codex/.github/workflows/v8-canary.yml

name: v8-canary

# Do not use trigger-level path filters here. This workflow is also called by
# postmerge-ci, and GitHub cannot share a path filter between pull_request and
# workflow_call. v8_canary_changes.py is the single source of truth instead;
# unrelated events run only the cheap metadata job below.
on:
  workflow_call:
  pull_request: {}
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}::${{ github.event.pull_request.number > 0 && format('pr-{0}', github.event.pull_request.number) || github.ref_name }}
  cancel-in-progress: ${{ github.ref_name != 'main' }}

jobs:
  metadata:
    runs-on: ubuntu-latest
    outputs:
      # Older revisions can contain a detector that does not emit this output.
      # Missing must mean "run" so they cannot silently skip the expensive V8
      # coverage while reporting success.
      canary_required: ${{ steps.changes.outputs.canary_required || 'true' }}
      v8_version: ${{ steps.v8_version.outputs.version }}
      windows_source_required: ${{ steps.changes.outputs.windows_source_required }}

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"

      - name: Resolve exact v8 crate version
        id: v8_version
        shell: bash
        run: |
          set -euo pipefail
          version="$(python3 .github/scripts/rusty_v8_bazel.py resolved-v8-crate-version)"
          echo "version=${version}" >> "$GITHUB_OUTPUT"

      - name: Detect V8 canary changes
        id: changes
        env:
          BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
          EVENT_NAME: ${{ github.event_name }}
          HEAD_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
        shell: bash
        run: |
          set -euo pipefail

          # Manual runs have no meaningful before/after range. Force every V8
          # variant so workflow_dispatch remains a reliable retry path.
          if [[ "${EVENT_NAME}" == "workflow_dispatch" ]]; then
            output="$(python3 .github/scripts/v8_canary_changes.py --force)"
          else
            output="$(python3 .github/scripts/v8_canary_changes.py \
              --base "${BASE_SHA}" \
              --head "${HEAD_SHA}")"
          fi
          echo "${output}"
          echo "${output}" >> "${GITHUB_OUTPUT}"

      - name: Check for a clean worktree
        if: always() && !cancelled()
        uses: ./.github/actions/check-clean-worktree

  build:
    name: Build ${{ matrix.variant }} ${{ matrix.target }}
    needs: metadata
    # Metadata always runs; only relevant changes pay for the large matrix.
    if: ${{ needs.metadata.outputs.canary_required == 'true' }}
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
      actions: read
    environment:
      name: bazel
      deployment: false
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-24.04
            bazel_config: ci-v8
            platform: linux_amd64
            sandbox: false
            target: x86_64-unknown-linux-gnu
            variant: release
          - runner: ubuntu-24.04
            bazel_config: ci-v8
            platform: linux_amd64
            sandbox: true
            target: x86_64-unknown-linux-gnu
            variant: ptrcomp-sandbox
          - runner: ubuntu-24.04-arm
            bazel_config: ci-v8
            platform: linux_arm64
            sandbox: false
            target: aarch64-unknown-linux-gnu
            variant: release
          - runner: ubuntu-24.04-arm
            bazel_config: ci-v8
            platform: linux_arm64
            sandbox: true
            target: aarch64-unknown-linux-gnu
            variant: ptrcomp-sandbox
          - runner: macos-15-intel
            bazel_config: ci-macos
            platform: macos_amd64
            sandbox: false
            target: x86_64-apple-darwin
            variant: release
          - runner: macos-15-intel
            bazel_config: ci-macos
            platform: macos_amd64
            sandbox: true
            target: x86_64-apple-darwin
            variant: ptrcomp-sandbox
          - runner: macos-15-xlarge
            bazel_config: ci-macos
            platform: macos_arm64
            sandbox: false
            target: aarch64-apple-darwin
            variant: release
          - runner: macos-15-xlarge
            bazel_config: ci-macos
            platform: macos_arm64
            sandbox: true
            target: aarch64-apple-darwin
            variant: ptrcomp-sandbox
          - runner: ubuntu-24.04
            bazel_config: ci-v8
            platform: linux_amd64_musl
            sandbox: false
            target: x86_64-unknown-linux-musl
            variant: release
          - runner: ubuntu-24.04
            bazel_config: ci-v8
            platform: linux_amd64_musl
            sandbox: true
            target: x86_64-unknown-linux-musl
            variant: ptrcomp-sandbox
          - runner: ubuntu-24.04-arm
            bazel_config: ci-v8
            platform: linux_arm64_musl
            sandbox: false
            target: aarch64-unknown-linux-musl
            variant: release
          - runner: ubuntu-24.04-arm
            bazel_config: ci-v8
            platform: linux_arm64_musl
            sandbox: true
            target: aarch64-unknown-linux-musl
            variant: ptrcomp-sandbox
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Prepare Bazel CI
        uses: ./.github/actions/prepare-bazel-ci
        with:
          target: ${{ matrix.target }}
          cache-scope: bazel-v8

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"

