Merge pull request #1 from netbrah/feat/xli-v5-sync #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Build XLI binaries for Linux x86_64 + Linux EL9 | |
| # | |
| # Mac arm64 is intentionally NOT built by CI: macos-15-xlarge runners | |
| # are billed at a 10× multiplier on private repos and a single run | |
| # consumes ~5-8× the Linux budget. Operators build mac arm64 locally | |
| # via `deploy/build.sh mac` (happy path — every push comes from a mac | |
| # anyway and the build is ~20 min on M-series). | |
| # | |
| # Flow: | |
| # push to dev → build linux-amd64 (glibc 2.39) + linux-el9 (glibc 2.34) | |
| # manual dispatch → same | |
| # tag xli-v* → same | |
| # | |
| # The linux-el9 build runs inside an AlmaLinux 9 container to link | |
| # against glibc 2.34, which is required for RHEL 9 / EL9 hosts. | |
| # | |
| # After CI completes, pull artifacts locally and ship: | |
| # gh run download <run-id> -D artifacts/ | |
| # cp target/release/xli deploy/npm/vendor/aarch64-apple-darwin/xli/xli # from local deploy/build.sh mac | |
| # cp artifacts/xli-linux-amd64/xli deploy/npm/vendor/x86_64-unknown-linux-gnu/xli | |
| # cp artifacts/xli-linux-el9/xli deploy/npm/vendor/x86_64-unknown-linux-gnu-el9/xli | |
| # deploy/upload.sh ship | |
| name: xli-build | |
| on: | |
| push: | |
| branches: [dev] | |
| paths: | |
| - 'codex-rs/**' | |
| - 'deploy/**' | |
| - '.github/workflows/xli-build.yml' | |
| tags: | |
| - 'xli-v*' | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: 'Version label (default: from package.json)' | |
| required: false | |
| default: '' | |
| concurrency: | |
| group: xli-build-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # ── Test-bin compile gate (R9) ───────────────────────────────────── | |
| # A test target that fails to COMPILE is invisible to `cargo test --lib` | |
| # and to nextest filters: --lib stays green while a guarded contract | |
| # silently rots. Upstream merges are exactly when an integration test bin | |
| # breaks (a moved/deleted symbol it imported), so this blind spot aligns | |
| # with peak risk. Gate the binary build on every test target at least | |
| # compiling. Mirrors `just test-compile`. | |
| test-compile: | |
| name: Test-bin compile gate | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 45 | |
| defaults: | |
| run: | |
| working-directory: codex-rs | |
| env: | |
| RUST_MIN_STACK: "8388608" # 8 MiB | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache cargo | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| codex-rs/target | |
| key: xli-test-compile-${{ hashFiles('codex-rs/Cargo.lock') }} | |
| restore-keys: xli-test-compile- | |
| - name: Install Linux build deps | |
| run: | | |
| sudo apt-get update -y | |
| sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \ | |
| pkg-config libcap-dev | |
| - name: Compile all test targets (no run) | |
| run: cargo test --workspace --all-targets --no-run | |
| build: | |
| name: Build - ${{ matrix.platform }} | |
| needs: test-compile | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 45 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - runner: ubuntu-24.04 | |
| target: x86_64-unknown-linux-gnu | |
| platform: linux-amd64 | |
| artifact_name: xli-linux-amd64 | |
| defaults: | |
| run: | |
| working-directory: codex-rs | |
| env: | |
| CARGO_PROFILE_RELEASE_LTO: thin | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: ${{ matrix.target }} | |
| - name: Cache cargo | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| codex-rs/target | |
| key: xli-${{ matrix.target }}-${{ hashFiles('codex-rs/Cargo.lock') }} | |
| restore-keys: xli-${{ matrix.target }}- | |
| - name: Install Linux build deps | |
| if: runner.os == 'Linux' | |
| run: | | |
| sudo apt-get update -y | |
| sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \ | |
| pkg-config libcap-dev | |
| - name: Build | |
| run: cargo build --release --target ${{ matrix.target }} -p codex-cli | |
| - name: Strip + measure | |
| run: | | |
| BIN="target/${{ matrix.target }}/release/xli" | |
| strip "$BIN" 2>/dev/null || true | |
