fix(ci): build x64 releases for baseline CPUs - #1514
Conversation
The emulated-CPU gate asserted only that the baseline Linux x64 artifacts run under `qemu-x86_64 -cpu Nehalem`. Nothing proved the harness could fail: a qemu that quietly emulated AVX2, an ignored `-cpu` flag, or a step that never really executed the artifact would all have looked like a pass. The build job now also compiles the CLI with Bun's DEFAULT x64 target (x86-64-v3/AVX2) as `baseline-control/control-cli-linux-x64-default` and uploads it under its own `baseline-gate-control` artifact name — never the `binaries` artifact, which is what the attest and release jobs resolve, so the control can never be attested or attached to a release. The Linux smoke leg runs that control through the identical qemu invocation first and requires exit 132 (SIGILL); any other status fails the job as a harness defect rather than a product defect. `smoke-binaries` already gates `attest`, so the control gates the release too. Also in this job: - Retry the `qemu-user` apt install three times with a short sleep, so a transient mirror failure cannot fail a release, and echo the qemu version. - Fix the paste-service startup poll, which sampled for 30s (60 x 0.5s) against a 60s subprocess timeout and could report failure while the process was still starting. The poll now samples every 2s for 90s, under a 120s per-run ceiling, so the poll loop — not the timeout — decides. It also reads the log before checking liveness, so a server that printed its banner and then exited still counts as started. - Name the binary and the emulated CPU model in every failure message. Cost: one extra cross-compile plus an artifact round-trip in the build job (about a minute), and a few seconds of emulated startup in the Linux smoke leg.
The CPU argument that moved Linux x64 to `bun-linux-x64-baseline` applies to Windows unchanged: Windows 10 is supported on plenty of pre-Haswell hardware, and Bun's default x64 target is x86-64-v3, so `plannotator-win32-x64.exe` SIGILLs on those machines exactly as the Linux build did. `bun build` accepts `bun-windows-x64-baseline` on the pinned Bun 1.3.14, and baseline keeps CPUID-dispatched SIMD, so modern CPUs lose nothing measurable — upstream Bun collapsed its own x64 downloads to baseline for the same reason (oven-sh/bun#34782). Windows is gated only by the existing smoke leg, not by an old-CPU run: qemu user-mode emulation has no Windows equivalent, and full-system emulation on a GitHub Windows runner is far too slow to sit in a release path, so the Linux control/gate pair is the only place the baseline claim is actually proven. The alternative — leaving Windows x64 on the default target — would keep shipping a binary that cannot start on the CPUs this PR exists to support, with no gate either way. macOS x64 deliberately stays on the default target: every Mac that runs a supported macOS is Haswell or newer, so baseline would cost dispatch for no reachable user. Asset names are unchanged (baseline replaces the default under the same name), so the installers, the release-evidence subject list, the attestation subjects and the docs need no change.
5fb49eb to
1616075
Compare
|
Thanks, kept your commit as-is (rebased onto main) and added two follow-ups on the branch. The gate now runs a control first: the build job compiles the same CLI with the default x64 target (AVX2) into its own The Windows x64 (CLI + paste) moves to Asset names are unchanged, so installers, evidence subjects, attestation subjects and docs need nothing. Added CI cost is one cross-compile plus an artifact round trip (~1 min) and a few seconds of emulated startup. actionlint + shellcheck clean; the added shell was dry-run locally against fake binaries. The real SIGILL-under-qemu assertion runs for the first time in CI, which is exactly what the control is for. |
2 participants
Summary
bun-linux-x64-baseline.--help, exact--version, and paste-service startup.Motivation
The official v0.27.14 Linux x64 CLI exits with SIGILL on an Ivy Bridge Xeon E3-1220 V2 and QEMU Nehalem. Explicit baseline builds start successfully. Bun 1.3.14's executable documentation recommends baseline for pre-2013 CPUs.
Validation
plannotator 0.27.14version passed.git diff --checkpassed.Limitations
Remote CI is pending. Paste coverage verifies startup after
Bun.serve, without HTTP or persistence checks. Emulation covers bounded startup, and performance was not benchmarked.