build: pin the siso revision in build/siso_revision instead of fetching Chromium's DEPS in CI (#53450)

The build-siso job needs the siso commit that our pinned Chromium expects. It
used to curl Chromium's DEPS from raw.githubusercontent.com on every run to find
it, and that fetch has failed main several times (HTTP errors / TLS resets that
took out all three siso jobs at once). The value only changes when Chromium
rolls, so record it in the repo and stop fetching:

- build/siso_revision holds the sha; pipeline-segment-build-siso reads it from a
  sparse checkout and no longer touches the network to resolve it.
- script/gen-siso-revision.js derives it from the synced Chromium tree
  (src/DEPS siso_version). A gen_siso_revision gclient hook runs it after every
  sync, lint-staged runs it when DEPS changes, and gn-check runs it with --check
  so a roll that forgets to commit the file fails with a clear message.
- The roller commit linter accepts "chore: update siso revision" (only that
  file), and the Chromium upgrade skill tells you to commit it after a
  successful sync, mirroring how filenames.libcxx.gni is handled.

.claude/skills/electron-chromium-upgrade/SKILL.md

@@ -55,7 +55,8 @@ Run these once at the start of each upgrade session:
    - IMPORTANT: Once `git am --continue` succeeds you MUST run `e patches {target}` to export fixes
    - Return to step 1
 4. When `e sync --3` succeeds, run `e patches all`
-5. **Read `references/phase-one-commit-guidelines.md` NOW**, then commit changes following those instructions exactly.
+5. If the sync changed `build/siso_revision` (the `gen_siso_revision` hook rewrites it when the new Chromium pins a different siso), commit that file on its own as `chore: update siso revision`. CI builds siso from this file and gn-check fails the roll if it is stale.
+6. **Read `references/phase-one-commit-guidelines.md` NOW**, then commit changes following those instructions exactly.
 
 ## Commands Reference
 

.claude/skills/electron-chromium-upgrade/references/phase-one-commit-guidelines.md

@@ -17,8 +17,9 @@ Allowed commit patterns:
 1. `fixup! <existing-commit-title>` — fixup against another commit on the branch
 2. `chore: bump chromium in DEPS to <version>` — must be the *only* change to `DEPS`, no other files
 3. `chore: update patches` — exact title, no commit body, only non-content patch changes (index hashes, line numbers, hunk headers)
-4. A commit referencing one Chromium CL: title must be exactly `<CL_NUMBER>: <upstream CL's original title>`
-5. A commit referencing multiple Chromium CLs: title is not enforced
+4. `chore: update siso revision` — exact title, the only change is `build/siso_revision` (rewritten by the `gen_siso_revision` sync hook)
+5. A commit referencing one Chromium CL: title must be exactly `<CL_NUMBER>: <upstream CL's original title>`
+6. A commit referencing multiple Chromium CLs: title is not enforced
 
 A Chromium CL is referenced by including the full Gerrit URL anywhere in the commit message, e.g. `Ref: https://chromium-review.googlesource.com/c/chromium/src/+/7536483`. Appending `#nolint` to the URL excludes that CL from validation (and from the single-CL title check).
 

