ci(release): add static ONNX Runtime build for macOS x86_64 #45

Workflow file for this run

.github/workflows/release.yml at fcb45a2

	name: Release

	on:
	push:
	tags:
	- '[0-9]+.[0-9]+.[0-9]+*' # Matches semver tags like 0.1.0, 1.0.0, etc.
	workflow_dispatch:
	inputs:
	tag:
	description: 'Tag to release (semver format, e.g., 0.1.0)'
	required: true
	type: string

	env:
	CARGO_TERM_COLOR: always
	RUST_BACKTRACE: 1

	jobs:
	create-release:
	name: Create Release
	runs-on: ubuntu-latest
	outputs:
	upload_url: ${{ steps.create_release.outputs.upload_url }}
	release_id: ${{ steps.create_release.outputs.id }}
	version: ${{ steps.get_version.outputs.VERSION }}
	changelog: ${{ steps.changelog.outputs.CHANGELOG }}
	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	with:
	fetch-depth: 0 # Fetch full history for changelog generation

	- name: Get version from tag
	id: get_version
	run: \|
	if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
	VERSION="${{ github.event.inputs.tag }}"
	else
	VERSION="${GITHUB_REF#refs/tags/}"
	fi
	echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
	echo "VERSION_NO_V=${VERSION#v}" >> $GITHUB_OUTPUT

	- name: Validate semver format
	run: \|
	VERSION="${{ steps.get_version.outputs.VERSION }}"
	# POSIX-compatible regex check for semver
	case "$VERSION" in
	[0-9].[0-9].[0-9]*)
	# Basic semver format matched
	;;
	*)
	echo "Error: Tag '$VERSION' is not a valid semver format"
	echo "Expected format: X.Y.Z, X.Y.Z-prerelease, or X.Y.Z+build"
	exit 1
	;;
	esac

	- name: Generate changelog
	id: changelog
	run: \|
	# Get the previous tag
	PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null \|\| echo "")

	if [ -z "$PREV_TAG" ]; then
	CHANGELOG="Initial release"
	else
	# Generate changelog from commits since last tag
	CHANGELOG=$(git log ${PREV_TAG}..HEAD --pretty=format:"- %s" --no-merges \| head -20)
	if [ -z "$CHANGELOG" ]; then
	CHANGELOG="- No changes since last release"
	fi
	fi

	# Escape for GitHub output (POSIX compatible)
	CHANGELOG=$(printf '%s\n' "$CHANGELOG" \| sed 's/%/%25/g; s/\r/%0D/g' \| awk '{printf "%s%0A", $0}' \| sed 's/%0A$//')
	echo "CHANGELOG=$CHANGELOG" >> $GITHUB_OUTPUT

	- name: Check if release exists
	id: check_release
	run: \|
	VERSION="${{ steps.get_version.outputs.VERSION }}"
	if gh release view "$VERSION" >/dev/null 2>&1; then
	echo "exists=true" >> $GITHUB_OUTPUT
	else
	echo "exists=false" >> $GITHUB_OUTPUT
	fi
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	- name: Create Release
	id: create_release
	if: steps.check_release.outputs.exists == 'false'
	run: \|
	VERSION="${{ steps.get_version.outputs.version }}"
	IS_PRERELEASE="false"

	# Check if this is a prerelease (contains - or is 0.x.x)
	case "$VERSION" in
	-\|0.*)
	IS_PRERELEASE="true"
	;;
	esac

	# Create the release as draft
	if [ "$IS_PRERELEASE" = "true" ]; then
	gh release create "$VERSION" \
	--title "Release $VERSION" \
	--notes "${{ steps.changelog.outputs.CHANGELOG }}" \
	--draft \
	--prerelease
	else
	gh release create "$VERSION" \
	--title "Release $VERSION" \
	--notes "${{ steps.changelog.outputs.CHANGELOG }}" \
	--draft
	fi

