chore(deps): bump the rust-minor group across 1 directory with 11 updates #1236
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| on: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| env: | |
| # Same memory-pressure profile as rust-tests: clippy --workspace | |
| # --all-targets compiles every test binary, each statically linking | |
| # the AWS SDK + OpenSSL + Postgres/MySQL/SQLite + aws-lc-rs. Cap | |
| # link concurrency at 2 and disable incremental compilation so the | |
| # 16 GB ubuntu-latest runner does not OOM rust-lld (observed as | |
| # "hosted runner lost communication with the server" after ~50 min). | |
| CARGO_BUILD_JOBS: "2" | |
| CARGO_INCREMENTAL: "0" | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Free disk space | |
| run: bash scripts/ci-free-disk-space.sh | |
| - name: Cache cargo registry | |
| uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| key: lint-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| lint-${{ runner.os }}- | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1 | |
| with: | |
| components: rustfmt, clippy | |
| - name: Install protoc | |
| run: sudo apt-get install -y protobuf-compiler | |
| - name: Lint | |
| run: scripts/test.sh --lint | |
| rust-tests: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| env: | |
| RUSTC_WRAPPER: sccache | |
| SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache | |
| SCCACHE_CACHE_SIZE: 2G | |
| # The workspace test binaries each statically embed the full AWS SDK, | |
| # OpenSSL, Postgres/MySQL/SQLite drivers, and aws-lc-rs. In debug mode | |
| # one link peaks at ~3-5 GB resident; cargo's default -j4 on a 16 GB | |
| # Ubuntu runner has been observed to OOM the rust-lld parallel-link | |
| # path with SIGBUS in llvm::parallelFor during link of memguard / | |
| # async_metastore_trait / config_env_tests test binaries. Cap link | |
| # concurrency at 2 and disable incremental compilation (matching the | |
| # other Rust build jobs in this workflow) so we stay well under the | |
| # cliff. | |
| CARGO_BUILD_JOBS: "2" | |
| CARGO_INCREMENTAL: "0" | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Free disk space | |
| run: bash scripts/ci-free-disk-space.sh | |
| - name: Restore workspace caches | |
| uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| .cache/sccache | |
| key: rust-tests-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| rust-tests-${{ runner.os }}- | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1 | |
| - uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3 | |
| with: | |
| tool: sccache@0.8.1 | |
| - name: Install protoc | |
| run: sudo apt-get install -y protobuf-compiler | |
| - name: Unit tests | |
| run: scripts/test.sh --unit | |
| # The default AEAD backend (hardware-crypto / hardware-rust-crypto) is | |
| # exercised by the rust-tests and integration-tests jobs above. This job | |
| # keeps the opt-in `ring-crypto` backend green: it must build clean, pass | |
| # clippy with -D warnings, and decrypt the same NIST/cross-language | |
| # envelopes as the hardware backend (proving wire compatibility). | |
| aead-ring-backend: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_BUILD_JOBS: "2" | |
| CARGO_INCREMENTAL: "0" | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Free disk space | |
| run: bash scripts/ci-free-disk-space.sh | |
| - name: Cache cargo registry | |
| uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| key: aead-ring-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| aead-ring-${{ runner.os }}- | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1 | |
| with: | |
| components: clippy | |
| - name: Install protoc | |
| run: sudo apt-get install -y protobuf-compiler | |
| - name: Clippy (ring-crypto backend) | |
| run: cargo clippy -p asherah --no-default-features --features ring-crypto --all-targets -- -D warnings | |
| - name: Unit tests (ring-crypto backend) | |
| run: cargo test -p asherah --no-default-features --features ring-crypto | |
| integration-tests: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| env: | |
| # Same memory-pressure profile as rust-tests; integration tests | |
| # link the same fat test binaries. | |
| CARGO_BUILD_JOBS: "2" | |
| CARGO_INCREMENTAL: "0" | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Free disk space | |
| run: bash scripts/ci-free-disk-space.sh | |
| - name: Cache cargo registry | |
| uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| key: integration-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| integration-${{ runner.os }}- | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1 | |
| - name: Verify Docker availability | |
| run: docker version | |
| - name: Integration tests | |
| run: scripts/test.sh --integration | |
| build-rlib-x86_64: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-22.04 | |
| env: | |
| CARGO_HOME: ${{ github.workspace }}/.cache/cargo | |
| RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup | |
| CARGO_INCREMENTAL: 0 | |
| RUSTC_WRAPPER: sccache | |
| SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache | |
| SCCACHE_CACHE_SIZE: 2G | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Restore workspace caches | |
| uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 | |
| with: | |
| path: | | |
| .cache/cargo | |
| .cache/rustup | |
| .cache/sccache | |
| key: build-${{ runner.os }}-x86_64-rlib-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| build-${{ runner.os }}-x86_64-rlib- | |
| - uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3 | |
| with: | |
| tool: sccache@0.8.1 | |
| - name: Build FFI rlib (x86_64) | |
| env: | |
| TARGET_ARCH: x86_64 | |
| BINDING_COMPONENTS: ffi | |
| run: ./scripts/build-bindings.sh | |
| - name: Create rlib tarball | |
| run: | | |
| TAR_ARGS=() | |
| for p in \ | |
| target/x86_64-unknown-linux-gnu/release \ | |
| target/x86_64-unknown-linux-gnu/x86_64-unknown-linux-gnu/release \ | |
| ; do | |
| [ -d "$p" ] && TAR_ARGS+=("$p") | |
| done | |
| for f in target/release/libasherah_ffi*; do | |
| [ -e "$f" ] && TAR_ARGS+=("$f") | |
| done | |
| tar czf /tmp/x86_64-rlib.tar.gz "${TAR_ARGS[@]}" | |
| - name: Upload x86_64 rlib artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: x86_64-rlib-artifacts | |
| retention-days: 1 | |
| path: /tmp/x86_64-rlib.tar.gz | |
| build-node-x86_64: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-22.04 | |
| needs: build-rlib-x86_64 | |
| env: | |
| CARGO_HOME: ${{ github.workspace }}/.cache/cargo | |
| RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup | |
| NPM_CONFIG_CACHE: ${{ github.workspace }}/.cache/npm | |
| CARGO_INCREMENTAL: 0 | |
| RUSTC_WRAPPER: sccache | |
| SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache | |
| SCCACHE_CACHE_SIZE: 2G | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Restore workspace caches | |
| uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 | |
| with: | |
| path: | | |
| .cache/cargo | |
| .cache/rustup | |
| .cache/npm | |
| .cache/sccache | |
| key: build-${{ runner.os }}-x86_64-node-${{ hashFiles('**/Cargo.lock', 'asherah-node/package-lock.json') }} | |
| restore-keys: | | |
| build-${{ runner.os }}-x86_64-node- | |
| - name: Download x86_64 rlib artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: x86_64-rlib-artifacts | |
| path: /tmp | |
| - name: Extract rlib artifacts | |
| run: tar xzf /tmp/x86_64-rlib.tar.gz | |
| - uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3 | |
| with: | |
| tool: sccache@0.8.1 | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 20 | |
| - name: Build Node.js binding (x86_64) | |
| env: | |
| TARGET_ARCH: x86_64 | |
| BINDING_COMPONENTS: node | |
| SKIP_CORE_BUILD: "1" | |
| run: ./scripts/build-bindings.sh | |
| - name: Upload x86_64 node binding artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: bindings-linux-x86_64-part-node | |
| retention-days: 1 | |
| path: artifacts/x86_64 | |
| build-python-x86_64: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-22.04 | |
| needs: build-rlib-x86_64 | |
| container: quay.io/pypa/manylinux_2_28_x86_64 | |
| env: | |
