Skip to content

chore(deps): bump the rust-minor group across 1 directory with 11 updates #1236

chore(deps): bump the rust-minor group across 1 directory with 11 updates

chore(deps): bump the rust-minor group across 1 directory with 11 updates #1236

Workflow file for this run

name: CI
permissions:
contents: read
concurrency:
group: ci-${{ github.ref }}
cancel-in-progress: true
on:
push:
branches: [ main ]
pull_request:
branches: [ main ]
jobs:
lint:
runs-on: ubuntu-latest
permissions:
contents: read
env:
# Same memory-pressure profile as rust-tests: clippy --workspace
# --all-targets compiles every test binary, each statically linking
# the AWS SDK + OpenSSL + Postgres/MySQL/SQLite + aws-lc-rs. Cap
# link concurrency at 2 and disable incremental compilation so the
# 16 GB ubuntu-latest runner does not OOM rust-lld (observed as
# "hosted runner lost communication with the server" after ~50 min).
CARGO_BUILD_JOBS: "2"
CARGO_INCREMENTAL: "0"
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Free disk space
run: bash scripts/ci-free-disk-space.sh
- name: Cache cargo registry
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
with:
path: |
~/.cargo/registry
~/.cargo/git
key: lint-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
restore-keys: |
lint-${{ runner.os }}-
- name: Install Rust
uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1
with:
components: rustfmt, clippy
- name: Install protoc
run: sudo apt-get install -y protobuf-compiler
- name: Lint
run: scripts/test.sh --lint
rust-tests:
runs-on: ubuntu-latest
permissions:
contents: read
env:
RUSTC_WRAPPER: sccache
SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache
SCCACHE_CACHE_SIZE: 2G
# The workspace test binaries each statically embed the full AWS SDK,
# OpenSSL, Postgres/MySQL/SQLite drivers, and aws-lc-rs. In debug mode
# one link peaks at ~3-5 GB resident; cargo's default -j4 on a 16 GB
# Ubuntu runner has been observed to OOM the rust-lld parallel-link
# path with SIGBUS in llvm::parallelFor during link of memguard /
# async_metastore_trait / config_env_tests test binaries. Cap link
# concurrency at 2 and disable incremental compilation (matching the
# other Rust build jobs in this workflow) so we stay well under the
# cliff.
CARGO_BUILD_JOBS: "2"
CARGO_INCREMENTAL: "0"
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Free disk space
run: bash scripts/ci-free-disk-space.sh
- name: Restore workspace caches
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
with:
path: |
~/.cargo/registry
~/.cargo/git
.cache/sccache
key: rust-tests-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
restore-keys: |
rust-tests-${{ runner.os }}-
- name: Install Rust
uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1
- uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3
with:
tool: sccache@0.8.1
- name: Install protoc
run: sudo apt-get install -y protobuf-compiler
- name: Unit tests
run: scripts/test.sh --unit
# The default AEAD backend (hardware-crypto / hardware-rust-crypto) is
# exercised by the rust-tests and integration-tests jobs above. This job
# keeps the opt-in `ring-crypto` backend green: it must build clean, pass
# clippy with -D warnings, and decrypt the same NIST/cross-language
# envelopes as the hardware backend (proving wire compatibility).
aead-ring-backend:
runs-on: ubuntu-latest
permissions:
contents: read
env:
CARGO_BUILD_JOBS: "2"
CARGO_INCREMENTAL: "0"
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Free disk space
run: bash scripts/ci-free-disk-space.sh
- name: Cache cargo registry
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
with:
path: |
~/.cargo/registry
~/.cargo/git
key: aead-ring-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
restore-keys: |
aead-ring-${{ runner.os }}-
- name: Install Rust
uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1
with:
components: clippy
- name: Install protoc
run: sudo apt-get install -y protobuf-compiler
- name: Clippy (ring-crypto backend)
run: cargo clippy -p asherah --no-default-features --features ring-crypto --all-targets -- -D warnings
- name: Unit tests (ring-crypto backend)
run: cargo test -p asherah --no-default-features --features ring-crypto
integration-tests:
runs-on: ubuntu-latest
permissions:
contents: read
env:
# Same memory-pressure profile as rust-tests; integration tests
# link the same fat test binaries.
CARGO_BUILD_JOBS: "2"
CARGO_INCREMENTAL: "0"
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Free disk space
run: bash scripts/ci-free-disk-space.sh
- name: Cache cargo registry
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
with:
path: |
~/.cargo/registry
~/.cargo/git
key: integration-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
restore-keys: |
integration-${{ runner.os }}-
- name: Install Rust
uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1
- name: Verify Docker availability
run: docker version
- name: Integration tests
run: scripts/test.sh --integration
build-rlib-x86_64:
permissions:
contents: read
runs-on: ubuntu-22.04
env:
CARGO_HOME: ${{ github.workspace }}/.cache/cargo
RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup
CARGO_INCREMENTAL: 0
RUSTC_WRAPPER: sccache
SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache
SCCACHE_CACHE_SIZE: 2G
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Restore workspace caches
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
with:
path: |
.cache/cargo
.cache/rustup
.cache/sccache
key: build-${{ runner.os }}-x86_64-rlib-${{ hashFiles('**/Cargo.lock') }}
restore-keys: |
build-${{ runner.os }}-x86_64-rlib-
- uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3
with:
tool: sccache@0.8.1
- name: Build FFI rlib (x86_64)
env:
TARGET_ARCH: x86_64
BINDING_COMPONENTS: ffi
run: ./scripts/build-bindings.sh
- name: Create rlib tarball
run: |
TAR_ARGS=()
for p in \
target/x86_64-unknown-linux-gnu/release \
target/x86_64-unknown-linux-gnu/x86_64-unknown-linux-gnu/release \
; do
[ -d "$p" ] && TAR_ARGS+=("$p")
done
for f in target/release/libasherah_ffi*; do
[ -e "$f" ] && TAR_ARGS+=("$f")
done
tar czf /tmp/x86_64-rlib.tar.gz "${TAR_ARGS[@]}"
- name: Upload x86_64 rlib artifacts
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: x86_64-rlib-artifacts
retention-days: 1
path: /tmp/x86_64-rlib.tar.gz
build-node-x86_64:
permissions:
contents: read
runs-on: ubuntu-22.04
needs: build-rlib-x86_64
env:
CARGO_HOME: ${{ github.workspace }}/.cache/cargo
RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup
NPM_CONFIG_CACHE: ${{ github.workspace }}/.cache/npm
CARGO_INCREMENTAL: 0
RUSTC_WRAPPER: sccache
SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache
SCCACHE_CACHE_SIZE: 2G
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Restore workspace caches
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
with:
path: |
.cache/cargo
.cache/rustup
.cache/npm
.cache/sccache
key: build-${{ runner.os }}-x86_64-node-${{ hashFiles('**/Cargo.lock', 'asherah-node/package-lock.json') }}
restore-keys: |
build-${{ runner.os }}-x86_64-node-
- name: Download x86_64 rlib artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: x86_64-rlib-artifacts
path: /tmp
- name: Extract rlib artifacts
run: tar xzf /tmp/x86_64-rlib.tar.gz
- uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3
with:
tool: sccache@0.8.1
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 20
- name: Build Node.js binding (x86_64)
env:
TARGET_ARCH: x86_64
BINDING_COMPONENTS: node
SKIP_CORE_BUILD: "1"
run: ./scripts/build-bindings.sh
- name: Upload x86_64 node binding artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: bindings-linux-x86_64-part-node
retention-days: 1
