Publish portable x86-64 and AArch64 Linux builds

.github/workflows/build_binary.yml

@@ -5,43 +5,66 @@ description: |
 
 on:
   push:
-    branches: [ 'main' ]
-    tags: [ '*' ]
+    branches: ['main']
+    tags: ['*']
 
   pull_request:
-    branches: [ '*' ]
+    branches: ['*']
 
 jobs:
-  build-binary:
-    name: 'Build binary'
-    runs-on: ubuntu-latest
+  generate-target-metadata:
+    name: 'Generate target metadata (${{ matrix.target }})'
+    runs-on: ${{ matrix.runner }}
     env:
-      ASTREIN_VERSION: '1.1.0'
-      ASTREIN_SHA256: 'd5964319ea5a3742e4d7223ee5963d6aa3b24c8f67ef75c61d591c635f413497'
-    permissions:
-      contents: write
+      ASTREIN_VERSION: '1.2.0'
+      ASTREIN_SHA256: ${{ matrix.astrein-sha256 }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: x86_64-linux-gnu
+            arch: x86_64
+            runner: ubuntu-24.04
+            astrein-archive: astrein-linux-x86_64.tar.gz
+            astrein-sha256: 'cd0bb42f883322d9b7bbf1a34b57acfab83bcf78cf529a5cd122234fc8787582'
+
+          - target: aarch64-linux-gnu
+            arch: aarch64
+            runner: ubuntu-24.04-arm
+            astrein-archive: astrein-linux-aarch64.tar.gz
+            astrein-sha256: '6e53ac2f5a8b341e7a49439129790f4b1b82d5073a98ddf44a189fe9a9ebf732'
 
     steps:
       - name: 'Checkout repository'
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - name: 'Setup GCC'
-        uses: egor-tensin/setup-gcc@v2
-        with:
-          version: '16'
-          platform: 'x64'
+      - name: 'Validate ASTrein checksum'
+        run: |
+          if [[ ! "${ASTREIN_SHA256}" =~ ^[[:xdigit:]]{64}$ ]]; then
+            echo "Set the SHA-256 for ${{ matrix.astrein-archive }} after ASTrein v${ASTREIN_VERSION} is released." >&2
+            exit 1
+          fi
+
+      - name: 'Install native compiler'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            gcc-14 \
+            g++-14
 
       - name: 'Download ASTrein'
         run: |
           curl --fail --location \
-            --output "${RUNNER_TEMP}/astrein-linux-x86_64.tar.gz" \
-            "https://github.com/Katze719/ASTrein/releases/download/v${ASTREIN_VERSION}/astrein-linux-x86_64.tar.gz"
-          echo "${ASTREIN_SHA256}  ${RUNNER_TEMP}/astrein-linux-x86_64.tar.gz" \
+            --output "${RUNNER_TEMP}/${{ matrix.astrein-archive }}" \
+            "https://github.com/Katze719/ASTrein/releases/download/v${ASTREIN_VERSION}/${{ matrix.astrein-archive }}"
+          echo "${ASTREIN_SHA256} ${RUNNER_TEMP}/${{ matrix.astrein-archive }}" \
             | sha256sum --check -
+
           mkdir -p "${RUNNER_TEMP}/astrein"
-          tar -xzf "${RUNNER_TEMP}/astrein-linux-x86_64.tar.gz" \
+          tar -xzf "${RUNNER_TEMP}/${{ matrix.astrein-archive }}" \
             -C "${RUNNER_TEMP}/astrein" \
             --strip-components=1
           "${RUNNER_TEMP}/astrein/bin/astrein" --version
@@ -51,83 +74,234 @@ jobs:
         with:
           cmake-version: '3.31.x'
 
