Harden runtime packaging and native loading

.github/workflows/samples-integration-test.yml

@@ -16,6 +16,9 @@ on:
 permissions:
   contents: read
 
+env:
+  ORT_TELEMETRY_DISABLED: '1'
+
 jobs:
   # ── Python Samples ──────────────────────────────────────────────────
   python-samples:
@@ -32,7 +35,7 @@ jobs:
           clean: true
 
       - name: Setup Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v6
         with:
           python-version: '3.12'
 
@@ -96,17 +99,17 @@ jobs:
           clean: true
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v6
         with:
           node-version: '20.x'
 
       - name: Setup Python (for node-gyp)
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v6
         with:
           python-version: '3.x'
 
       - name: Setup .NET SDK for NuGet authentication
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: '10.0.x'
 
@@ -182,7 +185,7 @@ jobs:
           clean: true
 
       - name: Setup .NET SDK
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: |
             8.0.x

.pipelines/v2/templates/steps-build-js.yml

@@ -156,6 +156,14 @@ steps:
         throw "WinML runtime DLL not found in native artifact: $winmlDll"
       }
 
+      $directMlDll = Join-Path "${{ parameters.nativeArtifactDir }}" 'DirectML.dll'
+      if (Test-Path $directMlDll) {
+        Copy-Item $directMlDll -Destination $dst -Force
+        Write-Host "  staged DirectML.dll"
+      } else {
+        throw "DirectML.dll not found in native artifact: $directMlDll"
+      }
+
       Get-ChildItem $dst | ForEach-Object { Write-Host "    $($_.Name)  $($_.Length) bytes" }
     displayName: 'Stage prebuild directory'
 

.pipelines/v2/templates/steps-build-linux.yml

@@ -75,27 +75,44 @@ steps:
   displayName: 'Dump vcpkg error logs'
   condition: failed()
 
-# Stage the redistributable native artifact. Vcpkg uses static linkage on
-# Linux (see sdk_v2/cpp/triplets/x64-linux.cmake), so libfoundry_local.so
-# carries its transitive deps (azure-*, spdlog, fmt, libcurl, libssl/libcrypto,
-# zlib, brotli*) inside itself — the only file we need to forward downstream
-# is libfoundry_local.so. ORT/GenAI .so files are also present in bin/ but are
-# supplied to consumers separately (pip on the Python side, NuGet on the C#
-# side); test/example binaries are not part of the redistributable surface.
+# Stage the redistributable native artifacts for standalone C++ consumers.
 - bash: |
     set -euo pipefail
     src='$(Build.SourcesDirectory)/sdk_v2/cpp/build/Linux/${{ parameters.buildConfig }}/bin'
     dst='$(Build.ArtifactStagingDirectory)/native'
     mkdir -p "$dst"
 
-    primary="$src/libfoundry_local.so"
-    if [ ! -f "$primary" ]; then
-      echo "ERROR: libfoundry_local.so not found at $primary" >&2
-      exit 1
-    fi
-    cp -P "$primary" "$dst/"
-    echo "  staged libfoundry_local.so"
-
+    required=(
+      "$src/libfoundry_local.so"
+      "$src/libonnxruntime-genai.so"
+      "$src/libonnxruntime.so"
+    )
+    for f in "${required[@]}"; do
+      if [ ! -e "$f" ]; then
+        echo "ERROR: required native artifact not found: $f" >&2
+        exit 1
+      fi
+      cp -P "$f" "$dst/"
+      echo "  staged $(basename "$f")"
+    done
+    for f in "$src"/libonnxruntime.so.*; do
+      if [ -e "$f" ]; then
+        cp -P "$f" "$dst/"
+        echo "  staged $(basename "$f")"
+      fi
+    done
+    for f in "$src"/libonnxruntime-genai*.so; do
+      if [ -e "$f" ] && [ "$(basename "$f")" != "libonnxruntime-genai.so" ]; then
+        cp -P "$f" "$dst/"
+        echo "  staged $(basename "$f")"
+      fi
+    done
+    for f in "$src"/libonnxruntime_providers_*.so; do
+      if [ -e "$f" ]; then
+        cp -P "$f" "$dst/"
+        echo "  staged $(basename "$f")"
+      fi
+    done
   displayName: 'Stage native artifacts'
 