| CARGO_HOME: ${{ github.workspace }}/.cache/cargo | |
| RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup | |
| PIP_CACHE_DIR: ${{ github.workspace }}/.cache/pip | |
| CARGO_INCREMENTAL: 0 | |
| RUSTC_WRAPPER: sccache | |
| SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache | |
| SCCACHE_CACHE_SIZE: 2G | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Restore workspace caches | |
| uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 | |
| with: | |
| path: | | |
| .cache/cargo | |
| .cache/rustup | |
| .cache/pip | |
| .cache/sccache | |
| key: build-${{ runner.os }}-x86_64-python-${{ hashFiles('Cargo.lock', 'asherah-py/Cargo.toml') }} | |
| restore-keys: | | |
| build-${{ runner.os }}-x86_64-python- | |
| - name: Download x86_64 rlib artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: x86_64-rlib-artifacts | |
| path: /tmp | |
| - name: Extract rlib artifacts | |
| run: tar xzf /tmp/x86_64-rlib.tar.gz | |
| - name: Build Python binding (x86_64) - manylinux | |
| run: | | |
| yum install -y openssl-devel pkgconfig 2>/dev/null || true | |
| export HOME=/root | |
| export OPENSSL_NO_VENDOR=1 | |
| curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain none | |
| export PATH="$CARGO_HOME/bin:$PATH" | |
| rustup toolchain install 1.91.1 --profile minimal --component rustfmt | |
| bash "${GITHUB_WORKSPACE:-$(pwd)}/scripts/install-sccache.sh" | |
| python3.11 -m pip install maturin==1.9.4 | |
| rm -rf artifacts/x86_64/python || true | |
| mkdir -p artifacts/x86_64/python | |
| python3.11 -m maturin build --release --manifest-path asherah-py/Cargo.toml --compatibility manylinux_2_28 -i python3.11 --out artifacts/x86_64/python | |
| - name: Upload x86_64 python binding artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: bindings-linux-x86_64-part-python | |
| retention-days: 1 | |
| path: artifacts/x86_64 | |
| build-java-x86_64: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-22.04 | |
| needs: build-rlib-x86_64 | |
| env: | |
| CARGO_HOME: ${{ github.workspace }}/.cache/cargo | |
| RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup | |
| CARGO_INCREMENTAL: 0 | |
| RUSTC_WRAPPER: sccache | |
| SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache | |
| SCCACHE_CACHE_SIZE: 2G | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Restore workspace caches | |
| uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 | |
| with: | |
| path: | | |
| .cache/cargo | |
| .cache/rustup | |
| .cache/maven | |
| .cache/sccache | |
| key: build-${{ runner.os }}-x86_64-java-${{ hashFiles('**/Cargo.lock', 'asherah-java/java/pom.xml') }} | |
| restore-keys: | | |
| build-${{ runner.os }}-x86_64-java- | |
| - name: Download x86_64 rlib artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: x86_64-rlib-artifacts | |
| path: /tmp | |
| - name: Extract rlib artifacts | |
| run: tar xzf /tmp/x86_64-rlib.tar.gz | |
| - uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3 | |
| with: | |
| tool: sccache@0.8.1 | |
| - name: Build Java binding (x86_64) | |
| env: | |
| TARGET_ARCH: x86_64 | |
| BINDING_COMPONENTS: java | |
| SKIP_CORE_BUILD: "1" | |
| run: ./scripts/build-bindings.sh | |
| - name: Upload x86_64 java artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: bindings-linux-x86_64-part-java | |
| retention-days: 1 | |
| path: artifacts/x86_64 | |
| build-dotnet-x86_64: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-22.04 | |
| needs: build-rlib-x86_64 | |
| env: | |
| CARGO_HOME: ${{ github.workspace }}/.cache/cargo | |
| RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup | |
| CARGO_INCREMENTAL: 0 | |
| RUSTC_WRAPPER: sccache | |
| SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache | |
| SCCACHE_CACHE_SIZE: 2G | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Restore workspace caches | |
| uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 | |
| with: | |
| path: | | |
| .cache/cargo | |
| .cache/rustup | |
| .cache/dotnet | |
| .cache/sccache | |
| key: build-${{ runner.os }}-x86_64-dotnet-${{ hashFiles('**/Cargo.lock', 'asherah-dotnet/**/*.csproj', 'asherah-dotnet/Directory.Packages.props', 'asherah-dotnet/**/packages.lock.json') }} | |
| restore-keys: | | |
| build-${{ runner.os }}-x86_64-dotnet- | |
| - name: Download x86_64 rlib artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: x86_64-rlib-artifacts | |
| path: /tmp | |
| - name: Extract rlib artifacts | |
| run: tar xzf /tmp/x86_64-rlib.tar.gz | |
| - uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3 | |
| with: | |
| tool: sccache@0.8.1 | |
| - uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0 | |
| with: | |
| dotnet-version: | | |
| 8.0.x | |
| 10.0.x | |
| - name: Build .NET binding (x86_64) | |
| env: | |
| TARGET_ARCH: x86_64 | |
| BINDING_COMPONENTS: dotnet | |
| SKIP_CORE_BUILD: "1" | |
| run: ./scripts/build-bindings.sh | |
| - name: Upload x86_64 dotnet artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: bindings-linux-x86_64-part-dotnet | |
| retention-days: 1 | |
| path: artifacts/x86_64 | |
| publish-dry-run-nuget: | |
| runs-on: ubuntu-22.04 | |
| needs: build-rlib-x86_64 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0 | |
| with: | |
| dotnet-version: | | |
| 8.0.x | |
| 10.0.x | |
| - name: Download rlib artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: x86_64-rlib-artifacts | |
| path: /tmp | |
| - name: Extract rlib and build FFI lib | |
| run: | | |
| tar xzf /tmp/x86_64-rlib.tar.gz | |
| cargo build -p asherah-ffi --release | |
| - name: Pack both NuGet packages | |
| working-directory: asherah-dotnet | |
| run: | | |
| # Stage the FFI lib under every Linux + macOS RID the publish workflow | |
| # ships. We only have one host binary in dry-run, so the *contents* | |
| # are all the host x64 build — this verifies layout, not arch correctness. | |
| # publish-nuget.yml ships the right architecture per RID. | |
| NATIVE_DIR=src/GoDaddy.Asherah.Encryption/runtimes | |
| for rid in linux-x64 linux-arm64 linux-musl-x64 linux-musl-arm64; do | |
| mkdir -p "$NATIVE_DIR/$rid/native" | |
| cp ../target/release/libasherah_ffi.so "$NATIVE_DIR/$rid/native/" | |
| done | |
| for rid in osx-x64 osx-arm64; do | |
| mkdir -p "$NATIVE_DIR/$rid/native" | |
| cp ../target/release/libasherah_ffi.so "$NATIVE_DIR/$rid/native/libasherah_ffi.dylib" | |
| done | |
| dotnet pack src/GoDaddy.Asherah.Encryption/GoDaddy.Asherah.Encryption.csproj -c Release \ | |
| /p:Version="0.0.0-dryrun" \ | |
| /p:PackageOutputPath="$GITHUB_WORKSPACE/dist" \ | |
| /p:RestoreLockedMode=true | |
| dotnet pack src/GoDaddy.Asherah.Encryption.Compat/GoDaddy.Asherah.Encryption.Compat.csproj -c Release \ | |
| /p:Version="0.0.0-dryrun" \ | |
| /p:PackageOutputPath="$GITHUB_WORKSPACE/dist" \ | |
| /p:RestoreLockedMode=true | |
| - name: Verify packages | |
| run: | | |
| echo "=== Packed packages ===" | |
| ls -lh dist/ | |
| for pkg in dist/*.nupkg; do | |
| echo "--- $pkg ---" | |
| if echo "$pkg" | grep -q "Compat"; then | |
| echo " Compat package — no native libraries expected" | |
| continue | |
| fi | |
| unzip -l "$pkg" | grep -E 'native|runtimes' | sort | |
| for required in linux-x64 linux-arm64 linux-musl-x64 linux-musl-arm64 osx-x64 osx-arm64; do | |
| if ! unzip -l "$pkg" | grep -q "runtimes/${required}/native/"; then | |
| echo "ERROR: Core package missing required native library for ${required}" | |
| exit 1 | |
| fi | |
| done | |
| done | |
| echo "NuGet dry-run passed ($(ls dist/*.nupkg | wc -l) packages)" | |
| build-ffi-x86_64: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-22.04 | |
| needs: build-rlib-x86_64 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Download x86_64 rlib artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: x86_64-rlib-artifacts | |
| path: /tmp | |
| - name: Extract rlib artifacts | |
| run: tar xzf /tmp/x86_64-rlib.tar.gz | |
| - name: Package FFI artifacts (x86_64) | |
| run: | | |
| mkdir -p artifacts/x86_64/ffi artifacts/x86_64/ruby | |
| find target/release -name 'libasherah_ffi.*' -type f ! -name '*.d' -exec cp {} artifacts/x86_64/ffi/ \; | |
