CI: use strict channel priority for conda installs

macOS and Linux CI jobs that run `conda install -c conda-forge ...` have
been intermittently failing at env solve time with errors like:

    LibMambaUnsatisfiableError: package cmake-3.31.2-h326f17c_0 requires
    libzlib >=1.3.1,<2.0a0, but ... zlib 1.2.13.* is not installable.

The miniconda base env brings in older packages (e.g. zlib=1.2.13) from
the anaconda defaults channel, while conda-env-ci.txt's pins resolve
through conda-forge which ships newer transitive deps (libzlib>=1.3.1).
With both channels active and equal priority, conda's solver picks
ambiguously and tips into unsatisfiable. The same pattern surfaced in
the Voxtral metal e2e job during the ffmpeg install in test_model_e2e.sh
and would eventually bite the libstdcxx-ng installs in cuda.yml and the
aarch64 openblas install in install_conda.sh.

Adding `--strict-channel-priority` to every `conda install -c conda-forge`
site forces conda-forge to win for every package it provides, so the
defaults/conda-forge mismatch can no longer perturb the solve. This is
the conda-forge community's canonical recommendation for exactly this
mixed-channel scenario; it does not break the patched call sites because
each of them already targets conda-forge-only packages. The remaining
conda install sites in the repo (.ci/docker/common/utils.sh:20 and
.ci/scripts/setup-windows-msvc.ps1:5) intentionally do not pass
-c conda-forge and are left untouched, as is the sibling mkl install at
install_conda.sh:44.

Authored with Claude Code.

Author: rascani

.ci/docker/common/install_conda.sh

@@ -39,7 +39,7 @@ install_python() {
 
   # From https://github.com/pytorch/pytorch/blob/main/.ci/docker/common/install_conda.sh
   if [[ $(uname -m) == "aarch64" ]]; then
-    conda_install "openblas==0.3.29=*openmp*" -c conda-forge
+    conda_install "openblas==0.3.29=*openmp*" -c conda-forge --strict-channel-priority
   else
     conda_install mkl=2022.1.0 mkl-include=2022.1.0
   fi

.ci/scripts/setup-conda.sh

@@ -9,7 +9,11 @@ set -ex
 
 install_conda() {
   pushd .ci/docker || return
-  ${CONDA_INSTALL} -c conda-forge -y --file conda-env-ci.txt
+  # --strict-channel-priority makes conda-forge win for every package it
+  # provides, eliminating the defaults/conda-forge conflict that
+  # intermittently broke the macOS solve (LibMambaUnsatisfiableError on
+  # cmake's libzlib >=1.3.1 vs base-env zlib 1.2.13).
+  ${CONDA_INSTALL} -c conda-forge --strict-channel-priority -y --file conda-env-ci.txt
   popd || return
 }
 

.ci/scripts/test_model_e2e.sh

@@ -258,7 +258,7 @@ fi
 if [ "$AUDIO_URL" != "" ]; then
   curl -L $AUDIO_URL -o ${MODEL_DIR}/$AUDIO_FILE
 elif [[ "$MODEL_NAME" == *whisper* ]] || [ "$MODEL_NAME" = "voxtral_realtime" ]; then
-  conda install -y -c conda-forge "ffmpeg<8"
+  conda install -y -c conda-forge --strict-channel-priority "ffmpeg<8"
   pip install datasets soundfile
   # We pushd'd into EXECUTORCH_ROOT above, so torch_pin is importable here.
   TORCHCODEC_PKG=$(python -c "from torch_pin import torchcodec_spec; print(torchcodec_spec())")

.github/workflows/cuda.yml

@@ -125,7 +125,7 @@ jobs:
 
         # The Triton-compiled .so files in the CUDA backend require GLIBCXX_3.4.29
         # which the default system libstdc++ doesn't have. Install a newer one.
-        conda install -y -c conda-forge 'libstdcxx-ng>=12'
+        conda install -y -c conda-forge --strict-channel-priority 'libstdcxx-ng>=12'
         export LD_LIBRARY_PATH=/opt/conda/lib:$LD_LIBRARY_PATH
 
         # Build ExecuTorch with CUDA support
@@ -433,7 +433,7 @@ jobs:
         # The embedded .so files in the CUDA blob require GLIBCXX_3.4.29
         # which the default conda libstdc++ doesn't have. Install a newer
         # libstdc++ from conda-forge and use it via LD_PRELOAD.
-        conda install -y -c conda-forge 'libstdcxx-ng>=12'
+        conda install -y -c conda-forge --strict-channel-priority 'libstdcxx-ng>=12'
         export LD_LIBRARY_PATH=/opt/conda/lib:$LD_LIBRARY_PATH
         # Verify the new libstdc++ has GLIBCXX_3.4.29
         strings /opt/conda/lib/libstdc++.so.6 | grep GLIBCXX_3.4.29 || {