[CI/Build] Pin Cython below 3.3 for arm64 tilelang sdist

[khluu]

Purpose

Fix the deterministic arm64 image-build failure caused by Cython 3.3 while building tilelang==0.1.12 from source. No test runs: the image fails during dependency installation.

Exact reproductions on the restored immutable builder image:

• PR-head arm64 image #85174
• post-merge main arm64 image #85175

Root cause

The aarch64 build base is manylinux 2_28 / glibc 2.28, so it cannot install tilelang's manylinux_2_34 aarch64 wheel and uv builds tilelang from sdist. Fresh isolated builds now resolve Cython 3.3, which rejects tilelang's hardcoded Py_LIMITED_API=0x03080000 because Cython 3.3 requires Python Limited API 3.9 or newer. The previous successful build used the same immutable builder before Cython 3.3 was released, so it resolved an older compatible Cython.

Change

On aarch64 only, set uv's isolated-build constraint to cython<3.3 before installing CUDA requirements. x86_64 continues to install tilelang's wheel and is unaffected. CMake is no longer constrained; the restored builder remains on its existing CMake 4.4.2.

Duplicate-work check

Searched open PRs for cython arm64 tilelang, cython 3.3, and tilelang build. This PR was already the only open match, so it was narrowed in place instead of opening a duplicate.

Test status

• uvx --from pre-commit pre-commit run --files docker/Dockerfile: passed, including Dockerfile dependency-graph and versions.json validation.
• Exact updated-head arm64 image #85232 at 66ad0efdceb4: passed exit 0 in 39m34s, including the tilelang sdist build and complete vLLM image build/push under CMake 4.4.2.
• Merged as main e25c586b9030; post-merge main arm64 #85235 passed exit 0 in 39m21s, including the complete image build and registry push.
• Post-merge GH200 #85236 at 7f17348fd67c (exact merge commit plus only the selector scaffold key: gh200-test on a non-main validation branch) completed the full wheel build and reached Docker build 17/17 with neither build-tool failure. It stopped only at the separately baseline-known wheel-size gate: 561.96 MB > 500 MB (baseline #84342: 552.17 MB > 500 MB). No retry.

Post-merge arm64 and GH200 both cleared the Cython/Limited-API and fatal CUDA imported-location signatures. This incident is resolved on main; the GH200 wheel-size gate remains separate baseline debt.

AI-assistance disclosure

This change was prepared with AI assistance and reviewed before submission.

[vllm-agent]

Exact arm64 validation is terminal green at current head b53b2f5e293371940bd5be80ce3de79992b2e627.

• Exact job: https://buildkite.com/vllm/ci/builds/85162#01a0284a-07dd-4c68-88e7-473ad396a531
• Result: passed, exit 0, 38m12s (07:06:23–07:44:36 UTC)
• Evidence: the isolated aarch64 build used the cmake<4 + cython<3.3 constraints, built tilelang==0.1.12 from sdist, completed the vLLM arm64 wheel/image build, and cleared both prior failure points.

This is proposed-fix validation only. Final resolution still requires merge plus a post-merge cold/main Build arm64 image pass.

[khluu]

New evidence after PR #53374 merged changes the minimum fix:

• Restored CMake 4.4.2 image still failed exact head #85174 and post-merge main #85175.
• The recorded failed Ninja subcommand is now the generated Cython wrapper: stable Cython 3.3.0 (uploaded today at 05:16 UTC) rejects tilelang's Py_LIMITED_API=3.8.
• Historical green #84899 predates that Cython release, explaining why the same immutable image passed then.

This PR's broader cmake<4 + cython<3.3 combination remains exact-gate green in #85162, but after the image rollback the smallest follow-up should be rebase onto current main and narrow to only the aarch64 cython<3.3 isolated-build constraint, then run one fresh exact arm64 gate. Please do not merge the current draft as-is based solely on #85162.

[khluu]

Superseding my earlier Cython-only minimum-fix note with exact GH200 evidence:

• Daily #85202 GH200 still fails tilelang configuration under CMake 4.4 because CUDA::cuda_driver / CUDA::nvml imported locations are unset. This proves the cmake<4 constraint remains necessary for GH200 even after PR [CI][ARM64] Restore known-good CUDA 13 builder image #53374 restored the builder image.
• Valid isolated #85210 GH200 ran PR code b53b2f5e2933 plus only key: gh200-test as a selector scaffold. It cleared both CMake and Cython failures, built the aarch64 wheel, and reached the final size check.
• The only terminal error was the pre-existing size gate: 553.33 MB > 500 MB, matching baseline #84342 at 552.17 MB > 500 MB. No test ran because this optional job is a build/wheel gate.

Together with literal-head arm64 #85162 passing, this validates the current paired cmake<4 + cython<3.3 fix across both affected aarch64 paths. The PR remains draft for human review. Post-merge confirmation should require the arm64 image to pass and GH200 to clear these exact build-tool signatures again; the separately known wheel-size debt may still leave GH200 red.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}