-      - name: 'Configure CMake'
+      - name: 'Configure native metadata context'
         run: |
-          cmake --preset linux-gcc-release \
-            -DCMAKE_C_COMPILER=gcc-16 \
-            -DCMAKE_CXX_COMPILER=g++-16 \
+          cmake -S . -B "build/ffi/${{ matrix.arch }}" -G Ninja \
+            -DCMAKE_BUILD_TYPE=Release \
+            -DCMAKE_C_COMPILER=gcc-14 \
+            -DCMAKE_CXX_COMPILER=g++-14 \
             -DCPP_BINDINGS_LINUX_ENABLE_FFI_JSON_EXPORT=ON \
-            -DCPP_BINDINGS_LINUX_ASTREIN_EXECUTABLE="${RUNNER_TEMP}/astrein/bin/astrein"
+            -DCPP_BINDINGS_LINUX_ASTREIN_EXECUTABLE="${RUNNER_TEMP}/astrein/bin/astrein" \
+            -DCPP_BINDINGS_LINUX_FFI_JSON_OUTPUT="${GITHUB_WORKSPACE}/dist/ffi/${{ matrix.arch }}.ffi.json"
+
+      - name: 'Generate metadata'
+        run: |
+          cmake --build "build/ffi/${{ matrix.arch }}" \
+            --target cpp_bindings_linux_ffi_json
+
+      - name: 'Upload target-specific FFI metadata'
+        uses: actions/upload-artifact@v4
+        with:
+          if-no-files-found: error
+          name: cpp-bindings-linux-ffi-${{ matrix.target }}
+          path: dist/ffi/${{ matrix.arch }}.ffi.json
+
+  generate-metadata:
+    name: 'Generate metadata'
+    needs: ['generate-target-metadata']
+    runs-on: ubuntu-24.04
+    steps:
+      - name: 'Checkout repository'
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
-      - name: 'Build'
+      - name: 'Setup CMake'
+        uses: jwlawson/actions-setup-cmake@v2
+        with:
+          cmake-version: '3.31.x'
+
+      - name: 'Install package-context compiler'
         run: |
-          cmake --build --preset linux-gcc-release \
-            --target cpp_bindings_linux cpp_bindings_linux_ffi_json
-
-      - name: 'Set PACKAGE_VERSION from env.sh'
+          sudo apt-get update
+          sudo apt-get install -y \
+            gcc-14 \
+            g++-14
+
+      - name: 'Configure package context'
+        run: |
+          cmake -S . -B build/package -G Ninja \
+            -DCMAKE_BUILD_TYPE=Release \
+            -DCMAKE_C_COMPILER=gcc-14 \
+            -DCMAKE_CXX_COMPILER=g++-14
+
+      - name: 'Set package version'
         id: version
         run: |
-          . build/env.sh
-          echo "PACKAGE_VERSION=$PACKAGE_VERSION" >> $GITHUB_OUTPUT
+          . build/package/env.sh
+          echo "PACKAGE_VERSION=${PACKAGE_VERSION}" >> "${GITHUB_OUTPUT}"
 
-      - name: 'Check tag'
-        id: 'check-tag'
+      - name: 'Check package version'
+        id: check-tag
         env:
           PACKAGE_VERSION: ${{ steps.version.outputs.PACKAGE_VERSION }}
-
         run: |
-          if [[ "$PACKAGE_VERSION" =~ ^(0|[1-9][[:digit:]]*)\.(0|[1-9][[:digit:]]*)\.(0|[1-9][[:digit:]]*)(-(alpha|rc|beta|experimental)\.[1-9][[:digit:]]*)?$ ]]; then
-            echo "Version \"$PACKAGE_VERSION\" is a valid package version."
-            echo "IS_VALID_PACKAGE_VERSION=true" >> $GITHUB_OUTPUT
+          if [[ "${PACKAGE_VERSION}" =~ ^(0|[1-9][[:digit:]]*)\.(0|[1-9][[:digit:]]*)\.(0|[1-9][[:digit:]]*)(-(alpha|rc|beta|experimental)\.[1-9][[:digit:]]*)?$ ]]; then
+            echo "Version \"${PACKAGE_VERSION}\" is a valid package version."
+            echo "IS_VALID_PACKAGE_VERSION=true" >> "${GITHUB_OUTPUT}"
           else
-            echo "Version \"$PACKAGE_VERSION\" is not a valid package version."
-            echo "IS_VALID_PACKAGE_VERSION=false" >> $GITHUB_OUTPUT
+            echo "Version \"${PACKAGE_VERSION}\" is not a valid package version."
+            echo "IS_VALID_PACKAGE_VERSION=false" >> "${GITHUB_OUTPUT}"
           fi
 
