Skip to content

Add musl CLI artifacts to release workflow#1610

Merged
steipete merged 1 commit into
steipete:mainfrom
Yuxin-Qiao:codex/release-musl-cli-artifacts
Jun 18, 2026
Merged

Add musl CLI artifacts to release workflow#1610
steipete merged 1 commit into
steipete:mainfrom
Yuxin-Qiao:codex/release-musl-cli-artifacts

Conversation

@Yuxin-Qiao

@Yuxin-Qiao Yuxin-Qiao commented Jun 18, 2026 •
edited by steipete
Loading

Copy link
Copy Markdown
Contributor

Refs #1524

Third step of the musl CLI stack. #1609 is landed; this PR is now rebased and retargeted to main.

Summary

  • retain existing macOS and glibc Linux release artifacts
  • add static musl artifacts for x86_64 and aarch64
  • install the checksummed Swift 6.2.1 static Linux SDK and narrow it to the matrix architecture
  • build a checksummed target-architecture SQLite 3.53.2 static library through Add opt-in SQLite path for static Linux CLI builds #1609's opt-in linker path
  • smoke-test architecture, static linkage, --help, config validation, and version reporting
  • package distinct linux-musl-{x86_64,aarch64} tarballs and checksums
  • update release verification patterns and install/release documentation

The per-architecture SDK narrowing is intentional: live static-SDK proof showed that --triple alone can select headers from the other bundled architecture during dependency compilation.

Homebrew continues to consume the existing glibc Linux artifacts; this PR does not change that runtime contract.

Verification

  • release workflow YAML/matrix assertions
  • .mac-release.env shell syntax
  • make check
  • autoreview: clean, no actionable findings (0.76)
  • isolated Ubuntu 24.04 x86_64 static-musl build and CLI startup
  • exact x86_64 artifact name, VERSION injection, checksum, symlink, archive contents, architecture, and static-link proof
  • isolated native arm64 Ubuntu crabbox: static aarch64 build, CLI/config/version execution, checksum, symlink, archive contents, and linux-musl-aarch64 artifact naming passed
  • six-job release workflow passed for musl x86_64/aarch64, glibc x86_64/aarch64, and macOS x86_64/arm64
  • exact rebased head 462d05bb; its release diff is content-identical to workflow-proven head 272807bc (only Git blob IDs changed with the new base)

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Jun 18, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 61624dfef3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread .github/workflows/release-cli.yml
BUILD_ARGS=(swift build -c release --product CodexBarCLI)
if [[ -n "${{ matrix.build-arch }}" ]]; then
if [[ -n "${{ matrix.swift-sdk }}" ]]; then
BUILD_ARGS+=(--swift-sdk "${{ matrix.swift-sdk }}" --triple "${{ matrix.swift-sdk-triple }}")

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Select the musl SDK by target triple

For the musl matrix entries, this passes the bundle ID to --swift-sdk and relies on --triple to choose x86_64 vs aarch64. Swift's Static Linux SDK guide builds these targets by selecting the target triple directly (--swift-sdk x86_64-swift-linux-musl / aarch64-swift-linux-musl), and SwiftPM has a documented bug where bundle-ID + --triple can nondeterministically pick the wrong sub-SDK (swiftlang/swift-package-manager#10034). In this release workflow that makes the new musl jobs flaky or able to compile against the wrong sysroot; use matrix.swift-sdk-triple as the --swift-sdk value here and in the matching SHOW_BIN_ARGS path instead of adding --triple.

Useful? React with 👍 / 👎.

@clawsweeper clawsweeper Bot mentioned this pull request Jun 18, 2026
Merged
@clawsweeper

clawsweeper Bot commented Jun 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex review: needs maintainer review before merge. Reviewed June 18, 2026, 9:52 AM ET / 13:52 UTC.

Summary
The branch adds static musl x86_64/aarch64 CLI artifact jobs to Release CLI, wires release asset waits, and documents the new tarballs while preserving existing macOS, glibc Linux, and Homebrew outputs.

Reproducibility: not applicable. as a PR review. The linked Linux portability issue is source and release-artifact reproducible, and this branch is assessed through workflow and downloaded artifact proof rather than a local bug repro.

Review metrics: 3 noteworthy metrics.

  • Files changed: 7 files, +167/-8. The diff is concentrated in release automation and docs but changes shipped CLI artifact production.
  • Release matrix expansion: 2 musl jobs added, 4 existing jobs retained. The PR adds x86_64 and aarch64 static-musl outputs while preserving current macOS and glibc Linux artifacts.
  • Musl artifacts inspected: 2 tarballs, 2 checksums. Downloaded proof artifacts showed matching checksums, expected archive contents, static ELF architecture, and no dynamic section.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #1524
Summary: The canonical remaining work is fully static Linux CLI portability, and this PR is the release-workflow artifact candidate for that work.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🦞 diamond lobster ✨ media proof bonus
Patch quality: 🦐 gold shrimp
Result: needs maintainer review before merge.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Get maintainer sign-off for compiling the pinned SQLite source into release binaries.
  • Optionally rerun the Release CLI workflow on the exact current head before final release approval.