	# Get release info
	RELEASE_INFO=$(gh release view "$VERSION" --json id,uploadUrl)
	RELEASE_ID=$(echo "$RELEASE_INFO" \| jq -r '.id')
	UPLOAD_URL=$(echo "$RELEASE_INFO" \| jq -r '.uploadUrl')

	echo "id=${RELEASE_ID}" >> $GITHUB_OUTPUT
	echo "upload_url=${UPLOAD_URL}" >> $GITHUB_OUTPUT
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	build:
	name: Build ${{ matrix.target }}
	needs: create-release
	runs-on: ${{ matrix.os }}
	strategy:
	fail-fast: false
	matrix:
	include:
	- target: x86_64-unknown-linux-musl
	os: ubuntu-latest
	archive: tar.gz
	- target: aarch64-unknown-linux-musl
	os: ubuntu-22.04-arm
	archive: tar.gz
	- target: x86_64-pc-windows-msvc
	os: windows-latest
	archive: zip
	- target: aarch64-pc-windows-msvc
	os: windows-11-arm
	archive: zip
	- target: x86_64-apple-darwin
	os: macos-15-intel
	archive: tar.gz
	- target: aarch64-apple-darwin
	os: macos-15
	archive: tar.gz

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Install Rust
	uses: dtolnay/rust-toolchain@1.95.0
	with:
	targets: ${{ matrix.target }}

	- name: Setup protoc
	uses: arduino/setup-protoc@v3
	with:
	repo-token: ${{ secrets.GITHUB_TOKEN }}

	- name: Cache dependencies
	uses: actions/cache@v4
	with:
	path: \|
	~/.cargo/registry
	~/.cargo/git
	target
	key: ${{ endsWith(matrix.target, '-unknown-linux-musl') && 'docker-alpine' \|\| runner.os }}-${{ matrix.target }}-cargo-${{ hashFiles('**/Cargo.lock') }}
	restore-keys: \|
	${{ endsWith(matrix.target, '-unknown-linux-musl') && 'docker-alpine' \|\| runner.os }}-${{ matrix.target }}-cargo-
	${{ endsWith(matrix.target, '-unknown-linux-musl') && 'docker-alpine' \|\| runner.os }}-cargo-

	# Cache the static ONNX Runtime build for musl targets so we don't rebuild
	# (45–60 min) on every CI run. Cache full source+build tree because
	# ort-sys's full static-link branch needs build/_deps/ subtrees for
	# re2/abseil/protobuf/etc.
	# Cache the static ONNX Runtime build for targets where pyke ships no
	# prebuilts (musl, x86_64-apple-darwin). Cache full source+build tree
	# because ort-sys's full static-link branch needs build/_deps/ subtrees
	# for re2/abseil/protobuf/etc.
	- name: Cache ONNX Runtime static build
	if: endsWith(matrix.target, '-unknown-linux-musl') \|\| matrix.target == 'x86_64-apple-darwin'
	uses: actions/cache@v4
	with:
	path: onnxruntime-src
	key: onnxruntime-1.24.2-${{ matrix.target }}-v6

	- name: Build binary
	shell: sh
	run: \|
	if [ "${{ runner.os }}" = "Linux" ]; then
	# Linux musl: build ONNX Runtime statically from source inside Alpine,
	# then build octomind with fastembed enabled, linking ort-sys against
	# the local static build via ORT_LIB_LOCATION. Pyke ships no musl
	# prebuilts, so this is the only supported path. ORT 1.24.2 matches
	# ort-sys 2.0.0-rc.12 / fastembed's api-24 feature.
	#
	# Pre-create the cache dir on the host so Docker volume-mount
	# inherits writable permissions.
	mkdir -p onnxruntime-src

