Pin cmake version in macOS github Actions (#25998)

As a temporary solution for the
actions/runner-images#12934 issue.

Azure DevOps pipelines and Gtihub Actions are updating cmake to version
4.* starting from September 8th . However, our macOS build's coreml EP
has a dependency that still depends on cmake 3.x. This PR provides a
hotfix to the issue.

This PR does not address the concern for ADO pipelines, which will be
solved later.

Author: snnn

.github/actions/locate-vcvarsall-and-setup-env/action.yml

@@ -14,7 +14,7 @@ runs:
   steps:
 
     - name: Setup VCPKG
-      uses: microsoft/onnxruntime-github-actions/[email protected].7
+      uses: microsoft/onnxruntime-github-actions/[email protected].8
       with:
         vcpkg-version: '2025.06.13'
         vcpkg-hash: '735923258c5187966698f98ce0f1393b8adc6f84d44fd8829dda7db52828639331764ecf41f50c8e881e497b569f463dbd02dcb027ee9d9ede0711102de256cc'

.github/workflows/android.yml

@@ -37,7 +37,7 @@ jobs:
         ndk-version: 28.0.13004108
 
     - name: Get Docker Image using Action
-      uses: microsoft/onnxruntime-github-actions/[email protected].7
+      uses: microsoft/onnxruntime-github-actions/[email protected].8
       id: build_docker_image_step
       with:
         dockerfile: ${{ github.workspace }}/tools/ci_build/github/linux/docker/inference/x86_64/default/cpu/Dockerfile
@@ -122,7 +122,7 @@ jobs:
           architecture: x64
 
 
-      - uses: microsoft/onnxruntime-github-actions/[email protected].7
+      - uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           vcpkg-version: '2025.06.13'
           vcpkg-hash: '735923258c5187966698f98ce0f1393b8adc6f84d44fd8829dda7db52828639331764ecf41f50c8e881e497b569f463dbd02dcb027ee9d9ede0711102de256cc'

.github/workflows/ios.yml

@@ -23,6 +23,14 @@ jobs:
         uses: actions/checkout@v5
         with:
           submodules: false
+      - uses: microsoft/onnxruntime-github-actions/[email protected]
+        with:
+          vcpkg-version: '2025.06.13'
+          vcpkg-hash: 735923258c5187966698f98ce0f1393b8adc6f84d44fd8829dda7db52828639331764ecf41f50c8e881e497b569f463dbd02dcb027ee9d9ede0711102de256cc
+          cmake-version: '3.31.8'
+          cmake-hash: 99cc9c63ae49f21253efb5921de2ba84ce136018abf08632c92c060ba91d552e0f6acc214e9ba8123dee0cf6d1cf089ca389e321879fd9d719a60d975bcffcc8
+          add-cmake-to-path: 'true'
+          disable-terrapin: 'true'
       - name: Use Xcode ${{ env.XCODE_VERSION }}
         shell: bash
         run: |

.github/workflows/linux-wasm-ci-build-and-test-workflow.yml

@@ -56,7 +56,7 @@ jobs:
           python-version: "3.12"
           architecture: ${{ env.buildArch }}
 
-      - uses: microsoft/onnxruntime-github-actions/[email protected].7
+      - uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           vcpkg-version: '2025.06.13'
           vcpkg-hash: '735923258c5187966698f98ce0f1393b8adc6f84d44fd8829dda7db52828639331764ecf41f50c8e881e497b569f463dbd02dcb027ee9d9ede0711102de256cc'

.github/workflows/linux_cuda_ci.yml

@@ -50,7 +50,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
 
-      - uses: microsoft/onnxruntime-github-actions/[email protected].7
+      - uses: microsoft/onnxruntime-github-actions/[email protected].8
         id: build_docker_image_step
         with:
           dockerfile: ${{ github.workspace }}/tools/ci_build/github/linux/docker/Dockerfile.manylinux2_28_cuda
@@ -93,7 +93,7 @@ jobs:
       # So build.py --build_dir build/Release inside the container correctly finds the artifacts.
       - name: Test ONNX Runtime
         id: test_step
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           docker_image: ${{ steps.build_docker_image_step.outputs.full-image-name }}
           build_config: Release

