ci(llvm): disable Windows LLVM tools except llvm-config

Retry of the Windows LLVM tool-disable that landed+reverted in #360
(commits 3106d1e / 90df14b). The first attempt broke `Run tests` because
`llvm-sys` (pulled in via inkwell) runs `${LLVM_SYS_211_PREFIX}/bin/llvm-config`
at Rust crate-build time to discover include/lib paths, and `llvm-config` is
itself an LLVM tool that got disabled along with the rest.

This version keeps `llvm-config` alive while disabling the other ~200 tool
binaries:

  -DLLVM_BUILD_TOOLS=Off           # tools are no longer in the ALL target
  -DLLVM_INCLUDE_TOOLS=On          # tools/ subdirectory still configured,
                                    # so individual tool targets exist
  -DLLVM_TOOL_LLVM_CONFIG_BUILD=On # per-tool override forces llvm-config
                                    # specifically into the ALL target

LLVM's cmake uses the `LLVM_TOOL_<name>_BUILD` pattern to let individual
tools opt back in when LLVM_BUILD_TOOLS is off. Expected effect: only
`llvm-config.exe` builds (small link), the ~200 heavy tool links are skipped.

Run 24771100328 confirmed the validation target: with all tools disabled
the Windows Build LLVM step went from 42 min → 9:44 (4.3×). This PR aims
to preserve that win while keeping `llvm-sys` happy.

Cache-key hardening (required for correctness)

Extracts the cmake `--extra-args` construction into a new `Compute LLVM
build config` step and hashes the flag list into the artifact cache key
(`...-args<sha8>-<solx-llvm-sha>`). Without this, the existing key only
reflects the solx-dev action inputs + the solx-llvm submodule SHA — not
the cmake flags — so entries built with `LLVM_BUILD_TOOLS=Off` on Windows
would share a key with entries built with tools `On` and silently serve
the wrong install tree.

Side-benefit: the hash catches any future output-affecting flag added to
`--extra-args` without requiring reviewer discipline to update the key.
Non-output-affecting flag tweaks (e.g. LLVM_PARALLEL_LINK_JOBS scheduling)
also rotate the key, costing one cold build per tweak — acceptable with
ccache as fallback and much more robust than manual key maintenance.

The Build LLVM step now reads `${RUNNER_TEMP}/llvm-extra-args` produced by
the new step, so EXTRA_ARGS is constructed once and consumed twice (once
for the hash, once for the build).

Acceptance:
- Windows Build LLVM step < 15 min on a warm-ccache run.
- Windows `Run tests` succeeds (llvm-sys finds llvm-config).
- No regression on Linux/macOS (no flag change; just the new args-hash
  key component, which triggers a one-time cold build on first run).
- `Show ccache stats` still reports near-100% hit rate.

See #364 for the full design rationale and alternatives considered.

Author: nebasuke

.github/actions/build-llvm/action.yml

@@ -52,6 +52,49 @@ runs:
   using: "composite"
   steps:
 