 # Stage debug symbols into a separate artifact so they can be published

.pipelines/v2/templates/steps-build-macos.yml

@@ -81,26 +81,38 @@ steps:
   displayName: 'Dump vcpkg error logs'
   condition: failed()
 
-# Stage the redistributable native artifact. macOS has no triplet overlay so
-# vcpkg uses its default arm64-osx triplet, which is static — libfoundry_local.dylib
-# carries its transitive deps (azure-*, spdlog, fmt, libcurl, libssl/libcrypto,
-# zlib, brotli*) inside itself. ORT/GenAI .dylib files are supplied to consumers
-# separately (pip on the Python side, NuGet on the C# side); test/example binaries
-# are not part of the redistributable surface.
+# Stage the redistributable native artifacts for standalone C++ consumers.
 - bash: |
     set -euo pipefail
     src='$(Build.SourcesDirectory)/sdk_v2/cpp/build/macOS/${{ parameters.buildConfig }}/bin'
     dst='$(Build.ArtifactStagingDirectory)/native'
     mkdir -p "$dst"
 
-    primary="$src/libfoundry_local.dylib"
-    if [ ! -f "$primary" ]; then
-      echo "ERROR: libfoundry_local.dylib not found at $primary" >&2
-      exit 1
-    fi
-    cp -P "$primary" "$dst/"
-    echo "  staged libfoundry_local.dylib"
-
+    required=(
+      "$src/libfoundry_local.dylib"
+      "$src/libonnxruntime-genai.dylib"
+      "$src/libonnxruntime.dylib"
+    )
+    for f in "${required[@]}"; do
+      if [ ! -e "$f" ]; then
+        echo "ERROR: required native artifact not found: $f" >&2
+        exit 1
+      fi
+      cp -P "$f" "$dst/"
+      echo "  staged $(basename "$f")"
+    done
+    for f in "$src"/libonnxruntime.*.dylib; do
+      if [ -e "$f" ]; then
+        cp -P "$f" "$dst/"
+        echo "  staged $(basename "$f")"
+      fi
+    done
+    for f in "$src"/libonnxruntime_providers_*.dylib; do
+      if [ -e "$f" ]; then
+        cp -P "$f" "$dst/"
+        echo "  staged $(basename "$f")"
+      fi
+    done
   displayName: 'Stage native artifacts'
 
 # Stage debug symbols into a separate artifact so they can be published

.pipelines/v2/templates/steps-build-python.yml

@@ -106,10 +106,32 @@ steps:
         # deps (onnxruntime-{core,gpu} / onnxruntime-genai-{core,cuda}). Test
         # and example binaries are also filtered out upstream. We just copy
         # the curated artifact contents straight in.
-        $files = Get-ChildItem -Path "${{ parameters.nativeArtifactDir }}" -Recurse -File
+        $rid = '${{ parameters.rid }}'
+        if ($rid -like 'win-*') {
+            $allowed = @('foundry_local.dll', 'foundry_local.lib', 'Microsoft.Windows.AI.MachineLearning.dll', 'DirectML.dll')
+        } elseif ($rid -like 'linux-*') {
+            $allowed = @('libfoundry_local.so')
+        } elseif ($rid -like 'osx-*') {
+            $allowed = @('libfoundry_local.dylib')
+        } else {
+            throw "Unsupported Python wheel RID: $rid"
+        }
+        $files = foreach ($name in $allowed) {
+            Get-ChildItem -Path "${{ parameters.nativeArtifactDir }}" -Filter $name -File -ErrorAction SilentlyContinue
+        }
         if ($files.Count -eq 0) {
             throw "No native artifacts found under ${{ parameters.nativeArtifactDir }}"
         }
+        if ($rid -like 'win-*') {
+            $found = @{}
+            foreach ($f in $files) {
+                $found[$f.Name] = $true
+            }
+            $missing = @($allowed | Where-Object { -not $found.ContainsKey($_) })
+            if ($missing.Count -gt 0) {
+                throw "Missing required Windows native artifact(s): $($missing -join ', ') under ${{ parameters.nativeArtifactDir }}"
+            }
+        }
         foreach ($f in $files) {
             Copy-Item $f.FullName -Destination $dest -Force
         }

