ci: build linux64_sqlite against depends with PLATFORM_GUI=1

A new linux64_platform_gui depends target builds depends with
PLATFORM_GUI=1, and linux64_sqlite builds against it instead of the
linux64 depends (as linux64_tsan builds against linux64_multiprocess's),
so dash-qt and the unit tests of that job are built with
--enable-platform-gui (enabled through config.site) without adding a
separate build and test job.

contrib/devtools/check-no-rust.py then fails the linux64_sqlite build if
dashd, dash-cli, dash-tx, dash-wallet or the fuzz binary contain cxx
bridge, Rust runtime or Rust standard library symbols, or no symbols at
all: dash-sdk-cxx is for dash-qt only.

The source cache also gets the x86_64 Linux sources of the new depends
job: the Rust toolchain, protoc, standard library and Platform archives.
Its runner may be ARM, and the toolchain and protoc archives are chosen
by the build machine, so download-one is given BUILD and HOST directly;
download-linux would not pass BUILD to its sub-make. The cache key is
versioned so that a cache saved without those sources is not taken as
complete. This step fails until the Platform archives are on the depends
sources mirror.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: PastaPastaPasta

.github/workflows/build-depends.yml

@@ -170,8 +170,8 @@ jobs:
         uses: actions/cache/restore@v5
         with:
           path: depends/sources
-          key: depends-sources-${{ hashFiles('depends/packages/*') }}
-          restore-keys: depends-sources-
+          key: depends-sources-v2-${{ hashFiles('depends/packages/*') }}
+          restore-keys: depends-sources-v2-
 
       - name: Restore SDKs cache
         id: sdk-cache

.github/workflows/build.yml

@@ -227,8 +227,7 @@ jobs:
     if: |
       vars.SKIP_LINUX64 == '' ||
       vars.SKIP_LINUX64_ASAN == '' ||
-      vars.SKIP_LINUX64_FUZZ == '' ||
-      vars.SKIP_LINUX64_SQLITE == ''
+      vars.SKIP_LINUX64_FUZZ == ''
     with:
       build-target: linux64
       container-path: ${{ needs.container.outputs.path }}
@@ -263,6 +262,18 @@ jobs:
       runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
       runs-on-check: ${{ needs.check-skip.outputs['runner-check-skip'] }}
 
+  depends-linux64_platform_gui:
+    name: x86_64-pc-linux-gnu_platform_gui
+    uses: ./.github/workflows/build-depends.yml
+    needs: [check-skip, container, cache-sources]
+    if: ${{ vars.SKIP_LINUX64_SQLITE == '' }}
+    with:
+      build-target: linux64_platform_gui
+      container-path: ${{ needs.container.outputs.path }}
+      base-image-digest: ${{ needs.check-skip.outputs.base-image-digest }}
+      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
+      runs-on-check: ${{ needs.check-skip.outputs['runner-check-skip'] }}
+
   depends-mac:
     name: x86_64-apple-darwin
     uses: ./.github/workflows/build-depends.yml
@@ -387,15 +398,15 @@ jobs:
   src-linux64_sqlite:
     name: linux64_sqlite-build
     uses: ./.github/workflows/build-src.yml
-    needs: [check-skip, container, depends-linux64]
+    needs: [check-skip, container, depends-linux64_platform_gui]
     if: ${{ vars.SKIP_LINUX64_SQLITE == '' }}
     with:
       build-target: linux64_sqlite
       container-path: ${{ needs.container.outputs.path }}
-      depends-key: ${{ needs.depends-linux64.outputs.key }}
-      depends-host: ${{ needs.depends-linux64.outputs.host }}
-      depends-dep-opts: ${{ needs.depends-linux64.outputs.dep-opts }}
-      depends-artifact: ${{ needs.depends-linux64.outputs.built-artifact }}
+      depends-key: ${{ needs.depends-linux64_platform_gui.outputs.key }}
+      depends-host: ${{ needs.depends-linux64_platform_gui.outputs.host }}
+      depends-dep-opts: ${{ needs.depends-linux64_platform_gui.outputs.dep-opts }}
+      depends-artifact: ${{ needs.depends-linux64_platform_gui.outputs.built-artifact }}
       runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
     secrets: *remote-ccache-auth
 

.github/workflows/cache-depends-sources.yml

@@ -31,15 +31,23 @@ jobs:
           allow-unsafe-pr-checkout: true
           persist-credentials: false
 
+      # v2: caches from before the Platform GUI step below lack its sources.
       - name: Check for cached sources
         id: cache-check
         uses: actions/cache@v5
         with:
           path: depends/sources
-          key: depends-sources-${{ hashFiles('depends/packages/*') }}
-          restore-keys: depends-sources-
+          key: depends-sources-v2-${{ hashFiles('depends/packages/*') }}
+          restore-keys: depends-sources-v2-
           lookup-only: true
 
       - name: Download sources
         if: steps.cache-check.outputs.cache-hit != 'true'
         run: make -C depends download
+
+      # The linux64_platform_gui depends job runs on x86_64, but this runner
+      # may not: name the build machine, since the Rust toolchain and protoc
+      # archives are chosen by it. download-linux would not pass BUILD on.
+      - name: Download Platform GUI sources for x86_64 Linux
+        if: steps.cache-check.outputs.cache-hit != 'true'
+        run: make -C depends download-one PLATFORM_GUI=1 BUILD=x86_64-pc-linux-gnu HOST=x86_64-unknown-linux-gnu

ci/dash/build_src.sh

@@ -54,6 +54,10 @@ if [ "${RUN_STDLIB_PATH_CHECK}" = "true" ]; then
   make -C src --jobs=1 check-stdlib-paths
 fi
 
