Migrate CI to dcc-bigfred/common shared workflows

.github/workflows/ci.yml

@@ -9,157 +9,16 @@ on:
       - "v*"
   pull_request:
 
-permissions:
-  contents: read
-
 concurrency:
   group: ci-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  test:
-    name: Test
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rustfmt, clippy
-
-      - name: Cache cargo
-        uses: Swatinem/rust-cache@v2
-
-      - name: Format
-        run: cargo fmt --all -- --check
-
-      - name: Clippy
-        run: cargo clippy --all-targets -- -D warnings
-
-      - name: Test
-        run: cargo test --locked
-
-  build:
-    name: Build musl (${{ matrix.name }})
-    needs: test
-    runs-on: ${{ matrix.runner }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - name: arm64
-            runner: ubuntu-24.04-arm
-            rust_target: aarch64-unknown-linux-musl
-            dist_name: microdns-linux-arm64
-            linker_env: CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER
-            cc_env: CC_aarch64_unknown_linux_musl
-            ar_env: AR_aarch64_unknown_linux_musl
-          - name: amd64
-            runner: ubuntu-latest
-            rust_target: x86_64-unknown-linux-musl
-            dist_name: microdns-linux-amd64
-            linker_env: CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER
-            cc_env: CC_x86_64_unknown_linux_musl
-            ar_env: AR_x86_64_unknown_linux_musl
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.rust_target }}
-
-      - name: Cache cargo
-        uses: Swatinem/rust-cache@v2
-        with:
-          key: ${{ matrix.name }}-musl
-
-      - name: Install musl toolchain (apt)
-        run: |
-          set -euo pipefail
-          sudo apt-get update
-          sudo apt-get install -y musl-tools musl-dev
-          musl-gcc --version
-
-      - name: Build static binary + package dist
-        run: |
-          set -euo pipefail
-          export ${{ matrix.linker_env }}=musl-gcc
-          export ${{ matrix.cc_env }}=musl-gcc
-          export ${{ matrix.ar_env }}=ar
-          export RUSTFLAGS='-C target-feature=+crt-static'
-          export MICRODNS_GIT_COMMIT="${GITHUB_SHA}"
-          export MICRODNS_BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-
-          cargo build --release --target ${{ matrix.rust_target }}
-
-          mkdir -p dist
-          cp -f "target/${{ matrix.rust_target }}/release/microdns" "dist/${{ matrix.dist_name }}"
-          chmod 755 "dist/${{ matrix.dist_name }}"
-
-          if [ "${{ matrix.name }}" = "arm64" ]; then
-            (
-              cd dist
-              sha256sum microdns-linux-arm64 > SHA256SUMS
-            )
-          fi
-
-          file "dist/${{ matrix.dist_name }}"
-          if ldd "dist/${{ matrix.dist_name }}" 2>&1 | grep -qi 'not a dynamic\|statically linked'; then
-            echo "static binary OK: dist/${{ matrix.dist_name }}"
-          else
-            echo "warning: ldd output:" >&2
-            ldd "dist/${{ matrix.dist_name }}" >&2 || true
-          fi
-          ls -lh "dist/${{ matrix.dist_name }}"
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: binaries-${{ matrix.name }}
-          path: dist/
-          if-no-files-found: error
-          retention-days: 90
-
-  publish-oci:
-    name: Publish OCI artifact to GHCR (ORAS)
-    needs: build
-    if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main')
-    runs-on: ubuntu-latest
+  ci:
     permissions:
       contents: read
-      packages: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Download arm64 binaries
-        uses: actions/download-artifact@v4
-        with:
-          name: binaries-arm64
-          path: dist/
-
-      - name: Set up ORAS
-        uses: oras-project/setup-oras@v1
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Publish microdns-linux-arm64
-        run: ./scripts/publish-oci-microdns.sh dist/microdns-linux-arm64
-
-      - name: Job summary
-        run: |
-          {
-            echo "### OCI publish (ORAS)"
-            echo ""
-            echo "- Image: \`ghcr.io/dcc-bigfred/microdns-linux-arm64\`"
-            echo "- Tags: \`main\`, \`sha-${GITHUB_SHA::7}\`"
-          } >> "$GITHUB_STEP_SUMMARY"
+    uses: dcc-bigfred/common/.github/workflows/rust-musl-ci.yml@v2
+    with:
+      binaries: '[{"name":"microdns","dist":"microdns-linux"}]'
+      build_env: |
+        MICRODNS_GIT_COMMIT=${{ github.sha }}

.github/workflows/release.yml

@@ -5,125 +5,13 @@ on:
     tags:
       - "v*"
 