      - name: Set up Rust toolchain for Cargo smoke
        uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
        with:
          toolchain: "1.95.0"
          targets: ${{ matrix.target }}

      - name: Build Bazel V8 release pair
        env:
          PLATFORM: ${{ matrix.platform }}
          SANDBOX: ${{ matrix.sandbox }}
          TARGET: ${{ matrix.target }}
        shell: bash
        run: |
          set -euo pipefail

          target_suffix="${TARGET//-/_}"
          pair_kind="release_pair"
          if [[ "${SANDBOX}" == "true" ]]; then
            pair_kind="sandbox_release_pair"
          fi
          pair_target="//third_party/v8:rusty_v8_${pair_kind}_${target_suffix}"

          bazel_args=(
            build
            "--platforms=@llvm//platforms:${PLATFORM}"
            "${pair_target}"
            --build_metadata=COMMIT_SHA=$(git rev-parse HEAD)
          )

          ./.github/scripts/run_bazel_with_buildbuddy.py \
            --noexperimental_remote_repo_contents_cache \
            "${bazel_args[@]}" \
            "--config=${{ matrix.bazel_config }}"

      - name: Stage release pair
        env:
          BAZEL_CONFIG: ${{ matrix.bazel_config }}
          PLATFORM: ${{ matrix.platform }}
          SANDBOX: ${{ matrix.sandbox }}
          TARGET: ${{ matrix.target }}
        shell: bash
        run: |
          set -euo pipefail

          stage_args=(
            --platform "${PLATFORM}"
            --target "${TARGET}"
            --output-dir "dist/${TARGET}"
            --bazel-config "${BAZEL_CONFIG}"
          )
          if [[ "${SANDBOX}" == "true" ]]; then
            stage_args+=(--sandbox)
          fi

          python3 .github/scripts/rusty_v8_bazel.py stage-release-pair "${stage_args[@]}"

      # Larger Linux runner images may omit the host linker used by Cargo build scripts.
      - name: Install native Linux Cargo smoke dependencies
        if: ${{ runner.os == 'Linux' }}
        env:
          TARGET: ${{ matrix.target }}
        shell: bash
        run: |
          set -euo pipefail
          packages=(build-essential)
          if [[ "${TARGET}" == *-musl ]]; then
            packages+=(musl-tools)
          fi
          sudo apt-get update -y
          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "${packages[@]}"
          if [[ "${TARGET}" == *-musl ]]; then
            # Use musl only for target links; Cargo build scripts still link on the glibc host.
            linker_var="CARGO_TARGET_${TARGET^^}_LINKER"
            echo "${linker_var//-/_}=$(command -v musl-gcc)" >> "${GITHUB_ENV}"
          fi

      - name: Smoke test staged artifact with Cargo
        env:
          SANDBOX: ${{ matrix.sandbox }}
          TARGET: ${{ matrix.target }}
        shell: bash
        run: |
          set -euo pipefail

          archive="$(find "dist/${TARGET}" -maxdepth 1 -type f -name 'librusty_v8_*.a.gz' -print -quit)"
          binding="$(find "dist/${TARGET}" -maxdepth 1 -type f -name 'src_binding_*.rs' -print -quit)"
          if [[ -z "${archive}" || -z "${binding}" ]]; then
            echo "Missing staged archive or binding for ${TARGET}." >&2
            exit 1
          fi

          cargo_args=(test -p codex-v8-poc --target "${TARGET}")
          if [[ "${SANDBOX}" == "true" ]]; then
            cargo_args+=(--features sandbox)
          fi
          cargo_args+=(-- --include-ignored)

          (
            cd codex-rs
            CARGO_TARGET_DIR="${RUNNER_TEMP}/rusty-v8-cargo-smoke-${TARGET}-${SANDBOX}" \
            RUSTY_V8_ARCHIVE="${GITHUB_WORKSPACE}/${archive}" \
            RUSTY_V8_SRC_BINDING_PATH="${GITHUB_WORKSPACE}/${binding}" \
            cargo "${cargo_args[@]}"
          )

      - name: Upload staged artifacts
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: v8-canary-${{ needs.metadata.outputs.v8_version }}-${{ matrix.variant }}-${{ matrix.target }}
          path: dist/${{ matrix.target }}/*

      - name: Check for a clean worktree
        if: always() && !cancelled()
        uses: ./.github/actions/check-clean-worktree

  build-windows-source:
    name: Build ptrcomp-sandbox ${{ matrix.target }} from source
    needs: metadata
    if: ${{ needs.metadata.outputs.windows_source_required == 'true' }}
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: windows-2025
            target: x86_64-pc-windows-msvc
          - runner: windows-2025
            target: aarch64-pc-windows-msvc

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - id: setup_ci
        uses: ./.github/actions/setup-ci

      - name: Configure git for upstream checkout
        shell: bash
        run: git config --global core.symlinks true

      - name: Check out upstream rusty_v8
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          repository: denoland/rusty_v8
          ref: v${{ needs.metadata.outputs.v8_version }}
          path: upstream-rusty-v8
          submodules: recursive
          persist-credentials: false

