CI fixes: SpotBugs suppressions, spirv-headers, clang-cl for Windows arm64

Fixes three PR #293 CI failures.

1. SpotBugs (spotbugs-exclude.xml): the branch's new server classes tripped 14
   fb-contrib/findsecbugs findings not yet covered by the exclude file. All are
   false-positives or intentional tradeoffs mirroring suppressions the project
   already applies elsewhere. Added six method-scoped Match blocks with rationale:
   - NativeServer: IMC_IMMATURE_CLASS_NO_EQUALS, MDM_THREAD_YIELD (main() poll),
     UVA_USE_VAR_ARGS (native JNI method), WEM_WEAK_EXCEPTION_MESSAGING.
   - ServerLauncher.main: THROWS_METHOD_THROWS_CLAUSE_BASIC_EXCEPTION.
   - OpenAiServerCli parse/usage/parseChatTemplateKwargs: ENMI_NULL_ENUM_VALUE
     (@nullable CacheType unset sentinel), POTENTIAL_XML_INJECTION + PRMC (plain-
     text usage() help, no XML), EXS_EXCEPTION_SOFTENING (Jackson->CLI error, cause
     chained), PSC_PRESIZE_COLLECTIONS.
   - OpenAiServerCli$Options.getChatTemplateKwargs: EI_EXPOSE_REP (returns an
     already-unmodifiable map).
   Verified: mvn spotbugs:check -> BugInstance size 0, BUILD SUCCESS.

2. Linux Vulkan (publish.yml): both build-linux-*-vulkan jobs failed
   find_package(SPIRV-Headers CONFIG REQUIRED) because the apt install omitted it.
   Added spirv-headers to both apt lines (exact parity with upstream llama.cpp's
   build-vulkan.yml: 'glslc libvulkan-dev spirv-headers').

3. Windows arm64 (publish.yml + CLAUDE.md): ggml aborts 'MSVC is not supported for
   ARM, use clang'. The generator (Ninja) was never the issue — the compiler was.
   Switched the job to clang-cl (-DCMAKE_C_COMPILER=clang-cl
   -DCMAKE_CXX_COMPILER=clang-cl): it satisfies ggml's guard
   (if (MSVC AND NOT CMAKE_C_COMPILER_ID STREQUAL "Clang")) while keeping
   CMake's MSVC=TRUE, so our static /MT CRT block still applies and the runner +
   Ninja + ctest all stay. msvc-dev-cmd (arm64) supplies the MSVC headers/libs.
   First-run watch item: clang-cl must be on PATH (VS Clang component / LLVM); if
   CI reports it missing, add an LLVM setup step.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HL7d4uQ3cKR5HwYFPvZvv7

Author: claude

.github/workflows/publish.yml

@@ -467,7 +467,7 @@ jobs:
       - name: Install Vulkan SDK (headers + loader + glslc shader compiler)
         run: |
           sudo apt-get update
-          sudo apt-get install -y libvulkan-dev glslc glslang-tools
+          sudo apt-get install -y libvulkan-dev glslc glslang-tools spirv-headers
       - name: Build libraries
         shell: bash
         run: |
@@ -506,7 +506,7 @@ jobs:
       - name: Install toolchain (GCC 14) + Vulkan SDK
         run: |
           sudo apt-get update
-          sudo apt-get install -y gcc-14 g++-14 libvulkan-dev glslc glslang-tools
+          sudo apt-get install -y gcc-14 g++-14 libvulkan-dev glslc glslang-tools spirv-headers
           echo "CC=gcc-14" >> "$GITHUB_ENV"
           echo "CXX=g++-14" >> "$GITHUB_ENV"
       - name: Build libraries
@@ -881,6 +881,15 @@ jobs:
     # src/main/resources. sccache is intentionally omitted (the existing install step pulls the
     # x86_64 sccache zip; an arm64 build would need the aarch64 release — not worth the extra path
     # for one CPU job, so build.bat just builds uncached when sccache is absent).
+    #
+    # Compiler: clang-cl, NOT MSVC cl.exe. ggml's ggml-cpu/CMakeLists.txt aborts with "MSVC is not
+    # supported for ARM, use clang" via `if (MSVC AND NOT CMAKE_C_COMPILER_ID STREQUAL "Clang")`.
+    # clang-cl (LLVM's MSVC-compatible driver) satisfies that guard (its compiler id is "Clang")
+    # while still leaving CMake's MSVC=TRUE, so our static /MT CRT block (CMAKE_MSVC_RUNTIME_LIBRARY
+    # in CMakeLists.txt) keeps applying and the generator stays Ninja Multi-Config. msvc-dev-cmd
+    # (arm64) supplies the MSVC headers/libs/linker that clang-cl links against. NOTE: clang-cl must
+    # be on PATH (the VS "C++ Clang tools" component / LLVM); if a first CI run reports it missing,
+    # add an LLVM setup step here.
     runs-on: windows-11-arm
     steps:
       - uses: actions/checkout@v7
@@ -898,8 +907,9 @@ jobs:
         # No mvn compile needed: the JNI header (jllama.h) is committed and the native build
         # uses the bundled JNI headers in .github/include, and OS_NAME/OS_ARCH are passed
         # explicitly (so the OSInfo-class OS-detection path is skipped) — same as the x86_64 job.
+        # clang-cl (see the job comment) is required: ggml refuses MSVC cl.exe on ARM.
         run: |
-          .github\build.bat -G "Ninja Multi-Config" -DOS_NAME=Windows -DOS_ARCH=aarch64 -DBUILD_TESTING=ON
+          .github\build.bat -G "Ninja Multi-Config" -DCMAKE_C_COMPILER=clang-cl -DCMAKE_CXX_COMPILER=clang-cl -DOS_NAME=Windows -DOS_ARCH=aarch64 -DBUILD_TESTING=ON
       - name: Run C++ unit tests
         run: ctest --test-dir llama/build --output-on-failure
       - name: Upload artifacts