-permissions:
-  contents: write
-  packages: write
-
 jobs:
   release:
-    name: Publish GitHub release + OCI tags
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Wait for CI build artifacts
-        id: ci
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          SHA="${GITHUB_SHA}"
-          DEADLINE=$(( $(date +%s) + 1800 ))
-          RUN_ID=""
-
-          while [ "$(date +%s)" -lt "$DEADLINE" ]; do
-            RUN_JSON="$(gh run list --workflow=ci.yml --commit="$SHA" --limit=1 --json databaseId,status,conclusion)"
-            if [ "$RUN_JSON" = "[]" ]; then
-              echo "CI workflow run for ${SHA} not found yet; retrying..."
-              sleep 15
-              continue
-            fi
-
-            STATUS="$(echo "$RUN_JSON" | jq -r '.[0].status')"
-            CONCLUSION="$(echo "$RUN_JSON" | jq -r '.[0].conclusion')"
-            RUN_ID="$(echo "$RUN_JSON" | jq -r '.[0].databaseId')"
-
-            if [ "$STATUS" = "completed" ]; then
-              if [ "$CONCLUSION" != "success" ]; then
-                echo "CI workflow run ${RUN_ID} finished with conclusion: ${CONCLUSION}"
-                exit 1
-              fi
-              echo "CI workflow run ${RUN_ID} succeeded"
-              echo "run_id=${RUN_ID}" >> "$GITHUB_OUTPUT"
-              exit 0
-            fi
-
-            echo "CI workflow run ${RUN_ID} status=${STATUS}; waiting..."
-            sleep 15
-          done
-
-          echo "Timed out after 30 minutes waiting for CI workflow on commit ${SHA}"
-          exit 1
-
-      - name: Download CI binaries (linux arm64)
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          mkdir -p release-assets
-          gh run download "${{ steps.ci.outputs.run_id }}" \
-            --name binaries-arm64 \
-            --dir release-assets
-
-      - name: Download CI binaries (linux amd64)
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          mkdir -p release-assets
-          gh run download "${{ steps.ci.outputs.run_id }}" \
-            --name binaries-amd64 \
-            --dir release-assets/amd64
-          find release-assets/amd64 -type f -exec cp -f {} release-assets/ \;
-          rm -rf release-assets/amd64
-
-      - name: Create release if missing
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          TAG="${GITHUB_REF_NAME}"
-          if ! gh release view "$TAG" >/dev/null 2>&1; then
-            gh release create "$TAG" \
-              --title "$TAG" \
-              --generate-notes
-          else
-            echo "Release ${TAG} already exists"
-          fi
-
-      - name: Upload binaries to release
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          TAG="${GITHUB_REF_NAME}"
-          mapfile -d '' FILES < <(find release-assets -type f -print0)
-          if [ "${#FILES[@]}" -eq 0 ]; then
-            echo "No release assets found"
-            exit 1
-          fi
-          gh release upload "$TAG" "${FILES[@]}" --clobber
-
-      - name: Set up ORAS
-        uses: oras-project/setup-oras@v1
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Retag microdns ORAS artifact from main
-        run: ./scripts/retag-oci-microdns.sh "${GITHUB_REF_NAME}"
-
-      - name: Job summary
-        run: |
-          {
-            echo "### Release ${GITHUB_REF_NAME}"
-            echo ""
-            echo "- GitHub Release assets uploaded (linux arm64 + amd64)"
-            echo "- ORAS: \`ghcr.io/dcc-bigfred/microdns-linux-arm64:${GITHUB_REF_NAME}\`"
-            echo "- ORAS: \`ghcr.io/dcc-bigfred/microdns-linux-arm64:latest-release\`"
-          } >> "$GITHUB_STEP_SUMMARY"
+    permissions:
+      contents: write
+    uses: dcc-bigfred/common/.github/workflows/rust-release.yml@v2
+    with:
+      elf_binaries: microdns-linux-arm64
+      elf_section: .microdns.version
+      ci_workflow: ci.yml
+    secrets: inherit

.gitignore

@@ -1,5 +1,6 @@
 /target/
 /dist/
+/.ci-github/
 **/*.rs.bk
 *.swp
 *.swo

Cargo.toml

@@ -35,6 +35,11 @@ strip = true
 panic = "abort"
 overflow-checks = true
 
+[profile.release-assertions]
+inherits = "release"
+debug-assertions = true
+overflow-checks = true
+
 [lints.rust]
 unused_must_use = "deny"
 

Makefile

@@ -5,7 +5,8 @@ CARGO ?= cargo
 RUSTUP_TOOLCHAIN ?= stable
 export RUSTUP_TOOLCHAIN
 
-.PHONY: all build release release-musl check test clean fmt clippy
+.PHONY: all build release release-musl check test test-release-assertions \
+	clean fmt clippy
 
 all: build
 
@@ -28,6 +29,9 @@ check:
 test:
 	$(CARGO) test
 
+test-release-assertions:
+	$(CARGO) test --profile release-assertions
+
 fmt:
 	$(CARGO) fmt