path: artifacts/x86_64
build-python-x86_64:
permissions:
contents: read
runs-on: ubuntu-22.04
needs: build-rlib-x86_64
container: quay.io/pypa/manylinux_2_28_x86_64
env:
CARGO_HOME: ${{ github.workspace }}/.cache/cargo
RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup
PIP_CACHE_DIR: ${{ github.workspace }}/.cache/pip
CARGO_INCREMENTAL: 0
RUSTC_WRAPPER: sccache
SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache
SCCACHE_CACHE_SIZE: 2G
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Restore workspace caches
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
with:
path: |
.cache/cargo
.cache/rustup
.cache/pip
.cache/sccache
key: build-${{ runner.os }}-x86_64-python-${{ hashFiles('Cargo.lock', 'asherah-py/Cargo.toml') }}
restore-keys: |
build-${{ runner.os }}-x86_64-python-
- name: Download x86_64 rlib artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: x86_64-rlib-artifacts
path: /tmp
- name: Extract rlib artifacts
run: tar xzf /tmp/x86_64-rlib.tar.gz
- name: Build Python binding (x86_64) - manylinux
run: |
yum install -y openssl-devel pkgconfig 2>/dev/null || true
export HOME=/root
export OPENSSL_NO_VENDOR=1
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain none
export PATH="$CARGO_HOME/bin:$PATH"
rustup toolchain install 1.91.1 --profile minimal --component rustfmt
bash "${GITHUB_WORKSPACE:-$(pwd)}/scripts/install-sccache.sh"
python3.11 -m pip install maturin==1.9.4
rm -rf artifacts/x86_64/python || true
mkdir -p artifacts/x86_64/python
python3.11 -m maturin build --release --manifest-path asherah-py/Cargo.toml --compatibility manylinux_2_28 -i python3.11 --out artifacts/x86_64/python
- name: Upload x86_64 python binding artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: bindings-linux-x86_64-part-python
retention-days: 1
path: artifacts/x86_64
build-java-x86_64:
permissions:
contents: read
runs-on: ubuntu-22.04
needs: build-rlib-x86_64
env:
CARGO_HOME: ${{ github.workspace }}/.cache/cargo
RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup
CARGO_INCREMENTAL: 0
RUSTC_WRAPPER: sccache
SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache
SCCACHE_CACHE_SIZE: 2G
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Restore workspace caches
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
with:
path: |
.cache/cargo
.cache/rustup
.cache/maven
.cache/sccache
key: build-${{ runner.os }}-x86_64-java-${{ hashFiles('**/Cargo.lock', 'asherah-java/java/pom.xml') }}
restore-keys: |
build-${{ runner.os }}-x86_64-java-
- name: Download x86_64 rlib artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: x86_64-rlib-artifacts
path: /tmp
- name: Extract rlib artifacts
run: tar xzf /tmp/x86_64-rlib.tar.gz
- uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3
with:
tool: sccache@0.8.1
- name: Build Java binding (x86_64)
env:
TARGET_ARCH: x86_64
BINDING_COMPONENTS: java
SKIP_CORE_BUILD: "1"
run: ./scripts/build-bindings.sh
- name: Upload x86_64 java artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: bindings-linux-x86_64-part-java
retention-days: 1
path: artifacts/x86_64
build-dotnet-x86_64:
permissions:
contents: read
runs-on: ubuntu-22.04
needs: build-rlib-x86_64
env:
CARGO_HOME: ${{ github.workspace }}/.cache/cargo
RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup
CARGO_INCREMENTAL: 0
RUSTC_WRAPPER: sccache
SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache
SCCACHE_CACHE_SIZE: 2G
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Restore workspace caches
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
with:
path: |
.cache/cargo
.cache/rustup
.cache/dotnet
.cache/sccache
key: build-${{ runner.os }}-x86_64-dotnet-${{ hashFiles('**/Cargo.lock', 'asherah-dotnet/**/*.csproj', 'asherah-dotnet/Directory.Packages.props', 'asherah-dotnet/**/packages.lock.json') }}
restore-keys: |
build-${{ runner.os }}-x86_64-dotnet-
- name: Download x86_64 rlib artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: x86_64-rlib-artifacts
path: /tmp
- name: Extract rlib artifacts
run: tar xzf /tmp/x86_64-rlib.tar.gz
- uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3
with:
tool: sccache@0.8.1
- uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
with:
dotnet-version: |
8.0.x
10.0.x
- name: Build .NET binding (x86_64)
env:
TARGET_ARCH: x86_64
BINDING_COMPONENTS: dotnet
SKIP_CORE_BUILD: "1"
run: ./scripts/build-bindings.sh
- name: Upload x86_64 dotnet artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: bindings-linux-x86_64-part-dotnet
retention-days: 1
path: artifacts/x86_64
publish-dry-run-nuget:
runs-on: ubuntu-22.04
needs: build-rlib-x86_64
permissions:
contents: read
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
with:
dotnet-version: |
8.0.x
10.0.x
- name: Download rlib artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: x86_64-rlib-artifacts
path: /tmp
- name: Extract rlib and build FFI lib
run: |
tar xzf /tmp/x86_64-rlib.tar.gz
cargo build -p asherah-ffi --release
- name: Pack both NuGet packages
working-directory: asherah-dotnet
run: |
# Stage the FFI lib under every Linux + macOS RID the publish workflow
# ships. We only have one host binary in dry-run, so the *contents*
# are all the host x64 build — this verifies layout, not arch correctness.
# publish-nuget.yml ships the right architecture per RID.
NATIVE_DIR=src/GoDaddy.Asherah.Encryption/runtimes
for rid in linux-x64 linux-arm64 linux-musl-x64 linux-musl-arm64; do
mkdir -p "$NATIVE_DIR/$rid/native"
cp ../target/release/libasherah_ffi.so "$NATIVE_DIR/$rid/native/"
done
for rid in osx-x64 osx-arm64; do
mkdir -p "$NATIVE_DIR/$rid/native"
cp ../target/release/libasherah_ffi.so "$NATIVE_DIR/$rid/native/libasherah_ffi.dylib"
done
dotnet pack src/GoDaddy.Asherah.Encryption/GoDaddy.Asherah.Encryption.csproj -c Release \
/p:Version="0.0.0-dryrun" \
/p:PackageOutputPath="$GITHUB_WORKSPACE/dist" \
/p:RestoreLockedMode=true
dotnet pack src/GoDaddy.Asherah.Encryption.Compat/GoDaddy.Asherah.Encryption.Compat.csproj -c Release \
/p:Version="0.0.0-dryrun" \
/p:PackageOutputPath="$GITHUB_WORKSPACE/dist" \
/p:RestoreLockedMode=true
- name: Verify packages
run: |
echo "=== Packed packages ==="
ls -lh dist/
for pkg in dist/*.nupkg; do
echo "--- $pkg ---"
if echo "$pkg" | grep -q "Compat"; then
echo " Compat package — no native libraries expected"
continue
fi
unzip -l "$pkg" | grep -E 'native|runtimes' | sort
for required in linux-x64 linux-arm64 linux-musl-x64 linux-musl-arm64 osx-x64 osx-arm64; do
if ! unzip -l "$pkg" | grep -q "runtimes/${required}/native/"; then
echo "ERROR: Core package missing required native library for ${required}"
exit 1
fi
done
done
echo "NuGet dry-run passed ($(ls dist/*.nupkg | wc -l) packages)"
build-ffi-x86_64:
permissions:
contents: read
runs-on: ubuntu-22.04
needs: build-rlib-x86_64
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Download x86_64 rlib artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: x86_64-rlib-artifacts
path: /tmp
- name: Extract rlib artifacts
run: tar xzf /tmp/x86_64-rlib.tar.gz
- name: Package FFI artifacts (x86_64)
run: |
mkdir -p artifacts/x86_64/ffi artifacts/x86_64/ruby
find target/release -name 'libasherah_ffi.*' -type f ! -name '*.d' -exec cp {} artifacts/x86_64/ffi/ \;
find target/release -name 'libasherah_ffi.*' -type f ! -name '*.d' -exec cp {} artifacts/x86_64/ruby/ \;
- name: Upload x86_64 ffi artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: bindings-linux-x86_64-part-ffi
retention-days: 1
path: artifacts/x86_64
build-cobhan-x86_64:
permissions:
contents: read
runs-on: ubuntu-22.04
needs: build-rlib-x86_64
env:
CARGO_HOME: ${{ github.workspace }}/.cache/cargo
RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup
