From d3bc65f60ab46a0fb2763093e8ad3ae5ce1f2320 Mon Sep 17 00:00:00 2001 From: Ben Llanes Date: Tue, 10 Mar 2026 15:50:00 +0000 Subject: [PATCH 1/3] ci: add workflow to build and release deterministic binding Triggered on v*-deterministic tags. Builds linux-x64-gnu with the release profile (fat LTO, strip) in the upstream napi-rs Docker image, packages as an npm-compatible tarball, and creates a GitHub Release. --- .github/workflows/release-deterministic.yml | 71 +++++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 .github/workflows/release-deterministic.yml diff --git a/.github/workflows/release-deterministic.yml b/.github/workflows/release-deterministic.yml new file mode 100644 index 000000000000..6bd2dea00925 --- /dev/null +++ b/.github/workflows/release-deterministic.yml @@ -0,0 +1,71 @@ +name: Release Deterministic Binding + +on: + push: + tags: + - "v*-deterministic" + +permissions: + contents: write + +jobs: + build: + uses: ./.github/workflows/reusable-build-build.yml + with: + target: x86_64-unknown-linux-gnu + runner: '["ubuntu-latest"]' + profile: release + prefer_docker: true + + release: + needs: build + runs-on: ubuntu-latest + steps: + - name: Download binding artifact + uses: actions/download-artifact@v4 + with: + name: bindings-x86_64-unknown-linux-gnu + path: artifact + + - name: Package tarball + run: | + mkdir -p package + cp artifact/rspack.linux-x64-gnu.node package/ + cat > package/package.json << 'EOF' + { + "name": "@rspack/binding-linux-x64-gnu", + "version": "${{ github.ref_name }}", + "os": ["linux"], + "cpu": ["x64"], + "main": "rspack.linux-x64-gnu.node", + "files": ["rspack.linux-x64-gnu.node"], + "license": "MIT", + "description": "Patched rspack binding with deterministic contenthash fixes" + } + EOF + # Fix version — strip the leading 'v' from the tag + VERSION="${{ github.ref_name }}" + sed -i "s/\"version\": \".*\"/\"version\": \"${VERSION#v}\"/" package/package.json + # Strip leading whitespace from heredoc + sed -i 's/^ //' package/package.json + cat package/package.json + tar czf rspack-binding-linux-x64-gnu-deterministic.tgz package/ + + - name: Verify glibc compatibility + run: | + objdump -T artifact/rspack.linux-x64-gnu.node \ + | grep GLIBC_ | sed 's/.*GLIBC_/GLIBC_/' | sort -uV | tail -5 + MAX_GLIBC=$(objdump -T artifact/rspack.linux-x64-gnu.node \ + | grep -oP 'GLIBC_\d+\.\d+' | sort -t. -k1,1n -k2,2n | tail -1) + echo "Max GLIBC requirement: $MAX_GLIBC" + + - name: Create GitHub Release + uses: softprops/action-gh-release@v2 + with: + files: rspack-binding-linux-x64-gnu-deterministic.tgz + body: | + Patched `@rspack/binding-linux-x64-gnu` with deterministic contenthash fixes for RBE builds. + + Built with upstream's Docker image (`ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-debian`) and `release` profile (fat LTO, strip, codegen-units=1). + + See the `v1.7.5-deterministic` branch for the source diff against upstream v1.7.5. From 5b253cd213fb3162314ae6676cb8a1749e0ba5c1 Mon Sep 17 00:00:00 2001 From: Ben Llanes Date: Tue, 10 Mar 2026 15:57:00 +0000 Subject: [PATCH 2/3] ci: rewrite release workflow as self-contained Docker build The reusable-build-build.yml from main is incompatible with the v1.7.5 codebase (cargo codegen differences). Replace with a self-contained workflow that builds directly in Docker, matching the local build approach. Adds glibc compatibility verification step. --- .github/workflows/release-deterministic.yml | 75 ++++++++++++--------- 1 file changed, 44 insertions(+), 31 deletions(-) diff --git a/.github/workflows/release-deterministic.yml b/.github/workflows/release-deterministic.yml index 6bd2dea00925..694845f59e13 100644 --- a/.github/workflows/release-deterministic.yml +++ b/.github/workflows/release-deterministic.yml @@ -3,38 +3,63 @@ name: Release Deterministic Binding on: push: tags: - - "v*-deterministic" + - 'v*-deterministic' permissions: