name: Binary Release
on:
workflow_dispatch:
inputs:
tag:
description: 'Release tag to attach binaries to (e.g. v1.3.0)'
required: true
type: string
unlocked:
description: 'Drop --locked (backfill of pre-v1.4.3 tags whose Cargo.lock is stale)'
required: false
type: boolean
default: false
permissions:
contents: write
concurrency:
group: binary-release-${{ inputs.tag }}
cancel-in-progress: false
env:
CROSS_VERSION: v0.2.5
jobs:
ensure-release:
name: Ensure release exists
runs-on: [self-hosted, clean-room, X64]
outputs:
tag: ${{ steps.tag.outputs.tag }}
steps:
- name: Resolve release tag
id: tag
run: |
TAG="${{ inputs.tag }}"
if [ -z "$TAG" ]; then
echo "::error::No tag resolved (release event missing tag_name and no dispatch input)"
exit 1
fi
case "$TAG" in
v*) ;;
*) echo "::error::Resolved ref '$TAG' is not a v* tag"; exit 1 ;;
esac
echo "tag=$TAG" >> "$GITHUB_OUTPUT"
echo "Releasing forjar $TAG"
- name: Create GitHub Release if missing (idempotent)
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
TAG="${{ steps.tag.outputs.tag }}"
# Mirrors release.yml create-release: never clobber an existing
# release or its hand-written notes.
if gh release view "$TAG" --repo "${{ github.repository }}" >/dev/null 2>&1; then
echo "Release $TAG already exists — leaving notes intact, will upload assets."
else
gh release create "$TAG" \
--title "$TAG" \
--generate-notes \
--verify-tag \
--prerelease \
--repo "${{ github.repository }}"
fi
build:
name: ${{ matrix.target }}
needs: ensure-release
runs-on: [self-hosted, clean-room, X64]
env:
CARGO_HOME: ${{ github.workspace }}/../cargo-home-${{ github.job }}
strategy:
fail-fast: false
matrix:
include:
- target: x86_64-unknown-linux-musl
cross: false
- target: x86_64-unknown-linux-gnu
cross: false
- target: aarch64-unknown-linux-musl
cross: true
- target: aarch64-unknown-linux-gnu
cross: true
steps:
- name: Resolve release tag
id: tag
run: |
TAG="${{ needs.ensure-release.outputs.tag }}"
echo "tag=$TAG" >> "$GITHUB_OUTPUT"
echo "Building forjar for $TAG → ${{ matrix.target }}"
- name: Checkout at tag
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with:
ref: ${{ steps.tag.outputs.tag }}
- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
with:
targets: ${{ matrix.target }}
- name: Install target on workspace-pinned toolchain
if: ${{ !matrix.cross }}
run: rustup target add ${{ matrix.target }}
- name: Install musl tools
if: matrix.target == 'x86_64-unknown-linux-musl'
run: |
if command -v musl-gcc >/dev/null 2>&1; then
echo "musl-gcc already present: $(command -v musl-gcc)"
elif command -v apt-get >/dev/null 2>&1; then
sudo apt-get update -qq
sudo apt-get install -y --no-install-recommends musl-tools
else
echo "::warning::musl-gcc is absent and apt-get is not available on this runner. The build will reach the link step and fail there naming the missing linker. Install musl-tools on the fleet image, or give this leg a runner that has it." >&2
fi
- name: Install cross
if: matrix.cross
run: |
dir="$RUNNER_TEMP/cross"
mkdir -p "$dir"
curl -sL "https://github.com/cross-rs/cross/releases/download/${CROSS_VERSION}/cross-x86_64-unknown-linux-musl.tar.gz" \
| tar xz -C "$dir"
echo "$dir" >> "$GITHUB_PATH"
- name: Cache cargo
uses: Swatinem/rust-cache@v2
with:
shared-key: binary-${{ matrix.target }}-u2204
- name: Build forjar
run: |
LOCKED="--locked"
if [ "${{ inputs.unlocked }}" = "true" ]; then
LOCKED=""
echo "::warning::building without --locked (stale-lock backfill mode)"
fi
if [ "${{ matrix.cross }}" = "true" ]; then
cross build --release --features vendored-openssl --bin forjar --target ${{ matrix.target }} $LOCKED
else
cargo build --release --features vendored-openssl --bin forjar --target ${{ matrix.target }} $LOCKED
fi
- name: Strip binary
run: |
TARGET="${{ matrix.target }}"
BIN_PATH="target/${TARGET}/release/forjar"