| find target/release -name 'libasherah_ffi.*' -type f ! -name '*.d' -exec cp {} artifacts/x86_64/ruby/ \; | |
| - name: Upload x86_64 ffi artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: bindings-linux-x86_64-part-ffi | |
| retention-days: 1 | |
| path: artifacts/x86_64 | |
| build-cobhan-x86_64: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-22.04 | |
| needs: build-rlib-x86_64 | |
| env: | |
| CARGO_HOME: ${{ github.workspace }}/.cache/cargo | |
| RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup | |
| CARGO_INCREMENTAL: 0 | |
| RUSTC_WRAPPER: sccache | |
| SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache | |
| SCCACHE_CACHE_SIZE: 2G | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Restore workspace caches | |
| uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 | |
| with: | |
| path: | | |
| .cache/cargo | |
| .cache/rustup | |
| .cache/sccache | |
| key: build-${{ runner.os }}-x86_64-cobhan-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| build-${{ runner.os }}-x86_64-cobhan- | |
| - name: Download x86_64 rlib artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: x86_64-rlib-artifacts | |
| path: /tmp | |
| - name: Extract rlib artifacts | |
| run: tar xzf /tmp/x86_64-rlib.tar.gz | |
| - uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3 | |
| with: | |
| tool: sccache@0.8.1 | |
| - name: Build asherah-cobhan (x86_64) | |
| env: | |
| TARGET_ARCH: x86_64 | |
| BINDING_COMPONENTS: cobhan | |
| SKIP_CORE_BUILD: "1" | |
| run: ./scripts/build-bindings.sh | |
| - name: Upload x86_64 cobhan artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: bindings-linux-x86_64-part-cobhan | |
| retention-days: 1 | |
| path: artifacts/x86_64 | |
| # --- macOS x86_64 cross-compile from ARM64 --- | |
| build-ffi-macos-x64: | |
| runs-on: macos-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1 | |
| with: | |
| targets: x86_64-apple-darwin,aarch64-apple-darwin | |
| - name: Build FFI for macOS x86_64 + arm64 | |
| run: | | |
| cargo build --release -p asherah-ffi -p asherah-java --target x86_64-apple-darwin | |
| cargo build --release -p asherah-ffi -p asherah-java --target aarch64-apple-darwin | |
| - name: Verify x86_64 binary architecture | |
| run: file target/x86_64-apple-darwin/release/libasherah_ffi.dylib | grep -q "x86_64" | |
| - name: Upload macOS artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: ffi-macos | |
| retention-days: 1 | |
| path: | | |
| target/x86_64-apple-darwin/release/libasherah_ffi.dylib | |
| target/x86_64-apple-darwin/release/libasherah_java.dylib | |
| target/aarch64-apple-darwin/release/libasherah_ffi.dylib | |
| target/aarch64-apple-darwin/release/libasherah_java.dylib | |
| # --- Windows x86_64 --- | |
| build-ffi-windows-x64: | |
| runs-on: windows-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1 | |
| - name: Install OpenSSL via vcpkg | |
| shell: bash | |
| run: | | |
| bash "$GITHUB_WORKSPACE/scripts/vcpkg-install-with-retry.sh" openssl:x64-windows-static-md | |
| echo "OPENSSL_DIR=C:/vcpkg/installed/x64-windows-static-md" >> "$GITHUB_ENV" | |
| echo "OPENSSL_STATIC=1" >> "$GITHUB_ENV" | |
| echo "OPENSSL_NO_VENDOR=1" >> "$GITHUB_ENV" | |
| - name: Build FFI for Windows x86_64 | |
| shell: bash | |
| run: cargo build --release -p asherah-ffi -p asherah-java --target x86_64-pc-windows-msvc | |
| - name: Upload Windows artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: ffi-windows-x64 | |
| retention-days: 1 | |
| path: | | |
| target/x86_64-pc-windows-msvc/release/asherah_ffi.dll | |
| target/x86_64-pc-windows-msvc/release/asherah_java.dll | |
| package-x86_64: | |
| permissions: | |
| contents: read | |
| if: github.event_name == 'push' | |
| runs-on: ubuntu-latest | |
| needs: [build-ffi-x86_64, build-cobhan-x86_64, build-node-x86_64, build-python-x86_64, build-dotnet-x86_64, build-java-x86_64] | |
| steps: | |
| - name: Download all x86_64 artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: bindings-linux-x86_64-part-* | |
| path: artifacts-staging | |
| merge-multiple: true | |
| - name: Consolidate artifacts | |
| run: | | |
| mkdir -p artifacts/x86_64 | |
| cp -r artifacts-staging/* artifacts/x86_64/ | |
| - name: Upload consolidated x86_64 artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: bindings-linux-x86_64 | |
| retention-days: 1 | |
| path: artifacts/x86_64 | |
| arm64-test-image: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-latest | |
| env: | |
| CACHE_MAX_AGE_DAYS: 7 | |
| outputs: | |
| cache-hit: ${{ steps.check-cache.outputs.cache-hit }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Calculate cache key | |
| id: cache-key | |
| run: | | |
| DOCKERFILE_HASH=$(sha256sum docker/tests.Dockerfile | cut -d' ' -f1 | head -c 8) | |
| # Get week number to force rebuild every N days | |
| WEEK_NUM=$(( $(date +%s) / 86400 / ${{ env.CACHE_MAX_AGE_DAYS }} )) | |
| CACHE_KEY="arm64-test-image-${DOCKERFILE_HASH}-week-${WEEK_NUM}" | |
| echo "cache-key=${CACHE_KEY}" >> $GITHUB_OUTPUT | |
| echo "Cache key: ${CACHE_KEY}" | |
| - name: Check for cached image | |
| id: check-cache | |
| uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 | |
| with: | |
| path: /tmp/asherah-tests-arm64.tar | |
| key: ${{ steps.cache-key.outputs.cache-key }} | |
| lookup-only: true | |
| - name: Set up QEMU | |
| if: steps.check-cache.outputs.cache-hit != 'true' | |
| uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 | |
| with: | |
| platforms: linux/arm64 | |
| - name: Set up Docker Buildx | |
| if: steps.check-cache.outputs.cache-hit != 'true' | |
| uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 | |
| - name: Build arm64 test image | |
| if: steps.check-cache.outputs.cache-hit != 'true' | |
| run: | | |
| docker buildx build \ | |
| --file docker/tests.Dockerfile \ | |
| --platform linux/arm64 \ | |
| --tag asherah-tests:arm64 \ | |
| --cache-from type=gha,scope=tests-arm64-image \ | |
| --cache-to type=gha,mode=max,scope=tests-arm64-image \ | |
| --output type=docker,dest=/tmp/asherah-tests-arm64.tar \ | |
| . | |
| - name: Restore cached image | |
| if: steps.check-cache.outputs.cache-hit == 'true' | |
| uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 | |
| with: | |
| path: /tmp/asherah-tests-arm64.tar | |
| key: ${{ steps.cache-key.outputs.cache-key }} | |
| - name: Save image to cache | |
| if: steps.check-cache.outputs.cache-hit != 'true' | |
| uses: actions/cache/save@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 | |
| with: | |
| path: /tmp/asherah-tests-arm64.tar | |
| key: ${{ steps.cache-key.outputs.cache-key }} | |
| - name: Upload arm64 test image | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: arm64-tests-image | |
| retention-days: 1 | |
| path: /tmp/asherah-tests-arm64.tar | |
| binding-tests-x86_64: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-22.04 | |
| needs: | |
| - build-ffi-x86_64 | |
| - build-node-x86_64 | |
| - build-python-x86_64 | |
| - build-java-x86_64 | |
| - build-dotnet-x86_64 | |
| strategy: | |
| fail-fast: true | |
| matrix: | |
| binding: [python, node, bun, ruby, go, java, dotnet, php] | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Download all x86_64 binding artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: bindings-linux-x86_64-part-* | |
| path: ${{ github.workspace }}/ci-artifacts | |
| merge-multiple: true | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| if: matrix.binding == 'node' || matrix.binding == 'bun' | |
| with: | |
| node-version: 20 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| if: matrix.binding == 'bun' | |
| with: | |
| bun-version: 1.3.14 | |
| - uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0 | |
| if: matrix.binding == 'dotnet' | |
| with: | |
| dotnet-version: | | |
| 8.0.x | |
| 10.0.x | |
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 | |
| if: matrix.binding == 'go' | |
| with: | |
| go-version: '1.23' | |
| cache-dependency-path: asherah-go/go.sum | |
| - uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1.314.0 | |
| if: matrix.binding == 'ruby' | |
| with: | |
| ruby-version: '3.3' | |
| bundler-cache: true | |
| working-directory: asherah-ruby | |