      - name: Download upstream Windows build tools
        shell: bash
        working-directory: upstream-rusty-v8
        run: |
          set -euo pipefail
          # Upstream skips this submodule and downloads the pinned archive in CI.
          mkdir -p tools/win
          curl -fL https://chromium.googlesource.com/chromium/src/tools/win/+archive/faefd1b6fa9eeb033ad6fe60368ccb9bf908cbd0.tar.gz |
            tar -xz -C tools/win

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: "3.11"
          architecture: x64

      - name: Set up Codex Rust toolchain for Cargo smoke
        uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
        with:
          toolchain: "1.95.0"
          targets: ${{ matrix.target }}

      - name: Install rusty_v8 Rust toolchain
        env:
          TARGET: ${{ matrix.target }}
        shell: bash
        run: |
          set -euo pipefail
          rustup toolchain install 1.91.0 --profile minimal --no-self-update
          rustup target add --toolchain 1.91.0 "${TARGET}"

      - name: Write upstream submodule status
        shell: bash
        working-directory: upstream-rusty-v8
        run: git submodule status --recursive > git_submodule_status.txt

      - name: Restore upstream source-build cache
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
        with:
          path: |
            ${{ steps.setup_ci.outputs.cargo-target-dir }}/sccache
            ${{ steps.setup_ci.outputs.cargo-target-dir }}/${{ matrix.target }}/release/gn_out
          key: rusty-v8-source-${{ matrix.target }}-${{ matrix.runner }}-sandbox-${{ hashFiles('upstream-rusty-v8/Cargo.lock', 'upstream-rusty-v8/build.rs', 'upstream-rusty-v8/git_submodule_status.txt', 'patches/v8_array_sort_elements_kind.patch') }}
          restore-keys: |
            rusty-v8-source-${{ matrix.target }}-${{ matrix.runner }}-sandbox-

      - name: Apply V8 Array.sort backport
        shell: bash
        working-directory: upstream-rusty-v8/v8
        run: git apply -p3 "${GITHUB_WORKSPACE}/patches/v8_array_sort_elements_kind.patch"

      - name: Install sccache
        uses: taiki-e/install-action@44c6d64aa62cd779e873306675c7a58e86d6d532 # v2.62.49
        with:
          tool: sccache@0.8.2

      - name: Start sccache
        shell: pwsh
        env:
          SCCACHE_CACHE_SIZE: 256M
          SCCACHE_DIR: ${{ steps.setup_ci.outputs.cargo-target-dir }}/sccache
          SCCACHE_IDLE_TIMEOUT: 0
        run: sccache --start-server

      - name: Install Chromium clang for ARM64 MSVC cross build
        if: matrix.target == 'aarch64-pc-windows-msvc'
        shell: bash
        working-directory: upstream-rusty-v8
        run: python3 tools/clang/scripts/update.py

      - name: Build upstream rusty_v8 sandbox release pair
        env:
          SCCACHE_IDLE_TIMEOUT: 0
          TARGET: ${{ matrix.target }}
          V8_FROM_SOURCE: "1"
        shell: bash
        working-directory: upstream-rusty-v8
        run: cargo +1.91.0 build --locked --release --target "${TARGET}" --features v8_enable_sandbox

      - name: Stage upstream sandbox release pair
        env:
          TARGET: ${{ matrix.target }}
        shell: bash
        run: |
          set -euo pipefail
          python3 .github/scripts/rusty_v8_bazel.py stage-upstream-release-pair \
            --target-dir "${CARGO_TARGET_DIR}" \
            --target "${TARGET}" \
            --output-dir "dist/${TARGET}" \
            --sandbox

      - name: Smoke link staged artifact with Cargo
        env:
          TARGET: ${{ matrix.target }}
        shell: bash
        run: |
          set -euo pipefail

          archive="$(find "dist/${TARGET}" -maxdepth 1 -type f -name 'rusty_v8_*.lib.gz' -print -quit)"
          binding="$(find "dist/${TARGET}" -maxdepth 1 -type f -name 'src_binding_*.rs' -print -quit)"
          if [[ -z "${archive}" || -z "${binding}" ]]; then
            echo "Missing staged archive or binding for ${TARGET}." >&2
            exit 1
          fi

          (
            cd codex-rs
            RUSTY_V8_ARCHIVE="${GITHUB_WORKSPACE}/${archive}" \
            RUSTY_V8_SRC_BINDING_PATH="${GITHUB_WORKSPACE}/${binding}" \
            cargo +1.95.0 test -p codex-v8-poc --target "${TARGET}" --features sandbox --no-run
          )

      - name: Upload staged artifacts
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
        with:
          name: v8-canary-${{ needs.metadata.outputs.v8_version }}-ptrcomp-sandbox-${{ matrix.target }}
          path: dist/${{ matrix.target }}/*

      - name: Check for a clean worktree
        if: always() && !cancelled()
        uses: ./.github/actions/check-clean-worktree