# Each cross image ships only the matching ${triple}-strip;
# the gnu image lacks musl-strip and vice-versa.
case "$TARGET" in
aarch64-unknown-linux-musl) STRIP=aarch64-linux-musl-strip ;;
aarch64-unknown-linux-gnu) STRIP=aarch64-linux-gnu-strip ;;
*) STRIP="" ;;
esac
if [ -n "$STRIP" ]; then
docker run --rm -v "$PWD/target:/target:Z" \
"ghcr.io/cross-rs/${TARGET}:main" \
"$STRIP" "/$BIN_PATH" || true
else
strip "$BIN_PATH" || true
fi
ls -la "$BIN_PATH"
- name: Record the glibc floor this binary demands
if: ${{ !contains(matrix.target, 'musl') }}
run: |
TARGET="${{ matrix.target }}"
BIN_PATH="target/${TARGET}/release/forjar"
# `ldd --version` reports the glibc of the HOST running this step.
# For the aarch64 leg the binary was built inside a cross container
# on an x86_64 host, so the host's glibc is not the one it linked
# against and printing it would be a measurement of the wrong thing.
# The DEMANDED floor below is read out of the binary itself and is
# correct on every leg; the builder line is only claimed where it is
# true.
case "$TARGET" in
x86_64-unknown-linux-gnu)
builder="$(ldd --version 2>/dev/null | head -1 || echo 'ldd unavailable')" ;;
*)
builder="not applicable — ${TARGET} was cross-built, so this host's glibc is not what it linked against" ;;
esac
demanded="$(strings -a "$BIN_PATH" 2>/dev/null \
| sed -n 's/.*GLIBC_\([0-9][0-9.]*\).*/\1/p' \
| sort -V | tail -1)"
[ -n "$demanded" ] || demanded="none found (static, or strings unavailable)"
printf 'builder: %s\nbinary demands at most GLIBC_%s\n' "$builder" "$demanded"
# shellcheck disable=SC2016 # the backticks below are MARKDOWN code
# fences in a printf FORMAT string, not command substitutions: they must
# reach $GITHUB_STEP_SUMMARY literally. Disabled by name with a reason
# rather than left as three findings a receipt then has to explain away.
{
printf '### glibc floor — `%s`\n\n' "$TARGET"
printf -- '- builder: `%s`\n' "$builder"
printf -- '- binary demands at most: `GLIBC_%s`\n' "$demanded"
} >> "$GITHUB_STEP_SUMMARY"
# AND IT IS A GATE, not only a record (PMAT-547, review round 9).
#
# This leg was pinned to ubuntu-22.04 precisely so the gnu binaries could
# not demand more than glibc 2.35. Moving it to the fleet removed that pin,
# and a measurement that never fails is not what the pin was: a fleet
# upgraded to a newer glibc would publish binaries that refuse to start on
# an old host, silently, exactly as before the pin existed. A review lane
# named it as a weakened gate and it was right.
#
# 2.35 is not a guess: it is the floor ubuntu-22.04 enforced. Measured on
# the fleet today, the binary demands GLIBC_2.34, so this ceiling passes
# with room and fires the day the fleet moves past what the pin allowed.
# Raising it is a decision someone writes here, in the open, with a reason.
GLIBC_CEILING=2.35
case "$demanded" in
none*) ;; # static or unreadable: the arms above already say which
*)
highest="$(printf '%s\n%s\n' "$demanded" "$GLIBC_CEILING" | sort -V | tail -1)"
if [ "$highest" != "$GLIBC_CEILING" ]; then
echo "::error::${TARGET} demands GLIBC_${demanded}, above the ${GLIBC_CEILING} floor ubuntu-22.04 used to enforce. A host with an older glibc cannot start this binary. Either lower what the build links against, or raise GLIBC_CEILING here with a reason."