CARGO_INCREMENTAL: 0
RUSTC_WRAPPER: sccache
SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache
SCCACHE_CACHE_SIZE: 2G
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Restore workspace caches
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
with:
path: |
.cache/cargo
.cache/rustup
.cache/sccache
key: build-${{ runner.os }}-x86_64-cobhan-${{ hashFiles('**/Cargo.lock') }}
restore-keys: |
build-${{ runner.os }}-x86_64-cobhan-
- name: Download x86_64 rlib artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: x86_64-rlib-artifacts
path: /tmp
- name: Extract rlib artifacts
run: tar xzf /tmp/x86_64-rlib.tar.gz
- uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3
with:
tool: sccache@0.8.1
- name: Build asherah-cobhan (x86_64)
env:
TARGET_ARCH: x86_64
BINDING_COMPONENTS: cobhan
SKIP_CORE_BUILD: "1"
run: ./scripts/build-bindings.sh
- name: Upload x86_64 cobhan artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: bindings-linux-x86_64-part-cobhan
retention-days: 1
path: artifacts/x86_64
# --- macOS x86_64 cross-compile from ARM64 ---
build-ffi-macos-x64:
runs-on: macos-latest
permissions:
contents: read
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1
with:
targets: x86_64-apple-darwin,aarch64-apple-darwin
- name: Build FFI for macOS x86_64 + arm64
run: |
cargo build --release -p asherah-ffi -p asherah-java --target x86_64-apple-darwin
cargo build --release -p asherah-ffi -p asherah-java --target aarch64-apple-darwin
- name: Verify x86_64 binary architecture
run: file target/x86_64-apple-darwin/release/libasherah_ffi.dylib | grep -q "x86_64"
- name: Upload macOS artifacts
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: ffi-macos
retention-days: 1
path: |
target/x86_64-apple-darwin/release/libasherah_ffi.dylib
target/x86_64-apple-darwin/release/libasherah_java.dylib
target/aarch64-apple-darwin/release/libasherah_ffi.dylib
target/aarch64-apple-darwin/release/libasherah_java.dylib
# --- Windows x86_64 ---
build-ffi-windows-x64:
runs-on: windows-latest
permissions:
contents: read
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1
- name: Install OpenSSL via vcpkg
shell: bash
run: |
bash "$GITHUB_WORKSPACE/scripts/vcpkg-install-with-retry.sh" openssl:x64-windows-static-md
echo "OPENSSL_DIR=C:/vcpkg/installed/x64-windows-static-md" >> "$GITHUB_ENV"
echo "OPENSSL_STATIC=1" >> "$GITHUB_ENV"
echo "OPENSSL_NO_VENDOR=1" >> "$GITHUB_ENV"
- name: Build FFI for Windows x86_64
shell: bash
run: cargo build --release -p asherah-ffi -p asherah-java --target x86_64-pc-windows-msvc
- name: Upload Windows artifacts
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: ffi-windows-x64
retention-days: 1
path: |
target/x86_64-pc-windows-msvc/release/asherah_ffi.dll
target/x86_64-pc-windows-msvc/release/asherah_java.dll
package-x86_64:
permissions:
contents: read
if: github.event_name == 'push'
runs-on: ubuntu-latest
needs: [build-ffi-x86_64, build-cobhan-x86_64, build-node-x86_64, build-python-x86_64, build-dotnet-x86_64, build-java-x86_64]
steps:
- name: Download all x86_64 artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
pattern: bindings-linux-x86_64-part-*
path: artifacts-staging
merge-multiple: true
- name: Consolidate artifacts
run: |
mkdir -p artifacts/x86_64
cp -r artifacts-staging/* artifacts/x86_64/
- name: Upload consolidated x86_64 artifacts
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: bindings-linux-x86_64
retention-days: 1
path: artifacts/x86_64
arm64-test-image:
permissions:
contents: read
runs-on: ubuntu-latest
env:
CACHE_MAX_AGE_DAYS: 7
outputs:
cache-hit: ${{ steps.check-cache.outputs.cache-hit }}
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Calculate cache key
id: cache-key
run: |
DOCKERFILE_HASH=$(sha256sum docker/tests.Dockerfile | cut -d' ' -f1 | head -c 8)
# Get week number to force rebuild every N days
WEEK_NUM=$(( $(date +%s) / 86400 / ${{ env.CACHE_MAX_AGE_DAYS }} ))
CACHE_KEY="arm64-test-image-${DOCKERFILE_HASH}-week-${WEEK_NUM}"
echo "cache-key=${CACHE_KEY}" >> $GITHUB_OUTPUT
echo "Cache key: ${CACHE_KEY}"
- name: Check for cached image
id: check-cache
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
with:
path: /tmp/asherah-tests-arm64.tar
key: ${{ steps.cache-key.outputs.cache-key }}
lookup-only: true
- name: Set up QEMU
if: steps.check-cache.outputs.cache-hit != 'true'
uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
with:
platforms: linux/arm64
- name: Set up Docker Buildx
if: steps.check-cache.outputs.cache-hit != 'true'
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
- name: Build arm64 test image
if: steps.check-cache.outputs.cache-hit != 'true'
run: |
docker buildx build \
--file docker/tests.Dockerfile \
--platform linux/arm64 \
--tag asherah-tests:arm64 \
--cache-from type=gha,scope=tests-arm64-image \
--cache-to type=gha,mode=max,scope=tests-arm64-image \
--output type=docker,dest=/tmp/asherah-tests-arm64.tar \
.
- name: Restore cached image
if: steps.check-cache.outputs.cache-hit == 'true'
uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
with:
path: /tmp/asherah-tests-arm64.tar
key: ${{ steps.cache-key.outputs.cache-key }}
- name: Save image to cache
if: steps.check-cache.outputs.cache-hit != 'true'
uses: actions/cache/save@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
with:
path: /tmp/asherah-tests-arm64.tar
key: ${{ steps.cache-key.outputs.cache-key }}
- name: Upload arm64 test image
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: arm64-tests-image
retention-days: 1
path: /tmp/asherah-tests-arm64.tar
binding-tests-x86_64:
permissions:
contents: read
runs-on: ubuntu-22.04
needs:
- build-ffi-x86_64
- build-node-x86_64
- build-python-x86_64
- build-java-x86_64
- build-dotnet-x86_64
strategy:
fail-fast: true
matrix:
binding: [python, node, bun, ruby, go, java, dotnet, php]
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Download all x86_64 binding artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
pattern: bindings-linux-x86_64-part-*
path: ${{ github.workspace }}/ci-artifacts
merge-multiple: true
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
if: matrix.binding == 'node' || matrix.binding == 'bun'
with:
node-version: 20
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
if: matrix.binding == 'bun'
with:
bun-version: 1.3.14
- uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
if: matrix.binding == 'dotnet'
with:
dotnet-version: |
8.0.x
10.0.x
- uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
if: matrix.binding == 'go'
with:
go-version: '1.23'
cache-dependency-path: asherah-go/go.sum
- uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1.314.0
if: matrix.binding == 'ruby'
with:
ruby-version: '3.3'
bundler-cache: true
working-directory: asherah-ruby
- name: Run ${{ matrix.binding }} binding tests (x86_64)
env:
BINDING_ARTIFACTS_DIR: ${{ github.workspace }}/ci-artifacts
run: scripts/test.sh --bindings --binding=${{ matrix.binding }}
php-binding-supported-minors:
permissions:
contents: read
runs-on: ubuntu-22.04
needs: build-ffi-x86_64
strategy:
fail-fast: false
matrix:
php-image:
- php:8.1-cli
- php:8.2-cli
- php:8.3-cli
- php:8.4-cli
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Download x86_64 FFI artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: bindings-linux-x86_64-part-ffi
path: ${{ github.workspace }}/ci-artifacts
- name: Run PHP binding tests on ${{ matrix.php-image }}
env:
BINDING_ARTIFACTS_DIR: ${{ github.workspace }}/ci-artifacts
PHP_IMAGE_TAG: ${{ matrix.php-image }}
run: scripts/test.sh --bindings --binding=php
interop-tests:
runs-on: ubuntu-22.04
needs: build-rlib-x86_64
permissions:
contents: read
env:
