pacman-static.yml

name: Static pacman

# Build a statically linked pacman for every architecture, from source, and
# publish the eight binaries as release assets.
#
# ⛔ Nothing here touches an image build. The Dockerfile does not read the source
# pin and does not fetch these binaries. This produces release assets only, and
# tests/static/85-pacman-static-pin.sh fails if that ever stops being true.
#
# ⭐ A dispatch builds and uploads for inspection and stops. Nothing here creates
# a release: release.yml owns the v* tag and calls this workflow for the eight
# binaries, so a manual run cannot publish one by accident and there is one
# place that publishes rather than two.
on:
  workflow_dispatch:
  workflow_call:

defaults:
  run:
    shell: bash

permissions:
  contents: read

concurrency:
  group: pacman-static-${{ github.ref }}
  cancel-in-progress: true

jobs:
  #----------------------------------------------------------------------------------#
  # One job per architecture. fail-fast is off so one run reports every broken
  # target rather than the first, and the release job needs the whole matrix, so
  # a run that lost one architecture publishes nothing.
  #----------------------------------------------------------------------------------#
  build:
    name: Build ${{ matrix.docker_arch }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        # ⚠ arch-subset: this is the whole architecture set and is kept in step
        # with the build matrix by tests/static/85-pacman-static-pin.sh, which
        # reads build-deploy.yml and fails when a row here is missing from
        # scripts/build-pacman-static.
        docker_arch:
          - amd64
          - arm64
          - armv7
          - loong64
          - riscv64
          # - ppc
          # - ppc64
          # - ppc64le
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # The build runs natively; the emulator is only used to run the finished
      # binary and print its version. ⛔ Without one the run column reads
      # NOT MEASURED, so the emulator is what turns a link into a proof.
      # ⛔ meson comes from pip at a pinned version, not from apt.
      #
      # meson detects a linker by its banner, and the branch that recognises
      # zig's `zig ld` arrived in meson 1.6.0. ubuntu-latest ships 1.3.2 through
      # apt, so every architecture built all eleven libraries and then stopped
      # at the pacman step with "Unable to detect linker". Measured 2026-08-29
      # in run 33208408451.
      #
      # ⛔ Pinned rather than floated, for the same reason every other input
      # here is: the runner image's apt version is upstream's mood, and this
      # build's output must not depend on it. scripts/build-pacman-static
      # asserts the minimum separately, so a host with an old meson fails with
      # the version named rather than with meson's own message.
      #
      # ⚠ This pin has no freshness job watching it. HISTORY/pacman-static.md.
      - name: Install the build tools and the emulators
        env:
          MESON_VERSION: "1.10.1"
        run: |
          set -euo pipefail
          sudo apt-get update -qq
          sudo apt-get install -y -qq --no-install-recommends \
            cmake ninja-build gperf diffutils qemu-user-static gnupg

          # An explicit branch on a capability, not a suppressed failure: the
          # runner image has pipx, and a host without it still gets a pinned
          # meson rather than whatever apt holds.
          if command -v pipx > /dev/null; then
            pipx install "meson==${MESON_VERSION}"
            echo "$HOME/.local/bin" >> "$GITHUB_PATH"
            export PATH="$HOME/.local/bin:$PATH"
          else
            python3 -m pip install --break-system-packages --quiet "meson==${MESON_VERSION}"
          fi

          got="$(meson --version)"
          if [ "$got" != "${MESON_VERSION}" ]; then
            echo "meson is $got, the pin says ${MESON_VERSION}" >&2
            echo "an unpinned meson is the runner image's apt version, which was 1.3.2" >&2
            command -v meson
            exit 1
          fi
          echo "meson $got, ninja $(ninja --version)"

      # ⛔ Asserted, not assumed. The emulator for this target has to be on PATH
      # before the build starts, because the build treats a missing one as
      # NOT MEASURED rather than as a failure, and a whole matrix reporting
      # NOT MEASURED would read like a pass.
      - name: Check the emulator for this target is installed
        env:
          DOCKER_ARCH: ${{ matrix.docker_arch }}
        run: |
          set -euo pipefail
          case "$DOCKER_ARCH" in
            amd64) emu=qemu-x86_64-static ;;
            arm64) emu=qemu-aarch64-static ;;
            armv7) emu=qemu-arm-static ;;
            loong64) emu=qemu-loongarch64-static ;;
            riscv64) emu=qemu-riscv64-static ;;
            ppc) emu=qemu-ppc-static ;;
            ppc64) emu=qemu-ppc64-static ;;
            ppc64le) emu=qemu-ppc64le-static ;;
            *) echo "no emulator recorded for $DOCKER_ARCH" >&2; exit 1 ;;
          esac
          if ! command -v "$emu" > /dev/null; then
            echo "$emu is not installed, so the binary for $DOCKER_ARCH could be built and never run" >&2
            echo "qemu-user-static supplies it. What is present:" >&2
            ls /usr/bin/qemu-*-static >&2
            exit 1
          fi
          echo "$emu: $("$emu" --version | awk 'NR == 1')"

      - name: Build
        env:
          DOCKER_ARCH: ${{ matrix.docker_arch }}
        run: |
          set -euo pipefail
          WORK="${RUNNER_TEMP}/pacman-static" OUT="${RUNNER_TEMP}/dist" \
            scripts/build-pacman-static "$DOCKER_ARCH"

      # ⛔ The pin names two pacman release manager fingerprints and the build
      # requires a signature from one of them. NOT VERIFIED is what an evidence
      # file carries when that never ran, and SKIPPED is what it carries when
      # somebody set PACMAN_TAG_VERIFY=skip. Neither may reach a release asset.
      - name: Refuse an asset whose signed tag was not verified
        env:
          DOCKER_ARCH: ${{ matrix.docker_arch }}
        run: |
          set -euo pipefail
          ev="${RUNNER_TEMP}/dist/pacman-static-${DOCKER_ARCH}.json"
          verified="$(jq -r .pacman_tag_verified_by "$ev")"
          signer="$(jq -r .pacman_tag_signer "$ev")"
          case "$verified" in
            "NOT VERIFIED" | SKIPPED | "" | null)
              echo "the ${DOCKER_ARCH} asset carries tag verification: $verified" >&2
              echo "an asset whose upstream signature was never checked is not evidence" >&2
              exit 1
              ;;
          esac
          echo "::notice::${DOCKER_ARCH} signed tag verified by ${signer} (${verified})"

      # ⛔ The build says NOT MEASURED when it could not run the binary. That is
      # the honest value and it must not reach a release, so it is refused here
      # rather than shipped with a caveat nobody reads.
      - name: Refuse an asset whose binary was never run
        env:
          DOCKER_ARCH: ${{ matrix.docker_arch }}
        run: |
          set -euo pipefail
          ev="${RUNNER_TEMP}/dist/pacman-static-${DOCKER_ARCH}.json"
          reported="$(jq -r .reported_version "$ev")"
          if [ "$reported" = "NOT MEASURED" ]; then
            echo "the ${DOCKER_ARCH} binary linked and was never executed" >&2
            echo "an asset nobody has run is not evidence that it works" >&2
            exit 1
          fi
          echo "::notice::${DOCKER_ARCH} reported ${reported}"

      - name: Upload
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: pacman-static-${{ matrix.docker_arch }}
          path: |
            ${{ runner.temp }}/dist/pacman-static-${{ matrix.docker_arch }}
            ${{ runner.temp }}/dist/pacman-static-${{ matrix.docker_arch }}.json
          if-no-files-found: error
          retention-days: 7