Support linking the SDKs against secretspec-ffi via pkg-config #69
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Go static lib" | |
| # Builds the fully-static (musl) Go binary for the `-tags static` binding: cgo | |
| # links libsecretspec_ffi.a directly into the executable, so the Rust resolver is | |
| # embedded and the binary has no dynamic dependencies at all. Built via devenv, | |
| # which provides the musl C cross-toolchain (for the sqlite3/aws-lc-sys build | |
| # scripts and the cgo link) and static libunwind. | |
| # | |
| # The default `go get` path stays purego/dlopen (no cgo); this artifact is for | |
| # users who want a self-contained static binary. The staticlib + header are | |
| # uploaded for linking; they are never committed (the Go module proxy carries no | |
| # binary assets -- see RELEASE.md). aarch64-musl and the macOS self-contained | |
| # static build are follow-ups; the static binding itself is exercised on every PR | |
| # by sdks.yml's `-tags static` leg. | |
| on: | |
| workflow_call: | |
| inputs: | |
| release_tag: | |
| description: Existing GitHub Release tag to upload artifacts to | |
| required: false | |
| type: string | |
| default: "" | |
| workflow_dispatch: | |
| inputs: | |
| release_tag: | |
| description: Existing GitHub Release tag to upload artifacts to | |
| required: false | |
| type: string | |
| default: "" | |
| push: | |
| tags: | |
| - v** | |
| pull_request: | |
| paths: | |
| - "secretspec-go/**" | |
| - "secretspec-ffi/**" | |
| - ".github/workflows/go-static.yml" | |
| jobs: | |
| static: | |
| name: x86_64-linux-musl (fully static) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| # The musl rebuild of the full provider stack plus the Nix store overflows | |
| # the ~14GB free on a hosted runner. | |
| - name: Free up disk space | |
| run: | | |
| sudo rm -rf /usr/share/dotnet /usr/local/lib/android \ | |
| /opt/hostedtoolcache/CodeQL /usr/local/.ghcup /opt/ghc \ | |
| /usr/local/share/boost /usr/local/share/powershell | |
| sudo docker image prune --all --force | |
| df -h / | |
| - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0 | |
| - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17 | |
| with: | |
| name: devenv | |
| - name: Install devenv.sh | |
| run: nix profile install nixpkgs#devenv | |
| - name: Build and smoke test the fully-static binary | |
| run: | | |
| # Variables in this single-quoted script intentionally expand inside | |
| # the devenv shell, not in the outer workflow shell. | |
| # shellcheck disable=SC2016 | |
| devenv shell -- bash -c ' | |
| set -euo pipefail | |
| # Stage the release musl archive + header + generated cgo LDFLAGS | |
| # (cargo compiles the C deps with the musl cc via the CC_/linker env). | |
| ( cd secretspec-go && SECRETSPEC_FFI_TARGET=x86_64-unknown-linux-musl \ | |
| SECRETSPEC_FFI_PROFILE=release bash scripts/stage-staticlib.sh ) | |
| # A self-contained smoke program: build it fully static and assert it. | |
| smoke="$RUNNER_TEMP/ssstatic" | |
| mkdir -p "$smoke" | |
| cat > "$smoke/main.go" <<EOF | |
| package main | |
| import ( | |
| "fmt" | |
| secretspec "github.com/cachix/secretspec/secretspec-go" | |
| ) | |
| func main() { | |
| v, err := secretspec.ABIVersion() | |
| if err != nil { panic(err) } | |
| fmt.Println("abi", v) | |
| } | |
| EOF | |
| cat > "$smoke/go.mod" <<EOF | |
| module example.com/ssstatic | |
| go 1.23 | |
| require github.com/cachix/secretspec/secretspec-go v0.0.0 | |
| replace github.com/cachix/secretspec/secretspec-go => $GITHUB_WORKSPACE/secretspec-go | |
| EOF | |
| cd "$smoke" | |
| GOFLAGS=-mod=mod CGO_ENABLED=1 CC="$MUSL_CC" CGO_LDFLAGS="$MUSL_STATIC_LDFLAGS" \ | |
| go build -buildvcs=false -tags static \ | |
| -ldflags "-linkmode external -extldflags \"-static\"" -o ssstatic . | |
| file ssstatic | |
| file ssstatic | grep -q "statically linked" | |
| # ldd exits non-zero on a fully static binary, and pipefail would | |
| # propagate that through the pipe (aborting under set -e even when | |
| # grep matched), so capture its output first, then assert it reports | |
| # no dynamic dependencies. | |
| ldd_out="$(ldd ssstatic 2>&1 || true)" | |
| echo "$ldd_out" | grep -qE "not a dynamic executable|statically linked" | |
| ./ssstatic | |
| ' | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: go-static-x86_64-linux-musl | |
| path: | | |
| secretspec-go/lib/*.a | |
| secretspec-go/include/secretspec.h | |
| secretspec-go/cgo_ldflags_*.go | |
| release: | |
| name: Publish Go static release | |
| needs: static | |
| if: >- | |
| (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) || | |
| inputs.release_tag != '' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: go-static-x86_64-linux-musl | |
| path: staged | |
| - name: Attach the static SDK bundle to the GitHub Release | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASE_TAG: ${{ inputs.release_tag || github.ref_name }} | |
| run: | | |
| set -euo pipefail | |
| asset="secretspec-go-static-x86_64-linux-musl.tar.gz" | |
| tar -czf "$asset" -C staged . | |
| bash scripts/upload-release-asset.sh \ | |
| "$RELEASE_TAG" "$asset" |