fix(ci): sae-builder-cpu could not configure this repository at all

v1 has no libfftw3. SAE_SCENE_XGB is on by default and pulls the learned
scene-boundary detector into result_sink, whose find_library(FFTW3_LIB
fftw3 REQUIRED) at CMakeLists.txt:377 runs at CONFIGURE time -- so cmake
fails before any target is chosen, and building only `sae_tests` does not
get you past it. The image predates the detector; nothing rebuilt it when
the detector landed, which is precisely the gap DP-007's own register row
records.

-DSAE_SCENE_XGB=OFF would also have made the configure pass. It is the
wrong fix and worth saying why: CI is the only place these tests run, so
a flag that silences a subsystem there silences it everywhere, and the
job would have gone green over a detector nobody was compiling.

The image's self-check gains a line, because an image that ships a
library CMake cannot find the way CMake looks for it is the failure this
block exists to catch. FFTW is checked as a bare .so rather than through
pkg-config, since find_library is what CMakeLists.txt actually calls --
checking fftw3.pc would pass on an image whose libfftw3.so was absent.

Tag bumped v1 -> v2 here, in build_builder_image.sh and in the workflow's
run-time assert, in one commit, as this image's contract requires. v2 is
built and published. Rehearsed in the image before pinning it: configure,
build and 151 tests now run.

TRACES: DP-007 | PR-004

.gitea/workflows/unit-tests.yml

@@ -40,7 +40,7 @@ jobs:
     # bumping the tag in scripts/ci/build_builder_image.sh AND here, in one
     # commit -- see that script's header.
     container:
-      image: gitea.tourolle.paris/dtourolle/sae-builder-cpu:v1
+      image: gitea.tourolle.paris/dtourolle/sae-builder-cpu:v2
 
     steps:
       - name: Checkout repository
@@ -73,8 +73,8 @@ jobs:
           # line above and the image that actually landed disagree, which is
           # exactly the drift the pinning exists to prevent -- so it fails the
           # job rather than building against an unknown toolchain.
-          [ "$SAE_BUILDER_VERSION" = "v1" ] || {
-            echo "image reports version '$SAE_BUILDER_VERSION', workflow pins v1" >&2
+          [ "$SAE_BUILDER_VERSION" = "v2" ] || {
+            echo "image reports version '$SAE_BUILDER_VERSION', workflow pins v2" >&2
             exit 1
           }
 

Dockerfile.builder-cpu

@@ -116,6 +116,17 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     # Both the main build (CMakeLists.txt:162) and the test target
     # (tests/CMakeLists.txt:42) discover it through pkg-config `openblas`.
     libopenblas-dev \
+    # FFTW3. The learned scene-boundary detector is compiled into result_sink
+    # whenever SAE_SCENE_XGB is on -- which is the default -- and it pulls in
+    # xgboost + FFTW + ffmpeg together (CMakeLists.txt:377). The find_library is
+    # REQUIRED and runs at CONFIGURE time, so a missing libfftw3 fails the whole
+    # cmake step: the `sae_tests` target never gets as far as being irrelevant
+    # to it. This image predates the detector, which is why it was absent.
+    #
+    # Turning SAE_SCENE_XGB off in CI would also make the configure pass, and it
+    # is the wrong fix: CI is the only place these tests run, so the flag that
+    # silences a subsystem there silences it everywhere.
+    libfftw3-dev \
     # Python: the build itself needs the interpreter and headers
     # (find_package(Python COMPONENTS Interpreter Development.Module) at
     # CMakeLists.txt:254, for the nanobind modules). numpy/h5py/scipy are for
@@ -140,14 +151,18 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     zlib1g-dev \
     && rm -rf /var/lib/apt/lists/*
 
-# Fail the image build, not the CI run, if OpenBLAS or swresample are not
-# discoverable the way CMakeLists.txt discovers them. An image that ships
+# Fail the image build, not the CI run, if OpenBLAS, swresample or FFTW are
+# not discoverable the way CMakeLists.txt discovers them. An image that ships
 # libopenblas but no openblas.pc would compile the scalar fallback in silence.
+# FFTW is checked as a bare .so rather than by pkg-config because that is how
+# CMake looks for it -- find_library(FFTW3_LIB fftw3), not pkg_check_modules.
 RUN set -eux; \
     pkg-config --exists openblas; \
     echo "openblas    $(pkg-config --modversion openblas)"; \
     pkg-config --exists libswresample; \
-    echo "swresample  $(pkg-config --modversion libswresample)"
+    echo "swresample  $(pkg-config --modversion libswresample)"; \
+    ls /usr/lib/*/libfftw3.so > /dev/null; \
+    echo "fftw3       $(pkg-config --modversion fftw3)"
 
 # ─── ONNX Runtime, CPU provider only ─────────────────────────────────────────
 #

scripts/ci/build_builder_image.sh

@@ -5,9 +5,9 @@
 # TRACES: DP-007 | PR-004
 #
 # Usage:
-#   scripts/ci/build_builder_image.sh                  # build only, tag v1
+#   scripts/ci/build_builder_image.sh                  # build only, tag v2
 #   scripts/ci/build_builder_image.sh --push           # build and push
-#   scripts/ci/build_builder_image.sh --tag v2 --push  # bump the pinned tag
+#   scripts/ci/build_builder_image.sh --tag v3 --push  # bump the pinned tag
 #   scripts/ci/build_builder_image.sh --no-cache       # force a clean rebuild
 #
 # The tag is the contract with CI. .gitea/workflows/unit-tests.yml names an
@@ -34,7 +34,10 @@ DOCKERFILE="Dockerfile.builder-cpu"
 # .gitea/workflows/unit-tests.yml; the workflow asserts at run time that the
 # image it landed in reports this same version, so a drift shows up as a failed
 # job rather than as a build against the wrong toolchain.
-TAG="v1"
+#
+# v2 adds libfftw3-dev: the learned scene-boundary detector's find_library is
+# REQUIRED at configure time, so v1 cannot configure this repository at all.
+TAG="v2"
 
 PUSH=0
 EXTRA_ARGS=()