fix: Propagate version tag to WebUI asset download in self-hosted CI (#23051)

* fix: Propagate version tag to WebUI asset download in self-hosted CI

* refactor: Apply suggestions from @CISC

Co-authored-by: Sigbjørn Skjæret <sigbjorn.skjaeret@scala.com>

* fix: Skip npm build when Node.js is not installed

Avoid 'no such file or directory' errors on CI runners that lack
Node.js. Check if npm is available via find_program before attempting
npm install + npm run build. Falls back to HF Bucket download.

* fix: Use + separator for ASSETS list to fix Windows build

Replace fragile \; escaping with a + separator when passing the
WebUI asset list via -DASSETS to the download script. On Windows,
the \; escaping was not reliably preserved through the CMake build
system, causing all asset filenames to be concatenated into one
(e.g., 'index.html;bundle.js;bundle.css;loading.html' as a single
file), which broke the HF Bucket download and subsequent xxd.cmake
step.

+ is safe because it is not special in cmd.exe (unlike | which is a
pipe operator), not special in CMake's -D argument parser, and not
a valid Windows filename character. CMakeLists.txt joins assets
with + and webui-download.cmake splits them back via regex.

* fix: Validate HF_WEBUI_VERSION environment variable with regex

Add input validation for the HF_WEBUI_VERSION env var to prevent
CMake list separator or path-traversal issues in stamp filenames
and download URLs. Rejects non-conforming characters early.

* fix: Remove 'latest' fallback for HF_WEBUI_VERSION

When needs.determine-tag.outputs.tag_name is empty, let CMake's
default resolution handle it (empty -> git-based version lookup)
instead of falling back to 'latest'. This ensures the sentinel
stamp file is consistent with CMake's resolution logic.

* fix: Demote checksum verification failure to warning instead of hard gate

* fix: End line character

---------

Co-authored-by: Sigbjørn Skjæret <sigbjorn.skjaeret@scala.com>

tools/server/CMakeLists.txt

@@ -76,12 +76,21 @@ if (LLAMA_BUILD_WEBUI)
 
     # Priority 2: Build-time asset provisioning (npm build → HF Bucket fallback)
     if(NOT WEBUI_SOURCE_DIR)
-        if(DEFINED LLAMA_BUILD_NUMBER)
-            set(HF_WEBUI_VERSION "${LLAMA_BUILD_NUMBER}")
+        # Environment variable takes precedence (e.g., from CI workflows)
+        if(DEFINED ENV{HF_WEBUI_VERSION})
+            set(HF_WEBUI_VERSION "$ENV{HF_WEBUI_VERSION}")
+            # Validate against allowed characters to prevent CMake list separator
+            # or path-traversal issues in stamp filenames and download URLs
+            if(NOT HF_WEBUI_VERSION MATCHES "^[A-Za-z0-9._-]+$")
+                message(FATAL_ERROR "WebUI: invalid HF_WEBUI_VERSION='${HF_WEBUI_VERSION}' - must match ^[A-Za-z0-9._-]+$")
+            endif()
+            message(STATUS "WebUI: using HF_WEBUI_VERSION from environment=${HF_WEBUI_VERSION}")
+        elseif(DEFINED LLAMA_BUILD_NUMBER)
+            set(HF_WEBUI_VERSION "b${LLAMA_BUILD_NUMBER}")
             message(STATUS "WebUI: using LLAMA_BUILD_NUMBER=${HF_WEBUI_VERSION}")
         else()
             set(HF_WEBUI_VERSION "")
-            message(STATUS "WebUI: LLAMA_BUILD_NUMBER not defined")
+            message(STATUS "WebUI: version not specified (will use HF 'latest')")
         endif()
 
         # Stamp file embeds the version tag so a changed build number triggers
@@ -93,8 +102,8 @@ if (LLAMA_BUILD_WEBUI)
         endif()
         set(WEBUI_STAMP "${CMAKE_CURRENT_BINARY_DIR}/.webui-${WEBUI_VERSION_TAG}.stamp")
 
-        # Escape semicolons so the CMake list is passed as a single -D argument
-        string(REPLACE ";" "\\;" PUBLIC_ASSETS_ESC "${PUBLIC_ASSETS}")
+        # Join assets with + separator (safe across all platforms, unlike ; and |)
+        string(REPLACE ";" "+" PUBLIC_ASSETS_JOINED "${PUBLIC_ASSETS}")
 
         add_custom_command(
             OUTPUT ${WEBUI_STAMP}
@@ -104,7 +113,7 @@ if (LLAMA_BUILD_WEBUI)
                 "-DHF_BUCKET=${LLAMA_WEBUI_HF_BUCKET}"
                 "-DHF_VERSION=${HF_WEBUI_VERSION}"
                 "-DHF_ENABLED=${LLAMA_USE_PREBUILT_WEBUI}"
-                "-DASSETS=${PUBLIC_ASSETS_ESC}"
+                "-DASSETS=${PUBLIC_ASSETS_JOINED}"
                 "-DSTAMP_FILE=${WEBUI_STAMP}"
                 "-DNPM_DIR=${CMAKE_CURRENT_SOURCE_DIR}/webui"
                 -P ${PROJECT_SOURCE_DIR}/scripts/webui-download.cmake