.github/workflows/linux_minimal_build.yml

@@ -37,7 +37,7 @@ jobs:
         with:
           node-version: 20
 
-      - uses: microsoft/onnxruntime-github-actions/[email protected].7
+      - uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           vcpkg-version: '2025.06.13'
           vcpkg-hash: '735923258c5187966698f98ce0f1393b8adc6f84d44fd8829dda7db52828639331764ecf41f50c8e881e497b569f463dbd02dcb027ee9d9ede0711102de256cc'
@@ -47,7 +47,7 @@ jobs:
           disable-terrapin: 'true'
 
       - name: Build Full ORT and Prepare Test Files
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
 
       - name: Upload Test Data Artifact
         uses: actions/upload-artifact@v4
@@ -74,7 +74,7 @@ jobs:
           node-version: 20
 
       - name: Get Docker Image using Action
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         id: build_docker_image_step
         with:
           dockerfile: ${{ github.workspace }}/tools/ci_build/github/linux/docker/inference/x86_64/default/cpu/Dockerfile
@@ -85,7 +85,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Run Build 2 (Update)
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           docker_image: ${{ steps.build_docker_image_step.outputs.full-image-name
             }}
@@ -100,7 +100,7 @@ jobs:
             --enable_training_ops
 
       - name: Run Build 2 (Build)
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           docker_image: ${{ steps.build_docker_image_step.outputs.full-image-name
             }}
@@ -132,7 +132,7 @@ jobs:
         with:
           node-version: 20
 
-      - uses: microsoft/onnxruntime-github-actions/[email protected].7
+      - uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           vcpkg-version: '2025.06.13'
           vcpkg-hash: '735923258c5187966698f98ce0f1393b8adc6f84d44fd8829dda7db52828639331764ecf41f50c8e881e497b569f463dbd02dcb027ee9d9ede0711102de256cc'
@@ -142,7 +142,7 @@ jobs:
           disable-terrapin: 'true'
 
       - name: Build Full ORT and Prepare Test Files
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           reduced-ops-config-file: required_ops.ort_models.config
           enable-custom-ops: 'true'
@@ -166,7 +166,7 @@ jobs:
         with:
           node-version: 20
 
-      - uses: microsoft/onnxruntime-github-actions/[email protected].7
+      - uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           vcpkg-version: '2025.06.13'
           vcpkg-hash: '735923258c5187966698f98ce0f1393b8adc6f84d44fd8829dda7db52828639331764ecf41f50c8e881e497b569f463dbd02dcb027ee9d9ede0711102de256cc'
@@ -175,7 +175,7 @@ jobs:
           add-cmake-to-path: 'true'
           disable-terrapin: 'true'
       - name: Build Full ORT and Prepare Test Files
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           reduced-ops-config-file: required_ops_and_types.ort_models.config
           enable-type-reduction: 'true'
@@ -198,7 +198,7 @@ jobs:
         with:
           node-version: 20
 
-      - uses: microsoft/onnxruntime-github-actions/[email protected].7
+      - uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           vcpkg-version: '2025.06.13'
           vcpkg-hash: '735923258c5187966698f98ce0f1393b8adc6f84d44fd8829dda7db52828639331764ecf41f50c8e881e497b569f463dbd02dcb027ee9d9ede0711102de256cc'
@@ -208,7 +208,7 @@ jobs:
           disable-terrapin: 'true'
 
       - name: Build Full ORT and Prepare Test Files
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           globally_allowed_types: 'bool,float,int8_t,uint8_t'
           enable-type-reduction: 'true'
@@ -233,7 +233,7 @@ jobs:
           node-version: 20
 
       - name: Get Docker Image using Action
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         id: build_docker_image_step
         with:
           dockerfile: ${{ github.workspace }}/tools/ci_build/github/linux/docker/inference/x86_64/default/cpu/Dockerfile
@@ -245,7 +245,7 @@ jobs:
 