| - name: Run ${{ matrix.binding }} binding tests (x86_64) | |
| env: | |
| BINDING_ARTIFACTS_DIR: ${{ github.workspace }}/ci-artifacts | |
| run: scripts/test.sh --bindings --binding=${{ matrix.binding }} | |
| php-binding-supported-minors: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-22.04 | |
| needs: build-ffi-x86_64 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| php-image: | |
| - php:8.1-cli | |
| - php:8.2-cli | |
| - php:8.3-cli | |
| - php:8.4-cli | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Download x86_64 FFI artifact | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: bindings-linux-x86_64-part-ffi | |
| path: ${{ github.workspace }}/ci-artifacts | |
| - name: Run PHP binding tests on ${{ matrix.php-image }} | |
| env: | |
| BINDING_ARTIFACTS_DIR: ${{ github.workspace }}/ci-artifacts | |
| PHP_IMAGE_TAG: ${{ matrix.php-image }} | |
| run: scripts/test.sh --bindings --binding=php | |
| interop-tests: | |
| runs-on: ubuntu-22.04 | |
| needs: build-rlib-x86_64 | |
| permissions: | |
| contents: read | |
| env: | |
| RUSTC_WRAPPER: sccache | |
| SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache | |
| SCCACHE_CACHE_SIZE: 2G | |
| # Match rust-tests: cap link concurrency on the 16 GB runner. | |
| CARGO_BUILD_JOBS: "2" | |
| CARGO_INCREMENTAL: "0" | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Free disk space | |
| run: bash scripts/ci-free-disk-space.sh | |
| - name: Restore workspace caches | |
| uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| .cache/sccache | |
| key: interop-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| interop-${{ runner.os }}- | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1 | |
| with: | |
| components: rustfmt | |
| - uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3 | |
| with: | |
| tool: sccache@0.8.1 | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 20 | |
| - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0 | |
| with: | |
| # canonical com.godaddy.asherah:appencryption@0.4.0 is compiled | |
| # with JDK 17 (class file 61.0). The canonical-java probe under | |
| # interop/canonical-java requires JDK 17+ to build. | |
| java-version: '17' | |
| distribution: 'temurin' | |
| - name: Download x86_64 rlib artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: x86_64-rlib-artifacts | |
| path: /tmp | |
| - name: Extract rlib artifacts | |
| run: tar xzf /tmp/x86_64-rlib.tar.gz | |
| - name: Install dependencies | |
| run: | | |
| sudo gem install ffi --no-document | |
| pip3 install pytest pytest-asyncio maturin | |
| cd asherah-node && npm install | |
| - name: Interop tests | |
| run: scripts/test.sh --interop | |
| tests-arm64: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-latest | |
| needs: | |
| - build-ffi-arm64 | |
| - build-node-arm64 | |
| - build-python-arm64 | |
| - build-java-arm64 | |
| - build-dotnet-arm64 | |
| - arm64-test-image | |
| strategy: | |
| fail-fast: true | |
| matrix: | |
| binding: [python, node, bun, ruby, go, java, dotnet] | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Restore workspace caches | |
| uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 | |
| with: | |
| path: | | |
| .cache/cargo | |
| .cache/rustup | |
| .cache/pip | |
| .cache/npm | |
| .cache/maven | |
| .cache/dotnet | |
| key: tests-${{ runner.os }}-arm64-${{ matrix.binding }}-${{ hashFiles('**/Cargo.lock', 'asherah-node/package-lock.json', 'asherah-py/Cargo.toml', 'asherah-py/pyproject.toml', 'asherah-java/java/pom.xml', 'asherah-dotnet/**/*.csproj', 'asherah-dotnet/Directory.Packages.props', 'asherah-dotnet/**/packages.lock.json') }} | |
| restore-keys: | | |
| tests-${{ runner.os }}-arm64-${{ matrix.binding }}- | |
| tests-${{ runner.os }}-arm64- | |
| - name: Download all arm64 binding artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: bindings-linux-aarch64-part-* | |
| path: ${{ github.workspace }}/artifacts/aarch64 | |
| merge-multiple: true | |
| - name: Download arm64 test image | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: arm64-tests-image | |
| path: artifacts | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 | |
| with: | |
| platforms: linux/arm64 | |
| - name: Load arm64 test image | |
| run: docker load --input artifacts/asherah-tests-arm64.tar | |
| - name: Run ${{ matrix.binding }} binding tests (Arm64) | |
| env: | |
| DOCKER_PLATFORM: linux/arm64 | |
| BINDING_ARTIFACTS_DIR: ${{ github.workspace }}/artifacts/aarch64 | |
| BINDING_TESTS_BINDING: ${{ matrix.binding }} | |
| USE_PREBUILT_TEST_IMAGE: "1" | |
| TESTS_IMAGE_TAG: asherah-tests:arm64 | |
| run: ./scripts/test-in-docker.sh | |
| sanitizers: | |
| runs-on: ubuntu-latest | |
| needs: build-rlib-x86_64 | |
| permissions: | |
| contents: read | |
| # Runs on every PR to main (gating), on main pushes, on schedule, and on any | |
| # push whose commit message contains [sanitize]. PR gating was enabled once | |
| # the release cadence slowed enough that the added PR latency is worth more | |
| # than fast PRs for catching sanitizer regressions before merge. | |
| if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event_name == 'schedule' || contains(github.event.head_commit.message, '[sanitize]') | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Cache cargo registry | |
| uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| key: sanitizers-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| sanitizers-${{ runner.os }}- | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1 | |
| - name: Install dependencies | |
| run: | | |
| echo 'Acquire::Retries "3";' | sudo tee /etc/apt/apt.conf.d/80-retries | |
| sudo apt-get update | |
| sudo apt-get install -y clang llvm valgrind protobuf-compiler | |
| - name: Sanitizer tests | |
| run: scripts/test.sh --sanitizers --platform=x64 | |
| build-rlib-arm64: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-latest | |
| container: rust:1.91-bookworm | |
| env: | |
| CARGO_HOME: ${{ github.workspace }}/.cache/cargo | |
| RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup | |
| CARGO_TARGET_DIR: ${{ github.workspace }}/target | |
| CARGO_INCREMENTAL: 0 | |
| RUSTC_WRAPPER: sccache | |
| SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache | |
| SCCACHE_CACHE_SIZE: 2G | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Restore workspace caches | |
| uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 | |
| with: | |
| path: | | |
| .cache/cargo | |
| .cache/rustup | |
| .cache/sccache | |
| key: build-${{ runner.os }}-arm64-rlib-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| build-${{ runner.os }}-arm64-rlib- | |
| - name: Install cross-compile toolchain and sccache | |
| run: | | |
| echo 'Acquire::Retries "3";' > /etc/apt/apt.conf.d/80-retries | |
| apt-get update | |
| apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu curl | |
| bash "${GITHUB_WORKSPACE:-$(pwd)}/scripts/install-sccache.sh" | |
| - name: Build FFI rlib (arm64) | |
| env: | |
| CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc | |
| CXX_aarch64_unknown_linux_gnu: aarch64-linux-gnu-g++ | |
| AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar | |
| CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc | |
| PKG_CONFIG_ALLOW_CROSS: 1 | |
| TARGET_ARCH: aarch64 | |
| BINDING_COMPONENTS: ffi | |
| run: | | |
| rustup target add aarch64-unknown-linux-gnu | |
| # Build core rlibs first for dependency reuse | |
| cargo build --release -p asherah --features sqlite --target aarch64-unknown-linux-gnu | |
| cargo build --release -p asherah-config --target aarch64-unknown-linux-gnu | |
| # Build FFI cdylib for other bindings | |
| ./scripts/build-bindings.sh | |
| - name: Create rlib tarball | |
| shell: bash | |
| run: | | |
| TAR_ARGS=() | |
| for p in \ | |
| target/aarch64-unknown-linux-gnu/release \ | |
| target/aarch64-unknown-linux-gnu/aarch64-unknown-linux-gnu/release \ | |
| ; do | |
| [ -d "$p" ] && TAR_ARGS+=("$p") | |
| done | |
| for f in target/release/libasherah_ffi*; do | |
| [ -e "$f" ] && TAR_ARGS+=("$f") | |
| done | |
| tar czf /tmp/arm64-rlib.tar.gz "${TAR_ARGS[@]}" | |
