diff --git a/.gitea/workflows/release.yaml b/.gitea/workflows/release.yaml index 98f7fe4..14110ea 100644 --- a/.gitea/workflows/release.yaml +++ b/.gitea/workflows/release.yaml @@ -1,13 +1,15 @@ -# Release: on a version tag, build the static Linux binary (D2) and publish it -# to a Gitea release with a checksum. Runs in the same prebuilt CI image as the -# gate, so the pinned toolchain + musl target/cc are already warm. +# Release: on a version tag, build the cross-platform binaries and publish them +# to a Gitea release with checksums. Runs in the prebuilt CI image, so the +# pinned toolchain + the release targets + cargo-zigbuild/zig are already warm. # -# Scope: x86_64-unknown-linux-musl only, for now. The rest of the D1 matrix -# (aarch64, macOS, Windows) and the D3 package-manager manifests layer on later, -# step by step. +# Matrix (D1, cross-built from Linux x86_64 via cargo-zigbuild): +# x86_64-unknown-linux-musl aarch64-unknown-linux-musl (static, D2) +# x86_64-pc-windows-gnu aarch64-pc-windows-gnullvm (standalone .exe) +# macOS is deferred — its arboard/AppKit link needs Apple's SDK (see ADR-ci-001). +# D3 package-manager manifests layer on later. # -# Tests run here before the build so a tag can never publish untested code, -# even one pointing at a commit that was never gated on a branch. +# Tests run once (host) before the matrix, so a tag can never publish untested +# code, even one pointing at a commit that was never gated on a branch. name: release on: push: @@ -15,46 +17,59 @@ on: - 'v*' jobs: - release: + test: runs-on: ci-public container: image: git.lazyeval.net/oli/rdbms-playground-ci:latest - env: - TARGET: x86_64-unknown-linux-musl steps: - uses: actions/checkout@v4 - - name: test run: nix develop -c cargo test --no-fail-fast - - name: build static binary - run: nix develop -c cargo build --release --target "$TARGET" + build: + needs: test + runs-on: ci-public + container: + image: git.lazyeval.net/oli/rdbms-playground-ci:latest + strategy: + fail-fast: false + matrix: + target: + - x86_64-unknown-linux-musl + - aarch64-unknown-linux-musl + - x86_64-pc-windows-gnu + - aarch64-pc-windows-gnullvm + steps: + - uses: actions/checkout@v4 - - name: package artifacts + - name: build + run: nix develop -c cargo zigbuild --release --target ${{ matrix.target }} + + - name: package + publish # Pin bash: the runner defaults scripted steps to dash, which rejects # `set -o pipefail`. bash is in the CI image. - shell: bash - run: | - set -euo pipefail - BIN="target/$TARGET/release/rdbms-playground" - ls -l "$BIN" - OUT="rdbms-playground-${{ github.ref_name }}-$TARGET" - mkdir -p dist - cp "$BIN" "dist/$OUT" - ( cd dist && sha256sum "$OUT" > "$OUT.sha256" ) - ls -l dist - - - name: publish gitea release + assets shell: bash env: - # Auto-provided by Gitea Actions; has repo write (release) scope. + TARGET: ${{ matrix.target }} + # GITEA_TOKEN is auto-provided with repo write (release) scope. TOKEN: ${{ secrets.GITEA_TOKEN }} API: ${{ github.server_url }}/api/v1 REPO: ${{ github.repository }} TAG: ${{ github.ref_name }} run: | set -euo pipefail - # Create the release for this tag; if it already exists, look it up. + + # Windows targets produce a .exe; the rest a bare binary. + case "$TARGET" in *windows*) EXT=.exe ;; *) EXT= ;; esac + BIN="target/$TARGET/release/rdbms-playground$EXT" + OUT="rdbms-playground-$TAG-$TARGET$EXT" + mkdir -p dist + cp "$BIN" "dist/$OUT" + ( cd dist && sha256sum "$OUT" > "$OUT.sha256" ) + ls -l dist + + # Create the release for this tag; if a sibling matrix job already + # created it, look it up instead (idempotent + race-tolerant). created=$(curl -sS -X POST "$API/repos/$REPO/releases" \ -H "Authorization: token $TOKEN" \ -H "Content-Type: application/json" \ @@ -66,6 +81,7 @@ jobs: | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{process.stdout.write(String(JSON.parse(s).id))})') fi echo "release id: $id" + for f in dist/*; do name=$(basename "$f") echo "uploading $name" @@ -73,4 +89,4 @@ jobs: -H "Authorization: token $TOKEN" \ -F "attachment=@$f" > /dev/null done - echo "published $TAG" + echo "published $TARGET assets for $TAG" diff --git a/docs/ci/adr/20260612-adr-ci-001.md b/docs/ci/adr/20260612-adr-ci-001.md index 4f34a05..8389a59 100644 --- a/docs/ci/adr/20260612-adr-ci-001.md +++ b/docs/ci/adr/20260612-adr-ci-001.md @@ -24,6 +24,35 @@ it rather than restating it. > previously forced website ADRs to be renumbered (see that namespace's > history