.pipelines/v2/templates/steps-build-windows.yml

@@ -138,7 +138,13 @@ steps:
         (Join-Path $binDir  'foundry_local.dll'),
         (Join-Path $binDir  'foundry_local.pdb'),
         (Join-Path $linkDir 'foundry_local.lib'),
-        (Join-Path $binDir  'Microsoft.Windows.AI.MachineLearning.dll')
+        (Join-Path $binDir  'Microsoft.Windows.AI.MachineLearning.dll'),
+        (Join-Path $binDir  'DirectML.dll'),
+        (Join-Path $binDir  'onnxruntime.dll'),
+        (Join-Path $binDir  'onnxruntime-genai.dll')
+      )
+      $optionalPatterns = @(
+        'onnxruntime_providers_*.dll'
       )
 
       foreach ($s in $sources) {
@@ -149,6 +155,12 @@ steps:
         Copy-Item -Path $s -Destination $dst -Force
         Write-Host "  staged $(Split-Path -Leaf $s)"
       }
+      foreach ($pattern in $optionalPatterns) {
+        Get-ChildItem -Path $binDir -Filter $pattern -File -ErrorAction SilentlyContinue | ForEach-Object {
+          Copy-Item -Path $_.FullName -Destination $dst -Force
+          Write-Host "  staged $($_.Name)"
+        }
+      }
 
 - ${{ if eq(parameters.stageHeaders, true) }}:
   - task: CopyFiles@2

.pipelines/v2/templates/steps-pack-cpp-sdk.yml

@@ -61,9 +61,8 @@ steps:
 
         Copy-Item -Path (Join-Path $includeSrc '*') -Destination $includeDst -Recurse -Force
 
-        # The SDK tgz should include only public wrapper headers.
+        # The SDK tgz should include public wrapper headers and their header-only dependencies.
         $pathsToPrune = @(
-          (Join-Path $includeDst 'gsl'),
           (Join-Path $includeDst '_manifest')
         )
         foreach ($pathToPrune in $pathsToPrune) {
@@ -72,13 +71,17 @@ steps:
           }
         }
 
-        foreach ($f in $Files) {
-          $src = Join-Path $nativeSrc $f
-          if (-not (Test-Path $src)) {
-            throw "Required native file not found: $src"
+        foreach ($entry in $Files) {
+          $optional = $entry.StartsWith('?')
+          $pattern = if ($optional) { $entry.Substring(1) } else { $entry }
+          $matches = @(Get-ChildItem -Path $nativeSrc -Filter $pattern -File -ErrorAction SilentlyContinue)
+          if ($matches.Count -eq 0 -and -not $optional) {
+            throw "Required native file not found: $(Join-Path $nativeSrc $pattern)"
+          }
+          foreach ($match in $matches) {
+            $dst = Join-Path $libDst $match.Name
+            Copy-Item -Path $match.FullName -Destination $dst -Force
           }
-          $dst = Join-Path $libDst (Split-Path -Leaf $src)
-          Copy-Item -Path $src -Destination $dst -Force
         }
 
         if ($SymbolsArtifact) {
@@ -115,23 +118,40 @@ steps:
       New-SdkArchive -Rid 'win-x64' -NativeArtifact 'cpp-native-win-x64' -Files @(
         'foundry_local.dll',
         'foundry_local.pdb',
-        'foundry_local.lib'
+        'foundry_local.lib',
+        'Microsoft.Windows.AI.MachineLearning.dll',
+        'DirectML.dll',
+        'onnxruntime.dll',
+        'onnxruntime-genai.dll',
+        '?onnxruntime_providers_*.dll'
       )
 