.github/workflows/pipeline-segment-build-siso.yml

@@ -1,8 +1,9 @@
 name: Pipeline Segment - Build Siso
 
 # Builds a patched siso binary for a single CI build host. Reads the siso
-# revision from the Chromium DEPS file at the pinned chromium_version,
-# shallow-clones chromium.googlesource.com/build at that revision, applies the
+# revision from build/siso_revision (kept in step with Chromium's DEPS by the
+# gen_siso_revision gclient hook and checked in gn-check; nothing is fetched
+# here), shallow-clones chromium.googlesource.com/build at that revision, applies the
 # patches under .github/siso-patches/, and cross-compiles siso for the requested
 # build host. siso runs on the build host (not the target), so three host arches
 # cover every build job: Windows targets use windows-amd64, Linux targets (any
@@ -55,28 +56,22 @@ jobs:
         fetch-depth: 1
         ref: ${{ github.event.pull_request.head.sha }}
         sparse-checkout: |
-          DEPS
+          build/siso_revision
           .github/siso-patches
         persist-credentials: false
-    - name: Resolve siso revision from Chromium DEPS
+    - name: Resolve siso revision
       id: resolve
       run: |
         set -euo pipefail
-        CHROMIUM_VERSION=$(python3 -c "import re; print(re.search(r\"'chromium_version':\s*\n\s*'([^']+)'\", open('DEPS').read()).group(1))")
-        if ! [[ "$CHROMIUM_VERSION" =~ ^[0-9]+(\.[0-9]+){1,3}$ ]]; then
-          echo "error: unexpected chromium_version format: $CHROMIUM_VERSION" >&2
-          exit 1
-        fi
-        curl -sfL "https://raw.githubusercontent.com/chromium/chromium/${CHROMIUM_VERSION}/DEPS" -o /tmp/chromium-DEPS
-        SISO_SHA=$(python3 -c "import re; print(re.search(r\"'siso_version':\s*'git_revision:([0-9a-f]+)'\", open('/tmp/chromium-DEPS').read()).group(1))")
+        SISO_SHA=$(tr -d '[:space:]' < build/siso_revision)
         if ! [[ "$SISO_SHA" =~ ^[0-9a-f]{40}$ ]]; then
-          echo "error: unexpected siso_version SHA: $SISO_SHA" >&2
+          echo "error: build/siso_revision does not hold a 40-char git SHA: '$SISO_SHA'" >&2
           exit 1
         fi
         PATCHES_HASH=$(find .github/siso-patches -type f -name '*.patch' | sort | xargs sha256sum | sha256sum | awk '{print $1}')
         echo "siso-sha=${SISO_SHA}" >> "$GITHUB_OUTPUT"
         echo "patches-hash=${PATCHES_HASH}" >> "$GITHUB_OUTPUT"
-        echo "Chromium ${CHROMIUM_VERSION} pins siso at ${SISO_SHA}"
+        echo "build/siso_revision pins siso at ${SISO_SHA}"
         echo "Patches hash: ${PATCHES_HASH}"
     - name: Restore cached siso binary
       id: cache-siso

.github/workflows/pipeline-segment-electron-gn-check.yml

@@ -187,6 +187,7 @@ jobs:
         node script/gen-hunspell-filenames.js --check
 
         node script/gen-libc++-filenames.js --check
+        node script/gen-siso-revision.js --check
         node script/yarn.js ts-node script/gen-filenames.ts -- --check
     - name: Wait for active SSH sessions
       if: always() && !cancelled()

DEPS

@@ -166,6 +166,17 @@ hooks = [
       'import os, subprocess; os.chdir(os.path.join("src", "electron")); subprocess.check_call(["node", ".yarn/releases/yarn-4.12.0.cjs", "install", "--immutable"]);',
     ],
   },
+  {
+    # Keep src/electron/build/siso_revision in step with the siso commit this
+    # Chromium pins; CI builds siso from that file (see the script header).
+    'name': 'gen_siso_revision',
+    'condition': 'checkout_chromium and process_deps',
+    'pattern': 'src/electron',
+    'action': [
+      'node',
+      'src/electron/script/gen-siso-revision.js',
+    ],
+  },
   {
     'name': 'sysroot_arm',
     'pattern': '.',

build/siso_revision

@@ -0,0 +1 @@
+efbbe7f1892211b5e9512576843a3c247b6a6d7c

package.json

@@ -124,7 +124,9 @@
     ],
     "DEPS": [
       "node script/gen-hunspell-filenames.js",
-      "node script/gen-libc++-filenames.js"
+      "node script/gen-libc++-filenames.js",
+      "node script/gen-siso-revision.js",
+      "git add build/siso_revision"
     ],
     ".github/workflows/pipeline-segment-electron-build.yml": [
       "node script/copy-pipeline-segment-publish.js",

