From b2c2f5b594fb179d402af162efab1fa984e18e8f Mon Sep 17 00:00:00 2001
From: Greg Benz <git-noreply@gregbenzphotography.com>
Date: Mon, 28 Sep 2026 09:47:46 -0500
Subject: [PATCH] Repair mingw32 and Intel SDE setup in CI

mingw32 fails during dependency installation because the pacboy GoogleTest
package is unavailable. Use the existing pinned GoogleTest submodule for
mingw32 while retaining system GoogleTest for other MSYS2 environments.

The pinned Intel SDE 9.33 download no longer returns a usable archive, so
x64 cross-test and AVX3 conformance jobs fail before executing tests.
Update both download sites to 10.13.1, reject HTTP errors, and check the
published SHA-256 before extracting downloaded or cached archives.
Keep the existing test matrix and test-selection rules.

Intel download and checksum:
https://www.intel.com/content/www/us/en/download/684897/intel-software-development-emulator.html

Validation: the old setup failures are reproduced in
https://github.com/gregbenz/libjxl/pull/2 . These exact workflow changes
passed mingw32 compilation, x64 shards, and conformance in
https://github.com/gregbenz/libjxl/pull/1 . Normal PR runs compile mingw32
but skip its unit tests unless CI:full is set. Local ci.sh lint 15,
source-list checks, YAML parsing, and git diff --check pass.
---
 .github/workflows/build_test_cross.yml | 8 +++++---
 .github/workflows/build_test_msys2.yml | 5 +++--
 .github/workflows/conformance.yml      | 8 +++++---
 3 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/build_test_cross.yml b/.github/workflows/build_test_cross.yml
index 6eebcdf1818..2984fbc084d 100644
--- a/.github/workflows/build_test_cross.yml
+++ b/.github/workflows/build_test_cross.yml
@@ -23,8 +23,9 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
-  SDE_ID: "813591"
-  SDE_VERSION: "9.33.0-2024-01-07"
+  SDE_ID: "924984"
+  SDE_VERSION: "10.13.1-2026-07-28"
+  SDE_SHA256: "94e97d623fec54385686e1e7ba65ebc9941748c05ee451423948334892bf2b50"
 
 jobs:
   compile:
@@ -192,9 +193,10 @@ jobs:
         cd sde
         SDE_ARCHIVE=sde.tar.xz
         if [ ! -f "${SDE_ARCHIVE}" ]; then
-          curl -L --show-error -o "${SDE_ARCHIVE}" \
+          curl --fail -L --show-error -o "${SDE_ARCHIVE}" \
             https://downloadmirror.intel.com/${{ env.SDE_ID }}/sde-external-${{ env.SDE_VERSION }}-lin.tar.xz
         fi
+        printf '%s  %s\n' "${SDE_SHA256}" "${SDE_ARCHIVE}" | sha256sum --check
         tar --strip-components=1 -xJf "${SDE_ARCHIVE}"
         cd ..
 
diff --git a/.github/workflows/build_test_msys2.yml b/.github/workflows/build_test_msys2.yml
index b78823d3dbd..50d3fc1bcb2 100644
--- a/.github/workflows/build_test_msys2.yml
+++ b/.github/workflows/build_test_msys2.yml
@@ -71,11 +71,12 @@ jobs:
             base-devel
             git
             procps
+          # mingw32 has no pacboy GTest package, so use the bundled googletest submodule.
           pacboy: >-
             brotli:p
             cmake:p
             giflib:p
-            gtest:p
+            ${{ matrix.msystem != 'mingw32' && 'gtest:p' || '' }}
             ${{ matrix.msystem != 'mingw32' && 'libavif:p' || '' }}
             libjpeg-turbo:p
             libpng:p
@@ -90,7 +91,7 @@ jobs:
             -DJPEGXL_ENABLE_JNI=OFF \
             -DJPEGXL_ENABLE_MANPAGES=OFF \
             -DJPEGXL_FORCE_SYSTEM_BROTLI=ON \
-            -DJPEGXL_FORCE_SYSTEM_GTEST=ON \
+            -DJPEGXL_FORCE_SYSTEM_GTEST=${{ matrix.msystem != 'mingw32' && 'ON' || 'OFF' }} \
             -B build \
             -G Ninja
 
diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml
index 3c641fcfa66..1d93964ef1d 100644
--- a/.github/workflows/conformance.yml
+++ b/.github/workflows/conformance.yml
@@ -22,8 +22,9 @@ env:
   CONFORMANCE_REPO_HASH: 4bf053529c7cefd2951be453475bb3dccc7e7be8
   LIBJXL_VERSION: "0.13.0"
   LIBJXL_ABI_VERSION: "0.13"
-  SDE_ID: "813591"
-  SDE_VERSION: "9.33.0-2024-01-07"
+  SDE_ID: "924984"
+  SDE_VERSION: "10.13.1-2026-07-28"
+  SDE_SHA256: "94e97d623fec54385686e1e7ba65ebc9941748c05ee451423948334892bf2b50"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
@@ -221,9 +222,10 @@ jobs:
         cd sde
         SDE_ARCHIVE=sde.tar.xz
         if [ ! -f "${SDE_ARCHIVE}" ]; then
-          curl -L --show-error -o "${SDE_ARCHIVE}" \
+          curl --fail -L --show-error -o "${SDE_ARCHIVE}" \
             https://downloadmirror.intel.com/${{ env.SDE_ID }}/sde-external-${{ env.SDE_VERSION }}-lin.tar.xz
         fi
+        printf '%s  %s\n' "${SDE_SHA256}" "${SDE_ARCHIVE}" | sha256sum --check
         tar --strip-components=1 -xJf "${SDE_ARCHIVE}"
         cd ..