[fix](thirdparty) order Paimon codec dependencies

.github/workflows/build-thirdparty.yml

@@ -59,6 +59,7 @@ jobs:
               - 'thirdparty/patches/apache-arrow-*.patch'
               - 'thirdparty/patches/paimon-cpp-*.patch'
               - 'thirdparty/test/arrow-paimon-lifecycle-test.sh'
+              - 'thirdparty/test/paimon-codec-dependency-test.sh'
               - '.github/workflows/build-thirdparty.yml'
 
   arrow_paimon_lifecycle_test:
@@ -71,7 +72,9 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Test focused thirdparty lifecycle
-        run: thirdparty/test/arrow-paimon-lifecycle-test.sh
+        run: |
+          thirdparty/test/arrow-paimon-lifecycle-test.sh
+          thirdparty/test/paimon-codec-dependency-test.sh
 
   script_test:
     name: Thirdparty Script Test

thirdparty/arrow-paimon-vars.sh

@@ -61,7 +61,9 @@ PAIMON_BUILD_SCHEMA_VERSION="1"
 # mandatory before reuse. Delete the lists once master has published a prebuilt that
 # carries the semantic marker itself.
 ARROW_LEGACY_COMPATIBLE_SEMANTIC_FINGERPRINT="ab79ab0bbfbf93f9860050fb751b20fee9e40d96"
-PAIMON_LEGACY_COMPATIBLE_SEMANTIC_FINGERPRINT="cb82e41ba46f534e611cdd52e66b53c227d49bf8"
+# Dependency ordering does not change the installed Paimon artifacts, so existing
+# complete prebuilts remain compatible with the corrected clean-build graph.
+PAIMON_LEGACY_COMPATIBLE_SEMANTIC_FINGERPRINT="9887cf1ec13106da4250f8d7ea931a258879089c"
 ARROW_LEGACY_BUILD_FINGERPRINTS=(
     # published 2026-08-19, master after apache/doris#66842
     8356a3a464b93f3a59a6bdae6a51258947ab35d2

thirdparty/patches/paimon-cpp-buildutils-static-deps.patch

@@ -343,3 +343,20 @@ diff --git a/src/paimon/format/blob/blob_format_writer.cpp b/src/paimon/format/b
 +   list(GET Thrift_VERSION_LIST 0 Thrift_VERSION_MAJOR)
 +   list(GET Thrift_VERSION_LIST 1 Thrift_VERSION_MINOR)
 +   list(GET Thrift_VERSION_LIST 2 Thrift_VERSION_PATCH)
+
+diff --git a/src/paimon/CMakeLists.txt b/src/paimon/CMakeLists.txt
+index 76dd03b..9317324 100644
+--- a/src/paimon/CMakeLists.txt
++++ b/src/paimon/CMakeLists.txt
+@@ -281,6 +281,11 @@ add_paimon_lib(paimon
+                ${PAIMON_COMMON_SRCS}
+                ${PAIMON_CORE_SRCS}
+                DEPENDENCIES
++               # Codec headers come from ExternalProject install steps, so object
++               # compilation must not race those steps in clean parallel builds.
++               zstd
++               snappy
++               lz4
+                arrow
+                tbb
+                glog

thirdparty/test/paimon-codec-dependency-test.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+set -eo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." &>/dev/null && pwd)"
+
+fail() {
+    echo "FAIL: $*" >&2
+    exit 1
+}
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "${tmpdir}"' EXIT
+
+fixture="${tmpdir}/paimon-codec-dependency"
+focused_patch="${fixture}/codec-dependency.patch"
+mkdir -p "${fixture}/src/paimon"
+{
+    printf '%s\n' 'add_paimon_lib(paimon'
+    printf '%s\n' '               SOURCES'
+    printf '%s\n' '               ${PAIMON_COMMON_SRCS}'
+    printf '%s\n' '               ${PAIMON_CORE_SRCS}'
+    printf '%s\n' '               DEPENDENCIES'
+    printf '%s\n' '               arrow'
+    printf '%s\n' '               tbb'
+    printf '%s\n' '               glog'
+    printf '%s\n' '               fmt'
+    printf '%s\n' '               roaring_bitmap'
+    printf '%s\n' '               xxhash'
+    printf '%s\n' '               Threads::Threads'
+    printf '%s\n' '               RapidJSON'
+    printf '%s\n' '               STATIC_LINK_LIBS'
+    printf '%s\n' '               arrow)'
+} >"${fixture}/src/paimon/CMakeLists.txt"
+
+awk '
+    /^diff --git / {
+        if (found) {
+            exit
+        }
+        if ($0 == "diff --git a/src/paimon/CMakeLists.txt b/src/paimon/CMakeLists.txt") {
+            found = 1
+        }
+    }
+    found { print }
+' "${ROOT}/patches/paimon-cpp-buildutils-static-deps.patch" >"${focused_patch}"
+[[ -s "${focused_patch}" ]] || fail "the Paimon codec dependency patch is missing"
+(
+    cd "${fixture}"
+    patch -s -p1 <"${focused_patch}"
+) || fail "the Paimon codec dependency patch did not apply"
+
+dependencies="$(sed -n '/^[[:space:]]*DEPENDENCIES$/,/^[[:space:]]*STATIC_LINK_LIBS$/p' \
+    "${fixture}/src/paimon/CMakeLists.txt")"
+grep -Eq '^[[:space:]]+zstd$' <<<"${dependencies}" ||
+    fail "paimon_objlib does not wait for the ZSTD headers"
+grep -Eq '^[[:space:]]+snappy$' <<<"${dependencies}" ||
+    fail "paimon_objlib does not wait for the Snappy headers"
+grep -Eq '^[[:space:]]+lz4$' <<<"${dependencies}" ||
+    fail "paimon_objlib does not wait for the LZ4 headers"
+
+echo "PASS"