Risk before merge

  • [P1] The workflow compiles downloaded SQLite source into shipped musl CLI binaries; the SHA3-256 check is good, but maintainers still need to accept this new release supply-chain input.
  • [P1] The Release CLI matrix grows from four to six artifact jobs and .mac-release waits for four extra assets, so musl SDK, SQLite, runner, or artifact naming failures can block release completion.
  • [P1] The strongest Release CLI proof ran on an equivalent workflow head rather than the exact current head; the release workflow and docs are unchanged, but maintainers may still prefer an exact-head release workflow run before final approval.

Maintainer options:

  1. Approve Static-Musl Release Model (recommended)
    Maintainers can accept the pinned SDK plus SQLite source input and rely on the inspected equivalent-head artifacts while ordinary branch checks gate the final merge.
  2. Run Exact-Head Release CLI Proof
    Before merging or before the next release, rerun the Release CLI workflow on the current head if maintainers want proof on the exact commit rather than an equivalent workflow diff.
  3. Route SQLite To Dependency First
    Pause this PR if maintainers prefer static SQLite to be owned by SweetCookieKit or another dependency-level mechanism before release automation consumes it.

Next step before merge

  • [P2] The remaining action is maintainer release/toolchain supply-chain approval, not a narrow automated code repair.

Security
Needs attention: The diff adds a release-time SQLite source download and compile step for shipped CLI binaries, with a pinned checksum but still requiring maintainer supply-chain approval.

Review details

Best possible solution:

Land this after maintainer acceptance of the pinned static SDK and SQLite release inputs, with glibc/Homebrew outputs preserved and release proof available for both musl architectures.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a PR review. The linked Linux portability issue is source and release-artifact reproducible, and this branch is assessed through workflow and downloaded artifact proof rather than a local bug repro.

Is this the best way to solve the issue?

Mostly yes: adding parallel musl tarballs preserves the existing glibc and Homebrew contract while solving older-glibc and NixOS portability, but the SQLite release input is a maintainer acceptance decision.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 016f3b9e1314.

Label changes

Label changes:

  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): The linked Release CLI workflow passed all six build jobs, and downloaded musl artifacts showed matching checksums, expected contents, static x86-64/AArch64 ELF binaries, symlinks, VERSION files, and no dynamic section.
  • remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

  • P2: This is a bounded Linux CLI portability improvement with limited runtime blast radius but meaningful release/toolchain impact.
  • merge-risk: 🚨 automation: The diff changes the release workflow matrix, SDK setup, packaging names, artifact upload path, and release asset wait patterns.
  • merge-risk: 🚨 other: The workflow compiles a newly downloaded SQLite source archive into shipped binaries, which needs maintainer supply-chain acceptance.
  • rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): The linked Release CLI workflow passed all six build jobs, and downloaded musl artifacts showed matching checksums, expected contents, static x86-64/AArch64 ELF binaries, symlinks, VERSION files, and no dynamic section.
  • proof: sufficient: Contributor real behavior proof is sufficient. The linked Release CLI workflow passed all six build jobs, and downloaded musl artifacts showed matching checksums, expected contents, static x86-64/AArch64 ELF binaries, symlinks, VERSION files, and no dynamic section.
Evidence reviewed

Security concerns:

  • [low] Approve release-time SQLite source compilation — .github/workflows/release-cli.yml:228
    The musl jobs fetch the SQLite amalgamation from sqlite.org and compile it into libsqlite3.a for release artifacts; the checksum check helps, but this is a new third-party release input maintainers should explicitly accept.
    Confidence: 0.84

What I checked:

  • Repository policy read: AGENTS.md was read fully; its release workflow, SwiftPM, validation, and release-script guidance shaped this read-only PR review. (AGENTS.md:1, 016f3b9e1314)
  • Vision sign-off context: VISION.md says package, dependency, toolchain, release, and meaningful maintenance-complexity changes need sign-off, which applies to this release workflow expansion. (VISION.md:9, 016f3b9e1314)
  • No maintainer notes found: The checkout did not contain matching .agents/maintainer-notes entries to apply for this release workflow review.
  • Current main release shape: Current main's Release CLI matrix only has macOS and glibc Linux jobs, so the requested musl artifact publishing is not already implemented on main. (.github/workflows/release-cli.yml:22, 016f3b9e1314)
  • Current main SQLite hook prerequisite: The current main Package.swift already includes the opt-in CODEXBAR_SQLITE3_LIB_DIR linker path consumed by this workflow, from the merged prerequisite branch. (Package.swift:13, 016f3b9e1314)
  • PR adds musl matrix entries: The PR head adds linux-musl-x64 and linux-musl-arm64 release jobs with distinct linux-musl asset platform names and target triples. (.github/workflows/release-cli.yml:44, 462d05bb1f23)

