Patch around GCC 14 rejecting vendored RapidJSON's broken operator=

objtreelite fails to build on the manylinux_riscv64 image's GCC 14:
RapidJSON v1.1.0's GenericStringRef declares a copy-assignment that
assigns to its own const length member, upstream-fixed 3 commits later
by deleting the operator outright. Also wires the patch into the build
and its paths into the workflow triggers.

Author: luhenry

.github/workflows/build-treelite-runtime.yml

@@ -21,11 +21,13 @@ on:
     paths:
       - '.github/workflows/build-treelite-runtime.yml'
       - 'docs/packages/treelite-runtime.yaml'
+      - 'patches/treelite-runtime/**'
   push:
     branches: [main]
     paths:
       - '.github/workflows/build-treelite-runtime.yml'
       - 'docs/packages/treelite-runtime.yaml'
+      - 'patches/treelite-runtime/**'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
@@ -68,6 +70,15 @@ jobs:
           ref: ${{ env.TREELITE_RUNTIME_VERSION }}
           persist-credentials: false
 
+      - name: Checkout python-wheels
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          path: python-wheels
+          persist-credentials: false
+
+      - name: Patch treelite source
+        run: git apply python-wheels/patches/treelite-runtime/${{ env.TREELITE_RUNTIME_VERSION }}/0001-*.patch
+
       # setuptools' default license-files glob (LICEN[CSZ]E*) is rooted at
       # setup.py's own directory, which for the runtime package is
       # runtime/python/, not the repository root where LICENSE actually lives.

patches/treelite-runtime/3.9.1/0001-Pin-RapidJSON-past-v1.1.0-s-broken-operator.patch

@@ -0,0 +1,34 @@
+From eaa233f4e012135829b4584d97b18a9bd534e4ee Mon Sep 17 00:00:00 2001
+From: Ludovic Henry <git@ludovic.dev>
+Date: Mon, 5 Oct 2026 19:26:42 +0000
+Subject: [PATCH] Pin vendored RapidJSON past v1.1.0's broken
+ GenericStringRef::operator=
+
+GenericStringRef declares a copy-assignment operator that assigns to
+its own const length member, which GCC 14 rejects outright instead of
+just warning (operator= is a template-class member never odr-used
+elsewhere in treelite, so older GCC never instantiated, and so never
+type-checked, its body). Fixed 3 commits after v1.1.0 by explicitly
+deleting the operator; pin to that commit instead of the tag.
+
+Upstream-Status: Backport [https://github.com/Tencent/rapidjson/commit/862c39be371278a45a88d4d1d75164be57bb7e2d]
+---
+ cmake/ExternalLibs.cmake | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/cmake/ExternalLibs.cmake b/cmake/ExternalLibs.cmake
+index 996874f..4405f50 100644
+--- a/cmake/ExternalLibs.cmake
++++ b/cmake/ExternalLibs.cmake
+@@ -29,7 +29,7 @@ else()
+   FetchContent_Declare(
+     RapidJSON
+     GIT_REPOSITORY      https://github.com/Tencent/rapidjson
+-    GIT_TAG             v1.1.0
++    GIT_TAG             862c39be371278a45a88d4d1d75164be57bb7e2d
+   )
+   FetchContent_Populate(RapidJSON)
+   message(STATUS "RapidJSON was downloaded at ${rapidjson_SOURCE_DIR}.")
+-- 
+2.43.0
+