Merge remote-tracking branch 'origin/docker-blackwell-build' into pr-jupyter-studio-ux

# Conflicts:
#	.github/workflows/docker-publish.yml

.github/workflows/docker-publish.yml

@@ -44,6 +44,10 @@ on:
         description: 'unsloth-zoo git ref to bake in'
         required: false
         default: 'main'
+      llama_prebuilt_tag:
+        description: 'unslothai/llama.cpp prebuilt release tag to bake (blank = newest)'
+        required: false
+        default: ''
 
 env:
   REGISTRY: docker.io
@@ -66,6 +70,36 @@ permissions:
   contents: read
 
 jobs:
+  # ---------------------------------------------------------------------------
+  # Resolve the llama.cpp prebuilt release ONCE, up front, so both arch legs of
+  # the base build bake the identical GGUF binaries. Resolving "latest" inside
+  # each leg would let upstream publish a new release between the amd64 and
+  # arm64 builds, putting different binaries under one published image tag.
+  # An explicit dispatch input pins a frozen release; otherwise we follow the
+  # /releases/latest redirect to a concrete tag (mirrors docker/build.sh).
+  # ---------------------------------------------------------------------------
+  prepare:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      llama_tag: ${{ steps.llama.outputs.tag }}
+    steps:
+      - name: Resolve llama.cpp prebuilt tag
+        id: llama
+        env:
+          INPUT_TAG: ${{ github.event.inputs.llama_prebuilt_tag }}
+        run: |
+          TAG="$INPUT_TAG"
+          if [ -z "$TAG" ]; then
+              TAG="$(curl -fsSL -o /dev/null -w '%{url_effective}' \
+                  https://github.com/unslothai/llama.cpp/releases/latest \
+                  | sed -n 's#.*/releases/tag/##p')"
+          fi
+          echo "tag=${TAG:-latest}" >> "$GITHUB_OUTPUT"
+          echo "llama.cpp prebuilt tag: ${TAG:-latest}"
+
   # ---------------------------------------------------------------------------
   # Per-arch build. The matrix fans out two parallel jobs on the matching
   # native runner. Each pushes a single-arch image *by digest* (no human-
@@ -75,6 +109,7 @@ jobs:
   # that you get when two jobs push the same tag separately.
   # ---------------------------------------------------------------------------
   build:
+    needs: prepare
     strategy:
       fail-fast: false
       matrix:
@@ -170,12 +205,15 @@ jobs:
           #   UNSLOTH_ZOO_REF (from the resolve step above): explicit dispatch
           #     input, else the pushed tag IF the zoo repo has it, else main -- a
           #     branch SHA does not exist in the zoo repo.
+          #   LLAMA_PREBUILT_TAG (from the prepare job): one concrete tag shared
+          #     by both arch legs so the published manifest is reproducible.
           build-args: |
             CUDA_VERSION=12.8.1
             UBUNTU_VERSION=24.04
             PYTHON_VERSION=3.12
             UNSLOTH_REF=${{ github.event.inputs.unsloth_ref || (startsWith(github.ref, 'refs/tags/') && github.ref_name) || github.sha || 'main' }}
             UNSLOTH_ZOO_REF=${{ steps.zoo_ref.outputs.ref }}
+            LLAMA_PREBUILT_TAG=${{ needs.prepare.outputs.llama_tag }}
 
       # Stash the per-arch digest as an artifact for the merge job to pick up.
       # Filenames need to be unique across the matrix; `platform` contains a
@@ -391,10 +429,15 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          # latest=false disables metadata-action's implicit latest=auto, which
+          # would otherwise emit :latest on a v* tag push and bypass the
+          # default-branch-only gate below. :latest is published only by the
+          # explicit type=raw rule (default-branch pushes), matching the base job.
+          flavor: latest=false
           tags: |
             # The full Studio image owns the unprefixed namespace, headed by
-            # :latest, with a stable :studio alias. Same gating rationale as
-            # the core job.
+            # :latest plus a stable :studio alias (default branch only). Tag
+            # pushes publish the version tag. Same gating rationale as the core job.
             type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.event.inputs.unsloth_ref == '' }}
             type=raw,value=studio,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.event.inputs.unsloth_ref == '' }}
             type=ref,event=tag
@@ -472,6 +515,9 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          # Mirror the studio tag rules (incl. latest=false) so the smoke test
+          # pulls the tag just published, not an implicit latest=auto :latest.
+          flavor: latest=false
           tags: |
             type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.event.inputs.unsloth_ref == '' }}
             type=raw,value=studio,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.event.inputs.unsloth_ref == '' }}