note and ADR-0000 "Numbering discipline"). +## Amendment — 2026-06-13: D1 matrix expanded (non-macOS targets) + +The release now builds the **four non-macOS D1 targets**, all cross-compiled +from the Linux x86_64 runner with **`cargo-zigbuild`** (Zig's bundled clang + +libc as one universal cross cc/linker — including the `cc`-crate compile of +rusqlite's bundled SQLite C — added to the flake devShell, replacing the +single-target musl cc): + +- `x86_64-unknown-linux-musl`, `aarch64-unknown-linux-musl` — static (D2); +- `x86_64-pc-windows-gnu`, `aarch64-pc-windows-gnullvm` — standalone `.exe`. + +`release.yaml` became a **`test` (once, host) → `build` (matrix over the four +targets)** workflow; each matrix job uploads its artifact + `.sha256` to the +shared release (idempotent create-or-get). + +**Windows link fix:** Rust's std links `-lsynchronization` (WaitOnAddress +thread-parking), an import lib that rust-overlay's toolchain doesn't ship and +Zig's mingw lacks. Those symbols are forwarded by `kernel32` (already linked), +so an **empty stub** `libsynchronization.a` (committed at `ci/winstub/`, wired +via `.cargo/config.toml` for the Windows targets only) satisfies the linker. +Verified locally: all four build; the Linux binaries are statically linked; the +Windows artifacts are valid PE32+ (x86-64 / Aarch64) — not yet runtime +smoke-tested on Windows. + +**macOS stays deferred** (see Deferred): `arboard`→AppKit needs Apple's SDK, +which a Linux runner can't supply cleanly — and the CI image is *public*, so the +SDK can't be baked in even if the licensing grey area were accepted. macOS is +its own step (osxcross + a private SDK, or a real Mac runner). + ## Context The project is near feature-complete and needs CI (`requirements.md` **TT5**; @@ -162,8 +191,9 @@ iteration ships **Linux x86_64 only**; the rest is deferred (below). ## Deferred / out of scope (tracked, step by step) -- **D1 matrix:** aarch64, macOS, Windows builds (cross toolchains; macOS is the - hard part on a Linux runner). +- **D1 matrix:** **macOS only** now (x86_64 + aarch64). The four non-macOS + targets shipped via cargo-zigbuild (see the 2026-06-13 amendment); macOS needs + Apple's SDK (osxcross + private SDK, or a Mac runner). - **D3 packaging:** Homebrew / Scoop / winget / `cargo-binstall` manifests (and binstall-friendly asset naming/archives). - **Tier 4 (PTY E2E):** still unwired (`requirements.md` **TT4**); the gate runs diff --git a/docs/ci/adr/README.md b/docs/ci/adr/README.md index 38aa095..0a2339c 100644 --- a/docs/ci/adr/README.md +++ b/docs/ci/adr/README.md @@ -18,5 +18,5 @@ here too). ## Index -- [ADR-ci-001 — CI + release pipeline on Gitea Actions](20260612-adr-ci-001.md) — **Accepted 2026-06-12** (implemented the same day on the `ci` branch). Establishes the CI/release pipeline on the self-hosted Gitea instance's Actions runner (`ci-public`). **Runner model** (established by a throwaway probe): jobs execute *inside* a container (`catthehacker/ubuntu:act-22.04` by default), as root, so the runner host's nix is **not** reachable from steps. **Toolchain delivery:** a **baked CI image** — `node:22-bookworm-slim` (satisfies the act_runner job-container contract: `/bin/sleep` keep-alive, `bash`, `node` for JS actions; a bare `nixos/nix` image lacks these and won't start) **+ single-user nix + the flake's devShell pre-warmed** — built by `build-ci-image.yaml` via DinD and pushed to the Gitea container registry as a **public** package, so CI runs `nix develop -c …` against the **same pinned toolchain as dev** (the flake, ADR-ci-002) with a warm store (~1.4 s to a ready toolchain). **Gate** (`ci.yaml`): `clippy -D warnings` + `cargo test` inside that image on branch pushes + PRs; **fmt deliberately not gated** (the tree isn't stock-rustfmt-clean — user decision, revisit on `main`; see ADR-ci-002). **Release** (`release.yaml`): on a `v*` tag, runs the tests, builds the **static `x86_64-unknown-linux-musl` binary** (D2: single static binary, no runtime deps — the glibc/nix build is non-portable), strips it, and publishes it + a `.sha256` to a Gitea release via the API and the auto-provided `GITEA_TOKEN`. **Triggers:** gate + image-build are scoped to **branch** pushes (`branches: ['**']`) so a release tag doesn't spuriously re-run them; the image-build additionally path-filters to its inputs (Dockerfile/flake/toolchain); the release owns tags. **Auth:** a dedicated PAT (`REGISTRY_USERNAME`/`REGISTRY_TOKEN` secrets) pushes