Expand CI precompiled guardrail to full release-blocking matrix

Author: ealdent

.github/workflows/ci.yml

@@ -169,13 +169,33 @@ jobs:
         run: ./bin/test-packaged-gem-manifest
 
   precompiled-gem-build:
-    name: precompiled gem build / ${{ matrix.os }}
+    name: precompiled gem build / ${{ matrix.label }}
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 60
+    timeout-minutes: 90
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-14]
+        include:
+          - os: ubuntu-latest
+            platform: x86_64-linux
+            label: linux-x86_64
+            kind: linux
+          - os: ubuntu-latest
+            platform: x86_64-linux-musl
+            label: linux-musl-x86_64
+            kind: musl
+          - os: macos-15-intel
+            platform: x86_64-darwin
+            label: macos-x86_64
+            kind: macos
+          - os: macos-14
+            platform: arm64-darwin
+            label: macos-arm64
+            kind: macos
+          - os: windows-latest
+            platform: x64-mingw-ucrt
+            label: windows-x64-mingw-ucrt
+            kind: windows
 
     steps:
       - uses: actions/checkout@v4
@@ -187,20 +207,104 @@ jobs:
           bundler-cache: true
 
       - name: Set up Rust toolchain
+        if: ${{ matrix.kind != 'musl' }}
         uses: dtolnay/rust-toolchain@stable
 
+      - name: Install Rust GNU toolchain for RubyInstaller ABI
+        if: ${{ matrix.kind == 'windows' }}
+        shell: pwsh
+        run: |
+          rustup toolchain install stable-x86_64-pc-windows-gnu
+          "RUSTUP_TOOLCHAIN=stable-x86_64-pc-windows-gnu" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+      - name: Resolve cargo path for bash steps
+        if: ${{ matrix.kind == 'windows' }}
+        shell: pwsh
+        run: |
+          $cargo = (Get-Command cargo -ErrorAction Stop).Source
+          "CARGO=$cargo" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+          Write-Host "Resolved cargo executable: $cargo"
+
       - name: Install Rust bindgen dependencies (Linux)
-        if: ${{ runner.os == 'Linux' }}
+        if: ${{ matrix.kind == 'linux' }}
         run: sudo apt-get update && sudo apt-get install -y clang libclang-dev pkg-config
 
       - name: Install Rust bindgen dependencies (macOS)
-        if: ${{ runner.os == 'macOS' }}
+        if: ${{ matrix.kind == 'macos' }}
         run: |
           brew install llvm
           echo "LIBCLANG_PATH=$(brew --prefix llvm)/lib" >> "${GITHUB_ENV}"
 