script/gen-siso-revision.js

@@ -0,0 +1,48 @@
+const fs = require('node:fs');
+const path = require('node:path');
+const { styleText } = require('node:util');
+
+// build/siso_revision records the siso commit that the pinned Chromium
+// (chromium_version in DEPS) expects, i.e. the `siso_version` git_revision in
+// Chromium's own DEPS. CI builds a patched siso from exactly that commit
+// (.github/workflows/pipeline-segment-build-siso.yml) before any Chromium
+// checkout exists, so the value has to live in this repo rather than be
+// fetched at build time. This script derives it from the synced Chromium tree:
+// the `gen_siso_revision` gclient hook and lint-staged run it to keep the file
+// current, and CI runs it with --check to fail a roll that forgot to commit it.
+
+const check = process.argv.includes('--check');
+
+const OUT_FILE = path.join('build', 'siso_revision');
+const outPath = path.resolve(__dirname, '..', OUT_FILE);
+const chromiumDepsPath = path.resolve(__dirname, '..', '..', 'DEPS');
+
+if (!fs.existsSync(chromiumDepsPath)) {
+  // No Chromium checkout next to us (e.g. a standalone clone); nothing to derive from.
+  console.log(`${chromiumDepsPath} not found; leaving ${OUT_FILE} as is`);
+  process.exit(0);
+}
+
+const chromiumDeps = fs.readFileSync(chromiumDepsPath, 'utf8');
+const match = /'siso_version':\s*'git_revision:([0-9a-f]{40})'/.exec(chromiumDeps);
+if (!match) {
+  console.error(styleText('bold', `Could not find siso_version in ${chromiumDepsPath}`));
+  process.exit(1);
+}
+const expected = `${match[1]}\n`;
+const current = fs.existsSync(outPath) ? fs.readFileSync(outPath, 'utf8') : '';
+
+if (current === expected) {
+  process.exit(0);
+}
+
+if (check) {
+  console.error(styleText('bold', `${OUT_FILE} is out of date:`));
+  console.error(`  recorded: ${current.trim() || '(missing)'}`);
+  console.error(`  Chromium: ${expected.trim()}`);
+  console.error(styleText('bold', `\nRun node script/gen-siso-revision.js (or e sync) and commit ${OUT_FILE}`));
+  process.exit(1);
+}
+
+fs.writeFileSync(outPath, expected);
+console.log(`Updated ${OUT_FILE} to ${expected.trim()}; commit this alongside the Chromium roll.`);

script/lint-roller-chromium-changes.mjs

@@ -18,6 +18,8 @@ const DEPS_BUMP_MSG_REGEX = /^chore: bump chromium in DEPS to (\S+)$/;
 const PATCHES_UPDATE_MSG = 'chore: update patches';
 const LIBCXX_FILENAMES_UPDATE_MSG = 'chore: update libc++ filenames';
 const LIBCXX_FILENAMES_FILE = 'filenames.libcxx.gni';
+const SISO_REVISION_UPDATE_MSG = 'chore: update siso revision';
+const SISO_REVISION_FILE = 'build/siso_revision';
 
 function getCLLabel(cl) {
   const [owner, repo] = cl.fullRepo.split('/');
@@ -432,6 +434,23 @@ async function main() {
       continue;
     }
 
+    // Validate "chore: update siso revision" commits
+    if (firstLine === SISO_REVISION_UPDATE_MSG) {
+      const changedFiles = getChangedFilesForCommit(commit.sha);
+
+      if (!changedFiles || changedFiles.length !== 1 || changedFiles[0] !== SISO_REVISION_FILE) {
+        const filesDesc = changedFiles ? changedFiles.join(', ') : 'unknown';
+        console.error(
+          `  ❌ "${SISO_REVISION_UPDATE_MSG}" commit must only modify ${SISO_REVISION_FILE}, but changes: ${filesDesc}`
+        );
+        hasErrors = true;
+      } else {
+        console.log(`  ✅ "${SISO_REVISION_UPDATE_MSG}" commit is valid`);
+      }
+
+      continue;
+    }
+
     const cls = [...commit.message.matchAll(CL_REGEX)].map((match) => ({
       url: match[0],
       fullRepo: match[1],
@@ -442,7 +461,7 @@ async function main() {
     if (cls.length === 0) {
       console.error(`  ❌ Commit does not match any allowed pattern and references no CLs`);
       console.error(
-        `     Allowed: fixup! commit, merge commit, "chore: bump chromium in DEPS to <version>", "${PATCHES_UPDATE_MSG}", "${LIBCXX_FILENAMES_UPDATE_MSG}", or a commit referencing one or more CLs`
+        `     Allowed: fixup! commit, merge commit, "chore: bump chromium in DEPS to <version>", "${PATCHES_UPDATE_MSG}", "${LIBCXX_FILENAMES_UPDATE_MSG}", "${SISO_REVISION_UPDATE_MSG}", or a commit referencing one or more CLs`
       );
       hasErrors = true;
       continue;