From c7f14368b90ff43d75909200f01923312f420504 Mon Sep 17 00:00:00 2001
From: Dom <168790843+firestar5683@users.noreply.github.com>
Date: Sun, 11 Oct 2026 19:37:40 -0600
Subject: [PATCH] Add pinned Python 3.12 build dependency for ARM qualification

---
 .github/workflows/card_stall_native_artifact.yaml     | 7 ++++---
 tools/ci/card_stall_native_artifact/build_native.py   | 9 ++++++++-
 tools/ci/card_stall_native_artifact/requirements.lock | 1 +
 3 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/card_stall_native_artifact.yaml b/.github/workflows/card_stall_native_artifact.yaml
index 8306720270..67a1148fd6 100644
--- a/.github/workflows/card_stall_native_artifact.yaml
+++ b/.github/workflows/card_stall_native_artifact.yaml
@@ -48,10 +48,11 @@ jobs:
           git config remote.origin.partialclonefilter blob:none
           git sparse-checkout init --no-cone
           printf '%s\n' '/msgq_repo/' '/openpilot/selfdrive/car/card.py' '/openpilot/starpilot/card_stall_timing.py' '/openpilot/starpilot/aol/tests/test_card_stall_timing.py' '/tools/ci/card_stall_native_artifact/' '/uv.lock' '/pyproject.toml' '/.github/workflows/card_stall_native_artifact.yaml' | git sparse-checkout set --no-cone --stdin
-          git -c protocol.version=2 fetch --filter=blob:none --depth=3 origin "$GITHUB_SHA"
+          git -c protocol.version=2 fetch --filter=blob:none --depth=4 origin "$GITHUB_SHA"
           test "$(git rev-parse FETCH_HEAD)" = "$GITHUB_SHA"
-          test "$(git rev-parse FETCH_HEAD^)" = 402a55b49d15df5cff985d5034f0e2053a4c677a
-          test "$(git rev-parse FETCH_HEAD^^)" = e8389b0b7529bad402f1f4e5fbd672ff13d9d382
+          test "$(git rev-parse FETCH_HEAD^)" = c32912dbd66aabb62b67afa793af936c547e4f94
+          test "$(git rev-parse FETCH_HEAD^^)" = 402a55b49d15df5cff985d5034f0e2053a4c677a
+          test "$(git rev-parse FETCH_HEAD^^^)" = e8389b0b7529bad402f1f4e5fbd672ff13d9d382
           git checkout --detach "$GITHUB_SHA"
           test ! -e openpilot/selfdrive/modeld/models
       - name: Verify frozen source and baseline artifacts
diff --git a/tools/ci/card_stall_native_artifact/build_native.py b/tools/ci/card_stall_native_artifact/build_native.py
index b8270cb74f..db3ebf0cf5 100644
--- a/tools/ci/card_stall_native_artifact/build_native.py
+++ b/tools/ci/card_stall_native_artifact/build_native.py
@@ -19,7 +19,7 @@ from validate_elf import BASELINE_SHA256
 
 HERE = Path(__file__).resolve().parent
 PINNED = {'Cython': '3.3.0', 'SCons': '4.11.1', 'pytest': '8.4.2', 'iniconfig': '2.3.0',
-          'packaging': '26.3', 'pluggy': '1.6.0', 'Pygments': '2.21.0'}
+          'packaging': '26.3', 'pluggy': '1.6.0', 'Pygments': '2.21.0', 'setuptools': '84.0.0'}
 
 
 def check(condition, message):
@@ -85,6 +85,13 @@ def main():
   check(not capture('git', 'status', '--porcelain', '--untracked-files=all', cwd=source), 'Source checkout must be clean, including untracked paths')
   versions = {name: importlib.metadata.version(name) for name in PINNED}
   check(versions == PINNED, f'Build/test packages differ from reviewed uv.lock pins: {versions}')
+  # Python 3.12 removed stdlib distutils; Cython lazily needs setuptools' copy.
+  # Exercise the actual import closure before allocating a build directory.
+  for module_name in ('distutils.extension', 'Cython.Build.Dependencies', 'SCons.Script'):
+    try:
+      importlib.import_module(module_name)
+    except ImportError as exc:
+      raise RuntimeError(f'Minimal native build import preflight failed: {module_name}: {exc}') from exc
   compiler = {key: Path(os.environ.get(key, '/usr/bin/'+name+'-13')).resolve() for key, name in [('GCC', 'gcc'), ('GXX', 'g++')]}
   expected_gcc = os.environ['EXPECTED_GCC_VERSION']
   check(expected_gcc.split('.')[0] == '13', 'Only explicitly reviewed GCC 13 is allowed')
diff --git a/tools/ci/card_stall_native_artifact/requirements.lock b/tools/ci/card_stall_native_artifact/requirements.lock
index 654d497a10..b435e47688 100644
--- a/tools/ci/card_stall_native_artifact/requirements.lock
+++ b/tools/ci/card_stall_native_artifact/requirements.lock
@@ -8,3 +8,4 @@ iniconfig==2.3.0 --hash=sha256:f631c04d2c48c52b84d0d0549c99ff3859c98df65b3101406
 packaging==26.3 --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c
 pluggy==1.6.0 --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
 pygments==2.21.0 --hash=sha256:2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9
+setuptools==84.0.0 --hash=sha256:51a52592b3b99e102b609654876bd65f19f999935166d1352678931132b0c670