Build LTO and non-LTO versions, pin vcpkg version

trailofbits · Feb 5, 2024 · 4fa0717 · 4fa0717
1 parent 154c7b0
commit 4fa0717
Showing 1 changed file with 70 additions and 13 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -17,7 +17,8 @@ concurrency:
 env:
   LLVM_VER: 17
   PYTHON_VER: 3.11
-  VCPKG_REGISTRY_VERSION: v1.1.0
+  VCPKG_REGISTRY_VERSION: v1.2.0
+  VCPKG_COMMIT: fecdd89f28ed883b26a48c2b30085f6384070bb8
 
 jobs:
   build:
@@ -30,6 +31,14 @@ jobs:
       contents: write
       packages: write
 
+    strategy:
+      matrix:
+        include:
+          - name: lto
+            additional_flags: -flto
+          - name: nolto
+            additional_flags:
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -53,7 +62,13 @@ jobs:
           chmod 600 ~/.ssh/known_hosts
           echo "$MX_REGISTRY_KEY" | ssh-add - 
           git submodule update --init --recursive -- vcpkg-registry
-        env:
+
+          cd vcpkg-registry
+          git fetch
+          head_hash="$(git rev-parse HEAD)"
+          tag_hash="$(git rev-parse $VCPKG_REGISTRY_VERSION)"
+          [[ "$head_hash" == "$tag_hash" ]] || { echo "The \$VCPKG_REGISTRY_VERSION specified in CI ($VCPKG_REGISTRY_VERSION) and the submodule commit don\'t match. You probably updated \$VCPKG_REGISTRY_VERSION without updating the submodule version as well." ; exit 1 ; }
+      env:
           MX_REGISTRY_KEY: ${{ secrets.MX_REGISTRY_KEY }}
 
       - name: Setup cmake
@@ -68,26 +83,27 @@ jobs:
         run: |
           echo "RELEASE_DIR=${RUNNER_TEMP}/release" >> $GITHUB_ENV
           echo "VERSION=$(git rev-parse --short=7 HEAD)" >> $GITHUB_ENV
-          echo "ARTIFACT_NAME=multiplier-$(git rev-parse --short=7 HEAD).tar.xz" >> $GITHUB_ENV
+          echo "ARTIFACT_NAME=multiplier-$(git rev-parse --short=7 HEAD)-${{ matrix.name }}.tar.xz" >> $GITHUB_ENV
           echo "CC=$(which clang-$LLVM_VER)" >> $GITHUB_ENV
           echo "CXX=$(which clang++-$LLVM_VER)" >> $GITHUB_ENV
-          echo "CFLAGS=-g0 --ld-path=$(which ld.lld-$LLVM_VER)" >> $GITHUB_ENV
-          echo "CXXFLAGS=-g0 --ld-path=$(which ld.lld-$LLVM_VER)" >> $GITHUB_ENV
+          echo "CFLAGS=-g0 --ld-path=$(which ld.lld-$LLVM_VER) ${{ matrix.additional_flags }}" >> $GITHUB_ENV
+          echo "CXXFLAGS=-g0 --ld-path=$(which ld.lld-$LLVM_VER) ${{ matrix.additional_flags }}" >> $GITHUB_ENV
           echo "VCPKG_BINARY_SOURCES=clear;files,$GITHUB_WORKSPACE/vcpkg-binary-cache,readwrite" >> $GITHUB_ENV
 
       - name: Setup vcpkg
         run: |
           mkdir -p $GITHUB_WORKSPACE/vcpkg-binary-cache
           git clone https://github.com/microsoft/vcpkg $HOME/vcpkg
-          $HOME/vcpkg/bootstrap-vcpkg.sh
+          git -C $HOME/vcpkg checkout $VCPKG_COMMIT
+          $HOME/vcpkg/bootstrap-vcpkg.sh -disableMetrics
 
       - name: Preseed vcpkg cache
         run: |
           gh release download $VCPKG_REGISTRY_VERSION \
-            --pattern vcpkg-binary-cache.tar.bz2 \
+            --pattern vcpkg-binary-cache-${{ matrix.name }}.tar.bz2 \
             --repo trailofbits/multiplier-vcpkg-registry
-          tar xjf vcpkg-binary-cache.tar.bz2
-          rm vcpkg-binary-cache.tar.bz2
+          tar xjf vcpkg-binary-cache-${{ matrix.name }}.tar.bz2
+          rm vcpkg-binary-cache-${{ matrix.name }}.tar.bz2
         env:
           GITHUB_TOKEN: ${{ secrets.MX_REGISTRY_RELEASES_TOKEN }}
 
@@ -96,9 +112,9 @@ jobs:
         uses: actions/cache@v4
         with:
           path: vcpkg-binary-cache
-          key: ${{ runner.os }}-${{ hashFiles('vcpkg-registry/ports/**/*') }}
+          key: ${{ runner.os }}-${{ matrix.name }}-${{ hashFiles('vcpkg-registry/ports/**/*') }}
           restore-keys: |
-            ${{ runner.os }}-${{ hashFiles('vcpkg-registry/ports/**/*') }}
+            ${{ runner.os }}-${{ matrix.name }}-${{ hashFiles('vcpkg-registry/ports/**/*') }}
             ${{ runner.os }}-
 
       - name: Build
@@ -120,8 +136,49 @@ jobs:
         working-directory: ${{ env.RELEASE_DIR }}
         run: tar --use-compress-program pixz -cf "${ARTIFACT_NAME}" *
 
-      - name: Create Release
+      - name: Upload cache artifact
         if: github.ref == 'refs/heads/main'
-        run: gh release create ${VERSION} --generate-notes ${{ env.RELEASE_DIR }}/${{ env.ARTIFACT_NAME }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: multiplier-${{ matrix.name }}
+          path: ${{ env.RELEASE_DIR }}/${{ env.ARTIFACT_NAME }}
+
+  create-release:
+    runs-on: ubuntu-latest
+    needs: [build]
+    if: github.ref == 'refs/heads/main'
+    name: Create release
+
+    permissions:
+      contents: write
+      packages: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          submodules: "recursive"
+
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          run-id: build
+
+      - name: Install gh and extract
+        run: |
+          curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
+          sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
+          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null
+
+          sudo apt-get update
+          sudo apt-get install gh
+          echo "VERSION=$(git rev-parse --short=7 HEAD)" >> $GITHUB_ENV
+          echo "ARTIFACT_PREFIX=multiplier-$(git rev-parse --short=7 HEAD)" >> $GITHUB_ENV
+
+      - name: Create release
+        run: |
+          gh release create "${{ env.VERSION }}" --generate-notes \
+            multiplier-lto/${{ env.ARTIFACT_PREFIX }}-lto.tar.xz \
+            multiplier-nolto/${{ env.ARTIFACT_PREFIX }}-nolto.tar.xz \
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}