CLAUDE.md

@@ -295,7 +295,15 @@ tree — so it ships in the **default** JAR alongside Windows x86-64 / x86 (like
 classifier). No Java change was needed: `OSInfo` already maps a Windows-on-ARM JVM (`os.arch=aarch64`)
 to `Windows/aarch64` (it isn't in `archMapping`, so it falls through `translateArchNameToFolderName`).
 sccache is intentionally omitted (the shared install step pulls the x86_64 sccache zip; not worth an
-arm64 path for one CPU job — `build.bat` just builds uncached).
+arm64 path for one CPU job — `build.bat` just builds uncached). **Compiler: `clang-cl`, not MSVC
+`cl.exe`.** ggml's `ggml-cpu/CMakeLists.txt` aborts with *"MSVC is not supported for ARM, use clang"*
+via `if (MSVC AND NOT CMAKE_C_COMPILER_ID STREQUAL "Clang")`; `clang-cl` (LLVM's MSVC-compatible driver)
+satisfies that guard (compiler id `"Clang"`) while keeping CMake's `MSVC=TRUE`, so the static `/MT` CRT
+block still applies and the generator stays Ninja Multi-Config. The job passes
+`-DCMAKE_C_COMPILER=clang-cl -DCMAKE_CXX_COMPILER=clang-cl`; `msvc-dev-cmd` supplies the MSVC
+headers/libs/linker `clang-cl` links against. (Upstream llama.cpp instead cross-compiles arm64 from an
+x64 runner with `vcvarsall amd64_arm64` + a `clang`/`clang++` toolchain file and no arm64 tests; the
+native-runner + `clang-cl` route here keeps the `/MT` CRT and lets `ctest` run on real ARM hardware.)
 
 ## WebUI (llama.cpp Svelte UI) embedding
 

llama/spotbugs-exclude.xml

@@ -622,4 +622,95 @@ SPDX-License-Identifier: MIT
         <Method name="~\$default\$.*"/>
     </Match>
 