-      - name: 'Upload artifacts'
-        uses: actions/upload-artifact@v4
+      - name: 'Download target-specific FFI metadata'
+        uses: actions/download-artifact@v4
         with:
-          if-no-files-found: error
-          name: libcpp_bindings_linux
-          path: |
-            build/libcpp_bindings_linux.so
-            build/cpp_bindings_linux.ffi.json
+          pattern: cpp-bindings-linux-ffi-*
+          path: dist/ffi
+          merge-multiple: true
 
-      - name: 'Create GitHub Release'
-        if: github.ref_type == 'tag' && steps.check-tag.outputs.IS_VALID_PACKAGE_VERSION == 'true'
-        uses: softprops/action-gh-release@v2
+      - name: 'Upload combined FFI metadata'
+        uses: actions/upload-artifact@v4
         with:
-          name: 'v${{ steps.version.outputs.PACKAGE_VERSION }}'
-          tag_name: ${{ github.ref_name }}
-          generate_release_notes: true
-          files: |
-            build/libcpp_bindings_windows.so
-            build/cpp_bindings_linux.ffi.json
+          if-no-files-found: error
+          name: cpp-bindings-linux-ffi
+          path: dist/ffi/*.ffi.json
 
     outputs:
       package_version: ${{ steps.version.outputs.PACKAGE_VERSION }}
       is_valid_package_version: ${{ steps.check-tag.outputs.IS_VALID_PACKAGE_VERSION }}
 