	docker run --rm \
	-v "$(pwd):/workspace" \
	-w /workspace \
	rust:1.95.0-alpine3.22 \
	sh -c '
	set -eu
	# No protobuf-dev: it pulls in abseil-cpp-dev transitively, which
	# makes ORT'\''s CMake skip its bundled abseil and (because re2
	# depends on bundled absl targets) drop re2 from the build entirely.
	# ort-sys 2.0.0-rc.12 hardcodes static links to ~25 absl_*, re2,
	# protobuf libs at fixed _deps/ paths, so all three must be built
	# by ORT, not the system. Without the system packages ORT
	# FetchContent'\''s and compiles all three from source.
	apk add --no-cache \
	git perl bash musl-dev openssl-dev openssl-libs-static \
	pkgconfig gcc g++ \
	cmake make linux-headers python3 py3-pip patch

	# Provide stub execinfo.h — musl lacks it and Alpine 3.17+ removed
	# libexecinfo. ORT'\''s stacktrace.cc unconditionally includes it on
	# non-Android POSIX. The stub provides no-op backtrace functions.
	# Written to /tmp since /usr/include may not be writable.
	mkdir -p /tmp/include
	cat > /tmp/include/execinfo.h << "EOF"
	#ifndef _EXECINFO_H
	#define _EXECINFO_H
	#include <stddef.h>
	static inline int backtrace(void **buffer, int size) { (void)buffer; (void)size; return 0; }
	static inline char *backtrace_symbols(void const *buffer, int size) { (void)buffer; (void)size; return NULL; }
	static inline void backtrace_symbols_fd(void const buffer, int size, int fd) { (void)buffer; (void)size; (void)fd; }
	#endif
	EOF
	export C_INCLUDE_PATH=/tmp/include
	export CPLUS_INCLUDE_PATH=/tmp/include

	rustup target add ${{ matrix.target }}

	ORT_SRC=/workspace/onnxruntime-src
	ORT_LIB_LOCATION="$ORT_SRC/build/Release"
	# libre2.a is the late marker — re2 is built last in the bundled
	# dep graph (after abseil + protobuf), so its presence proves the
	# full static tree is in place. A partial cache that only has
	# libonnxruntime_common.a but no libre2.a triggers a clean rebuild.
	if [ ! -f "$ORT_LIB_LOCATION/_deps/re2-build/libre2.a" ]; then
	echo "==> Building ONNX Runtime 1.24.2 from source (static, musl)"
	rm -rf "$ORT_SRC"
	git clone --single-branch --branch v1.24.2 --recursive \
	https://github.com/microsoft/onnxruntime.git "$ORT_SRC"
	cd "$ORT_SRC"
	./build.sh \
	--config Release \
	--build_dir build \
	--parallel \
	--skip_tests \
	--skip_submodule_sync \
	--allow_running_as_root \
	--compile_no_warning_as_error \
	--no_kleidiai \
	--no_sve \
	--cmake_extra_defines \
	CMAKE_POSITION_INDEPENDENT_CODE=ON \
	onnxruntime_BUILD_UNIT_TESTS=OFF \
	onnxruntime_BUILD_SHARED_LIB=OFF
	# ORT'\''s static build (.a archives, --skip_tests) never link an
	# executable, so target_link_libraries deps like re2::re2 don'\''t
	# trigger compilation — re2 is FetchContent-populated but its
	# CMake target stays unbuilt. ort-sys 2.0.0-rc.12 hardcodes a
	# static link to it. Explicitly drive the re2 target inside ORT'\''s
	# configured build tree (uses bundled abseil from the same tree).
	cmake --build "$ORT_LIB_LOCATION" --target re2 -j
	cd /workspace
	else
	echo "==> Using cached ONNX Runtime static build"
	fi

