fix(ci): unblock first PR run — sherpa Linux URL, CMake bump, RAG include path

Three pre-existing C++/script bugs surfaced when adding Linux/Windows/Web
to the matrix for the first time:

1. sherpa-onnx Linux x64 URL — script used the aarch64 naming pattern
   (`-shared-cpu`) for x64; the actual filename is `-shared` (no `-cpu`
   suffix) for x64. Also added a download-size sanity check so a 9-byte
   404 page can no longer slip past curl into bzip2.

2. CMake version bump 3.22 → 3.27. cmake/FetchONNXRuntime.cmake uses
   the DOWNLOAD_EXTRACT_TIMESTAMP keyword which was added in 3.24, so
   3.22 mis-parses it as part of the URL list and fails with
   "At least one entry of URL is a path". CMakeLists.txt's
   cmake_minimum_required(3.22) stays as documentation; CI installs 3.27.

3. RAG CMakeLists used ${CMAKE_SOURCE_DIR}/include for commons headers,
   which is wrong when commons is pulled in via add_subdirectory() from
   another project (e.g. sdk/runanywhere-web/wasm/). Switched to
   CMAKE_CURRENT_SOURCE_DIR-relative path that walks up to commons/.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: sanchitmonga22

sdk/runanywhere-commons/VERSIONS

@@ -46,8 +46,12 @@ JAVA_VERSION=17
 # Gradle wrapper version baseline
 GRADLE_VERSION=8.11.1
 
-# CMake minimum version (matches sdk/runanywhere-commons/CMakeLists.txt:1)
-CMAKE_VERSION=3.22
+# CMake version installed in CI. Must be >= 3.24 because
+# cmake/FetchONNXRuntime.cmake uses the DOWNLOAD_EXTRACT_TIMESTAMP keyword
+# which was added in CMake 3.24. (The repo's CMakeLists.txt advertises
+# cmake_minimum_required(3.22) for build-system documentation, but the
+# toolchain installed in CI has to be 3.24+ to actually run the build.)
+CMAKE_VERSION=3.27
 
 # =============================================================================
 # ONNX Runtime

sdk/runanywhere-commons/scripts/linux/download-sherpa-onnx.sh

@@ -87,8 +87,10 @@ if [ "$ARCH" = "aarch64" ]; then
     URL="https://github.com/k2-fsa/sherpa-onnx/releases/download/v${VERSION}/sherpa-onnx-v${VERSION}-linux-aarch64-shared-cpu.tar.bz2"
     ARCHIVE_NAME="sherpa-onnx-v${VERSION}-linux-aarch64-shared-cpu"
 elif [ "$ARCH" = "x86_64" ]; then
-    URL="https://github.com/k2-fsa/sherpa-onnx/releases/download/v${VERSION}/sherpa-onnx-v${VERSION}-linux-x64-shared-cpu.tar.bz2"
-    ARCHIVE_NAME="sherpa-onnx-v${VERSION}-linux-x64-shared-cpu"
+    # Note: sherpa-onnx publishes Linux x64 as `-shared` (no `-cpu` suffix);
+    # aarch64 keeps the `-shared-cpu` suffix.
+    URL="https://github.com/k2-fsa/sherpa-onnx/releases/download/v${VERSION}/sherpa-onnx-v${VERSION}-linux-x64-shared.tar.bz2"
+    ARCHIVE_NAME="sherpa-onnx-v${VERSION}-linux-x64-shared"
 else
     print_error "Unsupported architecture: $ARCH"
     echo "Supported architectures: x86_64, aarch64"
@@ -121,7 +123,17 @@ TEMP_DIR=$(mktemp -d)
 trap "rm -rf ${TEMP_DIR}" EXIT
 
 print_step "Downloading Sherpa-ONNX v${VERSION}..."
-curl -L -o "${TEMP_DIR}/sherpa-onnx.tar.bz2" "${URL}"
+# `--fail` makes curl exit non-zero on HTTP 4xx/5xx so a 404 page doesn't end
+# up being passed to tar/bzip2 below as a 9-byte "Not Found" file.
+curl -L --fail -o "${TEMP_DIR}/sherpa-onnx.tar.bz2" "${URL}"
+
+# Sanity-check the archive size — anything under 1 MB is almost certainly an
+# error page that slipped past --fail (e.g. proxy-mediated redirect).
+DL_SIZE=$(stat -c%s "${TEMP_DIR}/sherpa-onnx.tar.bz2" 2>/dev/null || stat -f%z "${TEMP_DIR}/sherpa-onnx.tar.bz2")
+if [ "${DL_SIZE}" -lt 1048576 ]; then
+    print_error "Downloaded file is suspiciously small (${DL_SIZE} bytes). URL may be wrong: ${URL}"
+    exit 1
+fi
 
 print_step "Extracting archive..."
 mkdir -p "${DEST_DIR}"

sdk/runanywhere-commons/src/features/rag/CMakeLists.txt

@@ -81,8 +81,12 @@ add_library(rac_backend_rag OBJECT ${RAG_PIPELINE_SOURCES} ${RAG_PIPELINE_HEADER
 
 target_include_directories(rac_backend_rag PUBLIC
     ${CMAKE_CURRENT_SOURCE_DIR}
-    ${CMAKE_SOURCE_DIR}/include
-    ${CMAKE_SOURCE_DIR}/include/rac/backends
+    # Walk up from src/features/rag/ to commons/, then into include/. Uses
+    # CMAKE_CURRENT_SOURCE_DIR (not CMAKE_SOURCE_DIR) so the path is correct
+    # whether commons is the top-level CMake project or pulled in via
+    # add_subdirectory() from another project (e.g., the Web/WASM build).
+    ${CMAKE_CURRENT_SOURCE_DIR}/../../../include
+    ${CMAKE_CURRENT_SOURCE_DIR}/../../../include/rac/backends
     ${usearch_SOURCE_DIR}/include
 )