+    # Compute the cmake --extra-args list once, then (a) persist to a file for
+    # the Build LLVM step to re-use verbatim, and (b) hash into the artifact
+    # cache key so flag changes invalidate stale entries. Without hashing,
+    # changing output-affecting flags (e.g. LLVM_BUILD_TOOLS) while reusing
+    # the old cache key would let a pre-change entry satisfy a post-change
+    # restore — confusing or wrong installs. Non-output-affecting flag tweaks
+    # also rotate the key here; the one-time cache miss is cheap with ccache
+    # as fallback and the alternative (remembering to update the key when
+    # adding an output-affecting flag) doesn't hold up to reviewer discipline.
+    - name: Compute LLVM build config
+      id: build-config
+      shell: bash
+      run: |
+        # macos-15 ARM runner is 3 vCPU / 7 GB RAM; two parallel RelWithDebInfo
+        # links exceed RAM and push into swap. 2 fits 14-16 GB runners fine.
+        LINK_JOBS=2
+        if [ "${{ runner.os }}" = "macOS" ] && [ "${{ runner.arch }}" = "ARM64" ]; then
+          LINK_JOBS=1
+        fi
+
+        EXTRA_ARGS=(
+          "-DCMAKE_EXPORT_COMPILE_COMMANDS='Off'"
+          "-DLLVM_PARALLEL_LINK_JOBS='${LINK_JOBS}'"
+          "-DLLVM_OPTIMIZED_TABLEGEN='On'"
+        )
+
+        # Windows: skip LLVM tool binaries to cut lld-link wall-clock, but keep
+        # llvm-config (llvm-sys needs it at Rust build time) via the per-tool
+        # LLVM_TOOL_<name>_BUILD override. See #364 for background.
+        if [ "${{ runner.os }}" = "Windows" ]; then
+          EXTRA_ARGS+=(
+            "-DLLVM_BUILD_TOOLS='Off'"
+            "-DLLVM_INCLUDE_TOOLS='On'"
+            "-DLLVM_TOOL_LLVM_CONFIG_BUILD='On'"
+          )
+        fi
+
+        # Step outputs can't round-trip bash array semantics cleanly with
+        # special chars; write to a file instead.
+        printf '%s\n' "${EXTRA_ARGS[@]}" > "${RUNNER_TEMP}/llvm-extra-args"
+        ARGS_HASH=$(sha256sum "${RUNNER_TEMP}/llvm-extra-args" | head -c 8)
+        echo "args-hash=${ARGS_HASH}" | tee -a "${GITHUB_OUTPUT}"
+
     - name: Compute LLVM cache key
       id: llvm-cache
       shell: bash
@@ -64,7 +107,7 @@ runs:
         [ -n '${{ inputs.sanitizer }}' ] && KEY="${KEY}-${{ inputs.sanitizer }}"
         [ '${{ inputs.enable-coverage }}' = 'true' ] && KEY="${KEY}-coverage"
         [ '${{ inputs.enable-assertions }}' != 'true' ] && KEY="${KEY}-no-assertions"
-        KEY="${KEY}-${SHA}"
+        KEY="${KEY}-args${{ steps.build-config.outputs.args-hash }}-${SHA}"
         echo "key=${KEY}" | tee -a "${GITHUB_OUTPUT}"
 
     - name: Restore LLVM artifact cache
@@ -162,20 +205,13 @@ runs:
           fi
         fi
 
-        # With ccache at 99%+ hit rate, link time dominates. Each LLVM tool link
-        # peaks at 2-4 GB RSS on RelWithDebInfo. The hosted macos-15 ARM runner
-        # has 3 vCPU / 7 GB RAM — two parallel links alone can exceed RAM and
-        # push into swap, which is net slower than serialized links. The intel
-        # macos-15 has 14 GB and handles 2 parallel links fine, as do Linux and
-        # Windows hosted (16 GB).
-        LINK_JOBS=2
-        if [ "${{ runner.os }}" = "macOS" ] && [ "${{ runner.arch }}" = "ARM64" ]; then
-          LINK_JOBS=1
-        fi
+        # Load the cmake --extra-args computed in the Compute LLVM build config
+        # step (also hashed into the cache key).
+        readarray -t EXTRA_ARGS < "${RUNNER_TEMP}/llvm-extra-args"
 
         ./target/release/solx-dev llvm build --build-type ${{ inputs.build-type }} \
           --ccache-variant=ccache ${ENABLE_TESTS} ${ENABLE_VALGRIND} ${VALGRIND_OPTIONS} ${ENABLE_ASSERTIONS} ${ENABLE_COVERAGE} ${ENABLE_MLIR} ${SANITIZER} \
-          --extra-args "-DCMAKE_EXPORT_COMPILE_COMMANDS='Off'" "-DLLVM_PARALLEL_LINK_JOBS='${LINK_JOBS}'" "-DLLVM_OPTIMIZED_TABLEGEN='On'"
+          --extra-args "${EXTRA_ARGS[@]}"
 
     # `continue-on-error` keeps a failing ccache install (→ ccache not on PATH)
     # from masking the real Build LLVM failure in the step summary.