	# ort-sys static_config #1 with empty profile detection.
	# ORT_LIB_LOCATION = build/Release (where libonnxruntime_common.a lives directly).
	# Profile detection iterates build/Release/{Release,RelWithDebInfo,...},
	# none exist → profile="" → transform_dep adds no suffix.
	# lib_dir = base ✓, external_lib_dir = base/_deps = build/Release/_deps
	# which is where cmake actually places onnx-build/, re2-build/, abseil_cpp-build/, etc.
	#
	# DO NOT use ORT_LIB_LOCATION="$ORT_SRC/build": that triggers profile=Release
	# detection, which makes transform_dep append /Release to every _deps path,
	# so search paths land at build/_deps/onnx-build/Release (non-existent) and
	# linking fails with "could not find native static library 'onnx'".
	export ORT_LIB_LOCATION="$ORT_LIB_LOCATION"
	# GCC 15 (Alpine 3.23) introduced __cpu_features2 in libgcc.
	# ORT'\''s cpuid_info.cc.o references it; musl static link needs
	# libgcc.a explicitly or the symbol is undefined at link time.
	export RUSTFLAGS="-C link-arg=-lgcc"
	cargo build --release --target ${{ matrix.target }}
	'
	elif [ "${{ runner.os }}" = "Windows" ]; then
	# Windows: Pyke ships prebuilts for MSVC targets.
	# Pyke's prebuilt ORT static lib is compiled with /MD (dynamic CRT).
	# Rust on MSVC defaults to /MT (static CRT) → __imp_* unresolved
	# symbol errors at link time. Switch to dynamic CRT to match.
	# vcruntime140.dll is present on all Windows hosts.
	export RUSTFLAGS="-C target-feature=-crt-static"
	cargo build --release --target ${{ matrix.target }}
	elif [ "${{ matrix.target }}" = "x86_64-apple-darwin" ]; then
	# macOS x86_64: pyke 2.0.0-rc.12 ships no x86_64-apple-darwin
	# prebuilt (xcframework linking unsupported on this target). Build
	# ONNX Runtime 1.24.2 from source statically and link via
	# ORT_LIB_LOCATION, same approach as Linux musl.
	ORT_SRC="$(pwd)/onnxruntime-src"
	ORT_LIB_LOCATION="$ORT_SRC/build/Release"
	if [ ! -f "$ORT_LIB_LOCATION/_deps/re2-build/libre2.a" ]; then
	echo "==> Building ONNX Runtime 1.24.2 from source (static, macOS x86_64)"
	rm -rf "$ORT_SRC"
	git clone --single-branch --branch v1.24.2 --recursive \
	https://github.com/microsoft/onnxruntime.git "$ORT_SRC"
	(cd "$ORT_SRC" && ./build.sh \
	--config Release \
	--build_dir build \
	--parallel \
	--skip_tests \
	--skip_submodule_sync \
	--compile_no_warning_as_error \
	--cmake_extra_defines \
	CMAKE_POSITION_INDEPENDENT_CODE=ON \
	CMAKE_OSX_ARCHITECTURES=x86_64 \
	CMAKE_OSX_DEPLOYMENT_TARGET=11.0 \
	onnxruntime_BUILD_UNIT_TESTS=OFF \
	onnxruntime_BUILD_SHARED_LIB=OFF)
	# Static archive build never links an executable, so re2's
	# CMake target stays unbuilt while ort-sys hardcodes a static
	# link to libre2.a. Force-build it.
	cmake --build "$ORT_LIB_LOCATION" --target re2 -j
	else
	echo "==> Using cached ONNX Runtime static build"
	fi
	export ORT_LIB_LOCATION="$ORT_LIB_LOCATION"
	cargo build --release --target ${{ matrix.target }}
	else
	# Native build for other macOS targets (aarch64) — Pyke ships prebuilts.
	cargo build --release --target ${{ matrix.target }}
	fi

	- name: Create archive directory
	shell: sh
	run: mkdir -p dist

	- name: Create archive (Unix)
	if: matrix.archive == 'tar.gz'
	shell: sh
	run: \|
	cd target/${{ matrix.target }}/release
	case "${{ matrix.target }}" in
	windows)
	tar czf ../../../dist/octomind-${{ needs.create-release.outputs.version }}-${{ matrix.target }}.tar.gz octomind.exe
	;;
	*)
	tar czf ../../../dist/octomind-${{ needs.create-release.outputs.version }}-${{ matrix.target }}.tar.gz octomind
	;;
	esac

