps.image.outputs.tag }}-
 
       - name: Run whisper-stt build script
         run: bash scripts/build-whisper-stt.sh