cc18490979
Some checks failed
WAI operation catalogue / does this change touch it (push) Successful in 17s
wai-sink-android native sink library / does this change touch it (push) Successful in 18s
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (push) Has been cancelled
wai-sink-android native sink library / every ABI, the AAR, and the instrumented tests in a headless emulator · macos (push) Successful in 6m34s
WAI breaking changes and the conformance runner / WAI breaking · does this change touch WAI (push) Successful in 9s
WAI breaking changes and the conformance runner / WAI breaking · wire, record and API against main · linux (push) Successful in 48s
WAI operation catalogue / the catalogue and every door · linux (push) Successful in 6m36s
WAI breaking changes and the conformance runner / WAI breaking and conform · their tests, and the independent verifiers through wai conform · linux (push) Successful in 7m22s
wai-sink-android native sink library / the JNI layer and the platform-free half on the host JVM · linux-arm64 (push) Has been cancelled
The first wai-v* tag after 0833173ed would have failed the Android leg's publication and the
images job without the secret WAI_PACKAGES_TOKEN, and left the images job unclaimed with no
runner labelled oci, which keeps the run open. Both now run only once the setup exists, and fail
as before once they run:
- A job setup (gate pool, no checkout) reports whether WAI_PACKAGES_TOKEN is set as an output,
never its value, since a job's `if:` cannot read a secret; each missing piece of the setup is
one notice line, and it succeeds.
- The Maven publication step tests the mapped secret: without it, one notice and success. The
AAR is still built, checked and attached.
- The images job needs version and setup, with
`if: needs.version.result == 'success' && needs.setup.outputs.packages == 'true' &&
vars.WAI_OCI_RUNNER == 'true'`. Forgejo 16.0.6 evaluates a blocked job's `if:` on the server
once its needs are done (services/actions/job_emitter.go, prepareJobForEmitting), with the
`vars` context and the needs' results and outputs (runner v12.13.2's jobparser,
newJobIfInterpreter); a false one marks the job skipped, so it is never queued for a runner.
Only `env` and `secrets` there fall back to the runner, and neither is used.
The workflow's header gives the owner's steps in order: the secret, then an oci runner and the
variable WAI_OCI_RUNNER=true.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
42 lines
3.8 KiB
Markdown
42 lines
3.8 KiB
Markdown
### The release carries libwai for C, the Swift and Android packages, and the relay's and room service's images
|
|
|
|
- **C** (`quickstart/build-libwai.sh`): each Linux job of the release attaches
|
|
`libwai-<version>-<triple>.tar.gz`, for `x86_64-` and `aarch64-unknown-linux-gnu`. It holds
|
|
`lib/libwai.a`, built from wai-rs with the feature `native_sink` (the envelope and the native
|
|
sink, the C interface the Swift and Android packages carry; no codec library), for the glibc
|
|
target and without crt-static; the committed `include/wai.h`; and `lib/pkgconfig/wai.pc`, whose
|
|
prefix is its own directory and whose `Libs` name the system libraries the static library needs.
|
|
The library is static so that a program carries it: nothing of libwai is looked for when the
|
|
program runs, and its C runtime is the one it is linked against. Before it is attached, the header
|
|
the build regenerated must be the committed one, the library must define exactly the envelope's
|
|
and the native sink's functions (`quickstart/libwai_interface.py`), and
|
|
`quickstart/test/c-library.sh` compiles `quickstart/test/c/hello.c` against the archive with the
|
|
flags `pkg-config --cflags --libs wai` gives, links it and runs it.
|
|
- **Swift** (`wai-sink-swift`): `Package.swift` names the binary target `WaiFFI` by URL and checksum
|
|
where a release has written them, and `build/WaiFFI.xcframework` while it is built there. The
|
|
release's `swift` job builds every slice and attaches `WaiFFI-<version>.xcframework.zip` and
|
|
`wai-sink-swift-<version>.zip`, the package whose `Package.swift` names the zip by its download
|
|
URL and SwiftPM checksum (`scripts/package-release.sh`). `scripts/check-release-package.sh`
|
|
resolves, builds and runs an application that depends on the package, before the attach with the
|
|
framework served through a mirror of the URL and after from the URL itself, and requires the
|
|
package with a wrong checksum to be refused; `wai-sink-swift.yml` runs the first on every change.
|
|
- **Kotlin** (`wai-sink-android`): the library is published with maven-publish as
|
|
`science.transaction.wai:wai-sink:<version>`, the version of wai-rs, and its manifest is of the
|
|
package `science.transaction.wai.sink` (it was `wai.sink`; the Kotlin classes keep the package
|
|
`wai.sink`, which the JNI layer's symbols name). The release's `android` job holds the publication
|
|
to `scripts/check-publication.sh` (its coordinates, its manifest's package, both libraries of each
|
|
ABI, its classes), attaches `wai-sink-<version>.aar`, and publishes it to the forge's Maven
|
|
registry; `wai-sink-android.yml` writes and checks the publication on every change.
|
|
- **Images** (joule-code: `joule-moq-relay/deploy/`, `joule-moq-room/deploy/`): Containerfiles for
|
|
the relay and the room service, each with a `check-image.sh` that runs the image with a read-only
|
|
root and no capabilities and requires its user, its `--version` and its service: the relay's
|
|
WebSocket opening answered with its first capsule, and the room service's `/health` with its
|
|
clock's session to the relay's image up. The release's `images` job builds both, checks them and
|
|
pushes them to the forge's container registry (`quickstart/release-images.sh`,
|
|
`quickstart/oci-push.py`); an image that fails its check is not pushed.
|
|
- The forge's job token reads the organisation's packages and cannot write them, so the Maven
|
|
publication and the images run only once the owner's setup exists: the repository secret
|
|
`WAI_PACKAGES_TOKEN`, a forge token with the scope `write:package`, and for the images a runner
|
|
labelled `oci` and the repository variable `WAI_OCI_RUNNER` set to `true`. Until then the release
|
|
says which is missing in a notice and succeeds: the AAR is attached unpublished, and the images
|
|
job is skipped, not queued. Everything uploads to the forge over the private network.
|