+    <!--
+        NativeServer (net.ladenthin.llama.server.NativeServer) is the native-transport server-mode
+        entry point: it owns a background worker thread, three native JNI methods and a blocking
+        main(). Its SpotBugs findings are all fb-contrib style artifacts, not defects:
+          - IMC_IMMATURE_CLASS_NO_EQUALS: an identity/lifecycle-managed handle class, not a value
+            type — same rationale as the other server identity classes above.
+          - MDM_THREAD_YIELD: main() polls `while (isRunning()) Thread.sleep(...)` to keep the JVM
+            alive until the native server stops — a legitimate blocking wait in a process entry
+            point, not manual thread scheduling.
+          - UVA_USE_VAR_ARGS: startNativeServer(String[]) is a `native` method; its signature must
+            match the C/JNI side exactly and therefore cannot be varargs.
+          - WEM_WEAK_EXCEPTION_MESSAGING: the two start() guards throw with fixed messages
+            (single-instance-per-process / already-running), which carry no extra state worth
+            formatting — same category as the server request-parser WEM suppressions above.
+    -->
+    <Match>
+        <Class name="net.ladenthin.llama.server.NativeServer"/>
+        <Or>
+            <Bug pattern="IMC_IMMATURE_CLASS_NO_EQUALS"/>
+            <Bug pattern="MDM_THREAD_YIELD"/>
+            <Bug pattern="UVA_USE_VAR_ARGS"/>
+            <Bug pattern="WEM_WEAK_EXCEPTION_MESSAGING"/>
+        </Or>
+    </Match>
+
+    <!--
+        ServerLauncher.main(String[]) is the fat-jar dispatcher: it forwards to
+        OpenAiCompatServer.main / NativeServer.main, both of which declare `throws Exception` (they
+        block until server shutdown and surface whatever the underlying server throws). Declaring
+        `throws Exception` on the dispatcher mirrors that contract; narrowing it would force the
+        dispatcher to wrap arbitrary checked exceptions for no benefit — same rationale as the
+        ToolHandler.invoke THROWS suppression above.
+    -->
+    <Match>
+        <Class name="net.ladenthin.llama.server.ServerLauncher"/>
+        <Bug pattern="THROWS_METHOD_THROWS_CLAUSE_BASIC_EXCEPTION"/>
+        <Method name="main"/>
+    </Match>
+
+    <!--
+        OpenAiServerCli additions (the cache-type-k / cache-type-v, jinja and chat-template-kwargs
+        flags plus the extended usage() help). All fb-contrib/findsecbugs artifacts, not defects; scoped
+        to the specific methods that trigger them:
+          - parse(): ENMI_NULL_ENUM_VALUE — `@Nullable CacheType cacheTypeK/V = null`; null is the
+            documented "unset -> use the llama.cpp default" sentinel, explicitly @Nullable and
+            NullAway-checked.
+          - usage(): POTENTIAL_XML_INJECTION / PRMC_POSSIBLY_REDUNDANT_METHOD_CALLS — usage() builds
+            the plain-text console help string, appending the fixed cacheTypeChoices() enum list for
+            the -ctk and -ctv lines. There is no XML anywhere (false positive), and cacheTypeChoices()
+            is a cheap pure helper returning a constant, so calling it twice is harmless.
+          - parseChatTemplateKwargs(): EXS_EXCEPTION_SOFTENING_NO_CONSTRAINTS converts Jackson's
+            checked JsonProcessingException into a CLI usage error (cause chained) — the same intended
+            boundary softening already accepted for LlamaModel's JSON methods above; and
+            PSC_PRESIZE_COLLECTIONS on the tiny short-lived LinkedHashMap of CLI kwargs is not
+            worthwhile.
+    -->
+    <Match>
+        <Class name="net.ladenthin.llama.server.OpenAiServerCli"/>
+        <Bug pattern="ENMI_NULL_ENUM_VALUE"/>
+        <Method name="parse"/>
+    </Match>
+    <Match>
+        <Class name="net.ladenthin.llama.server.OpenAiServerCli"/>
+        <Or>
+            <Bug pattern="POTENTIAL_XML_INJECTION"/>
+            <Bug pattern="PRMC_POSSIBLY_REDUNDANT_METHOD_CALLS"/>
+        </Or>
+        <Method name="usage"/>
+    </Match>
+    <Match>
+        <Class name="net.ladenthin.llama.server.OpenAiServerCli"/>
+        <Or>
+            <Bug pattern="EXS_EXCEPTION_SOFTENING_NO_CONSTRAINTS"/>
+            <Bug pattern="PSC_PRESIZE_COLLECTIONS"/>
+        </Or>
+        <Method name="parseChatTemplateKwargs"/>
+    </Match>
+
+    <!--
+        OpenAiServerCli$Options.getChatTemplateKwargs() returns the chatTemplateKwargs field
+        directly, which fb-contrib flags as EI_EXPOSE_REP. The field only ever holds the
+        Collections.unmodifiableMap(...) returned by parseChatTemplateKwargs (or null when unset),
+        so the getter cannot leak a mutable map — the detector does not track that the stored map is
+        already unmodifiable.
+    -->
+    <Match>
+        <Class name="net.ladenthin.llama.server.OpenAiServerCli$Options"/>
+        <Bug pattern="EI_EXPOSE_REP"/>
+        <Method name="getChatTemplateKwargs"/>
+    </Match>
+
 </FindBugsFilter>