Support telemetry policy across ORT versions

.github/workflows/build.yml

@@ -65,17 +65,28 @@ jobs:
           path: onnxruntime
           fetch-depth: 1
 
-      - name: Verify patches and portable smoke-test headers
+      - name: Verify patches, build interface, and portable smoke-test headers
         shell: bash
         env:
+          ORT_REF: ${{ steps.meta.outputs.ort_ref }}
+          ORT_VERSION: ${{ steps.meta.outputs.ort_version }}
           ORT_COMMIT: ${{ steps.meta.outputs.ort_commit }}
+          PACKAGE_REVISION: ${{ steps.meta.outputs.package_revision }}
         run: |
           set -euo pipefail
           [ "$(git -C onnxruntime rev-parse HEAD)" = "$ORT_COMMIT" ]
           for patch in "$GITHUB_WORKSPACE"/patches/*.patch; do
             git -C onnxruntime apply --check "$patch"
             git -C onnxruntime apply "$patch"
           done
+          source scripts/common.sh
+          if ort_supports_no_telemetry; then
+            echo "Upstream build supports --no_telemetry"
+          else
+            echo "Upstream build requires the explicit telemetry CMake definition"
+          fi
+          jq --exit-status '.build_params | index("--no_telemetry") == null and index("--cmake_extra_defines=onnxruntime_USE_TELEMETRY=OFF") != null' config/android-webgpu.json >/dev/null
+          jq --exit-status '.build_params.base | index("--no_telemetry") == null and index("--cmake_extra_defines=onnxruntime_USE_TELEMETRY=OFF") != null' config/ios-coreml.json >/dev/null
           cmake -S tests -B "$RUNNER_TEMP/runtime-smoke" \
             -DORT_INCLUDE_DIR="$GITHUB_WORKSPACE/onnxruntime/include/onnxruntime/core/session"
           cmake --build "$RUNNER_TEMP/runtime-smoke" --parallel

.github/workflows/validate.yml

@@ -26,7 +26,7 @@ jobs:
           jq --exit-status . config/*.json >/dev/null
           source build.env
           [ "$ORT_TELEMETRY" = disabled ]
-          jq --exit-status ".build_params | index(\"--no_telemetry\") != null" config/android-webgpu.json >/dev/null
-          jq --exit-status ".build_params.base | index(\"--no_telemetry\") != null" config/ios-coreml.json >/dev/null
+          jq --exit-status '.build_params | index("--no_telemetry") == null and index("--cmake_extra_defines=onnxruntime_USE_TELEMETRY=OFF") != null' config/android-webgpu.json >/dev/null
+          jq --exit-status '.build_params.base | index("--no_telemetry") == null and index("--cmake_extra_defines=onnxruntime_USE_TELEMETRY=OFF") != null' config/ios-coreml.json >/dev/null
           # shellcheck disable=SC2016
           pwsh -NoProfile -Command '$errors = $null; Get-ChildItem scripts/*.ps1 | ForEach-Object { [System.Management.Automation.Language.Parser]::ParseFile($_.FullName, [ref]$null, [ref]$errors) | Out-Null }; if ($errors.Count) { $errors | Format-List; exit 1 }'

README.md

@@ -75,7 +75,7 @@ Never replace or retag an existing release. Create the next package revision ins
 
 The provider in an asset name is intentional: Android/Linux/Windows support WebGPU, while Apple packages intentionally use CoreML rather than WebGPU. Do not mix a packaged runtime, plugin, or headers with another ONNX Runtime build.
 
-Telemetry is compiled out of every package. Platform build jobs pass ONNX Runtime's `--no_telemetry` option and reject generated CMake configurations unless `onnxruntime_USE_TELEMETRY=OFF`, so an upstream default change cannot silently enable telemetry in a future release.
+Telemetry is compiled out of every package. Every build explicitly sets `onnxruntime_USE_TELEMETRY=OFF`, uses ONNX Runtime's `--no_telemetry` option when that release supports it, and rejects generated CMake configurations unless telemetry is disabled.
 