RUSTC_WRAPPER: sccache
SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache
SCCACHE_CACHE_SIZE: 2G
# Match rust-tests: cap link concurrency on the 16 GB runner.
CARGO_BUILD_JOBS: "2"
CARGO_INCREMENTAL: "0"
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Free disk space
run: bash scripts/ci-free-disk-space.sh
- name: Restore workspace caches
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
with:
path: |
~/.cargo/registry
~/.cargo/git
.cache/sccache
key: interop-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
restore-keys: |
interop-${{ runner.os }}-
- name: Install Rust
uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1
with:
components: rustfmt
- uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3
with:
tool: sccache@0.8.1
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 20
- uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
with:
# canonical com.godaddy.asherah:appencryption@0.4.0 is compiled
# with JDK 17 (class file 61.0). The canonical-java probe under
# interop/canonical-java requires JDK 17+ to build.
java-version: '17'
distribution: 'temurin'
- name: Download x86_64 rlib artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: x86_64-rlib-artifacts
path: /tmp
- name: Extract rlib artifacts
run: tar xzf /tmp/x86_64-rlib.tar.gz
- name: Install dependencies
run: |
sudo gem install ffi --no-document
pip3 install pytest pytest-asyncio maturin
cd asherah-node && npm install
- name: Interop tests
run: scripts/test.sh --interop
tests-arm64:
permissions:
contents: read
runs-on: ubuntu-latest
needs:
- build-ffi-arm64
- build-node-arm64
- build-python-arm64
- build-java-arm64
- build-dotnet-arm64
- arm64-test-image
strategy:
fail-fast: true
matrix:
binding: [python, node, bun, ruby, go, java, dotnet]
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Restore workspace caches
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
with:
path: |
.cache/cargo
.cache/rustup
.cache/pip
.cache/npm
.cache/maven
.cache/dotnet
key: tests-${{ runner.os }}-arm64-${{ matrix.binding }}-${{ hashFiles('**/Cargo.lock', 'asherah-node/package-lock.json', 'asherah-py/Cargo.toml', 'asherah-py/pyproject.toml', 'asherah-java/java/pom.xml', 'asherah-dotnet/**/*.csproj', 'asherah-dotnet/Directory.Packages.props', 'asherah-dotnet/**/packages.lock.json') }}
restore-keys: |
tests-${{ runner.os }}-arm64-${{ matrix.binding }}-
tests-${{ runner.os }}-arm64-
- name: Download all arm64 binding artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
pattern: bindings-linux-aarch64-part-*
path: ${{ github.workspace }}/artifacts/aarch64
merge-multiple: true
- name: Download arm64 test image
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: arm64-tests-image
path: artifacts
- name: Set up QEMU
uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
with:
platforms: linux/arm64
- name: Load arm64 test image
run: docker load --input artifacts/asherah-tests-arm64.tar
- name: Run ${{ matrix.binding }} binding tests (Arm64)
env:
DOCKER_PLATFORM: linux/arm64
BINDING_ARTIFACTS_DIR: ${{ github.workspace }}/artifacts/aarch64
BINDING_TESTS_BINDING: ${{ matrix.binding }}
USE_PREBUILT_TEST_IMAGE: "1"
TESTS_IMAGE_TAG: asherah-tests:arm64
run: ./scripts/test-in-docker.sh
sanitizers:
runs-on: ubuntu-latest
needs: build-rlib-x86_64
permissions:
contents: read
# Runs on every PR to main (gating), on main pushes, on schedule, and on any
# push whose commit message contains [sanitize]. PR gating was enabled once
# the release cadence slowed enough that the added PR latency is worth more
# than fast PRs for catching sanitizer regressions before merge.
if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event_name == 'schedule' || contains(github.event.head_commit.message, '[sanitize]')
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Cache cargo registry
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
with:
path: |
~/.cargo/registry
~/.cargo/git
key: sanitizers-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
restore-keys: |
sanitizers-${{ runner.os }}-
- name: Install Rust
uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1
- name: Install dependencies
run: |
echo 'Acquire::Retries "3";' | sudo tee /etc/apt/apt.conf.d/80-retries
sudo apt-get update
sudo apt-get install -y clang llvm valgrind protobuf-compiler
- name: Sanitizer tests
run: scripts/test.sh --sanitizers --platform=x64
build-rlib-arm64:
permissions:
contents: read
runs-on: ubuntu-latest
container: rust:1.91-bookworm
env:
CARGO_HOME: ${{ github.workspace }}/.cache/cargo
RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup
CARGO_TARGET_DIR: ${{ github.workspace }}/target
CARGO_INCREMENTAL: 0
RUSTC_WRAPPER: sccache
SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache
SCCACHE_CACHE_SIZE: 2G
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Restore workspace caches
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
with:
path: |
.cache/cargo
.cache/rustup
.cache/sccache
key: build-${{ runner.os }}-arm64-rlib-${{ hashFiles('**/Cargo.lock') }}
restore-keys: |
build-${{ runner.os }}-arm64-rlib-
- name: Install cross-compile toolchain and sccache
run: |
echo 'Acquire::Retries "3";' > /etc/apt/apt.conf.d/80-retries
apt-get update
apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu curl
bash "${GITHUB_WORKSPACE:-$(pwd)}/scripts/install-sccache.sh"
- name: Build FFI rlib (arm64)
env:
CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
CXX_aarch64_unknown_linux_gnu: aarch64-linux-gnu-g++
AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar
CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
PKG_CONFIG_ALLOW_CROSS: 1
TARGET_ARCH: aarch64
BINDING_COMPONENTS: ffi
run: |
rustup target add aarch64-unknown-linux-gnu
# Build core rlibs first for dependency reuse
cargo build --release -p asherah --features sqlite --target aarch64-unknown-linux-gnu
cargo build --release -p asherah-config --target aarch64-unknown-linux-gnu
# Build FFI cdylib for other bindings
./scripts/build-bindings.sh
- name: Create rlib tarball
shell: bash
run: |
TAR_ARGS=()
for p in \
target/aarch64-unknown-linux-gnu/release \
target/aarch64-unknown-linux-gnu/aarch64-unknown-linux-gnu/release \
; do
[ -d "$p" ] && TAR_ARGS+=("$p")
done
for f in target/release/libasherah_ffi*; do
[ -e "$f" ] && TAR_ARGS+=("$f")
done
tar czf /tmp/arm64-rlib.tar.gz "${TAR_ARGS[@]}"
- name: Upload arm64 rlib artifacts
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: arm64-rlib-artifacts