       New-SdkArchive -Rid 'win-arm64' -NativeArtifact 'cpp-native-win-arm64' -Files @(
         'foundry_local.dll',
         'foundry_local.pdb',
-        'foundry_local.lib'
+        'foundry_local.lib',
+        'Microsoft.Windows.AI.MachineLearning.dll',
+        'DirectML.dll',
+        'onnxruntime.dll',
+        'onnxruntime-genai.dll',
+        '?onnxruntime_providers_*.dll'
       )
 
       New-SdkArchive -Rid 'linux-x64' -NativeArtifact 'cpp-native-linux-x64' -Files @(
-        'libfoundry_local.so'
+        'libfoundry_local.so',
+        'libonnxruntime-genai.so',
+        '?libonnxruntime-genai*.so',
+        '?libonnxruntime_providers_*.so',
+        'libonnxruntime.so*'
       ) -SymbolsArtifact 'cpp-native-symbols-linux-x64' -SymbolItems @(
         'libfoundry_local.so.dbg'
       )
 
       New-SdkArchive -Rid 'osx-arm64' -NativeArtifact 'cpp-native-osx-arm64' -Files @(
-        'libfoundry_local.dylib'
+        'libfoundry_local.dylib',
+        'libonnxruntime-genai.dylib',
+        'libonnxruntime*.dylib',
+        '?libonnxruntime_providers_*.dylib'
       ) -SymbolsArtifact 'cpp-native-symbols-osx-arm64' -SymbolItems @(
         'libfoundry_local.dylib.dSYM'
       )

.pipelines/v2/templates/steps-pack-js.yml

@@ -74,6 +74,7 @@ steps:
       $dst = '${{ parameters.outputDir }}'
       New-Item -ItemType Directory -Force -Path $dst | Out-Null
       Set-Location "$(Build.SourcesDirectory)/sdk_v2/js"
+      Copy-Item "$(Build.SourcesDirectory)/sdk_v2/deps_versions.json" -Destination "deps_versions.json" -Force
       npm pack --pack-destination $dst
       if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
       Get-ChildItem $dst | ForEach-Object { Write-Host "  $($_.Name)  $($_.Length) bytes" }

sdk_v2/cpp/CMakeLists.txt

@@ -404,6 +404,13 @@ if(TARGET OnnxRuntime::OnnxRuntime)
                     $<TARGET_FILE_DIR:foundry_local>
             )
         endif()
+        if(WinMLEpCatalog_FOUND AND EXISTS "${WINML_EP_CATALOG_DLL_DIR}/DirectML.dll")
+            add_custom_command(TARGET foundry_local POST_BUILD
+                COMMAND ${CMAKE_COMMAND} -E copy_if_different
+                    "${WINML_EP_CATALOG_DLL_DIR}/DirectML.dll"
+                    $<TARGET_FILE_DIR:foundry_local>
+            )
+        endif()
     elseif(APPLE)
         # macOS: copy dylibs so consumers that only link libfoundry_local.dylib (e.g. cache_only_tests) find the correct
         # ORT version instead of any system-installed ORT, which would cause an Ort::InitApi() version mismatch.

sdk_v2/cpp/cmake/FindOnnxRuntime.cmake

@@ -97,7 +97,7 @@ else()
             message(STATUS "Downloading ${ORT_PACKAGE_NAME} ${ORT_VERSION} from nuget.org")
         endif()
     else()
-        message(STATUS "Using pre-configured ORT_FETCH_URL: ${ORT_FETCH_URL}")
+        message(STATUS "Using pre-configured ORT_FETCH_URL")
     endif()
 