exit 1
fi
;;
esac
- name: Package archive
id: package
run: |
TAG="${{ steps.tag.outputs.tag }}"
# Strip the leading 'v': assets are forjar-<x.y.z>-<target>.tar.gz,
# matching release.yml, the homebrew checksum patching, and the
# name install.sh resolves (VERSION_NUM="${TAG#v}").
VERSION="${TAG#v}"
TARGET="${{ matrix.target }}"
ARCHIVE="forjar-${VERSION}-${TARGET}"
mkdir -p "$ARCHIVE"
cp "target/${TARGET}/release/forjar" "$ARCHIVE/"
for f in README.md LICENSE LICENSE-MIT LICENSE-APACHE; do
[ -f "$f" ] && cp "$f" "$ARCHIVE/"
done
tar czf "${ARCHIVE}.tar.gz" "$ARCHIVE"
shasum -a 256 "${ARCHIVE}.tar.gz" > "${ARCHIVE}.tar.gz.sha256"
echo "archive=${ARCHIVE}.tar.gz" >> "$GITHUB_OUTPUT"
echo "sha=${ARCHIVE}.tar.gz.sha256" >> "$GITHUB_OUTPUT"
du -h "${ARCHIVE}.tar.gz"
- name: Upload assets to release
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
gh release upload "${{ steps.tag.outputs.tag }}" \
"${{ steps.package.outputs.archive }}" \
"${{ steps.package.outputs.sha }}" \
--clobber
checksums:
name: Aggregate SHA256SUMS
needs: [ensure-release, build]
runs-on: [self-hosted, clean-room, X64]
steps:
- name: Regenerate and upload SHA256SUMS
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
set -euo pipefail
TAG="${{ needs.ensure-release.outputs.tag }}"
mkdir assets && cd assets
# PMAT-230: --clobber on every `gh release download`. NOT load-bearing
# here and said so rather than implied: this job is on a hosted
# (ephemeral) runner and `mkdir assets` above gives it a fresh
# directory, so the fixed-path collision that killed the v1.28.0
# release in release.yml cannot happen on this line today. It carries
# the flag because the rule is uniform over every workflow — a rule
# that names the two files it was written for is a rule a third call
# site walks past — and because `runs-on` has moved under these jobs
# before.
gh release download "$TAG" --repo "${{ github.repository }}" --pattern '*.tar.gz' --clobber
# #324/#325: this job regenerates SHA256SUMS from whatever is CURRENTLY
# attached to the release, so anything stray that reached the object
# gets laundered into the authoritative checksum file. That is how
# v1.18.0 ended up with a 10-line SHA256SUMS, four lines of it for
# 1.17.0. #324 added this guard to release.yml, the other producer,
# and left this one open. Do not delete it as redundant: the two
# workflows are not ordered against each other, and either can run
# alone via workflow_dispatch.
ver="${TAG#v}"
stray=0
for f in *.tar.gz; do
case "$f" in
forjar-"$ver"-*) ;;
*) echo "::error::$TAG carries $f, which is not this release"; stray=1 ;;
esac
done
# A CLEAN DIRECTORY IS NOT PROOF. An empty download would also pass a
# "no strays" test while publishing a SHA256SUMS that describes
# nothing, so assert the denominator too.
n=$(ls -1 *.tar.gz 2>/dev/null | wc -l)
echo "$TAG holds $n archive(s)"
[ "$n" -gt 0 ] || { echo "::error::no archives downloaded — nothing to checksum"; exit 1; }
[ "$stray" -eq 0 ] || exit 1
sha256sum -- *.tar.gz > SHA256SUMS
# Sidecars too. This job used to refresh only SHA256SUMS, so a tarball
# that release.yml later --clobber'd kept an earlier, now-invalid
# `.sha256` naming bytes that no longer existed.
for f in *.tar.gz; do sha256sum -- "$f" > "$f.sha256"; done
cat SHA256SUMS
gh release upload "$TAG" SHA256SUMS ./*.tar.gz.sha256 --clobber --repo "${{ github.repository }}"
summary:
name: Summary
needs: [ensure-release, build]
runs-on: [self-hosted, clean-room, X64]
if: always()
steps:
- name: Write summary
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
TAG="${{ needs.ensure-release.outputs.tag }}"
STATUS="${{ needs.build.result }}"
{
echo "### Binary Release: $TAG"
echo ""
if [ "$STATUS" = "success" ]; then
echo "- Build matrix: **4/4 targets succeeded**"
else
echo "- Build matrix: **partial** (status=$STATUS)"
fi
echo "- Targets:"
echo " - x86_64-unknown-linux-musl"
echo " - x86_64-unknown-linux-gnu"
echo " - aarch64-unknown-linux-musl"
echo " - aarch64-unknown-linux-gnu"
} >> "$GITHUB_STEP_SUMMARY"