 ## Consumer requirements
 

config/android-webgpu.json

@@ -10,10 +10,10 @@
     "--build_shared_lib",
     "--use_webgpu",
     "--use_xnnpack",
-    "--no_telemetry",
     "--skip_tests",
     "--disable_rtti",
     "--enable_lto",
-    "--cmake_extra_defines=onnxruntime_BUILD_UNIT_TESTS=OFF"
+    "--cmake_extra_defines=onnxruntime_BUILD_UNIT_TESTS=OFF",
+    "--cmake_extra_defines=onnxruntime_USE_TELEMETRY=OFF"
   ]
 }

config/ios-coreml.json

@@ -12,10 +12,10 @@
       "--parallel",
       "--build_apple_framework",
       "--use_coreml",
-      "--no_telemetry",
       "--skip_tests",
       "--no_kleidiai",
-      "--cmake_extra_defines=onnxruntime_BUILD_UNIT_TESTS=OFF"
+      "--cmake_extra_defines=onnxruntime_BUILD_UNIT_TESTS=OFF",
+      "--cmake_extra_defines=onnxruntime_USE_TELEMETRY=OFF"
     ],
     "iphoneos": [
       "--ios",

scripts/build-android.sh

@@ -31,32 +31,46 @@ ndk_strip="$ndk_bin/llvm-strip"
 require_file "$ndk_readelf"
 require_file "$ndk_strip"
 
-python3 - "$REPO_ROOT/config/android-webgpu.json" "$ANDROID_MIN_SDK" <<'PY'
+prepare_ort_source
+
+build_dir="$BUILD_ROOT/android-$abi"
+dist_dir="$DIST_ROOT/android-$abi"
+settings="$build_dir/android-webgpu-$abi.json"
+rm -rf "$build_dir" "$dist_dir"
+mkdir -p "$build_dir" "$dist_dir"
+
+no_telemetry_supported=0
+if ort_supports_no_telemetry; then
+  no_telemetry_supported=1
+fi
+
+python3 - "$REPO_ROOT/config/android-webgpu.json" "$settings" "$abi" "$ANDROID_MIN_SDK" "$no_telemetry_supported" <<'PY'
 import json
 import sys
 
 with open(sys.argv[1], encoding="utf-8") as settings_file:
     settings = json.load(settings_file)
 
+params = settings.get("build_params", [])
 actual = settings.get("android_min_sdk_version")
-expected = int(sys.argv[2])
+expected = int(sys.argv[4])
 if actual != expected:
     raise SystemExit(
         f"Android build configuration uses minSdk {actual}; expected {expected} from build.env"
     )
-if "--no_telemetry" not in settings.get("build_params", []):
+if "--no_telemetry" in params:
+    raise SystemExit("Android build template must not require a version-specific telemetry option")
+if "--cmake_extra_defines=onnxruntime_USE_TELEMETRY=OFF" not in params:
     raise SystemExit("Android build configuration must disable telemetry")
-PY
 
-prepare_ort_source
+settings["build_abis"] = [sys.argv[3]]
+if sys.argv[5] == "1":
+    params.append("--no_telemetry")
 
-build_dir="$BUILD_ROOT/android-$abi"
-dist_dir="$DIST_ROOT/android-$abi"
-settings="$build_dir/android-webgpu-$abi.json"
-rm -rf "$build_dir" "$dist_dir"
-mkdir -p "$build_dir" "$dist_dir"
-
-sed "s/\"arm64-v8a\"/\"$abi\"/" "$REPO_ROOT/config/android-webgpu.json" >"$settings"
+with open(sys.argv[2], "w", encoding="utf-8") as settings_file:
+    json.dump(settings, settings_file, indent=2)
+    settings_file.write("\n")
+PY
 
 log "building Android WebGPU AAR for $abi"
 python3 "$ORT_SOURCE_DIR/tools/ci_build/github/android/build_aar_package.py" \

scripts/build-desktop.sh

@@ -18,7 +18,10 @@ dist_dir="$DIST_ROOT/$target"
 rm -rf "$build_dir" "$dist_dir"
 mkdir -p "$build_dir" "$dist_dir/package"
 
-cmake_defines=("onnxruntime_BUILD_UNIT_TESTS=OFF")
+cmake_defines=(
+  "onnxruntime_BUILD_UNIT_TESTS=OFF"
+  "onnxruntime_USE_TELEMETRY=OFF"
+)
 case "$target" in
   linux-*)
     cmake_defines+=(
@@ -64,9 +67,11 @@ build_args=(
   --build_shared_lib
   --use_vcpkg
   "${provider_args[@]}"
-  --no_telemetry
   --disable_rtti
 )
+if ort_supports_no_telemetry; then
+  build_args+=(--no_telemetry)
+fi
 if [[ "$target" == linux-* ]] && [ "$EUID" -eq 0 ]; then
   build_args+=(--allow_running_as_root)
 fi

scripts/build-ios.sh

@@ -18,21 +18,26 @@ require_cmd zip
 require_file "$REPO_ROOT/config/ios-coreml.json"
 prepare_ort_source
 