	- name: Create archive (Windows)
	if: matrix.archive == 'zip'
	shell: sh
	run: \|
	cd target/${{ matrix.target }}/release
	7z a ../../../dist/octomind-${{ needs.create-release.outputs.version }}-${{ matrix.target }}.zip octomind.exe

	- name: Upload release asset
	shell: sh
	run: \|
	gh release upload "${{ needs.create-release.outputs.version }}" \
	"./dist/octomind-${{ needs.create-release.outputs.version }}-${{ matrix.target }}.${{ matrix.archive }}" \
	--clobber
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	publish-crate:
	name: Publish to Crates.io
	needs: [create-release, build]
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Install Rust
	uses: dtolnay/rust-toolchain@1.95.0

	- name: Setup protoc
	uses: arduino/setup-protoc@v3
	with:
	repo-token: ${{ secrets.GITHUB_TOKEN }}

	- name: Cache dependencies
	uses: actions/cache@v4
	with:
	path: \|
	~/.cargo/registry
	~/.cargo/git
	target
	key: ${{ runner.os }}-cargo-publish-${{ hashFiles('**/Cargo.lock') }}
	restore-keys: \|
	${{ runner.os }}-cargo-publish-
	${{ runner.os }}-cargo-

	- name: Validate version matches tag
	run: \|
	VERSION="${{ needs.create-release.outputs.version }}"
	CARGO_VERSION=$(grep '^version = ' Cargo.toml \| head -1 \| sed 's/version = "$.*$"/\1/')

	if [ "$VERSION" != "$CARGO_VERSION" ]; then
	echo "❌ Version mismatch!"
	echo "Git tag: $VERSION"
	echo "Cargo.toml: $CARGO_VERSION"
	echo "Please update Cargo.toml version to match the git tag"
	exit 1
	fi

	echo "✅ Version validation passed: $VERSION"

	- name: Check if version already published
	id: check_published
	run: \|
	VERSION="${{ needs.create-release.outputs.version }}"

	# Check if this version already exists on crates.io
	if cargo search octomind --limit 1 \| grep -q "octomind = \"$VERSION\""; then
	echo "already_published=true" >> $GITHUB_OUTPUT
	echo "⚠️ Version $VERSION already published to crates.io"
	else
	echo "already_published=false" >> $GITHUB_OUTPUT
	echo "✅ Version $VERSION not yet published"
	fi

	- name: Dry run publish
	if: steps.check_published.outputs.already_published == 'false'
	run: \|
	echo "🔍 Running dry-run publish to validate package..."
	cargo publish --dry-run --no-default-features
	env:
	CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

	- name: Publish to crates.io
	if: steps.check_published.outputs.already_published == 'false'
	run: \|
	echo "🚀 Publishing to crates.io..."
	cargo publish --no-default-features
	echo "✅ Successfully published to crates.io!"
	env:
	CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

	- name: Skip publishing
	if: steps.check_published.outputs.already_published == 'true'
	run: \|
	echo "⏭️ Skipping crates.io publish - version already exists"

	finalize-release:
	name: Finalize Release
	needs: [create-release, build, publish-crate]
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Publish release
	run: \|
	VERSION="${{ needs.create-release.outputs.version }}"

	# Update release notes with download links
	cat > release_notes.md << EOF
	## 🚀 What's Changed

	${{ needs.create-release.outputs.changelog }}

	## 📦 Installation

	### Quick Install Script (Universal)
	\`\`\`bash
	curl -fsSL https://raw.githubusercontent.com/${{ github.repository }}/main/install.sh \| sh
	\`\`\`