| - name: Upload arm64 rlib artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: arm64-rlib-artifacts | |
| retention-days: 1 | |
| path: /tmp/arm64-rlib.tar.gz | |
| build-node-arm64: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-latest | |
| needs: build-rlib-arm64 | |
| container: rust:1.91-bookworm | |
| env: | |
| CARGO_HOME: ${{ github.workspace }}/.cache/cargo | |
| RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup | |
| NPM_CONFIG_CACHE: ${{ github.workspace }}/.cache/npm | |
| CARGO_TARGET_DIR: ${{ github.workspace }}/target | |
| CARGO_INCREMENTAL: 0 | |
| RUSTC_WRAPPER: sccache | |
| SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache | |
| SCCACHE_CACHE_SIZE: 2G | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Restore workspace caches | |
| uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 | |
| with: | |
| path: | | |
| .cache/cargo | |
| .cache/rustup | |
| .cache/npm | |
| .cache/sccache | |
| key: build-${{ runner.os }}-arm64-node-${{ hashFiles('**/Cargo.lock', 'asherah-node/package-lock.json') }} | |
| restore-keys: | | |
| build-${{ runner.os }}-arm64-node- | |
| - name: Download arm64 rlib artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: arm64-rlib-artifacts | |
| path: /tmp | |
| - name: Extract rlib artifacts | |
| run: tar xzf /tmp/arm64-rlib.tar.gz | |
| - name: Install cross-compile toolchain, Node.js, and sccache | |
| run: | | |
| echo 'Acquire::Retries "3";' > /etc/apt/apt.conf.d/80-retries | |
| apt-get update | |
| apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu curl | |
| curl -fsSL https://deb.nodesource.com/setup_20.x | bash - | |
| apt-get install -y nodejs | |
| bash "${GITHUB_WORKSPACE:-$(pwd)}/scripts/install-sccache.sh" | |
| - name: Build Node.js binding (arm64) | |
| env: | |
| CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc | |
| CXX_aarch64_unknown_linux_gnu: aarch64-linux-gnu-g++ | |
| AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar | |
| CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc | |
| PKG_CONFIG_ALLOW_CROSS: 1 | |
| TARGET_ARCH: aarch64 | |
| BINDING_COMPONENTS: node | |
| SKIP_CORE_BUILD: "1" | |
| run: | | |
| rustup target add aarch64-unknown-linux-gnu | |
| rustup default 1.91.1 | |
| ./scripts/build-bindings.sh | |
| - name: Upload arm64 node binding artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: bindings-linux-aarch64-part-node | |
| retention-days: 1 | |
| path: artifacts/aarch64 | |
| build-python-arm64: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-latest | |
| needs: build-rlib-arm64 | |
| container: rust:1.91-bookworm | |
| env: | |
| CARGO_HOME: ${{ github.workspace }}/.cache/cargo | |
| RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup | |
| PIP_CACHE_DIR: ${{ github.workspace }}/.cache/pip | |
| CARGO_TARGET_DIR: ${{ github.workspace }}/target | |
| CARGO_INCREMENTAL: 0 | |
| RUSTC_WRAPPER: sccache | |
| SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache | |
| SCCACHE_CACHE_SIZE: 2G | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Restore workspace caches | |
| uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 | |
| with: | |
| path: | | |
| .cache/cargo | |
| .cache/rustup | |
| .cache/pip | |
| .cache/sccache | |
| key: build-${{ runner.os }}-arm64-python-${{ hashFiles('Cargo.lock', 'asherah-py/Cargo.toml') }} | |
| restore-keys: | | |
| build-${{ runner.os }}-arm64-python- | |
| - name: Download arm64 rlib artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: arm64-rlib-artifacts | |
| path: /tmp | |
| - name: Extract rlib artifacts | |
| run: tar xzf /tmp/arm64-rlib.tar.gz | |
| - name: Install cross-compile toolchain, Python, and sccache | |
| run: | | |
| echo 'Acquire::Retries "3";' > /etc/apt/apt.conf.d/80-retries | |
| apt-get update | |
| # Note: NO `libssl-dev` here — for cross-compile to glibc | |
| # aarch64 we let `openssl-sys` vendor OpenSSL from source. | |
| # Per CLAUDE.md ("Cross-compile glibc: let openssl-sys vendor | |
| # from source"), installing the host's `libssl-dev` and | |
| # relying on `PKG_CONFIG_ALLOW_CROSS=1` would link against | |
| # x86_64 headers/libs which don't match the aarch64 target. | |
| apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu python3 python3-pip python3-venv curl pkg-config | |
| # Probe for `--break-system-packages` support (Bookworm and | |
| # later) instead of hardcoding it; older python3-pip versions | |
| # don't accept the flag and would fail. CLAUDE.md hard rule. | |
| PIP_BSP="" | |
| python3 -m pip install --break-system-packages --help &>/dev/null && PIP_BSP="--break-system-packages" | |
| pip3 install $PIP_BSP maturin==1.9.4 | |
| bash "${GITHUB_WORKSPACE:-$(pwd)}/scripts/install-sccache.sh" | |
| - name: Build Python binding (arm64) | |
| env: | |
| CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc | |
| CXX_aarch64_unknown_linux_gnu: aarch64-linux-gnu-g++ | |
| AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar | |
| CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc | |
| PKG_CONFIG_ALLOW_CROSS: 1 | |
| TARGET_ARCH: aarch64 | |
| CARGO_LOG: cargo::core::compiler::fingerprint=info | |
| run: | | |
| rustup toolchain install 1.91.1 --profile minimal --component rustfmt | |
| rustup default 1.91.1 | |
| rustup target add aarch64-unknown-linux-gnu | |
| rm -rf artifacts/aarch64/python || true | |
| mkdir -p artifacts/aarch64/python | |
| maturin build --release --target aarch64-unknown-linux-gnu --manifest-path asherah-py/Cargo.toml --skip-auditwheel --out artifacts/aarch64/python 2>&1 | tee /tmp/maturin-build.log | |
| echo "=== Checking for 'Fresh' vs 'Compiling' for asherah ===" | |
| grep -E "(Fresh|Compiling) (asherah|tokio|aws)" /tmp/maturin-build.log || true | |
| - name: Upload arm64 python binding artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: bindings-linux-aarch64-part-python | |
| retention-days: 1 | |
| path: artifacts/aarch64 | |
| build-java-arm64: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-latest | |
| needs: build-rlib-arm64 | |
| container: rust:1.91-bookworm | |
| env: | |
| CARGO_HOME: ${{ github.workspace }}/.cache/cargo | |
| RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup | |
| CARGO_TARGET_DIR: ${{ github.workspace }}/target | |
| CARGO_INCREMENTAL: 0 | |
| RUSTC_WRAPPER: sccache | |
| SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache | |
| SCCACHE_CACHE_SIZE: 2G | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Restore workspace caches | |
| uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 | |
| with: | |
| path: | | |
| .cache/cargo | |
| .cache/rustup | |
| .cache/maven | |
| .cache/sccache | |
| key: build-${{ runner.os }}-arm64-java-${{ hashFiles('**/Cargo.lock', 'asherah-java/java/pom.xml') }} | |
| restore-keys: | | |
| build-${{ runner.os }}-arm64-java- | |
| - name: Download arm64 rlib artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: arm64-rlib-artifacts | |
| path: /tmp | |
| - name: Extract rlib artifacts | |
| run: tar xzf /tmp/arm64-rlib.tar.gz | |
| - name: Install cross-compile toolchain, Maven, and sccache | |
| run: | | |
| echo 'Acquire::Retries "3";' > /etc/apt/apt.conf.d/80-retries | |
| apt-get update | |
| apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu maven curl | |
| bash "${GITHUB_WORKSPACE:-$(pwd)}/scripts/install-sccache.sh" | |
| - name: Build Java binding (arm64) | |
| env: | |
| CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc | |
| CXX_aarch64_unknown_linux_gnu: aarch64-linux-gnu-g++ | |
| AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar | |
| CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc | |
| TARGET_ARCH: aarch64 | |
| BINDING_COMPONENTS: java | |
| SKIP_CORE_BUILD: "1" | |
| run: | | |
| rustup target add aarch64-unknown-linux-gnu | |
| rustup default 1.91.1 | |
| ./scripts/build-bindings.sh | |
| - name: Upload Java binding artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: bindings-linux-aarch64-part-java | |
| retention-days: 1 | |
| path: artifacts/aarch64 | |
| build-dotnet-arm64: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-latest | |
| needs: build-rlib-arm64 | |
