ci(release): measure static linkage on dry runs instead of inferring it#80
Merged
Conversation
The musl targets exist so submod ships a fully static Linux binary, but a dry run built the archive and discarded it, so that property was only ever argued from curl-sys/openssl-sys build-script logic — never observed. Adds two workflow_dispatch-only steps to the build job: one that extracts the archive and asserts musl binaries are static (accepting both "statically linked" and the "static-pie linked" form Rust actually produces for musl, and failing loudly on anything dynamic), and one that keeps the archive as an artifact for 7 days so it can be inspected by hand. Both are gated on workflow_dispatch, so a v* tag release is unchanged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XocU6NjgZricrRWMLyLXDn
Codecov Report✅ All modified and coverable lines are covered by tests. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The musl targets added in #79 exist so submod ships a fully static Linux binary. But
dry-runbuilds the archive and then discards it, so that property was only ever argued — fromcurl-sys/openssl-sysbuild-script logic — never observed. The last dispatch confirmed vendored OpenSSL compiled and thatrustls/aws-lcappear nowhere in the build, but said nothing about the final binary's linkage.What
Two
workflow_dispatch-only steps on thebuildjob:file. For musl targets it asserts the binary is static and fails the job otherwise; for glibc targets it just reports, since dynamic linking is expected there.Both gated on
workflow_dispatch, so av*tag release is unchanged.One detail worth flagging
Rust links musl targets as static-pie by default, which
filereports asstatic-pie linked, notstatically linked. A naivegrep "statically linked"would have failed on a correctly-static binary. The check accepts both forms and rejects anything dynamic.🤖 Generated with Claude Code
https://claude.ai/code/session_01XocU6NjgZricrRWMLyLXDn