+      - name: Install LLVM (bindgen dependency)
+        if: ${{ matrix.kind == 'windows' }}
+        uses: KyleMayes/install-llvm-action@v2
+        with:
+          version: "18.1.8"
+
+      - name: Configure bindgen include paths for Windows Ruby headers
+        if: ${{ matrix.kind == 'windows' }}
+        shell: pwsh
+        run: |
+          $shimInclude = (Resolve-Path "ext/lda-ruby-rust/include").Path.Replace('\', '/')
+          $includeDirs = @($shimInclude)
+          $devkitRoot = $null
+
+          if ($env:RI_DEVKIT) {
+            $devkitRoot = $env:RI_DEVKIT.Replace('\', '/')
+            $candidateDirs = @(
+              "$devkitRoot/ucrt64/include",
+              "$devkitRoot/mingw64/include",
+              "$devkitRoot/usr/include"
+            )
+            $withStrings = $candidateDirs | Where-Object { Test-Path "$_/strings.h" } | Select-Object -Unique
+            if ($withStrings) {
+              $includeDirs += $withStrings
+            }
+          }
+
+          $bindgenArgList = @("--target=x86_64-w64-windows-gnu")
+          if ($devkitRoot) {
+            $bindgenArgList += "--sysroot=$devkitRoot/ucrt64"
+          }
+          $bindgenArgList += ($includeDirs | Select-Object -Unique | ForEach-Object { "-I$_" })
+          $bindgenArgList += @("-msse2", "-mavx")
+          $bindgenArgs = $bindgenArgList -join " "
+
+          "BINDGEN_EXTRA_CLANG_ARGS_x86_64-pc-windows-gnu=$bindgenArgs" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+          "BINDGEN_EXTRA_CLANG_ARGS_x86_64_pc_windows_gnu=$bindgenArgs" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+          "BINDGEN_EXTRA_CLANG_ARGS=$bindgenArgs" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+          $existingCppFlags = ruby -rrbconfig -e 'print RbConfig::CONFIG.fetch("CPPFLAGS", "")'
+          $mergedCppFlags = "$existingCppFlags $bindgenArgs".Trim()
+          "RBCONFIG_CPPFLAGS=$mergedCppFlags" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+          Write-Host "Configured bindgen extra clang args: $bindgenArgs"
+          Write-Host "Configured RBCONFIG_CPPFLAGS: $mergedCppFlags"
+
       - name: Build and verify precompiled gem
-        run: ./bin/release-precompiled-artifacts --skip-preflight
+        if: ${{ matrix.kind != 'musl' }}
+        shell: bash
+        run: ./bin/release-precompiled-artifacts --platform "${{ matrix.platform }}" --skip-preflight
+
+      - name: Build and verify musl precompiled gem (Alpine container)
+        if: ${{ matrix.kind == 'musl' }}
+        env:
+          PLATFORM: ${{ matrix.platform }}
+        run: |
+          docker run --rm \
+            -e PLATFORM="${PLATFORM}" \
+            -v "${PWD}:/workspace" \
+            -w /workspace \
+            alpine:3.20 \
+            sh -lc '
+              set -euo pipefail
+              apk add --no-cache bash build-base git ruby ruby-dev ruby-bundler rust cargo clang llvm-dev clang17-libclang pkgconf
+              mkdir -p /workspace/pkg
+              libclang_path="$(dirname "$(find /usr/lib -name libclang.so | head -n1)")"
+              export LIBCLANG_PATH="${libclang_path}"
+              bundle install
+              ./bin/release-precompiled-artifacts --platform "${PLATFORM}" --skip-preflight
+            '
 
   rust-scaffold:
     name: rust scaffold / ubuntu-latest

docs/modernization-handoff.md

@@ -137,7 +137,7 @@ Delivered:
   - Rust bindgen header/sysroot compatibility wiring for Windows runners
   - dual Rust DLL artifact-name staging support (`lda_ruby_rust.dll` and `liblda_ruby_rust.dll`)
 - CI jobs for packaged-gem fallback, rust-enabled checks, and manifest checks
-- CI precompiled gem build guardrail job (`precompiled-gem-build`)
+- CI precompiled gem build guardrail job (`precompiled-gem-build`) aligned to the full release-blocking precompiled matrix
 - release workflow matrix for precompiled gems:
   - `x86_64-linux`
   - `x86_64-linux-musl`

docs/porting-strategy.md

@@ -83,7 +83,7 @@ Completed in `codex/experiment-ruby3-modernization`:
 - Tag-driven release workflow added (`.github/workflows/release.yml`) with dry-run support and environment-gated publish jobs.
 - RubyGems credential preflight helper added (`bin/verify-rubygems-api-key`) for CI-safe publish key validation.
 - Post-publish verification helper added (`bin/verify-release-publish`) to validate RubyGems + GitHub release artifacts by tag.
-- CI precompiled guardrail job added (`precompiled-gem-build`) for Linux/macOS packaging checks.
+- CI precompiled guardrail job added (`precompiled-gem-build`) for full release-blocking platform packaging checks (Linux, Linux musl, macOS Intel, macOS Apple Silicon, Windows).
 - Release workflow post-publish verification job added (`verify_published_artifacts`).
 - Release failure alert workflow added (`.github/workflows/release-failure-alert.yml`) to open issue alerts for failed tag-triggered `release.yml` runs.
 - Maintainer release runbook added (`docs/release-runbook.md`) with publish and rollback/yank procedures.

docs/precompiled-platform-policy.md

@@ -55,7 +55,7 @@ Release automation requirements:
 
 Continuous integration guardrail:
 
-- `.github/workflows/ci.yml` runs `release-precompiled-artifacts` for representative Linux/macOS targets on every branch/PR.
+- `.github/workflows/ci.yml` runs `release-precompiled-artifacts` for the full release-blocking precompiled matrix (Linux, Linux musl, macOS Intel, macOS Apple Silicon, Windows) on every branch/PR.
 - `.github/workflows/precompiled-candidate-evaluation.yml` is used for additional platform candidate checks.
 - `.github/workflows/release.yml` dry-run validates the full release-blocking matrix before publish.