+if [ "${RUN_CHECK_NO_RUST}" = "true" ]; then
+  "${BASE_ROOT_DIR}/contrib/devtools/check-no-rust.py" src/dashd src/dash-cli src/dash-tx src/dash-wallet src/test/fuzz/fuzz
+fi
+
 if [ -n "$USE_VALGRIND" ]; then
     echo "valgrind in USE!"
     "${BASE_ROOT_DIR}/ci/test/wrap-valgrind.sh"

ci/dash/matrix.sh

@@ -30,6 +30,8 @@ elif [ "$BUILD_TARGET" = "linux64_multiprocess" ]; then
   source ./ci/test/00_setup_env_native_multiprocess.sh
 elif [ "$BUILD_TARGET" = "linux64_nowallet" ]; then
   source ./ci/test/00_setup_env_native_nowallet_libbitcoinkernel.sh
+elif [ "$BUILD_TARGET" = "linux64_platform_gui" ]; then
+  source ./ci/test/00_setup_env_native_platform_gui.sh
 elif [ "$BUILD_TARGET" = "linux64_sqlite" ]; then
   source ./ci/test/00_setup_env_native_sqlite.sh
 elif [ "$BUILD_TARGET" = "linux64_tsan" ]; then

ci/test/00_setup_env_native_platform_gui.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2026 The Dash Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+# Depends with dash-sdk-cxx (PLATFORM_GUI=1); linux64_sqlite builds against it.
+export CONTAINER_NAME=ci_native_platform_gui
+export HOST=x86_64-pc-linux-gnu
+export DEP_OPTS="PLATFORM_GUI=1"

ci/test/00_setup_env_native_sqlite.sh

@@ -11,3 +11,4 @@ export PACKAGES="python3-zmq qtbase5-dev qttools5-dev-tools libdbus-1-dev libhar
 export DEP_OPTS="NO_BDB=1 NO_UPNP=1 DEBUG=1"
 export GOAL="install"
 export BITCOIN_CONFIG="--enable-zmq --enable-reduce-exports --with-sqlite --without-bdb CC=gcc-11 CXX=g++-11"
+export RUN_CHECK_NO_RUST="true"

contrib/devtools/README.md

@@ -219,3 +219,11 @@ bundle hash on any machine. The Platform tarball and the bundle are then
 uploaded to the depends sources mirror.
 
     contrib/devtools/platform-bundle.sh <platform-commit>
+
+check-no-rust.py
+================
+
+Fails if any of the given executables contain Rust code. Run by the
+`linux64_sqlite` CI job, which builds against depends with `PLATFORM_GUI=1`,
+on `dashd`, the command-line tools and the fuzz binary, which must never link
+`dash-sdk-cxx`.

contrib/devtools/check-no-rust.py

@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+# Copyright (c) 2026 The Dash Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+'''
+Check that executables do not link Rust code.
+
+dash-sdk-cxx, the Dash Platform SDK binding (--enable-platform-gui), is for
+dash-qt only; dashd, the command-line tools and the fuzz binary must not
+contain any of it.
+A binary fails if its symbol table has cxx bridge, Rust runtime or Rust
+standard library symbols, or has no symbols at all (a stripped binary cannot
+be checked).
+
+Example usage:
+
+    contrib/devtools/check-no-rust.py src/dashd src/dash-cli src/dash-tx src/dash-wallet src/test/fuzz/fuzz
+'''
+import re
+import subprocess
+import sys
+
+from utils import determine_wellknown_cmd
+
+# cxx bridge symbols carry "cxxbridge1$". Rust code is either legacy-mangled
+# under a crate namespace (rust, std, core, alloc) or v0-mangled ("_R"
+# followed by a path tag and a crate root "Cs<disambiguator>_"), which C and
+# C++ symbols never match. The allocator shim, the panic handler and the
+# unwinding personality are plain C names every Rust program links.
+RUST_SYMBOL = re.compile(
+    r'cxxbridge1\$'
+    r'|_ZN(4rust|3std|4core|5alloc)[0-9]'
+    r'|\b_?_R[A-Za-z0-9_]*?Cs[A-Za-z0-9]*_[0-9]'
+    r'|\b_?(__rust_alloc|rust_begin_unwind|rust_eh_personality)'
+)
+
+
+def rust_symbols(nm, path):
+    result = subprocess.run(nm + [path], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False)
+    if result.returncode != 0:
+        sys.exit(f'{path}: {result.stderr.strip()}')
+    lines = result.stdout.splitlines()
+    if not lines:
+        sys.exit(f'{path}: no symbols, so it cannot be checked (stripped?)')
+    return [line for line in lines if RUST_SYMBOL.search(line)]
+
+
+def main():
+    if len(sys.argv) < 2:
+        sys.exit(__doc__)
+    nm = determine_wellknown_cmd('NM', 'nm')
+    failed = False
+    for path in sys.argv[1:]:
+        found = rust_symbols(nm, path)
+        if found:
+            failed = True
+            print(f'{path}: links Rust code, for example:')
+            for line in found[:5]:
+                print(f'    {line}')
+    sys.exit(1 if failed else 0)
+
+
+if __name__ == '__main__':
+    main()