native_release.yml: extract repeated ccache/apt scaffolding, de-duplicate CUDA version and Android CPU variant lists

[leehack]

Summary

.github/workflows/native_release.yml is 1242 lines, with several blocks copied verbatim across build jobs and two lists that duplicate values defined elsewhere in the repo.

Verbatim duplication

ccache scaffolding, repeated 5x — the Prime ccache / ccache stats / Append ccache stats to summary trio appears identically in every build job (android :177, apple :333, linux :521, linux-hip :684, plus the Windows sccache variant):

- name: Prime ccache
  run: |
    mkdir -p "${CCACHE_DIR}"
    ccache --max-size "${CCACHE_MAXSIZE}"
    ccache --zero-stats

apt retry helpers, defined 3x — apt_get_update() and apt_get_install() are re-declared at :421/:432, :627/:638, and :663.

ubuntu.sources content, duplicated across files — the arm64 cross-compile sources list is emitted as an inline heredoc at :444 and also exists as tools/docker/ubuntu.sources. The only difference is that the workflow templates ${VERSION_CODENAME} where the Docker copy hardcodes noble.

The repo already has .github/actions/checkout-llama-ref/action.yml, so the composite-action pattern is established — it just was not applied here.

Values duplicated from elsewhere

CUDA version check — CUDA_REDIST_VERSION: 12.8.1 is set once at :29, but the verification greps hardcode the version:

grep -q 'release 12\.8' nvcc-version.txt || {          # :508 (Linux)
  echo "Expected CUDA ${CUDA_REDIST_VERSION} nvcc" >&2

if (($nvccVersion -join "`n") -notmatch 'release 12\.8') {   # :823 (Windows)
  throw "Expected CUDA ${env:CUDA_REDIST_VERSION} nvcc"

Bumping CUDA_REDIST_VERSION to any non-12.8 version makes both checks fail while printing the new version in the error — a confusing failure mode. The pattern should be derived from the env var.

Android CPU variant list — ANDROID_ARM64_CPU_VARIANTS (tools/build.py:48) is re-listed by hand as expected_cpu_variants in the validation step (:240). Adding a variant in one place silently desynchronizes the other.

Suggested fix

• Extract a setup-ccache composite action taking a cache-key prefix and a summary label.
• Extract the apt retry helpers into a small shell script under tools/ and source it, or into a composite action.
• Derive the nvcc version pattern from CUDA_REDIST_VERSION instead of hardcoding it.
• Have the Android validation step read the expected variant list from tools/build.py (e.g. a --list-cpu-variants flag) rather than restating it.
• Consider whether the inline ubuntu.sources heredoc can just read tools/docker/ubuntu.sources with the codename substituted.

Related: the 80-line inline bash validators in these jobs would be better off in tools/validate_*.py, where half that logic already lives.