| container: rust:1.91-bookworm | |
| env: | |
| CARGO_HOME: ${{ github.workspace }}/.cache/cargo | |
| RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup | |
| CARGO_TARGET_DIR: ${{ github.workspace }}/target | |
| CARGO_INCREMENTAL: 0 | |
| RUSTC_WRAPPER: sccache | |
| SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache | |
| SCCACHE_CACHE_SIZE: 2G | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Restore workspace caches | |
| uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 | |
| with: | |
| path: | | |
| .cache/cargo | |
| .cache/rustup | |
| .cache/dotnet | |
| .cache/sccache | |
| key: build-${{ runner.os }}-arm64-dotnet-${{ hashFiles('**/Cargo.lock', 'asherah-dotnet/**/*.csproj', 'asherah-dotnet/Directory.Packages.props', 'asherah-dotnet/**/packages.lock.json') }} | |
| restore-keys: | | |
| build-${{ runner.os }}-arm64-dotnet- | |
| - name: Download arm64 rlib artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: arm64-rlib-artifacts | |
| path: /tmp | |
| - name: Extract rlib artifacts | |
| run: tar xzf /tmp/arm64-rlib.tar.gz | |
| - name: Install cross-compile toolchain, .NET, and sccache | |
| run: | | |
| echo 'Acquire::Retries "3";' > /etc/apt/apt.conf.d/80-retries | |
| apt-get update | |
| apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu wget curl | |
| wget https://dot.net/v1/dotnet-install.sh -O dotnet-install.sh | |
| chmod +x dotnet-install.sh | |
| ./dotnet-install.sh --channel 8.0 --install-dir /usr/share/dotnet | |
| ./dotnet-install.sh --channel 10.0 --install-dir /usr/share/dotnet | |
| ln -sf /usr/share/dotnet/dotnet /usr/bin/dotnet | |
| bash "${GITHUB_WORKSPACE:-$(pwd)}/scripts/install-sccache.sh" | |
| - name: Build .NET binding (arm64) | |
| env: | |
| CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc | |
| CXX_aarch64_unknown_linux_gnu: aarch64-linux-gnu-g++ | |
| AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar | |
| CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc | |
| TARGET_ARCH: aarch64 | |
| BINDING_COMPONENTS: dotnet | |
| SKIP_CORE_BUILD: "1" | |
| run: | | |
| rustup target add aarch64-unknown-linux-gnu | |
| rustup default 1.91.1 | |
| ./scripts/build-bindings.sh | |
| - name: Upload .NET binding artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: bindings-linux-aarch64-part-dotnet | |
| retention-days: 1 | |
| path: artifacts/aarch64 | |
| build-ffi-arm64: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-latest | |
| needs: build-rlib-arm64 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Download arm64 rlib artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: arm64-rlib-artifacts | |
| path: /tmp | |
| - name: Extract rlib artifacts | |
| run: tar xzf /tmp/arm64-rlib.tar.gz | |
| - name: Package FFI artifacts (arm64) | |
| run: | | |
| mkdir -p artifacts/aarch64/ffi artifacts/aarch64/ruby | |
| find target -name 'libasherah_ffi.*' -type f ! -name '*.d' -exec cp {} artifacts/aarch64/ffi/ \; | |
| find target -name 'libasherah_ffi.*' -type f ! -name '*.d' -exec cp {} artifacts/aarch64/ruby/ \; | |
| - name: Upload FFI artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: bindings-linux-aarch64-part-ffi | |
| retention-days: 1 | |
| path: artifacts/aarch64 | |
| build-cobhan-arm64: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-latest | |
| needs: build-rlib-arm64 | |
| container: rust:1.91-bookworm | |
| env: | |
| CARGO_HOME: ${{ github.workspace }}/.cache/cargo | |
| RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup | |
| CARGO_TARGET_DIR: ${{ github.workspace }}/target | |
| CARGO_INCREMENTAL: 0 | |
| RUSTC_WRAPPER: sccache | |
| SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache | |
| SCCACHE_CACHE_SIZE: 2G | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Restore workspace caches | |
| uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 | |
| with: | |
| path: | | |
| .cache/cargo | |
| .cache/rustup | |
| .cache/sccache | |
| key: build-${{ runner.os }}-arm64-cobhan-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| build-${{ runner.os }}-arm64-cobhan- | |
| - name: Download arm64 rlib artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: arm64-rlib-artifacts | |
| path: /tmp | |
| - name: Extract rlib artifacts | |
| run: tar xzf /tmp/arm64-rlib.tar.gz | |
| - name: Install cross-compile toolchain and sccache | |
| run: | | |
| echo 'Acquire::Retries "3";' > /etc/apt/apt.conf.d/80-retries | |
| apt-get update | |
| apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu curl | |
| bash "${GITHUB_WORKSPACE:-$(pwd)}/scripts/install-sccache.sh" | |
| - name: Build asherah-cobhan (arm64) | |
| env: | |
| CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc | |
| CXX_aarch64_unknown_linux_gnu: aarch64-linux-gnu-g++ | |
| AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar | |
| CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc | |
| PKG_CONFIG_ALLOW_CROSS: 1 | |
| TARGET_ARCH: aarch64 | |
| BINDING_COMPONENTS: cobhan | |
| SKIP_CORE_BUILD: "1" | |
| run: | | |
| rustup target add aarch64-unknown-linux-gnu | |
| rustup default 1.91.1 | |
| ./scripts/build-bindings.sh | |
| - name: Upload arm64 cobhan artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: bindings-linux-aarch64-part-cobhan | |
| retention-days: 1 | |
| path: artifacts/aarch64 | |
| package-arm64: | |
| permissions: | |
| contents: read | |
| if: github.event_name == 'push' | |
| runs-on: ubuntu-latest | |
| needs: [build-ffi-arm64, build-cobhan-arm64, build-node-arm64, build-python-arm64, build-dotnet-arm64, build-java-arm64] | |
| steps: | |
| - name: Download all arm64 artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: bindings-linux-aarch64-part-* | |
| path: artifacts-staging | |
| merge-multiple: true | |
| - name: Consolidate artifacts | |
| run: | | |
| mkdir -p artifacts/aarch64 | |
| cp -r artifacts-staging/* artifacts/aarch64/ | |
| - name: Upload consolidated arm64 artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: bindings-linux-aarch64 | |
| retention-days: 1 | |
| path: artifacts/aarch64 | |
| # ========================================================================== | |
| # Dry-run publish validation — ALL publish targets validated on every PR. | |
| # If any fail, the PR blocks. No release can go out broken. | |
| # ========================================================================== | |
| publish-dry-run-npm-musl-x64: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1 | |
| with: | |
| targets: x86_64-unknown-linux-musl | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 20 | |
| - name: Install Zig (with retries) | |
| # Replaces `mlugg/setup-zig@v2`, which has no internal retry — | |
| # a single transient `fetch failed` blocked PR CI repeatedly. | |
| # `scripts/install-zig.sh` wraps curl with `--retry 10` plus an | |
| # outer 3-attempt loop, and is shared with the publish | |
| # workflows so dry-runs can't drift. | |
| shell: bash | |
| run: bash "$GITHUB_WORKSPACE/scripts/install-zig.sh" | |
| - uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3 | |
| with: | |
| tool: cargo-zigbuild | |
| - name: Build asherah-node for x86_64-musl | |
| working-directory: asherah-node | |
| shell: bash | |
| run: | | |
| set -e | |
| ARCH=x86_64 source "$GITHUB_WORKSPACE/scripts/download-musl-openssl.sh" | |
| rustup target add x86_64-unknown-linux-musl | |
| npm ci | |
| npm run build -- --target x86_64-unknown-linux-musl --zig | |
| ls *.node || { echo "ERROR: No .node file produced"; exit 1; } | |
| publish-dry-run-windows-x64: | |
| runs-on: windows-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1 | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 20 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version: "3.11" | |
| - name: Install OpenSSL via vcpkg | |
| shell: bash | |
| run: | | |
| bash "$GITHUB_WORKSPACE/scripts/vcpkg-install-with-retry.sh" openssl:x64-windows-static-md | |
| echo "OPENSSL_DIR=C:/vcpkg/installed/x64-windows-static-md" >> "$GITHUB_ENV" | |
| echo "OPENSSL_STATIC=1" >> "$GITHUB_ENV" | |
| echo "OPENSSL_NO_VENDOR=1" >> "$GITHUB_ENV" | |