retention-days: 1
path: /tmp/arm64-rlib.tar.gz
build-node-arm64:
permissions:
contents: read
runs-on: ubuntu-latest
needs: build-rlib-arm64
container: rust:1.91-bookworm
env:
CARGO_HOME: ${{ github.workspace }}/.cache/cargo
RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup
NPM_CONFIG_CACHE: ${{ github.workspace }}/.cache/npm
CARGO_TARGET_DIR: ${{ github.workspace }}/target
CARGO_INCREMENTAL: 0
RUSTC_WRAPPER: sccache
SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache
SCCACHE_CACHE_SIZE: 2G
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Restore workspace caches
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
with:
path: |
.cache/cargo
.cache/rustup
.cache/npm
.cache/sccache
key: build-${{ runner.os }}-arm64-node-${{ hashFiles('**/Cargo.lock', 'asherah-node/package-lock.json') }}
restore-keys: |
build-${{ runner.os }}-arm64-node-
- name: Download arm64 rlib artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: arm64-rlib-artifacts
path: /tmp
- name: Extract rlib artifacts
run: tar xzf /tmp/arm64-rlib.tar.gz
- name: Install cross-compile toolchain, Node.js, and sccache
run: |
echo 'Acquire::Retries "3";' > /etc/apt/apt.conf.d/80-retries
apt-get update
apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu curl
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
apt-get install -y nodejs
bash "${GITHUB_WORKSPACE:-$(pwd)}/scripts/install-sccache.sh"
- name: Build Node.js binding (arm64)
env:
CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
CXX_aarch64_unknown_linux_gnu: aarch64-linux-gnu-g++
AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar
CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
PKG_CONFIG_ALLOW_CROSS: 1
TARGET_ARCH: aarch64
BINDING_COMPONENTS: node
SKIP_CORE_BUILD: "1"
run: |
rustup target add aarch64-unknown-linux-gnu
rustup default 1.91.1
./scripts/build-bindings.sh
- name: Upload arm64 node binding artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: bindings-linux-aarch64-part-node
retention-days: 1
path: artifacts/aarch64
build-python-arm64:
permissions:
contents: read
runs-on: ubuntu-latest
needs: build-rlib-arm64
container: rust:1.91-bookworm
env:
CARGO_HOME: ${{ github.workspace }}/.cache/cargo
RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup
PIP_CACHE_DIR: ${{ github.workspace }}/.cache/pip
CARGO_TARGET_DIR: ${{ github.workspace }}/target
CARGO_INCREMENTAL: 0
RUSTC_WRAPPER: sccache
SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache
SCCACHE_CACHE_SIZE: 2G
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Restore workspace caches
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
with:
path: |
.cache/cargo
.cache/rustup
.cache/pip
.cache/sccache
key: build-${{ runner.os }}-arm64-python-${{ hashFiles('Cargo.lock', 'asherah-py/Cargo.toml') }}
restore-keys: |
build-${{ runner.os }}-arm64-python-
- name: Download arm64 rlib artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: arm64-rlib-artifacts
path: /tmp
- name: Extract rlib artifacts
run: tar xzf /tmp/arm64-rlib.tar.gz
- name: Install cross-compile toolchain, Python, and sccache
run: |
echo 'Acquire::Retries "3";' > /etc/apt/apt.conf.d/80-retries
apt-get update
# Note: NO `libssl-dev` here — for cross-compile to glibc
# aarch64 we let `openssl-sys` vendor OpenSSL from source.
# Per CLAUDE.md ("Cross-compile glibc: let openssl-sys vendor
# from source"), installing the host's `libssl-dev` and
# relying on `PKG_CONFIG_ALLOW_CROSS=1` would link against
# x86_64 headers/libs which don't match the aarch64 target.
apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu python3 python3-pip python3-venv curl pkg-config
# Probe for `--break-system-packages` support (Bookworm and
# later) instead of hardcoding it; older python3-pip versions
# don't accept the flag and would fail. CLAUDE.md hard rule.
PIP_BSP=""
python3 -m pip install --break-system-packages --help &>/dev/null && PIP_BSP="--break-system-packages"
pip3 install $PIP_BSP maturin==1.9.4
bash "${GITHUB_WORKSPACE:-$(pwd)}/scripts/install-sccache.sh"
- name: Build Python binding (arm64)
env:
CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
CXX_aarch64_unknown_linux_gnu: aarch64-linux-gnu-g++
AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar
CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
PKG_CONFIG_ALLOW_CROSS: 1
TARGET_ARCH: aarch64
CARGO_LOG: cargo::core::compiler::fingerprint=info
run: |
rustup toolchain install 1.91.1 --profile minimal --component rustfmt
rustup default 1.91.1
rustup target add aarch64-unknown-linux-gnu
rm -rf artifacts/aarch64/python || true
mkdir -p artifacts/aarch64/python
maturin build --release --target aarch64-unknown-linux-gnu --manifest-path asherah-py/Cargo.toml --skip-auditwheel --out artifacts/aarch64/python 2>&1 | tee /tmp/maturin-build.log
echo "=== Checking for 'Fresh' vs 'Compiling' for asherah ==="
grep -E "(Fresh|Compiling) (asherah|tokio|aws)" /tmp/maturin-build.log || true
- name: Upload arm64 python binding artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: bindings-linux-aarch64-part-python
retention-days: 1
path: artifacts/aarch64
build-java-arm64:
permissions:
contents: read
runs-on: ubuntu-latest
needs: build-rlib-arm64
container: rust:1.91-bookworm
env:
CARGO_HOME: ${{ github.workspace }}/.cache/cargo
RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup
CARGO_TARGET_DIR: ${{ github.workspace }}/target
CARGO_INCREMENTAL: 0
RUSTC_WRAPPER: sccache
SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache
SCCACHE_CACHE_SIZE: 2G
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Restore workspace caches
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
with:
path: |
.cache/cargo
.cache/rustup
.cache/maven
.cache/sccache
key: build-${{ runner.os }}-arm64-java-${{ hashFiles('**/Cargo.lock', 'asherah-java/java/pom.xml') }}
restore-keys: |
build-${{ runner.os }}-arm64-java-
- name: Download arm64 rlib artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: arm64-rlib-artifacts
path: /tmp
- name: Extract rlib artifacts
run: tar xzf /tmp/arm64-rlib.tar.gz
- name: Install cross-compile toolchain, Maven, and sccache
run: |
echo 'Acquire::Retries "3";' > /etc/apt/apt.conf.d/80-retries
apt-get update
apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu maven curl
bash "${GITHUB_WORKSPACE:-$(pwd)}/scripts/install-sccache.sh"
- name: Build Java binding (arm64)
env:
CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
