ci: migrate cross builds to cargo-zigbuild#136
Merged
Merged
Conversation
cross 0.2.5's aarch64 images ship an x86_64 glibc too old to run build
scripts produced by modern Rust (1.96), so `cross build` for
aarch64-unknown-linux-{gnu,musl} fails with GLIBC_2.28+ symbol errors on a
fresh build (masked intermittently by CI caching). release.yml built the
same targets with the same cross 0.2.5 and was on borrowed time.
Migrate the Linux gnu/musl targets to cargo-zigbuild in both ci.yml and
release.yml — Zig bundles musl and lets us pin a low glibc floor (.2.17 on
aarch64-gnu). Android stays on cross but from git main (current-glibc
images), since zigbuild does not handle the NDK target; macOS builds
natively. Removes cross 0.2.5 and the musl-tools install.
ci.yml cross-smoke now covers all 5 release targets in debug on every PR.
Release artifact names are unchanged (packaged by base target, tolerant of
zigbuild's glibc-suffixed output dir).
Add scripts/verify-target-binary.sh, used by both workflows: - resolves the binary tolerant of cargo-zigbuild's glibc-suffixed target dir, failing loudly (with a find dump) if neither path holds an executable - gnu targets: asserts no required GLIBC symbol above the 2.17 floor - musl targets: asserts static (no GLIBC symbols, no dynamic interpreter) release.yml packaging now calls it (find + verify + package by base target, artifact names unchanged). ci.yml cross-smoke runs it as an ABI check on the zigbuild targets, so a build that links the wrong ABI fails the PR, not just a future release.
Addresses the adversarial-review finding that the release toolchain was non-reproducible: setup-zig defaulted to Zig master (an ephemeral nightly), cargo-zigbuild came from crates.io latest, and cross was built from the moving main branch — any of which could drift and change or break a future tag build without a repo change, in exactly the ABI/packaging area the migration is meant to stabilize. Pin all three (mirrored in ci.yml and release.yml so PR validation matches tag builds), to the exact known-good versions the green run used: - Zig 0.16.0 (latest stable; cargo-zigbuild 0.23.0 supports zig 0.15+) - cargo-zigbuild 0.23.0 (--version) - cross main @ 64b5bb4d (--rev) Bump these intentionally via dependency-update review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the aarch64 cross-build glibc failures that landed on master (
bf773ae).Root cause
cross 0.2.5's
aarch64-unknown-linux-{gnu,musl}:0.2.5images ship an x86_64 glibc too old to run build scripts compiled by modern Rust (1.96 → GLIBC_2.28+ symbols). Fresh builds fail; CI caching masked it intermittently (green on #135, red on the master push).release.ymlused the same cross 0.2.5, so the next fresh release build was at the same risk — the cross-smoke job caught a latent release regression, which is exactly its job.Change (per spec)
cargo-zigbuild. Zig bundles musl and pins a glibc floor (aarch64-unknown-linux-gnu.2.17), no stale images.main(current-glibc images); zigbuild doesn't do NDK targets.cargo.musl-toolsinstall.ci.ymlcross-smoke now builds all 5 release targets (debug) on every PR;release.ymluses the same split for release + packaging (artifact names unchanged; packaging tolerates zigbuild's glibc-suffixed output dir).Verify
This PR's
Build (…)matrix must go green for all 5 targets — especiallyaarch64-unknown-linux-gnuandaarch64-unknown-linux-musl, the arms that were failing.