 
       - name: Run Build 5 (Update)
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           docker_image: ${{ steps.build_docker_image_step.outputs.full-image-name
             }}
@@ -258,7 +258,7 @@ jobs:
             --minimal_build extended
 
       - name: Run Build 5 (Build)
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           docker_image: ${{ steps.build_docker_image_step.outputs.full-image-name
             }}
@@ -270,7 +270,7 @@ jobs:
             --use_binskim_compliant_compile_flags
             --minimal_build extended
       - name: Run Build 5 (Test)
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           docker_image: ${{ steps.build_docker_image_step.outputs.full-image-name
             }}
@@ -297,7 +297,7 @@ jobs:
           submodules: false
 
       - name: Get Docker Image using Action
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         id: build_docker_image_step
         with:
           dockerfile: ${{ github.workspace }}/tools/ci_build/github/linux/docker/inference/x86_64/default/cpu/Dockerfile
@@ -314,7 +314,7 @@ jobs:
           touch ${{ runner.temp }}/.test_data/include_no_operators.config
 
       - name: Run Build 6a (Update)
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           docker_image: ${{ steps.build_docker_image_step.outputs.full-image-name
             }}
@@ -330,7 +330,7 @@ jobs:
             --cmake_extra_defines onnxruntime_BUILD_UNIT_TESTS=OFF
 
       - name: Run Build 6a (Build)
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           docker_image: ${{ steps.build_docker_image_step.outputs.full-image-name
             }}
@@ -347,7 +347,7 @@ jobs:
 
 
       - name: Run Build 6a (Test)
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           docker_image: ${{ steps.build_docker_image_step.outputs.full-image-name
             }}
@@ -383,7 +383,7 @@ jobs:
           touch ${{ runner.temp }}/.test_data/include_no_operators.config
 
       - name: Get Docker Image using Action
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         id: build_docker_image_step
         with:
           dockerfile: ${{ github.workspace }}/tools/ci_build/github/linux/docker/inference/x86_64/default/cpu/Dockerfile
@@ -394,7 +394,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Run Build 6b (Update)
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           docker_image: ${{ steps.build_docker_image_step.outputs.full-image-name
             }}
@@ -413,7 +413,7 @@ jobs:
             --cmake_extra_defines onnxruntime_BUILD_UNIT_TESTS=OFF
 
       - name: Run Build 6b (Build)
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           docker_image: ${{ steps.build_docker_image_step.outputs.full-image-name
             }}
@@ -452,7 +452,7 @@ jobs:
           touch ${{ runner.temp }}/.test_data/include_no_operators.config
 
       - name: Get Docker Image using Action
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         id: build_docker_image_step
         with:
           dockerfile: ${{ github.workspace }}/tools/ci_build/github/linux/docker/inference/x86_64/default/cpu/Dockerfile
@@ -469,7 +469,7 @@ jobs:
           touch ${{ runner.temp }}/.test_data/include_no_operators.config
 
       - name: Run Build 6c (Update)
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           docker_image: ${{ steps.build_docker_image_step.outputs.full-image-name
             }}
@@ -488,7 +488,7 @@ jobs:
             --cmake_extra_defines onnxruntime_BUILD_UNIT_TESTS=OFF
 
       - name: Run Build 6c (Build)
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           docker_image: ${{ steps.build_docker_image_step.outputs.full-image-name
             }}
@@ -531,7 +531,7 @@ jobs:
           path: ${{ runner.temp }}/.test_data/
 
       - name: Get Docker Image using Action
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         id: build_docker_image_step
         with:
           dockerfile: ${{ github.workspace }}/tools/ci_build/github/linux/docker/inference/x86_64/default/cpu/Dockerfile

.github/workflows/linux_tensorrt_ci.yml

@@ -52,7 +52,7 @@ jobs:
 