| echo "### ${{ matrix.platform }}" >> "$GITHUB_STEP_SUMMARY" | |
| echo '```' >> "$GITHUB_STEP_SUMMARY" | |
| ls -lh "$BIN" >> "$GITHUB_STEP_SUMMARY" | |
| echo '```' >> "$GITHUB_STEP_SUMMARY" | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: ${{ matrix.artifact_name }} | |
| path: codex-rs/target/${{ matrix.target }}/release/xli | |
| retention-days: 30 | |
| # ── EL9-compatible build (glibc 2.34) ────────────────────────────── | |
| # Runs inside an AlmaLinux 9 container so the resulting binary links | |
| # against glibc 2.34 instead of 2.39. Required for RHEL 9 / EL9 hosts. | |
| build-el9: | |
| name: Build - linux-el9 | |
| needs: test-compile | |
| runs-on: ubuntu-24.04 | |
| container: almalinux:9 | |
| timeout-minutes: 45 | |
| defaults: | |
| run: | |
| working-directory: codex-rs | |
| env: | |
| CARGO_PROFILE_RELEASE_LTO: thin | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install EL9 build deps + Rust | |
| working-directory: . | |
| run: | | |
| dnf install -y gcc gcc-c++ make pkg-config openssl-devel libcap-devel curl perl | |
| curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable | |
| echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" | |
| - name: Cache cargo | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| codex-rs/target | |
| key: xli-el9-x86_64-${{ hashFiles('codex-rs/Cargo.lock') }} | |
| restore-keys: xli-el9-x86_64- | |
| - name: Build | |
| run: | | |
| source "$HOME/.cargo/env" | |
| cargo build --release --target x86_64-unknown-linux-gnu -p codex-cli | |
| - name: Strip + measure | |
| run: | | |
| BIN="target/x86_64-unknown-linux-gnu/release/xli" | |
| strip "$BIN" 2>/dev/null || true | |
| echo "### linux-el9 (glibc 2.34)" >> "$GITHUB_STEP_SUMMARY" | |
| echo '```' >> "$GITHUB_STEP_SUMMARY" | |
| ls -lh "$BIN" >> "$GITHUB_STEP_SUMMARY" | |
| # Show max glibc symbol version for verification | |
| objdump -T "$BIN" 2>/dev/null | grep -oP 'GLIBC_\d+\.\d+' | sort -uV | tail -1 >> "$GITHUB_STEP_SUMMARY" || true | |
| echo '```' >> "$GITHUB_STEP_SUMMARY" | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: xli-linux-el9 | |
| path: codex-rs/target/x86_64-unknown-linux-gnu/release/xli | |
| retention-days: 30 | |
| summary: | |
| name: Summary | |
| runs-on: ubuntu-24.04 | |
| needs: [build, build-el9] | |
| if: always() | |
| steps: | |
| - name: Download artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: artifacts/ | |
| - name: Build summary | |
| run: | | |
| echo "## XLI Build Results" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "_Mac arm64 is built locally via \`deploy/build.sh mac\` — not by CI (10× Actions-minute multiplier)._" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "| Platform | Size | Status |" >> "$GITHUB_STEP_SUMMARY" | |
| echo "|----------|------|--------|" >> "$GITHUB_STEP_SUMMARY" | |
| for name in xli-linux-amd64 xli-linux-el9; do | |
| if [[ -f "artifacts/$name/xli" ]]; then | |
| size=$(du -h "artifacts/$name/xli" | cut -f1) | |
| echo "| $name | $size | :white_check_mark: |" >> "$GITHUB_STEP_SUMMARY" | |
| else | |
| echo "| $name | --- | :x: |" >> "$GITHUB_STEP_SUMMARY" | |
| fi | |
| done | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "**Pull artifacts locally:**" >> "$GITHUB_STEP_SUMMARY" | |
| echo '```bash' >> "$GITHUB_STEP_SUMMARY" | |
| echo "# Download from this run:" >> "$GITHUB_STEP_SUMMARY" | |
| echo "gh run download ${{ github.run_id }} -D /tmp/xli-artifacts" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "# Build the mac arm64 half locally (not produced by CI):" >> "$GITHUB_STEP_SUMMARY" | |
| echo "deploy/build.sh mac" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "# Stage and ship:" >> "$GITHUB_STEP_SUMMARY" | |
| echo "cp /tmp/xli-artifacts/xli-linux-amd64/xli deploy/npm/vendor/x86_64-unknown-linux-gnu/xli" >> "$GITHUB_STEP_SUMMARY" | |
| echo "cp /tmp/xli-artifacts/xli-linux-el9/xli deploy/npm/vendor/x86_64-unknown-linux-gnu-el9/xli" >> "$GITHUB_STEP_SUMMARY" | |
| echo "deploy/upload.sh ship" >> "$GITHUB_STEP_SUMMARY" | |
| echo '```' >> "$GITHUB_STEP_SUMMARY" |