CXX_aarch64_unknown_linux_gnu: aarch64-linux-gnu-g++
AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar
CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
TARGET_ARCH: aarch64
BINDING_COMPONENTS: java
SKIP_CORE_BUILD: "1"
run: |
rustup target add aarch64-unknown-linux-gnu
rustup default 1.91.1
./scripts/build-bindings.sh
- name: Upload Java binding artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: bindings-linux-aarch64-part-java
retention-days: 1
path: artifacts/aarch64
build-dotnet-arm64:
permissions:
contents: read
runs-on: ubuntu-latest
needs: build-rlib-arm64
container: rust:1.91-bookworm
env:
CARGO_HOME: ${{ github.workspace }}/.cache/cargo
RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup
CARGO_TARGET_DIR: ${{ github.workspace }}/target
CARGO_INCREMENTAL: 0
RUSTC_WRAPPER: sccache
SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache
SCCACHE_CACHE_SIZE: 2G
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Restore workspace caches
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
with:
path: |
.cache/cargo
.cache/rustup
.cache/dotnet
.cache/sccache
key: build-${{ runner.os }}-arm64-dotnet-${{ hashFiles('**/Cargo.lock', 'asherah-dotnet/**/*.csproj', 'asherah-dotnet/Directory.Packages.props', 'asherah-dotnet/**/packages.lock.json') }}
restore-keys: |
build-${{ runner.os }}-arm64-dotnet-
- name: Download arm64 rlib artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: arm64-rlib-artifacts
path: /tmp
- name: Extract rlib artifacts
run: tar xzf /tmp/arm64-rlib.tar.gz
- name: Install cross-compile toolchain, .NET, and sccache
run: |
echo 'Acquire::Retries "3";' > /etc/apt/apt.conf.d/80-retries
apt-get update
apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu wget curl
wget https://dot.net/v1/dotnet-install.sh -O dotnet-install.sh
chmod +x dotnet-install.sh
./dotnet-install.sh --channel 8.0 --install-dir /usr/share/dotnet
./dotnet-install.sh --channel 10.0 --install-dir /usr/share/dotnet
ln -sf /usr/share/dotnet/dotnet /usr/bin/dotnet
bash "${GITHUB_WORKSPACE:-$(pwd)}/scripts/install-sccache.sh"
- name: Build .NET binding (arm64)
env:
CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
CXX_aarch64_unknown_linux_gnu: aarch64-linux-gnu-g++
AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar
CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
TARGET_ARCH: aarch64
BINDING_COMPONENTS: dotnet
SKIP_CORE_BUILD: "1"
run: |
rustup target add aarch64-unknown-linux-gnu
rustup default 1.91.1
./scripts/build-bindings.sh
- name: Upload .NET binding artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: bindings-linux-aarch64-part-dotnet
retention-days: 1
path: artifacts/aarch64
build-ffi-arm64:
permissions:
contents: read
runs-on: ubuntu-latest
needs: build-rlib-arm64
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Download arm64 rlib artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: arm64-rlib-artifacts
path: /tmp
- name: Extract rlib artifacts
run: tar xzf /tmp/arm64-rlib.tar.gz
- name: Package FFI artifacts (arm64)
run: |
mkdir -p artifacts/aarch64/ffi artifacts/aarch64/ruby
find target -name 'libasherah_ffi.*' -type f ! -name '*.d' -exec cp {} artifacts/aarch64/ffi/ \;
find target -name 'libasherah_ffi.*' -type f ! -name '*.d' -exec cp {} artifacts/aarch64/ruby/ \;
- name: Upload FFI artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: bindings-linux-aarch64-part-ffi
retention-days: 1
path: artifacts/aarch64
build-cobhan-arm64:
permissions:
contents: read
runs-on: ubuntu-latest
needs: build-rlib-arm64
container: rust:1.91-bookworm
env:
CARGO_HOME: ${{ github.workspace }}/.cache/cargo
RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup
CARGO_TARGET_DIR: ${{ github.workspace }}/target
CARGO_INCREMENTAL: 0
RUSTC_WRAPPER: sccache
SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache
SCCACHE_CACHE_SIZE: 2G
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Restore workspace caches
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
with:
path: |
.cache/cargo
.cache/rustup
.cache/sccache
key: build-${{ runner.os }}-arm64-cobhan-${{ hashFiles('**/Cargo.lock') }}
restore-keys: |
build-${{ runner.os }}-arm64-cobhan-
- name: Download arm64 rlib artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: arm64-rlib-artifacts
path: /tmp
- name: Extract rlib artifacts
run: tar xzf /tmp/arm64-rlib.tar.gz
- name: Install cross-compile toolchain and sccache
run: |
echo 'Acquire::Retries "3";' > /etc/apt/apt.conf.d/80-retries
apt-get update
apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu curl
bash "${GITHUB_WORKSPACE:-$(pwd)}/scripts/install-sccache.sh"
- name: Build asherah-cobhan (arm64)
env:
CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
CXX_aarch64_unknown_linux_gnu: aarch64-linux-gnu-g++
AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar
CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
PKG_CONFIG_ALLOW_CROSS: 1
TARGET_ARCH: aarch64
BINDING_COMPONENTS: cobhan
SKIP_CORE_BUILD: "1"
run: |
rustup target add aarch64-unknown-linux-gnu
rustup default 1.91.1
./scripts/build-bindings.sh
- name: Upload arm64 cobhan artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: bindings-linux-aarch64-part-cobhan
retention-days: 1
path: artifacts/aarch64
package-arm64:
permissions:
contents: read
if: github.event_name == 'push'
runs-on: ubuntu-latest
needs: [build-ffi-arm64, build-cobhan-arm64, build-node-arm64, build-python-arm64, build-dotnet-arm64, build-java-arm64]
steps:
- name: Download all arm64 artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
pattern: bindings-linux-aarch64-part-*
path: artifacts-staging
merge-multiple: true
- name: Consolidate artifacts
run: |
mkdir -p artifacts/aarch64
cp -r artifacts-staging/* artifacts/aarch64/
- name: Upload consolidated arm64 artifacts
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: bindings-linux-aarch64
retention-days: 1
path: artifacts/aarch64
# ==========================================================================
# Dry-run publish validation — ALL publish targets validated on every PR.
# If any fail, the PR blocks. No release can go out broken.
# ==========================================================================
publish-dry-run-npm-musl-x64:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1
with:
targets: x86_64-unknown-linux-musl
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 20
- name: Install Zig (with retries)