-settings="$REPO_ROOT/config/ios-coreml.json"
 build_dir="$BUILD_ROOT/ios"
 dist_dir="$DIST_ROOT/ios"
 package_dir="$dist_dir/package"
+settings="$build_dir/ios-coreml.json"
 rm -rf "$build_dir" "$dist_dir"
 mkdir -p "$build_dir" "$package_dir"
 
-python3 - "$settings" "$IOS_MIN_VERSION" <<'PY'
+no_telemetry_supported=0
+if ort_supports_no_telemetry; then
+  no_telemetry_supported=1
+fi
+
+python3 - "$REPO_ROOT/config/ios-coreml.json" "$settings" "$IOS_MIN_VERSION" "$no_telemetry_supported" <<'PY'
 import json
 import sys
 
 with open(sys.argv[1], encoding="utf-8") as settings_file:
     settings = json.load(settings_file)
 
-expected = f"--apple_deploy_target={sys.argv[2]}"
+expected = f"--apple_deploy_target={sys.argv[3]}"
 for sysroot in ("iphoneos", "iphonesimulator"):
     params = settings["build_params"][sysroot]
     if expected not in params:
@@ -41,11 +46,20 @@ for sysroot in ("iphoneos", "iphonesimulator"):
 base = settings["build_params"]["base"]
 if "--use_coreml" not in base:
     raise SystemExit("CoreML is not enabled")
-if "--no_telemetry" not in base:
+if "--no_telemetry" in base:
+    raise SystemExit("iOS build template must not require a version-specific telemetry option")
+if "--cmake_extra_defines=onnxruntime_USE_TELEMETRY=OFF" not in base:
     raise SystemExit("iOS build configuration must disable telemetry")
 for forbidden in ("--use_webgpu", "--use_xnnpack"):
     if any(param == forbidden or param.startswith(f"{forbidden}=") for params in settings["build_params"].values() for param in params):
         raise SystemExit(f"forbidden iOS provider enabled: {forbidden}")
+
+if sys.argv[4] == "1":
+    base.append("--no_telemetry")
+
+with open(sys.argv[2], "w", encoding="utf-8") as settings_file:
+    json.dump(settings, settings_file, indent=2)
+    settings_file.write("\n")
 PY
 
 log "building iOS CoreML XCFramework"

scripts/build-windows.ps1

@@ -65,6 +65,10 @@ if ($LASTEXITCODE -ne 0) {
     if ($LASTEXITCODE -ne 0) { throw "failed to apply public-vcpkg patch" }
 }
 
+$ortBuildArgs = Join-Path $ortSource "tools/ci_build/build_args.py"
+if (-not (Test-Path $ortBuildArgs)) { throw "missing ONNX Runtime build argument parser: $ortBuildArgs" }
+$noTelemetrySupported = Select-String -Path $ortBuildArgs -Pattern '["'']--no_telemetry["'']' -Quiet
+
 Remove-Item $buildDir, $distDir -Recurse -Force -ErrorAction SilentlyContinue
 New-Item $buildDir -ItemType Directory -Force | Out-Null
 New-Item $packageDir -ItemType Directory -Force | Out-Null
@@ -79,15 +83,18 @@ $buildArgs = @(
     "--use_vcpkg",
     "--use_webgpu", "shared_lib",
     "--wgsl_template", "static",
-    "--no_telemetry",
     "--disable_rtti",
     "--enable_lto",
     "--cmake_generator", "Visual Studio 17 2022",
     "--cmake_extra_defines",
     "onnxruntime_BUILD_UNIT_TESTS=OFF",
+    "onnxruntime_USE_TELEMETRY=OFF",
     "onnxruntime_ENABLE_DAWN_BACKEND_D3D12=1",
     "onnxruntime_ENABLE_DAWN_BACKEND_VULKAN=0"
 )
+if ($noTelemetrySupported) {
+    $buildArgs += "--no_telemetry"
+}
 if ($target -eq "windows-arm64") {
     # KleidiAI 1.20.0 calls a half-float conversion that is not declared by its
     # MSVC ARM64 configuration. Keep the correct MLAS fallback until upstream

scripts/common.sh

@@ -53,6 +53,13 @@ require_telemetry_disabled() {
   [ "${ORT_TELEMETRY:-}" = disabled ] || die "ORT_TELEMETRY must be disabled"
 }
 
+ort_supports_no_telemetry() {
+  local build_args_file="$ORT_SOURCE_DIR/tools/ci_build/build_args.py"
+  require_file "$build_args_file"
+  grep -Fq -- '"--no_telemetry"' "$build_args_file" ||
+    grep -Fq -- "'--no_telemetry'" "$build_args_file"
+}
+
 verify_ort_telemetry_disabled() {
   local root="$1"
   local cache count=0