     # Normalize backslashes (Windows paths) and handle .nupkg extension
@@ -106,11 +106,15 @@ else()
         set(_ORT_ZIP_PATH "${CMAKE_BINARY_DIR}/_deps/ortlib-download/ort.zip")
         get_filename_component(_ORT_ZIP_DIR "${_ORT_ZIP_PATH}" DIRECTORY)
         file(MAKE_DIRECTORY "${_ORT_ZIP_DIR}")
-        file(COPY_FILE "${ORT_FETCH_URL}" "${_ORT_ZIP_PATH}")
+        configure_file("${ORT_FETCH_URL}" "${_ORT_ZIP_PATH}" COPYONLY)
         set(ORT_FETCH_URL "${_ORT_ZIP_PATH}")
     endif()
 
-    FetchContent_Declare(ortlib URL ${ORT_FETCH_URL} DOWNLOAD_EXTRACT_TIMESTAMP TRUE DOWNLOAD_NAME ort.zip)
+    set(_ORT_FETCH_ARGS URL ${ORT_FETCH_URL} DOWNLOAD_NAME ort.zip)
+    if(CMAKE_VERSION VERSION_GREATER_EQUAL "3.24")
+        list(APPEND _ORT_FETCH_ARGS DOWNLOAD_EXTRACT_TIMESTAMP TRUE)
+    endif()
+    FetchContent_Declare(ortlib ${_ORT_FETCH_ARGS})
     FetchContent_MakeAvailable(ortlib)
 
     set(_ORT_HEADER_DIR "${ortlib_SOURCE_DIR}/build/native/include")
@@ -149,7 +153,7 @@ else()
                 message(STATUS "Downloading ${_ORT_GPU_LINUX_PACKAGE} ${ORT_VERSION} from nuget.org")
             endif()
         else()
-            message(STATUS "Using pre-configured ORT_GPU_LINUX_FETCH_URL: ${ORT_GPU_LINUX_FETCH_URL}")
+            message(STATUS "Using pre-configured ORT_GPU_LINUX_FETCH_URL")
         endif()
 
         # Normalize backslashes and handle .nupkg extension
@@ -158,11 +162,15 @@ else()
             set(_ORT_GPU_ZIP_PATH "${CMAKE_BINARY_DIR}/_deps/ort_gpu_linux-download/ort_gpu_linux.zip")
             get_filename_component(_ORT_GPU_ZIP_DIR "${_ORT_GPU_ZIP_PATH}" DIRECTORY)
             file(MAKE_DIRECTORY "${_ORT_GPU_ZIP_DIR}")
-            file(COPY_FILE "${ORT_GPU_LINUX_FETCH_URL}" "${_ORT_GPU_ZIP_PATH}")
+            configure_file("${ORT_GPU_LINUX_FETCH_URL}" "${_ORT_GPU_ZIP_PATH}" COPYONLY)
             set(ORT_GPU_LINUX_FETCH_URL "${_ORT_GPU_ZIP_PATH}")
         endif()
 
-        FetchContent_Declare(ort_gpu_linux URL ${ORT_GPU_LINUX_FETCH_URL} DOWNLOAD_EXTRACT_TIMESTAMP TRUE DOWNLOAD_NAME ort_gpu_linux.zip)
+        set(_ORT_GPU_FETCH_ARGS URL ${ORT_GPU_LINUX_FETCH_URL} DOWNLOAD_NAME ort_gpu_linux.zip)
+        if(CMAKE_VERSION VERSION_GREATER_EQUAL "3.24")
+            list(APPEND _ORT_GPU_FETCH_ARGS DOWNLOAD_EXTRACT_TIMESTAMP TRUE)
+        endif()
+        FetchContent_Declare(ort_gpu_linux ${_ORT_GPU_FETCH_ARGS})
         FetchContent_MakeAvailable(ort_gpu_linux)
 
         set(_ORT_LIB_DIR "${ort_gpu_linux_SOURCE_DIR}/runtimes/${_ORT_PLATFORM}/native")