# Replaces `mlugg/setup-zig@v2`, which has no internal retry —
# a single transient `fetch failed` blocked PR CI repeatedly.
# `scripts/install-zig.sh` wraps curl with `--retry 10` plus an
# outer 3-attempt loop, and is shared with the publish
# workflows so dry-runs can't drift.
shell: bash
run: bash "$GITHUB_WORKSPACE/scripts/install-zig.sh"
- uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3
with:
tool: cargo-zigbuild
- name: Build asherah-node for x86_64-musl
working-directory: asherah-node
shell: bash
run: |
set -e
ARCH=x86_64 source "$GITHUB_WORKSPACE/scripts/download-musl-openssl.sh"
rustup target add x86_64-unknown-linux-musl
npm ci
npm run build -- --target x86_64-unknown-linux-musl --zig
ls *.node || { echo "ERROR: No .node file produced"; exit 1; }
publish-dry-run-windows-x64:
runs-on: windows-latest
permissions:
contents: read
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 20
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
with:
python-version: "3.11"
- name: Install OpenSSL via vcpkg
shell: bash
run: |
bash "$GITHUB_WORKSPACE/scripts/vcpkg-install-with-retry.sh" openssl:x64-windows-static-md
echo "OPENSSL_DIR=C:/vcpkg/installed/x64-windows-static-md" >> "$GITHUB_ENV"
echo "OPENSSL_STATIC=1" >> "$GITHUB_ENV"
echo "OPENSSL_NO_VENDOR=1" >> "$GITHUB_ENV"
- name: Build asherah-node for Windows
working-directory: asherah-node
shell: bash
run: |
npm ci
npm run build -- --target x86_64-pc-windows-msvc
ls *.node || { echo "ERROR: No .node file produced"; exit 1; }
- name: Build asherah-py wheel for Windows
shell: bash
run: |
pip install maturin==1.9.4
maturin build --release --manifest-path asherah-py/Cargo.toml --out dist/
ls dist/*.whl || { echo "ERROR: No wheel produced"; exit 1; }
publish-dry-run-pypi-manylinux-x64:
runs-on: ubuntu-22.04
permissions:
contents: read
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
with:
python-version: "3.11"
- uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1
with:
targets: x86_64-unknown-linux-gnu
- name: Build manylinux x86_64 wheel
uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
with:
target: x86_64-unknown-linux-gnu
manylinux: "2_28"
rust-toolchain: "1.91.1"
before-script-linux: source scripts/maturin-before-script-linux.sh
args: --release --manifest-path asherah-py/Cargo.toml --out dist/
- name: Verify wheel
run: |
ls dist/*.whl
echo "manylinux x64 wheel succeeded"
publish-dry-run-pypi-manylinux-arm64:
runs-on: ubuntu-22.04
permissions:
contents: read
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
with:
python-version: "3.11"
- uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1
with:
targets: aarch64-unknown-linux-gnu
- name: Build manylinux aarch64 wheel
uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
with:
target: aarch64-unknown-linux-gnu
manylinux: "2_28"
rust-toolchain: "1.91.1"
before-script-linux: source scripts/maturin-before-script-linux.sh
args: --release --manifest-path asherah-py/Cargo.toml --out dist/
- name: Verify wheel
run: |
ls dist/*.whl
echo "manylinux arm64 wheel succeeded"
publish-dry-run-pypi-macos:
runs-on: macos-latest
permissions:
contents: read
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
with:
python-version: "3.11"
- uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1
with:
targets: x86_64-apple-darwin,aarch64-apple-darwin
- name: Build universal2 wheel
uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
with:
target: universal2-apple-darwin
args: --release --manifest-path asherah-py/Cargo.toml --out dist/
- name: Verify wheel
run: |
ls dist/*.whl
echo "macOS universal2 wheel succeeded"
publish-dry-run-pypi-musl-x64:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
with:
python-version: "3.11"
- uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1
with:
targets: x86_64-unknown-linux-musl
- name: Build musllinux x86_64 wheel
uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
with:
target: x86_64-unknown-linux-musl
manylinux: musllinux_1_2
rust-toolchain: "1.91.1"
before-script-linux: source scripts/maturin-before-script-linux.sh
args: --release --manifest-path asherah-py/Cargo.toml --out dist/
- name: Verify wheel
run: |
ls dist/*.whl
echo "musllinux x64 wheel succeeded"
publish-dry-run-pypi-musl-arm64:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
with:
python-version: "3.11"
- uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1
with:
targets: aarch64-unknown-linux-musl
- name: Build musllinux aarch64 wheel
uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
with:
target: aarch64-unknown-linux-musl
manylinux: musllinux_1_2
rust-toolchain: "1.91.1"
before-script-linux: source scripts/maturin-before-script-linux.sh
args: --release --manifest-path asherah-py/Cargo.toml --out dist/
- name: Verify wheel
run: |
ls dist/*.whl
echo "musllinux arm64 wheel succeeded"
publish-dry-run-npm-musl-arm64:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1
with:
targets: aarch64-unknown-linux-musl
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 20
- name: Install Zig (with retries)
# Replaces `mlugg/setup-zig@v2`, which has no internal retry —
# a single transient `fetch failed` blocked PR CI repeatedly.
# `scripts/install-zig.sh` wraps curl with `--retry 10` plus an
# outer 3-attempt loop, and is shared with the publish
# workflows so dry-runs can't drift.
shell: bash
run: bash "$GITHUB_WORKSPACE/scripts/install-zig.sh"
- uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3
with:
tool: cargo-zigbuild
- name: Build asherah-node for aarch64-musl
working-directory: asherah-node
shell: bash
run: |
set -e
ARCH=aarch64 source "$GITHUB_WORKSPACE/scripts/download-musl-openssl.sh"
rustup target add aarch64-unknown-linux-musl
npm ci
npm run build -- --target aarch64-unknown-linux-musl --zig
ls *.node || { echo "ERROR: No .node file produced"; exit 1; }
publish-dry-run-windows-arm64:
runs-on: windows-latest
permissions:
contents: read
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1
with:
targets: aarch64-pc-windows-msvc
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 20
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
with:
python-version: "3.11"
- name: Install OpenSSL via vcpkg (arm64)
shell: bash
run: |
bash "$GITHUB_WORKSPACE/scripts/vcpkg-install-with-retry.sh" openssl:arm64-windows-static-md
echo "OPENSSL_DIR=C:/vcpkg/installed/arm64-windows-static-md" >> "$GITHUB_ENV"
echo "OPENSSL_STATIC=1" >> "$GITHUB_ENV"
echo "OPENSSL_NO_VENDOR=1" >> "$GITHUB_ENV"
- name: Build asherah-node for Windows arm64
working-directory: asherah-node
shell: bash
run: |
npm ci
npm run build -- --target aarch64-pc-windows-msvc
ls *.node || { echo "ERROR: No .node file produced"; exit 1; }
- name: Build asherah-py wheel for Windows arm64
shell: bash
run: |
pip install maturin==1.9.4
maturin build --release --manifest-path asherah-py/Cargo.toml --target aarch64-pc-windows-msvc --out dist/
ls dist/*.whl || { echo "ERROR: No wheel produced"; exit 1; }
# Mirrors the musl build path in release-cobhan.yml's `build` matrix.
# Without this dry-run, a regression in the cobhan musl build (which
# produces the libasherah-*-musl.so binaries shipped to GitHub Releases
# and consumed by NuGet, Maven, RubyGems, and Go) would only surface
# at release time. The release workflow already runs `cargo zigbuild
# --release -p asherah-ffi -p asherah-java`; we replicate that exactly
# and then assert that the cdylib outputs actually exist on disk —
# the warning "dropping unsupported crate type cdylib" silently
# produces a successful exit code with no .so file.
publish-dry-run-cobhan-musl-x64:
runs-on: ubuntu-22.04
permissions:
contents: read
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1
with:
targets: x86_64-unknown-linux-musl
- name: Install Zig (with retries)
# Replaces `mlugg/setup-zig@v2`, which has no internal retry —
# a single transient `fetch failed` blocked PR CI repeatedly.
# `scripts/install-zig.sh` wraps curl with `--retry 10` plus an
# outer 3-attempt loop, and is shared with the publish
# workflows so dry-runs can't drift.
shell: bash
run: bash "$GITHUB_WORKSPACE/scripts/install-zig.sh"
- uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3
with:
tool: cargo-zigbuild
- name: Setup musl OpenSSL
shell: bash
run: |
ARCH=x86_64 source "$GITHUB_WORKSPACE/scripts/download-musl-openssl.sh"
{
echo "OPENSSL_DIR=$OPENSSL_DIR"
echo "OPENSSL_STATIC=$OPENSSL_STATIC"
echo "OPENSSL_NO_VENDOR=$OPENSSL_NO_VENDOR"
} >> "$GITHUB_ENV"
- name: Build asherah-ffi (musl x86_64)
env:
RUSTFLAGS: "-C target-feature=-crt-static"
run: |
cargo zigbuild --release -p asherah-ffi -p asherah-java --target x86_64-unknown-linux-musl
- name: Verify cdylib outputs exist
run: |
set -e
for lib in libasherah_ffi.so libasherah_java.so; do
path="target/x86_64-unknown-linux-musl/release/$lib"
if [ ! -f "$path" ]; then
echo "::error::Missing cdylib $path — Rust likely dropped the cdylib crate type for musl. Ensure RUSTFLAGS includes '-C target-feature=-crt-static'."