Likely related people:

  • steipete: GitHub path history shows repeated work on Release CLI asset publishing, Homebrew dispatch, .mac-release.env, and the merged musl source-compatibility prerequisite; the current PR commit is also authored by this handle. (role: recent release and packaging contributor; confidence: high; commits: 462d05bb1f23, d8ce86980772, 103b25b04839; files: .github/workflows/release-cli.yml, .mac-release.env, docs/RELEASING.md)
  • Yuxin-Qiao: Current main blame ties the opt-in SQLite linker hook prerequisite to this handle, and the current PR commit preserves them as co-author on the musl artifact workflow stack. (role: related musl stack contributor; confidence: high; commits: 016f3b9e1314, 462d05bb1f23; files: Package.swift, .github/workflows/release-cli.yml)
  • jskoiz: GitHub path history ties this handle to merged Release CLI manual-dispatch hardening in the same artifact publishing workflow. (role: recent release workflow contributor; confidence: medium; commits: a56340cee86e; files: .github/workflows/release-cli.yml)
  • ThiagoCAltoe: GitHub commit metadata ties this handle to prior CLI release version fallback work in the same release workflow surface. (role: adjacent release workflow contributor; confidence: medium; commits: da957fbc51a2; files: .github/workflows/release-cli.yml)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added proof: sufficient Contributor real behavior proof is sufficient. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. P2 Normal priority bug or improvement with limited blast radius. merge-risk: 🚨 compatibility 🚨 Merging this PR could break existing users, config, migrations, defaults, or upgrades. merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. merge-risk: 🚨 other 🚨 Merging this PR has meaningful risk outside the owned taxonomy. labels Jun 18, 2026
@clawsweeper clawsweeper Bot mentioned this pull request Jun 18, 2026
Merged
@steipete
steipete force-pushed the codex/release-musl-cli-artifacts branch from a3e2175 to e544795 Compare June 18, 2026 11:23
@steipete
steipete changed the base branch from main to fix/musl-sqlite-link June 18, 2026 11:23
@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. proof: sufficient Contributor real behavior proof is sufficient. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. and removed proof: sufficient Contributor real behavior proof is sufficient. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. merge-risk: 🚨 compatibility 🚨 Merging this PR could break existing users, config, migrations, defaults, or upgrades. labels Jun 18, 2026
@steipete
steipete force-pushed the fix/musl-sqlite-link branch from 064fec4 to 5560ab5 Compare June 18, 2026 12:13
@steipete
steipete force-pushed the codex/release-musl-cli-artifacts branch from e544795 to 272807b Compare June 18, 2026 12:15
@steipete
steipete force-pushed the codex/release-musl-cli-artifacts branch from 272807b to 462d05b Compare June 18, 2026 13:42
@steipete
steipete changed the base branch from fix/musl-sqlite-link to main June 18, 2026 13:43
@clawsweeper clawsweeper Bot removed the status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. label Jun 18, 2026
@clawsweeper clawsweeper Bot added the status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. label Jun 18, 2026
@steipete

steipete commented Jun 18, 2026

Copy link
Copy Markdown
Owner

Maintainer sign-off: accept the pinned Swift static SDK and checksummed SQLite source as release inputs for the optional musl artifacts. Existing macOS, glibc Linux, and Homebrew contracts remain unchanged.

Landing proof for exact head 462d05bb:

  • ordinary CI green: macOS lint/full Swift tests, Linux x86_64, Linux arm64, security
  • six-target release workflow green: macOS x86_64/arm64, glibc x86_64/arm64, musl x86_64/arm64
  • downloaded musl artifacts: checksums, archive layout, architecture, static linkage, CLI/config/version smoke checks
  • native arm64 crabbox artifact proof plus isolated x86_64 proof
  • make check and autoreview clean

Public model identifier gate: N/A; workflow/docs-only release artifact change, no model-bearing content.

@steipete
steipete merged commit ae08d86 into steipete:main Jun 18, 2026
4 checks passed
@steipete steipete mentioned this pull request Jun 18, 2026
Closed
@Yuxin-Qiao
Yuxin-Qiao deleted the codex/release-musl-cli-artifacts branch June 25, 2026 15:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

Assignees

No one assigned

Labels

merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. merge-risk: 🚨 other 🚨 Merging this PR has meaningful risk outside the owned taxonomy. P2 Normal priority bug or improvement with limited blast radius. proof: sufficient Contributor real behavior proof is sufficient. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Yuxin-Qiao @steipete