contents: write jobs: - build: - uses: ./.github/workflows/reusable-build-build.yml - with: - target: x86_64-unknown-linux-gnu - runner: '["ubuntu-latest"]' - profile: release - prefer_docker: true - - release: - needs: build + build-and-release: runs-on: ubuntu-latest steps: - - name: Download binding artifact - uses: actions/download-artifact@v4 - with: - name: bindings-x86_64-unknown-linux-gnu - path: artifact + - name: Checkout + uses: actions/checkout@v4 + + - name: Build binding in Docker + run: | + docker run --rm \ + -e CARGO_INCREMENTAL=0 \ + -e CI=1 \ + -v ${{ github.workspace }}:/rspack \ + -w /rspack \ + ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-debian \ + bash -c ' + set -ex + rustup target add x86_64-unknown-linux-gnu + npm install -g corepack@0.31.0 --force + corepack enable + mkdir -p .cargo + touch .cargo/config.toml + echo "" >> .cargo/config.toml + echo "trim-paths = true" >> .cargo/config.toml + pnpm install --frozen-lockfile + cargo codegen + RUST_TARGET=x86_64-unknown-linux-gnu pnpm build:binding:release + ' + sudo chown -R $USER:$USER . + + - name: Verify glibc compatibility + run: | + objdump -T crates/node_binding/rspack.linux-x64-gnu.node \ + | grep GLIBC_ | sed 's/.*GLIBC_/GLIBC_/' | sort -uV | tail -5 + MAX_GLIBC=$(objdump -T crates/node_binding/rspack.linux-x64-gnu.node \ + | grep -oP 'GLIBC_\d+\.\d+' | sort -t. -k1,1n -k2,2n | tail -1) + echo "Max GLIBC requirement: $MAX_GLIBC" + if [[ "$MAX_GLIBC" > "GLIBC_2.17" ]]; then + echo "ERROR: Max GLIBC $MAX_GLIBC exceeds 2.17 — binary may not work on RBE workers" + exit 1 + fi - name: Package tarball run: | + VERSION="${{ github.ref_name }}" + VERSION="${VERSION#v}" # strip leading 'v' mkdir -p package - cp artifact/rspack.linux-x64-gnu.node package/ - cat > package/package.json << 'EOF' + cp crates/node_binding/rspack.linux-x64-gnu.node package/ + cat > package/package.json << EOF { "name": "@rspack/binding-linux-x64-gnu", - "version": "${{ github.ref_name }}", + "version": "${VERSION%-deterministic}", "os": ["linux"], "cpu": ["x64"], "main": "rspack.linux-x64-gnu.node", @@ -43,22 +68,10 @@ jobs: "description": "Patched rspack binding with deterministic contenthash fixes" } EOF - # Fix version — strip the leading 'v' from the tag - VERSION="${{ github.ref_name }}" - sed -i "s/\"version\": \".*\"/\"version\": \"${VERSION#v}\"/" package/package.json - # Strip leading whitespace from heredoc sed -i 's/^ //' package/package.json cat package/package.json tar czf rspack-binding-linux-x64-gnu-deterministic.tgz package/ - - name: Verify glibc compatibility - run: | - objdump -T artifact/rspack.linux-x64-gnu.node \ - | grep GLIBC_ | sed 's/.*GLIBC_/GLIBC_/' | sort -uV | tail -5 - MAX_GLIBC=$(objdump -T artifact/rspack.linux-x64-gnu.node \ - | grep -oP 'GLIBC_\d+\.\d+' | sort -t. -k1,1n -k2,2n | tail -1) - echo "Max GLIBC requirement: $MAX_GLIBC" - - name: Create GitHub Release uses: softprops/action-gh-release@v2 with: From 21a5a708d64242e9eaf38f50bebe59b76ad4dfed Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 21 May 2026 13:22:19 +0000 Subject: [PATCH 3/3] chore(deps): bump rand from 0.8.5 to 0.8.6 Bumps [rand](https://github.com/rust-random/rand) from 0.8.5 to 0.8.6. - [Release notes](https://github.com/rust-random/rand/releases) - [Changelog](https://github.com/rust-random/rand/blob/0.8.6/CHANGELOG.md) - [Commits](https://github.com/rust-random/rand/compare/0.8.5...0.8.6) --- updated-dependencies: - dependency-name: rand dependency-version: 0.8.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index f8e6589d3825..de6cbf1092f4 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3243,9 +3243,9 @@ dependencies = [ [[package]] name = "rand" -version = "0.8.5" +version = "0.8.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404" +checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a" dependencies = [ "libc", "rand_chacha",