exit 1
fi
echo "OK: $path ($(stat -c%s "$path") bytes)"
done
publish-dry-run-cobhan-musl-arm64:
runs-on: ubuntu-22.04
permissions:
contents: read
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1
with:
targets: aarch64-unknown-linux-musl
- name: Install Zig (with retries)
# Replaces `mlugg/setup-zig@v2`, which has no internal retry —
# a single transient `fetch failed` blocked PR CI repeatedly.
# `scripts/install-zig.sh` wraps curl with `--retry 10` plus an
# outer 3-attempt loop, and is shared with the publish
# workflows so dry-runs can't drift.
shell: bash
run: bash "$GITHUB_WORKSPACE/scripts/install-zig.sh"
- uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3
with:
tool: cargo-zigbuild
- name: Setup musl OpenSSL
shell: bash
run: |
ARCH=aarch64 source "$GITHUB_WORKSPACE/scripts/download-musl-openssl.sh"
{
echo "OPENSSL_DIR=$OPENSSL_DIR"
echo "OPENSSL_STATIC=$OPENSSL_STATIC"
echo "OPENSSL_NO_VENDOR=$OPENSSL_NO_VENDOR"
} >> "$GITHUB_ENV"
- name: Build asherah-ffi (musl aarch64)
env:
RUSTFLAGS: "-C target-feature=-crt-static"
run: |
cargo zigbuild --release -p asherah-ffi -p asherah-java --target aarch64-unknown-linux-musl
- name: Verify cdylib outputs exist
run: |
set -e
for lib in libasherah_ffi.so libasherah_java.so; do
path="target/aarch64-unknown-linux-musl/release/$lib"
if [ ! -f "$path" ]; then
echo "::error::Missing cdylib $path — Rust likely dropped the cdylib crate type for musl. Ensure RUSTFLAGS includes '-C target-feature=-crt-static'."
exit 1
fi
echo "OK: $path ($(stat -c%s "$path") bytes)"
done
publish-dry-run-rubygem:
runs-on: ubuntu-latest
permissions:
contents: read
needs: build-ffi-x86_64
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1.314.0
with:
ruby-version: '3.3'
- name: Download x86_64 FFI artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: bindings-linux-x86_64-part-ffi
path: artifacts
- name: Build platform gems
working-directory: asherah-ruby
run: |
# Build both glibc + musl variants. Dry-run only has one host
# binary, so the *contents* match the host arch — this verifies
# the gemspec layout for both platforms; publish-rubygems.yml
# ships the right architecture per platform.
for platform in x86_64-linux x86_64-linux-musl; do
rm -rf lib/asherah/native
mkdir -p lib/asherah/native
find ../artifacts -name 'libasherah_ffi.*' -exec cp {} lib/asherah/native/ \;
ls lib/asherah/native/libasherah_ffi.* || { echo "ERROR: No native lib staged"; exit 1; }
ASHERAH_GEM_PLATFORM="$platform" gem build asherah.gemspec && mv *.gem /tmp/
done
ls /tmp/*.gem | grep -q 'x86_64-linux\.gem' || { echo "ERROR: glibc gem missing"; exit 1; }
ls /tmp/*.gem | grep -q 'x86_64-linux-musl\.gem' || { echo "ERROR: musl gem missing"; exit 1; }
publish-dry-run-php-source:
runs-on: ubuntu-22.04
permissions:
contents: read
needs: build-ffi-x86_64
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: dtolnay/rust-toolchain@32a995a99d743b9c19db6838def362cd715afeb6 # 1.91.1
with:
targets: x86_64-unknown-linux-musl
- name: Download x86_64 FFI artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: bindings-linux-x86_64-part-ffi
path: ci-artifacts
- name: Normalize FFI artifact permissions
run: chmod +x ci-artifacts/ffi/libasherah_ffi.so
- name: Install Zig (with retries)
shell: bash
run: bash "$GITHUB_WORKSPACE/scripts/install-zig.sh"
- uses: taiki-e/install-action@ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3 # v2.82.3
with:
tool: cargo-zigbuild
- name: Setup musl OpenSSL
shell: bash
run: |
ARCH=x86_64 source "$GITHUB_WORKSPACE/scripts/download-musl-openssl.sh"
{
echo "OPENSSL_DIR=$OPENSSL_DIR"
echo "OPENSSL_STATIC=$OPENSSL_STATIC"
echo "OPENSSL_NO_VENDOR=$OPENSSL_NO_VENDOR"
} >> "$GITHUB_ENV"
- name: Build PHP test image
run: docker build -t asherah-php-ffi-test -f asherah-php/.Dockerfile.debian asherah-php
- name: Build PHP Alpine test image
run: docker build -t asherah-php-ffi-test-alpine -f asherah-php/.Dockerfile.alpine asherah-php
- name: Build musl FFI for PHP Alpine smoke
env:
RUSTFLAGS: "-C target-feature=-crt-static"
run: cargo zigbuild --release -p asherah-ffi --target x86_64-unknown-linux-musl
- name: Build source-only Composer archive
run: |
docker run --rm -v "$PWD":/work -w /work/asherah-php asherah-php-ffi-test sh -lc '
set -e
/work/scripts/build-php-source-archive.sh /tmp/asherah-php-dist
test ! -e /work/asherah-php/composer.lock
test ! -d /work/asherah-php/vendor
test ! -d /work/asherah-php/native
'
- name: Consumer source install smoke
run: |
docker run --rm -v "$PWD":/work -w /work \
-e ASHERAH_PHP_NATIVE=/work/ci-artifacts/ffi \
asherah-php-ffi-test sh -lc '
set -e
rm -rf /tmp/asherah-php-consumer
mkdir /tmp/asherah-php-consumer
cd /tmp/asherah-php-consumer
composer init --name asherah/consumer-smoke --no-interaction >/dev/null
composer config repositories.asherah path /work/asherah-php
composer config minimum-stability dev
composer config prefer-stable true
bash /work/scripts/composer-retry.sh require godaddy/asherah:* --no-interaction --no-progress >/dev/null
php vendor/godaddy/asherah/tests/consumer_smoke.php
'
- name: Consumer source install smoke (musl)
run: |
docker run --rm -v "$PWD":/work -w /work \
-e ASHERAH_PHP_NATIVE=/work/target/x86_64-unknown-linux-musl/release \
asherah-php-ffi-test-alpine sh -lc '
set -e
rm -rf /tmp/asherah-php-consumer
mkdir /tmp/asherah-php-consumer
cd /tmp/asherah-php-consumer
composer init --name asherah/consumer-smoke --no-interaction >/dev/null
composer config repositories.asherah path /work/asherah-php
composer config minimum-stability dev
composer config prefer-stable true
bash /work/scripts/composer-retry.sh require godaddy/asherah:* --no-interaction --no-progress >/dev/null
php vendor/godaddy/asherah/tests/consumer_smoke.php
'
publish-dry-run-java-jar:
runs-on: ubuntu-latest
permissions:
contents: read
needs: build-java-x86_64
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
with:
java-version: '11'
distribution: 'temurin'
- name: Download x86_64 Java artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: bindings-linux-x86_64-part-java
path: artifacts
- name: Build JAR with pre-built native lib
run: |
NATIVE_DIR=asherah-java/java/src/main/resources/native
# Stage under both glibc and musl resource paths. Dry-run only has
# the host x86_64 binary; this verifies pom.xml/JAR layout for both
# platforms. publish-maven.yml ships the right architecture per RID.
for rid in linux-x86_64 linux-musl-x86_64; do
mkdir -p "$NATIVE_DIR/$rid"
find artifacts -name 'libasherah_java.*' -exec cp {} "$NATIVE_DIR/$rid/" \;
ls "$NATIVE_DIR/$rid/libasherah_java."* || { echo "ERROR: No JNI lib found for $rid"; exit 1; }
done
mvn -B -f asherah-java/java/pom.xml -Dnative.build.skip=true -DskipTests package
JAR=$(find asherah-java/java/target -name 'appencryption-*.jar' -not -name '*sources*' -not -name '*javadoc*' | head -1)
jar tf "$JAR" | grep "native/.*\\.so$" || { echo "ERROR: No native lib in JAR"; exit 1; }
jar tf "$JAR" | grep -q "native/linux-musl-x86_64/" || { echo "ERROR: musl JNI lib missing from JAR"; exit 1; }