the image; the auto `GITEA_TOKEN` publishes releases. **Scope this iteration:** Linux x86_64 only — the rest of the D1 matrix (aarch64/macOS/Windows), D3 package-manager manifests, CI-speed dependency caching, and the website's static→Cloudflare deploy are deferred, to be added step by step. Verified live: probe → runner facts; image built + checked locally; gate green (**2424 tests**); release exercised end-to-end (`v0.0.0-citest2` published with binary + checksum). Builds on **ADR-ci-002** (the nix flake, relocated here from main's ADR-0049 to avoid exactly this cross-branch collision). +- [ADR-ci-001 — CI + release pipeline on Gitea Actions](20260612-adr-ci-001.md) — **Accepted 2026-06-12** (implemented the same day on the `ci` branch). Establishes the CI/release pipeline on the self-hosted Gitea instance's Actions runner (`ci-public`). **Runner model** (established by a throwaway probe): jobs execute *inside* a container (`catthehacker/ubuntu:act-22.04` by default), as root, so the runner host's nix is **not** reachable from steps. **Toolchain delivery:** a **baked CI image** — `node:22-bookworm-slim` (satisfies the act_runner job-container contract: `/bin/sleep` keep-alive, `bash`, `node` for JS actions; a bare `nixos/nix` image lacks these and won't start) **+ single-user nix + the flake's devShell pre-warmed** — built by `build-ci-image.yaml` via DinD and pushed to the Gitea container registry as a **public** package, so CI runs `nix develop -c …` against the **same pinned toolchain as dev** (the flake, ADR-ci-002) with a warm store (~1.4 s to a ready toolchain). **Gate** (`ci.yaml`): `clippy -D warnings` + `cargo test` inside that image on branch pushes + PRs; **fmt deliberately not gated** (the tree isn't stock-rustfmt-clean — user decision, revisit on `main`; see ADR-ci-002). **Release** (`release.yaml`): on a `v*` tag, runs the tests, builds the **static `x86_64-unknown-linux-musl` binary** (D2: single static binary, no runtime deps — the glibc/nix build is non-portable), strips it, and publishes it + a `.sha256` to a Gitea release via the API and the auto-provided `GITEA_TOKEN`. **Triggers:** gate + image-build are scoped to **branch** pushes (`branches: ['**']`) so a release tag doesn't spuriously re-run them; the image-build additionally path-filters to its inputs (Dockerfile/flake/toolchain); the release owns tags. **Auth:** a dedicated PAT (`REGISTRY_USERNAME`/`REGISTRY_TOKEN` secrets) pushes the image; the auto `GITEA_TOKEN` publishes releases. **Scope:** the **four non-macOS D1 targets** (Linux + Windows × x86_64/aarch64) cross-built from Linux via cargo-zigbuild (2026-06-13 amendment); macOS, D3 package-manager manifests, CI-speed dependency caching, and the website's static→Cloudflare deploy remain deferred, added step by step. Verified live: probe → runner facts; image built + checked locally; gate green (**2424 tests**); release exercised end-to-end (`v0.0.0-citest2` published with binary + checksum). Builds on **ADR-ci-002** (the nix flake, relocated here from main's ADR-0049 to avoid exactly this cross-branch collision). - [ADR-ci-002 — Nix flake for a reproducible dev + build environment](20260612-adr-ci-002.md) — **Accepted 2026-06-12** (relocated from main's **ADR-0049** on the same day — content unchanged — to keep CI/dev-env decisions out of `main`'s integer sequence). The single, version-pinned declaration of the **dev *and* build toolchain** so CI never relies on whatever Rust is on the build machine — mirroring **datamage ADR 0046**, but far simpler (pure-Rust TUI). Root **Nix flake** with two outputs: **`devShells.default`** (pinned **Rust 1.95.0** via `rust-toolchain.toml` + `rust-overlay`, `cargo-sweep`, and the musl cc for the static release build) and **`packages.default`** (`rustPlatform.buildRustPackage` from the committed `Cargo.lock`; `doCheck = false`). Exact-pin (not floating `stable`) so `nix flake update` can't surprise-bump clippy past the `-D warnings` gate. System inputs near-empty by design (`libsqlite3-sys bundled` → stdenv cc only; `arboard`→`x11rb` pure-Rust). `.envrc` (`use flake`) for direnv parity. Verified through the flake: `nix build` yields a working binary, clippy clean, **2424 tests pass / 0 fail / 1 intentional ignored doctest**. Consumed by **ADR-ci-001** (the pipeline). Alternatives rejected: dev-shell-only; a standard `rust:1.95` CI image (a second toolchain definition = drift); `rustup` on the build host (non-reproducible).