	Works on: Linux, macOS, Windows (Git Bash/WSL/MSYS2), and any Unix-like system

	### Manual Download

	\| Platform \| Architecture \| Download \|
	\|----------\|--------------\|----------\|
	\| Linux \| x86_64 (static) \| [octomind-${VERSION}-x86_64-unknown-linux-musl.tar.gz](https://github.com/${{ github.repository }}/releases/download/${VERSION}/octomind-${VERSION}-x86_64-unknown-linux-musl.tar.gz) \|
	\| Linux \| ARM64 (static) \| [octomind-${VERSION}-aarch64-unknown-linux-musl.tar.gz](https://github.com/${{ github.repository }}/releases/download/${VERSION}/octomind-${VERSION}-aarch64-unknown-linux-musl.tar.gz) \|
	\| Windows \| x86_64 \| [octomind-${VERSION}-x86_64-pc-windows-msvc.zip](https://github.com/${{ github.repository }}/releases/download/${VERSION}/octomind-${VERSION}-x86_64-pc-windows-msvc.zip) \|
	\| Windows \| ARM64 \| [octomind-${VERSION}-aarch64-pc-windows-msvc.zip](https://github.com/${{ github.repository }}/releases/download/${VERSION}/octomind-${VERSION}-aarch64-pc-windows-msvc.zip) \|
	\| macOS \| x86_64 \| [octomind-${VERSION}-x86_64-apple-darwin.tar.gz](https://github.com/${{ github.repository }}/releases/download/${VERSION}/octomind-${VERSION}-x86_64-apple-darwin.tar.gz) \|
	\| macOS \| ARM64 \| [octomind-${VERSION}-aarch64-apple-darwin.tar.gz](https://github.com/${{ github.repository }}/releases/download/${VERSION}/octomind-${VERSION}-aarch64-apple-darwin.tar.gz) \|

	### Using Cargo (from crates.io)
	\`\`\`bash
	cargo install octomind
	\`\`\`

	### Using Cargo (from Git)
	\`\`\`bash
	cargo install --git https://github.com/${{ github.repository }}
	\`\`\`
	### Verify Installation
	\`\`\`bash
	octomind --version
	\`\`\`
	EOF

	# Publish the release (remove draft status)
	gh release edit "$VERSION" --draft=false --notes-file release_notes.md
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	notify-homebrew:
	name: Notify Homebrew Tap
	needs: [create-release, finalize-release]
	runs-on: ubuntu-latest
	steps:
	- name: Dispatch update to homebrew-tap
	run: \|
	curl -X POST \
	-H "Accept: application/vnd.github+json" \
	-H "Authorization: Bearer ${{ secrets.TAP_GITHUB_TOKEN }}" \
	https://api.github.com/repos/muvon/homebrew-tap/dispatches \
	-d "{\"event_type\":\"octomind-release\",\"client_payload\":{\"version\":\"${{ needs.create-release.outputs.version }}\"}}"

	docker:
	name: Build and Push Docker Images
	needs: [create-release, build, publish-crate]
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@v3

	- name: Login to GitHub Container Registry
	uses: docker/login-action@v3
	with:
	registry: ghcr.io
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	- name: Set lowercase repository name
	id: repo
	run: echo "repository=$(echo '${{ github.repository }}' \| tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT

	- name: Build and push Docker image
	uses: docker/build-push-action@v5
	with:
	context: .
	platforms: linux/amd64,linux/arm64
	push: true
	tags: \|
	ghcr.io/${{ steps.repo.outputs.repository }}:latest
	ghcr.io/${{ steps.repo.outputs.repository }}:${{ needs.create-release.outputs.version }}
	cache-from: type=gha
	cache-to: type=gha,mode=max

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci(release): add static ONNX Runtime build for macOS x86_64 #45

Workflow file

ci(release): add static ONNX Runtime build for macOS x86_64 #45

Uh oh!

Workflow file for this run