Support linking the SDKs against secretspec-ffi via pkg-config #80
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "FFI cdylib" | |
| # Builds the secretspec-ffi C ABI library for each platform the language SDKs | |
| # bundle. Linux builds use a manylinux_2_28 baseline. Other targets build | |
| # natively on per-platform runners rather than cross-compiling. | |
| on: | |
| workflow_call: | |
| inputs: | |
| release_tag: | |
| description: Existing GitHub Release tag to upload artifacts to | |
| required: false | |
| type: string | |
| default: "" | |
| workflow_dispatch: | |
| inputs: | |
| release_tag: | |
| description: Existing GitHub Release tag to upload artifacts to | |
| required: false | |
| type: string | |
| default: "" | |
| push: | |
| tags: | |
| - v** | |
| # PR runs are scoped to changes in the FFI crate or this workflow. Core | |
| # resolver changes are verified on PRs by the devenv-based test.yml and | |
| # sdks.yml; the full matrix here still runs on tags and manual dispatch. | |
| pull_request: | |
| paths: | |
| - "secretspec-ffi/**" | |
| - ".github/workflows/ffi-build.yml" | |
| - "scripts/check-linux-portability.sh" | |
| jobs: | |
| build: | |
| name: ${{ matrix.target }} | |
| runs-on: ${{ matrix.runner }} | |
| container: ${{ matrix.container || null }} | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - target: x86_64-unknown-linux-gnu | |
| runner: ubuntu-latest | |
| container: quay.io/pypa/manylinux_2_28_x86_64 | |
| artifact: libsecretspec_ffi.so | |
| - target: aarch64-unknown-linux-gnu | |
| runner: ubuntu-24.04-arm | |
| container: quay.io/pypa/manylinux_2_28_aarch64 | |
| artifact: libsecretspec_ffi.so | |
| - target: aarch64-apple-darwin | |
| runner: macos-latest | |
| artifact: libsecretspec_ffi.dylib | |
| - target: x86_64-pc-windows-msvc | |
| runner: windows-latest | |
| artifact: secretspec_ffi.dll | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install rustup (the manylinux container ships none) | |
| if: matrix.container | |
| run: | | |
| curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | | |
| sh -s -- -y --default-toolchain none | |
| echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" | |
| - name: Install Rust (pinned by rust-toolchain.toml) | |
| run: rustup toolchain install | |
| - name: Build cdylib | |
| run: >- | |
| cargo build -p secretspec-ffi --release | |
| --target ${{ matrix.target }} | |
| - name: Verify Linux portability (glibc <= 2.28, no libdbus) | |
| if: matrix.container | |
| shell: bash | |
| run: >- | |
| bash scripts/check-linux-portability.sh | |
| "target/${{ matrix.target }}/release/${{ matrix.artifact }}" | |
| - name: Smoke test the C ABI (Unix) | |
| if: runner.os != 'Windows' | |
| run: | | |
| cc secretspec-ffi/tests/smoke.c \ | |
| -I secretspec-ffi/include \ | |
| -L target/${{ matrix.target }}/release \ | |
| -lsecretspec_ffi -o smoke | |
| LD_LIBRARY_PATH=target/${{ matrix.target }}/release \ | |
| DYLD_LIBRARY_PATH=target/${{ matrix.target }}/release \ | |
| ./smoke | |
| - name: Stage release asset | |
| id: stage | |
| shell: bash | |
| run: | | |
| ext="${{ matrix.artifact }}"; ext="${ext##*.}" | |
| asset="secretspec-ffi-${{ matrix.target }}.${ext}" | |
| cp "target/${{ matrix.target }}/release/${{ matrix.artifact }}" "$asset" | |
| echo "asset=$asset" >> "$GITHUB_OUTPUT" | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: secretspec-ffi-${{ matrix.target }} | |
| path: | | |
| ${{ steps.stage.outputs.asset }} | |
| secretspec-ffi/include/secretspec.h | |
| release: | |
| name: Publish FFI release | |
| needs: build | |
| if: >- | |
| (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) || | |
| inputs.release_tag != '' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: secretspec-ffi-* | |
| path: staged | |
| merge-multiple: true | |
| # Attach each cdylib (named for its target, with a sha256 sidecar) to the | |
| # GitHub Release so the PHP SDK's `secretspec-install-lib` command can | |
| # fetch the right one for a plain `composer require` install. Publication | |
| # runs outside the manylinux build containers, which do not include `gh`. | |
| - name: Publish cdylibs to the release | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASE_TAG: ${{ inputs.release_tag || github.ref_name }} | |
| run: | | |
| set -euo pipefail | |
| mapfile -t assets < <( | |
| find staged -maxdepth 1 -type f -name 'secretspec-ffi-*' -print | | |
| sort | |
| ) | |
| if [[ "${#assets[@]}" -ne 4 ]]; then | |
| printf 'expected 4 FFI libraries, found %s\n' "${#assets[@]}" >&2 | |
| printf '%s\n' "${assets[@]}" >&2 | |
| exit 1 | |
| fi | |
| bash scripts/upload-release-asset.sh \ | |
| "$RELEASE_TAG" "${assets[@]}" |