| - name: Build asherah-node for Windows | |
| working-directory: asherah-node | |
| shell: bash | |
| run: | | |
| npm ci | |
| npm run build -- --target x86_64-pc-windows-msvc | |
| ls *.node || { echo "ERROR: No .node file produced"; exit 1; } | |
| - name: Build asherah-py wheel for Windows | |
| shell: bash | |
| run: | | |
| pip install maturin==1.9.4 | |
| maturin build --release --manifest-path asherah-py/Cargo.toml --out dist/ | |
| ls dist/*.whl || { echo "ERROR: No wheel produced"; exit 1; } | |
| publish-dry-run-pypi-manylinux-x64: | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version: "3.11" | |
| - uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1 | |
| with: | |
| targets: x86_64-unknown-linux-gnu | |
| - name: Build manylinux x86_64 wheel | |
| uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0 | |
| with: | |
| target: x86_64-unknown-linux-gnu | |
| manylinux: "2_28" | |
| rust-toolchain: "1.91.1" | |
| before-script-linux: source scripts/maturin-before-script-linux.sh | |
| args: --release --manifest-path asherah-py/Cargo.toml --out dist/ | |
| - name: Verify wheel | |
| run: | | |
| ls dist/*.whl | |
| echo "manylinux x64 wheel succeeded" | |
| publish-dry-run-pypi-manylinux-arm64: | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version: "3.11" | |
| - uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1 | |
| with: | |
| targets: aarch64-unknown-linux-gnu | |
| - name: Build manylinux aarch64 wheel | |
| uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0 | |
| with: | |
| target: aarch64-unknown-linux-gnu | |
| manylinux: "2_28" | |
| rust-toolchain: "1.91.1" | |
| before-script-linux: source scripts/maturin-before-script-linux.sh | |
| args: --release --manifest-path asherah-py/Cargo.toml --out dist/ | |
| - name: Verify wheel | |
| run: | | |
| ls dist/*.whl | |
| echo "manylinux arm64 wheel succeeded" | |
| publish-dry-run-pypi-macos: | |
| runs-on: macos-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version: "3.11" | |
| - uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1 | |
| with: | |
| targets: x86_64-apple-darwin,aarch64-apple-darwin | |
| - name: Build universal2 wheel | |
| uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0 | |
| with: | |
| target: universal2-apple-darwin | |
| args: --release --manifest-path asherah-py/Cargo.toml --out dist/ | |
| - name: Verify wheel | |
| run: | | |
| ls dist/*.whl | |
| echo "macOS universal2 wheel succeeded" | |
| publish-dry-run-pypi-musl-x64: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version: "3.11" | |
| - uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1 | |
| with: | |
| targets: x86_64-unknown-linux-musl | |
| - name: Build musllinux x86_64 wheel | |
| uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0 | |
| with: | |
| target: x86_64-unknown-linux-musl | |
| manylinux: musllinux_1_2 | |
| rust-toolchain: "1.91.1" | |
| before-script-linux: source scripts/maturin-before-script-linux.sh | |
| args: --release --manifest-path asherah-py/Cargo.toml --out dist/ | |
| - name: Verify wheel | |
| run: | | |
| ls dist/*.whl | |
| echo "musllinux x64 wheel succeeded" | |
| publish-dry-run-pypi-musl-arm64: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version: "3.11" | |
| - uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1 | |
| with: | |
| targets: aarch64-unknown-linux-musl | |
| - name: Build musllinux aarch64 wheel | |
| uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0 | |
| with: | |
| target: aarch64-unknown-linux-musl | |
| manylinux: musllinux_1_2 | |
| rust-toolchain: "1.91.1" | |
| before-script-linux: source scripts/maturin-before-script-linux.sh | |
| args: --release --manifest-path asherah-py/Cargo.toml --out dist/ | |
| - name: Verify wheel | |
| run: | | |
| ls dist/*.whl | |
| echo "musllinux arm64 wheel succeeded" | |
| publish-dry-run-npm-musl-arm64: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1 | |
| with: | |
| targets: aarch64-unknown-linux-musl | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 20 | |
| - name: Install Zig (with retries) | |
| # Replaces `mlugg/setup-zig@v2`, which has no internal retry — | |
| # a single transient `fetch failed` blocked PR CI repeatedly. | |
| # `scripts/install-zig.sh` wraps curl with `--retry 10` plus an | |
| # outer 3-attempt loop, and is shared with the publish | |
| # workflows so dry-runs can't drift. | |
| shell: bash | |
| run: bash "$GITHUB_WORKSPACE/scripts/install-zig.sh" | |
| - uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3 | |
| with: | |
| tool: cargo-zigbuild | |
| - name: Build asherah-node for aarch64-musl | |
| working-directory: asherah-node | |
| shell: bash | |
| run: | | |
| set -e | |
| ARCH=aarch64 source "$GITHUB_WORKSPACE/scripts/download-musl-openssl.sh" | |
| rustup target add aarch64-unknown-linux-musl | |
| npm ci | |
| npm run build -- --target aarch64-unknown-linux-musl --zig | |
| ls *.node || { echo "ERROR: No .node file produced"; exit 1; } | |
| publish-dry-run-windows-arm64: | |
| runs-on: windows-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1 | |
| with: | |
| targets: aarch64-pc-windows-msvc | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 20 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version: "3.11" | |
| - name: Install OpenSSL via vcpkg (arm64) | |
| shell: bash | |
| run: | | |
| bash "$GITHUB_WORKSPACE/scripts/vcpkg-install-with-retry.sh" openssl:arm64-windows-static-md | |
| echo "OPENSSL_DIR=C:/vcpkg/installed/arm64-windows-static-md" >> "$GITHUB_ENV" | |
| echo "OPENSSL_STATIC=1" >> "$GITHUB_ENV" | |
| echo "OPENSSL_NO_VENDOR=1" >> "$GITHUB_ENV" | |
| - name: Build asherah-node for Windows arm64 | |
| working-directory: asherah-node | |
| shell: bash | |
| run: | | |
| npm ci | |
| npm run build -- --target aarch64-pc-windows-msvc | |
| ls *.node || { echo "ERROR: No .node file produced"; exit 1; } | |
| - name: Build asherah-py wheel for Windows arm64 | |
| shell: bash | |
| run: | | |
| pip install maturin==1.9.4 | |
| maturin build --release --manifest-path asherah-py/Cargo.toml --target aarch64-pc-windows-msvc --out dist/ | |
| ls dist/*.whl || { echo "ERROR: No wheel produced"; exit 1; } | |
| # Mirrors the musl build path in release-cobhan.yml's `build` matrix. | |
| # Without this dry-run, a regression in the cobhan musl build (which | |
| # produces the libasherah-*-musl.so binaries shipped to GitHub Releases | |
| # and consumed by NuGet, Maven, RubyGems, and Go) would only surface | |
| # at release time. The release workflow already runs `cargo zigbuild | |
| # --release -p asherah-ffi -p asherah-java`; we replicate that exactly | |
| # and then assert that the cdylib outputs actually exist on disk — | |
| # the warning "dropping unsupported crate type cdylib" silently | |
| # produces a successful exit code with no .so file. | |
| publish-dry-run-cobhan-musl-x64: | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1 | |
| with: | |
| targets: x86_64-unknown-linux-musl | |
| - name: Install Zig (with retries) | |
| # Replaces `mlugg/setup-zig@v2`, which has no internal retry — | |
| # a single transient `fetch failed` blocked PR CI repeatedly. | |
| # `scripts/install-zig.sh` wraps curl with `--retry 10` plus an | |
| # outer 3-attempt loop, and is shared with the publish | |
| # workflows so dry-runs can't drift. | |
| shell: bash | |
| run: bash "$GITHUB_WORKSPACE/scripts/install-zig.sh" | |
| - uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3 | |
| with: | |
| tool: cargo-zigbuild | |
| - name: Setup musl OpenSSL | |
| shell: bash | |
| run: | | |
| ARCH=x86_64 source "$GITHUB_WORKSPACE/scripts/download-musl-openssl.sh" | |
| { | |
| echo "OPENSSL_DIR=$OPENSSL_DIR" | |
| echo "OPENSSL_STATIC=$OPENSSL_STATIC" | |
| echo "OPENSSL_NO_VENDOR=$OPENSSL_NO_VENDOR" | |
| } >> "$GITHUB_ENV" | |
| - name: Build asherah-ffi (musl x86_64) | |
| env: | |
| RUSTFLAGS: "-C target-feature=-crt-static" | |
| run: | | |
| cargo zigbuild --release -p asherah-ffi -p asherah-java --target x86_64-unknown-linux-musl | |
| - name: Verify cdylib outputs exist | |
| run: | | |
| set -e | |
