Refactor release builds, add aarch64-musl

This commit refactors the way release builds are done in CI in terms of
configuration and then additionally adds aarch64-musl release artifacts
as requested in bytecodealliance#9875. The refactoring here is done to reduce the number
of locations to understand release builds. Notably the
`binary-compatible-builds` action was removed in favor of direct
environment configuration in conjunction with docker images used to
build. The `aarch64-musl` build itself happens in a container provided
by the `cross` project to ensure that the right toolchain is configured.

Closes bytecodealliance#9875

prtest:full

.github/workflows/main.yml

@@ -1072,6 +1072,7 @@ jobs:
     strategy:
       fail-fast: ${{ github.event_name != 'pull_request' }}
       matrix: ${{ fromJson(needs.determine.outputs.build-matrix) }}
+    env: ${{ matrix.env || fromJSON('{}') }}
     steps:
     - uses: actions/checkout@v4
       with:
@@ -1089,16 +1090,13 @@ jobs:
     # it everywhere
     - run: ./ci/build-src-tarball.sh
       if: matrix.build == 'x86_64-linux'
-    - uses: ./.github/actions/binary-compatible-builds
-      with:
-        name: ${{ matrix.build }}
 
     - uses: ./.github/actions/android-ndk
       if: contains(matrix.target, 'android')
       with:
         target: ${{ matrix.target }}
 
-    - run: $CENTOS ./ci/build-release-artifacts.sh "${{ matrix.build }}" "${{ matrix.target }}"
+    - run: ./ci/build-release-artifacts.sh "${{ matrix.build }}" "${{ matrix.target }}"
 
     # Assemble release artifacts appropriate for this platform, then upload them
     # unconditionally to this workflow's files so we have a copy of them.

ci/build-build-matrix.js

@@ -17,41 +17,52 @@ const array = [
     "os": ubuntu,
     // The Rust target that will be used for the build.
     "target": "x86_64-unknown-linux-gnu",
+    "env": { "DOCKER_IMAGE": "./ci/docker/x86_64-linux/Dockerfile" },
   },
   {
     "build": "aarch64-linux",
     "os": ubuntu,
     "target": "aarch64-unknown-linux-gnu",
+    "env": { "DOCKER_IMAGE": "./ci/docker/aarch64-linux/Dockerfile" },
   },
   {
     "build": "s390x-linux",
     "os": ubuntu,
     "target": "s390x-unknown-linux-gnu",
+    "env": { "DOCKER_IMAGE": "./ci/docker/s390x-linux/Dockerfile" },
   },
   {
     "build": "riscv64gc-linux",
     "os": ubuntu,
     "target": "riscv64gc-unknown-linux-gnu",
+    "env": { "DOCKER_IMAGE": "./ci/docker/riscv64gc-linux/Dockerfile" },
   },
   {
     "build": "x86_64-macos",
     "os": macos,
     "target": "x86_64-apple-darwin",
+    // On OSX all we need to do is configure our deployment target as old as
+    // possible. For now 10.9 is the limit.
+    "env": { "MACOSX_DEPLOYMENT_TARGET": "10.9" },
   },
   {
     "build": "aarch64-macos",
     "os": macos,
     "target": "aarch64-apple-darwin",
+    "env": { "MACOSX_DEPLOYMENT_TARGET": "10.9" },
   },
   {
     "build": "x86_64-windows",
     "os": windows,
     "target": "x86_64-pc-windows-msvc",
+    // On Windows we build against the static CRT to reduce dll dependencies
+    "env": { "RUSTFLAGS": "-Ctarget-feature=+crt-static" },
   },
   {
     "build": "x86_64-mingw",
     "os": windows,
     "target": "x86_64-pc-windows-gnu",
+    "env": { "RUSTFLAGS": "-Ctarget-feature=+crt-static" },
   },
   {
     "build": "aarch64-android",
@@ -67,11 +78,19 @@ const array = [
     "build": "x86_64-musl",
     "os": ubuntu,
     "target": "x86_64-unknown-linux-musl",
+    "env": { "DOCKER_IMAGE": "./ci/docker/x86_64-musl/Dockerfile" },
+  },
+  {
+    "build": "aarch64-musl",
+    "os": ubuntu,
+    "target": "aarch64-unknown-linux-musl",
+    "env": { "DOCKER_IMAGE": "./ci/docker/aarch64-musl/Dockerfile" },
   },
   {
     "build": "aarch64-windows",
     "os": windows,
     "target": "aarch64-pc-windows-msvc",
+    "env": { "RUSTFLAGS": "-Ctarget-feature=+crt-static" },
   },
 ];
 

ci/build-release-artifacts.sh

@@ -13,6 +13,29 @@ set -ex
 
 build=$1
 target=$2
+wrapper=""
+
+# If `$DOCKER_IMAGE` is set then run the build inside of that docker container
+# instead of on the host machine. In CI this uses `./ci/docker/*/Dockerfile` to
+# have precise glibc requirements for Linux platforms for example.
+if [ "$DOCKER_IMAGE" != "" ]; then
+  if [ -f "$DOCKER_IMAGE" ]; then
+    docker build --tag build-image --file $DOCKER_IMAGE ci/docker
+    DOCKER_IMAGE=build-image
+  fi
+
+  # Inherit the environment's rustc and env vars related to cargo/rust, and then
+  # otherwise re-execute ourselves and we'll be missing `$DOCKER_IMAGE` in the
+  # container so we'll continue below.
+  exec docker run --interactive \
+    --volume `pwd`:`pwd` \
+    --volume `rustc --print sysroot`:/rust:ro \
+    --workdir `pwd` \
+    --interactive \
+    --env-file <(env | grep 'CARGO\|RUST') \
+    $DOCKER_IMAGE \
+    bash -c "PATH=\$PATH:/rust/bin RUSTFLAGS=\"\$RUSTFLAGS \$EXTRA_RUSTFLAGS\" `pwd`/$0 $*"
+fi
 
 # Default build flags for release artifacts. Leave debugging for
 # builds-from-source which have richer information anyway, and additionally the

ci/docker/aarch64-musl/Dockerfile

@@ -0,0 +1,4 @@
+FROM ghcr.io/cross-rs/aarch64-unknown-linux-musl
+
+RUN apt-get update -y && apt-get install -y ninja-build
+RUN git config --global --add safe.directory '*'