+  build-binary:
+    name: 'Build binary (${{ matrix.target }})'
+    runs-on: ${{ matrix.runner }}
+    container:
+      image: ${{ matrix.image }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: x86_64-linux-gnu
+            runner: ubuntu-24.04
+            image: quay.io/pypa/manylinux_2_28_x86_64@sha256:4dc41da7df20400310c80d162a2fe2d2c2f3d9734d8dec20f6b9843711618deb
+            artifact: libcpp_bindings_linux-x86_64-linux-gnu
+
+          - target: aarch64-linux-gnu
+            runner: ubuntu-24.04-arm
+            image: quay.io/pypa/manylinux_2_28_aarch64@sha256:29a6ceb78de5b00494e6e7456a72782a4cb54238de102e7491d15fe47789b4d1
+            artifact: libcpp_bindings_linux-aarch64-linux-gnu
+
+    steps:
+      - name: 'Checkout repository'
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: 'Configure portable release'
+        run: |
+          cmake -S . -B build -G "Unix Makefiles" \
+            -DCMAKE_BUILD_TYPE=Release \
+            -DCMAKE_C_COMPILER=gcc \
+            -DCMAKE_CXX_COMPILER=g++ \
+            -DCPP_BINDINGS_LINUX_PORTABLE_CPU_BASELINE=ON \
+            -DCPP_BINDINGS_LINUX_STATIC_CXX_RUNTIME=ON
+
+      - name: 'Build and test'
+        run: |
+          cmake --build build \
+            --target cpp_bindings_linux cpp_bindings_linux_tests \
+            --parallel 4
+          ctest --test-dir build \
+            --output-on-failure \
+            --output-junit test-report.xml
+
+      - name: 'Stage and verify binary'
+        run: |
+          mkdir -p "dist/${{ matrix.target }}"
+          cp -L build/libcpp_bindings_linux.so \
+            "dist/${{ matrix.target }}/libcpp_bindings_linux.so"
+          ./scripts/verify_release_binary.sh \
+            "dist/${{ matrix.target }}/libcpp_bindings_linux.so" \
+            "${{ matrix.target }}"
+
+      - name: 'Upload test report'
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          if-no-files-found: warn
+          name: test-report-${{ matrix.target }}
+          path: build/test-report.xml
+
+      - name: 'Upload binary'
+        uses: actions/upload-artifact@v4
+        with:
+          if-no-files-found: error
+          name: ${{ matrix.artifact }}
+          path: dist/${{ matrix.target }}/libcpp_bindings_linux.so
+
   test-unit-cpp:
     name: 'Run: Test Unit C++'
     needs: ['build-binary']
     uses: './.github/workflows/test_unit_cpp.yml'
-    with:
-      artifact-name: libcpp_bindings_linux
-
     permissions:
       contents: read
       checks: write
-
+
+    with:
+      artifact-name: libcpp_bindings_linux-x86_64-linux-gnu
+
+  create-release:
+    name: 'Create GitHub release'
+    needs: ['generate-metadata', 'build-binary', 'test-unit-cpp']
+    if: github.ref_type == 'tag' && needs.generate-metadata.outputs.is_valid_package_version == 'true'
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+
+    steps:
+      - name: 'Download x86-64 binary'
+        uses: actions/download-artifact@v4
+        with:
+          name: libcpp_bindings_linux-x86_64-linux-gnu
+          path: release/x86_64
+
+      - name: 'Download AArch64 binary'
+        uses: actions/download-artifact@v4
+        with:
+          name: libcpp_bindings_linux-aarch64-linux-gnu
+          path: release/aarch64
+
+      - name: 'Download FFI metadata'
+        uses: actions/download-artifact@v4
+        with:
+          name: cpp-bindings-linux-ffi
+          path: release/ffi
+
+      - name: 'Name release assets'
+        run: |
+          mv release/x86_64/libcpp_bindings_linux.so \
+            release/libcpp_bindings_linux-x86_64-linux-gnu.so
+          mv release/aarch64/libcpp_bindings_linux.so \
+            release/libcpp_bindings_linux-aarch64-linux-gnu.so
+          mv release/ffi/x86_64.ffi.json \
+            release/cpp_bindings_linux-x86_64-linux-gnu.ffi.json
+          mv release/ffi/aarch64.ffi.json \
+            release/cpp_bindings_linux-aarch64-linux-gnu.ffi.json
+
+      - name: 'Create GitHub release'
+        uses: softprops/action-gh-release@v2
+        with:
+          name: 'v${{ needs.generate-metadata.outputs.package_version }}'
+          tag_name: ${{ github.ref_name }}
+          generate_release_notes: true
+          files: |
+            release/libcpp_bindings_linux-x86_64-linux-gnu.so
+            release/libcpp_bindings_linux-aarch64-linux-gnu.so
+            release/cpp_bindings_linux-x86_64-linux-gnu.ffi.json
+            release/cpp_bindings_linux-aarch64-linux-gnu.ffi.json
+
   publish-jsr:
     name: 'Run: Publish JSR'
-    needs: ['build-binary', 'test-unit-cpp']
+    needs: ['generate-metadata', 'build-binary', 'test-unit-cpp']
     uses: './.github/workflows/publish_jsr.yml'
-    with:
-      publish: ${{ needs.build-binary.outputs.is_valid_package_version == 'true' }}
-      version: ${{ needs.build-binary.outputs.package_version }}
-      artifact-name: libcpp_bindings_linux
-
     permissions:
       contents: read
       id-token: write
+
+    with:
+      publish: ${{ needs.generate-metadata.outputs.is_valid_package_version == 'true' }}
+      version: ${{ needs.generate-metadata.outputs.package_version }}
+      x86-64-artifact-name: libcpp_bindings_linux-x86_64-linux-gnu
+      aarch64-artifact-name: libcpp_bindings_linux-aarch64-linux-gnu
+      ffi-artifact-name: cpp-bindings-linux-ffi