| for lib in libasherah_ffi.so libasherah_java.so; do | |
| path="target/x86_64-unknown-linux-musl/release/$lib" | |
| if [ ! -f "$path" ]; then | |
| echo "::error::Missing cdylib $path — Rust likely dropped the cdylib crate type for musl. Ensure RUSTFLAGS includes '-C target-feature=-crt-static'." | |
| exit 1 | |
| fi | |
| echo "OK: $path ($(stat -c%s "$path") bytes)" | |
| done | |
| publish-dry-run-cobhan-musl-arm64: | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1 | |
| with: | |
| targets: aarch64-unknown-linux-musl | |
| - name: Install Zig (with retries) | |
| # Replaces `mlugg/setup-zig@v2`, which has no internal retry — | |
| # a single transient `fetch failed` blocked PR CI repeatedly. | |
| # `scripts/install-zig.sh` wraps curl with `--retry 10` plus an | |
| # outer 3-attempt loop, and is shared with the publish | |
| # workflows so dry-runs can't drift. | |
| shell: bash | |
| run: bash "$GITHUB_WORKSPACE/scripts/install-zig.sh" | |
| - uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3 | |
| with: | |
| tool: cargo-zigbuild | |
| - name: Setup musl OpenSSL | |
| shell: bash | |
| run: | | |
| ARCH=aarch64 source "$GITHUB_WORKSPACE/scripts/download-musl-openssl.sh" | |
| { | |
| echo "OPENSSL_DIR=$OPENSSL_DIR" | |
| echo "OPENSSL_STATIC=$OPENSSL_STATIC" | |
| echo "OPENSSL_NO_VENDOR=$OPENSSL_NO_VENDOR" | |
| } >> "$GITHUB_ENV" | |
| - name: Build asherah-ffi (musl aarch64) | |
| env: | |
| RUSTFLAGS: "-C target-feature=-crt-static" | |
| run: | | |
| cargo zigbuild --release -p asherah-ffi -p asherah-java --target aarch64-unknown-linux-musl | |
| - name: Verify cdylib outputs exist | |
| run: | | |
| set -e | |
| for lib in libasherah_ffi.so libasherah_java.so; do | |
| path="target/aarch64-unknown-linux-musl/release/$lib" | |
| if [ ! -f "$path" ]; then | |
| echo "::error::Missing cdylib $path — Rust likely dropped the cdylib crate type for musl. Ensure RUSTFLAGS includes '-C target-feature=-crt-static'." | |
| exit 1 | |
| fi | |
| echo "OK: $path ($(stat -c%s "$path") bytes)" | |
| done | |
| publish-dry-run-rubygem: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| needs: build-ffi-x86_64 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1.314.0 | |
| with: | |
| ruby-version: '3.3' | |
| - name: Download x86_64 FFI artifact | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: bindings-linux-x86_64-part-ffi | |
| path: artifacts | |
| - name: Build platform gems | |
| working-directory: asherah-ruby | |
| run: | | |
| # Build both glibc + musl variants. Dry-run only has one host | |
| # binary, so the *contents* match the host arch — this verifies | |
| # the gemspec layout for both platforms; publish-rubygems.yml | |
| # ships the right architecture per platform. | |
| for platform in x86_64-linux x86_64-linux-musl; do | |
| rm -rf lib/asherah/native | |
| mkdir -p lib/asherah/native | |
| find ../artifacts -name 'libasherah_ffi.*' -exec cp {} lib/asherah/native/ \; | |
| ls lib/asherah/native/libasherah_ffi.* || { echo "ERROR: No native lib staged"; exit 1; } | |
| ASHERAH_GEM_PLATFORM="$platform" gem build asherah.gemspec && mv *.gem /tmp/ | |
| done | |
| ls /tmp/*.gem | grep -q 'x86_64-linux\.gem' || { echo "ERROR: glibc gem missing"; exit 1; } | |
| ls /tmp/*.gem | grep -q 'x86_64-linux-musl\.gem' || { echo "ERROR: musl gem missing"; exit 1; } | |
| publish-dry-run-php-source: | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: read | |
| needs: build-ffi-x86_64 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1 | |
| with: | |
| targets: x86_64-unknown-linux-musl | |
| - name: Download x86_64 FFI artifact | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: bindings-linux-x86_64-part-ffi | |
| path: ci-artifacts | |
| - name: Normalize FFI artifact permissions | |
| run: chmod +x ci-artifacts/ffi/libasherah_ffi.so | |
| - name: Install Zig (with retries) | |
| shell: bash | |
| run: bash "$GITHUB_WORKSPACE/scripts/install-zig.sh" | |
| - uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3 | |
| with: | |
| tool: cargo-zigbuild | |
| - name: Setup musl OpenSSL | |
| shell: bash | |
| run: | | |
| ARCH=x86_64 source "$GITHUB_WORKSPACE/scripts/download-musl-openssl.sh" | |
| { | |
| echo "OPENSSL_DIR=$OPENSSL_DIR" | |
| echo "OPENSSL_STATIC=$OPENSSL_STATIC" | |
| echo "OPENSSL_NO_VENDOR=$OPENSSL_NO_VENDOR" | |
| } >> "$GITHUB_ENV" | |
| - name: Build PHP test image | |
| run: docker build -t asherah-php-ffi-test -f asherah-php/.Dockerfile.debian asherah-php | |
| - name: Build PHP Alpine test image | |
| run: docker build -t asherah-php-ffi-test-alpine -f asherah-php/.Dockerfile.alpine asherah-php | |
| - name: Build musl FFI for PHP Alpine smoke | |
| env: | |
| RUSTFLAGS: "-C target-feature=-crt-static" | |
| run: cargo zigbuild --release -p asherah-ffi --target x86_64-unknown-linux-musl | |
| - name: Build source-only Composer archive | |
| run: | | |
| docker run --rm -v "$PWD":/work -w /work/asherah-php asherah-php-ffi-test sh -lc ' | |
| set -e | |
| /work/scripts/build-php-source-archive.sh /tmp/asherah-php-dist | |
| test ! -e /work/asherah-php/composer.lock | |
| test ! -d /work/asherah-php/vendor | |
| test ! -d /work/asherah-php/native | |
| ' | |
| - name: Consumer source install smoke | |
| run: | | |
| docker run --rm -v "$PWD":/work -w /work \ | |
| -e ASHERAH_PHP_NATIVE=/work/ci-artifacts/ffi \ | |
| asherah-php-ffi-test sh -lc ' | |
| set -e | |
| rm -rf /tmp/asherah-php-consumer | |
| mkdir /tmp/asherah-php-consumer | |
| cd /tmp/asherah-php-consumer | |
| composer init --name asherah/consumer-smoke --no-interaction >/dev/null | |
| composer config repositories.asherah path /work/asherah-php | |
| composer config minimum-stability dev | |
| composer config prefer-stable true | |
| bash /work/scripts/composer-retry.sh require godaddy/asherah:* --no-interaction --no-progress >/dev/null | |
| php vendor/godaddy/asherah/tests/consumer_smoke.php | |
| ' | |
| - name: Consumer source install smoke (musl) | |
| run: | | |
| docker run --rm -v "$PWD":/work -w /work \ | |
| -e ASHERAH_PHP_NATIVE=/work/target/x86_64-unknown-linux-musl/release \ | |
| asherah-php-ffi-test-alpine sh -lc ' | |
| set -e | |
| rm -rf /tmp/asherah-php-consumer | |
| mkdir /tmp/asherah-php-consumer | |
| cd /tmp/asherah-php-consumer | |
| composer init --name asherah/consumer-smoke --no-interaction >/dev/null | |
| composer config repositories.asherah path /work/asherah-php | |
| composer config minimum-stability dev | |
| composer config prefer-stable true | |
| bash /work/scripts/composer-retry.sh require godaddy/asherah:* --no-interaction --no-progress >/dev/null | |
| php vendor/godaddy/asherah/tests/consumer_smoke.php | |
| ' | |
| publish-dry-run-java-jar: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| needs: build-java-x86_64 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0 | |
| with: | |
| java-version: '11' | |
| distribution: 'temurin' | |
| - name: Download x86_64 Java artifact | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: bindings-linux-x86_64-part-java | |
| path: artifacts | |
| - name: Build JAR with pre-built native lib | |
| run: | | |
| NATIVE_DIR=asherah-java/java/src/main/resources/native | |
| # Stage under both glibc and musl resource paths. Dry-run only has | |
| # the host x86_64 binary; this verifies pom.xml/JAR layout for both | |
| # platforms. publish-maven.yml ships the right architecture per RID. | |
| for rid in linux-x86_64 linux-musl-x86_64; do | |
| mkdir -p "$NATIVE_DIR/$rid" | |
| find artifacts -name 'libasherah_java.*' -exec cp {} "$NATIVE_DIR/$rid/" \; | |
| ls "$NATIVE_DIR/$rid/libasherah_java."* || { echo "ERROR: No JNI lib found for $rid"; exit 1; } | |
| done | |
| mvn -B -f asherah-java/java/pom.xml -Dnative.build.skip=true -DskipTests package | |
| JAR=$(find asherah-java/java/target -name 'appencryption-*.jar' -not -name '*sources*' -not -name '*javadoc*' | head -1) | |
| jar tf "$JAR" | grep "native/.*\\.so$" || { echo "ERROR: No native lib in JAR"; exit 1; } | |
| jar tf "$JAR" | grep -q "native/linux-musl-x86_64/" || { echo "ERROR: musl JNI lib missing from JAR"; exit 1; } |