       # --- Build the Docker image needed for testing ---
       - name: Build Docker Image for Testing
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         id: build_docker_image_step
         with:
           dockerfile: ${{ github.workspace }}/tools/ci_build/github/linux/docker/Dockerfile.manylinux2_28_cuda
@@ -95,7 +95,7 @@ jobs:
       # So build.py --build_dir build/Release inside the container correctly finds the artifacts.
       - name: Test ONNX Runtime
         id: test_step
-        uses: microsoft/onnxruntime-github-actions/[email protected].7
+        uses: microsoft/onnxruntime-github-actions/[email protected].8
         with:
           docker_image: ${{ steps.build_docker_image_step.outputs.full-image-name }}
           build_config: Release

.github/workflows/linux_webgpu.yml

@@ -51,7 +51,7 @@ jobs:
   #     - name: Checkout code
   #       uses: actions/checkout@v4
 
-  #     - uses: microsoft/onnxruntime-github-actions/[email protected].7
+  #     - uses: microsoft/onnxruntime-github-actions/[email protected].8
   #       id: build_docker_image_step
   #       with:
   #         dockerfile: ${{ github.workspace }}/tools/ci_build/github/linux/docker/Dockerfile.manylinux2_28_webgpu
@@ -91,7 +91,7 @@ jobs:
 
   #     - name: Test ONNX Runtime
   #       id: test_step
-  #       uses: microsoft/onnxruntime-github-actions/[email protected].7
+  #       uses: microsoft/onnxruntime-github-actions/[email protected].8
   #       with:
   #         docker_image: ${{ steps.build_docker_image_step.outputs.full-image-name }}
   #         build_config: Release

.github/workflows/mac.yml

@@ -77,6 +77,14 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
+      - uses: microsoft/onnxruntime-github-actions/[email protected]
+        with:
+          vcpkg-version: '2025.06.13'
+          vcpkg-hash: 735923258c5187966698f98ce0f1393b8adc6f84d44fd8829dda7db52828639331764ecf41f50c8e881e497b569f463dbd02dcb027ee9d9ede0711102de256cc
+          cmake-version: '3.31.8'
+          cmake-hash: 99cc9c63ae49f21253efb5921de2ba84ce136018abf08632c92c060ba91d552e0f6acc214e9ba8123dee0cf6d1cf089ca389e321879fd9d719a60d975bcffcc8
+          add-cmake-to-path: 'true'
+          disable-terrapin: 'true'
 
       - name: macOS CI pipeline prepare steps
         uses: ./.github/actions/macos-ci-setup
@@ -117,6 +125,14 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
+      - uses: microsoft/onnxruntime-github-actions/[email protected]
+        with:
+          vcpkg-version: '2025.06.13'
+          vcpkg-hash: 735923258c5187966698f98ce0f1393b8adc6f84d44fd8829dda7db52828639331764ecf41f50c8e881e497b569f463dbd02dcb027ee9d9ede0711102de256cc
+          cmake-version: '3.31.8'
+          cmake-hash: 99cc9c63ae49f21253efb5921de2ba84ce136018abf08632c92c060ba91d552e0f6acc214e9ba8123dee0cf6d1cf089ca389e321879fd9d719a60d975bcffcc8
+          add-cmake-to-path: 'true'
+          disable-terrapin: 'true'
 
       - name: macOS CI pipeline prepare steps
         uses: ./.github/actions/macos-ci-setup

.github/workflows/macos-ci-build-and-test-workflow.yml

@@ -75,6 +75,14 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
+      - uses: microsoft/onnxruntime-github-actions/[email protected]
+        with:
+          vcpkg-version: '2025.06.13'
+          vcpkg-hash: 735923258c5187966698f98ce0f1393b8adc6f84d44fd8829dda7db52828639331764ecf41f50c8e881e497b569f463dbd02dcb027ee9d9ede0711102de256cc
+          cmake-version: '3.31.8'
+          cmake-hash: 99cc9c63ae49f21253efb5921de2ba84ce136018abf08632c92c060ba91d552e0f6acc214e9ba8123dee0cf6d1cf089ca389e321879fd9d719a60d975bcffcc8
+          add-cmake-to-path: 'true'
+          disable-terrapin: 'true'
 
       - name: macOS CI pipeline prepare steps
         uses: ./.github/actions/macos-ci-setup