relay/.github/workflows/build-broker-binary.yml at main · AgentWorkforce/relay · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
name: Build Broker Binary

on:
  push:
    branches: [main]
    paths:
      - 'crates/**'
      - 'Cargo.toml'
      - 'Cargo.lock'
      - '.github/workflows/build-broker-binary.yml'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag (e.g. v3.0.0, latest)'
        required: false
        default: 'latest'
        type: string

env:
  AGENT_RELAY_TELEMETRY_DISABLED: 1

jobs:
  build:
    name: Build (${{ matrix.target }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-musl
            artifact: agent-relay-broker-linux-x86_64
          - os: ubuntu-latest
            target: aarch64-unknown-linux-musl
            artifact: agent-relay-broker-linux-aarch64

    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}
          cache-bin: false

      - name: Install musl tools (x86_64)
        if: matrix.target == 'x86_64-unknown-linux-musl'
        run: |
          sudo apt-get update
          sudo apt-get install -y musl-tools

      - name: Install cross and strip tools (aarch64)
        if: matrix.target == 'aarch64-unknown-linux-musl'
        run: sudo apt-get update && sudo apt-get install -y binutils-aarch64-linux-gnu
      - name: Install cross (aarch64)
        if: matrix.target == 'aarch64-unknown-linux-musl'
        uses: taiki-e/install-action@cross

      - name: Build static binary
        # POSTHOG_PROJECT_KEY is a GitHub Actions repository *variable*
        # (Settings → Variables, NOT Secrets) because the PostHog ingest
        # key is a public-by-design write-only key — same category as a
        # Sentry DSN. We map it into the code-side env var name
        # `AGENT_RELAY_POSTHOG_KEY`, which `option_env!` in
        # crates/broker/src/telemetry.rs reads and bakes into the binary. Unset
        # variable → telemetry ships disabled (acceptable for forks and
        # pre-release pipelines).
        #
        # `AGENT_RELAY_VERSION` is consumed by `option_env!` in
        # crates/broker/src/util/version.rs. The standalone build is fed
        # from the dispatch tag input (or the repo's package.json version
        # for branch pushes) so the broker reports a release-line version
        # rather than the Cargo crate version.
        env:
          AGENT_RELAY_POSTHOG_KEY: ${{ vars.POSTHOG_PROJECT_KEY }}
        run: |
          # Resolve a release-line version for AGENT_RELAY_VERSION. Prefer the
          # workflow_dispatch tag (e.g. "v6.2.2" → "6.2.2"); fall back to
          # package.json on branch pushes.
          TAG_INPUT="${{ inputs.tag }}"
          if [[ -n "$TAG_INPUT" && "$TAG_INPUT" != "latest" ]]; then
            VERSION="${TAG_INPUT#v}"
          else
            # `npm pkg get` is available on the default GitHub runner image;
            # the value is quoted JSON, so strip the quotes.
            VERSION="$(npm pkg get version | tr -d '"')"
          fi
          export AGENT_RELAY_VERSION="$VERSION"
          echo "AGENT_RELAY_VERSION=$VERSION"
          if [[ "${{ matrix.target }}" == "aarch64-unknown-linux-musl" ]]; then
            RUSTFLAGS="-C target-feature=+crt-static" cross build --release --target ${{ matrix.target }} --bin agent-relay-broker
            aarch64-linux-gnu-strip target/${{ matrix.target }}/release/agent-relay-broker 2>/dev/null || true
          else
            RUSTFLAGS="-C target-feature=+crt-static" cargo build --release --target ${{ matrix.target }} --bin agent-relay-broker
            strip target/${{ matrix.target }}/release/agent-relay-broker 2>/dev/null || true
          fi

      - name: Verify static linking
        run: |
          file target/${{ matrix.target }}/release/agent-relay-broker
          # Ensure no dynamic glibc dependency
          ldd target/${{ matrix.target }}/release/agent-relay-broker 2>&1 | grep -q "not a dynamic" || \
            echo "Warning: binary may have dynamic dependencies"

      - name: Rename artifact
        run: cp target/${{ matrix.target }}/release/agent-relay-broker ${{ matrix.artifact }}

      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: ${{ matrix.artifact }}

  release:
    name: Upload to Release
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: Create or update release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ inputs.tag || 'latest' }}
          name: Broker Binary ${{ inputs.tag || 'latest' }}
          body: |
            Statically-linked broker binaries (musl, no glibc dependency).
            Built from commit ${{ github.sha }}.
          files: artifacts/*
          prerelease: ${{ inputs.tag == '' || inputs.tag == 'latest' }}
          make_latest: false