ci(nuget): split symbols and strip native binaries (#596)

Author: mamoreau-devolutions

.github/workflows/build-native.yml

@@ -205,12 +205,136 @@ jobs:
           New-Item -ItemType Directory -Path $OutputPath | Out-Null
           Copy-Item $OutputLibrary $(Join-Path $OutputPath $RenamedLibraryName)
 
+          # Export variables for symbol collection step
+          echo "RUST_TARGET=$RustTarget" >> $Env:GITHUB_ENV
+          echo "TARGET_FOLDER=$TargetFolder" >> $Env:GITHUB_ENV
+          echo "LIB_PREFIX=$LibPrefix" >> $Env:GITHUB_ENV
+          echo "DOTNET_OS=$DotNetOs" >> $Env:GITHUB_ENV
+          echo "DOTNET_RID=$DotNetRid" >> $Env:GITHUB_ENV
+
+      - name: Collect debug symbols
+        if: matrix.build == 'release'
+        shell: pwsh
+        run: |
+          Set-PSDebug -Trace 1
+
+          $DotNetOs = $Env:DOTNET_OS
+          $DotNetRid = $Env:DOTNET_RID
+          $RustTarget = $Env:RUST_TARGET
+          $TargetFolder = $Env:TARGET_FOLDER
+          $LibPrefix = $Env:LIB_PREFIX
+
+          $SymbolsPath = Join-Path "symbols" $DotNetRid
+          New-Item -ItemType Directory -Path $SymbolsPath -Force | Out-Null
+
+          $TargetDir = Join-Path "target" $RustTarget $TargetFolder
+
+          if ($DotNetOs -eq 'win') {
+            # Windows: Copy PDB file
+            $PdbFile = Join-Path $TargetDir "sspi.pdb"
+            if (Test-Path $PdbFile) {
+              Copy-Item $PdbFile (Join-Path $SymbolsPath "DevolutionsSspi.pdb")
+              Write-Host "Copied PDB: $PdbFile"
+            } else {
+              Write-Warning "PDB file not found: $PdbFile"
+              Get-ChildItem $TargetDir -Filter "*.pdb" | ForEach-Object { Write-Host "Found PDB: $($_.FullName)" }
+            }
+          } elseif ($DotNetOs -eq 'osx' -or $DotNetOs -eq 'ios') {
+            # macOS/iOS: Generate dSYM bundle using dsymutil
+            $DylibFile = Join-Path $TargetDir "${LibPrefix}sspi.dylib"
+            $DsymOutput = Join-Path $SymbolsPath "libDevolutionsSspi.dylib.dSYM"
+            if (Test-Path $DylibFile) {
+              & dsymutil $DylibFile -o $DsymOutput
+              Write-Host "Generated dSYM: $DsymOutput"
+            } else {
+              Write-Warning "Dylib file not found: $DylibFile"
+            }
+          } elseif ($DotNetOs -eq 'linux' -or $DotNetOs -eq 'android') {
+            # Linux/Android: Extract debug info into a separate file
+            $DwpFile = Join-Path $TargetDir "${LibPrefix}sspi.dwp"
+            $SoFile = Join-Path $TargetDir "${LibPrefix}sspi.so"
+            $DebugOutput = Join-Path $SymbolsPath "libDevolutionsSspi.so.debug"
+            if (Test-Path $DwpFile) {
+              # split-debuginfo=packed may produce a .dwp file
+              Copy-Item $DwpFile (Join-Path $SymbolsPath "libDevolutionsSspi.so.dwp")
+              Write-Host "Copied DWP: $DwpFile"
+            } elseif (Test-Path $SoFile) {
+              # Extract debug sections from the binary using objcopy
+              if ($DotNetOs -eq 'android') {
+                $ObjCopy = Join-Path $Env:ANDROID_NDK_HOME "toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-objcopy"
+                if (-not (Test-Path $ObjCopy)) {
+                  throw "llvm-objcopy not found at $ObjCopy"
+                }
+              } else {
+                $ObjCopy = 'llvm-objcopy'
+                $ObjCopyCmd = Get-Command $ObjCopy -ErrorAction SilentlyContinue
+                if (-not $ObjCopyCmd) {
+                  throw "llvm-objcopy not found on PATH"
+                }
+              }
+              Write-Host "Extracting debug info with: $ObjCopy --only-keep-debug"
+              & $ObjCopy --only-keep-debug $SoFile $DebugOutput 2>&1 | Write-Host
+              Write-Host "Extracted debug info: $DebugOutput"
+              $SizeMB = [math]::Round((Get-Item $DebugOutput).Length / 1MB, 2)
+              Write-Host "Debug file size: $SizeMB MB"
+            } else {
+              Write-Warning "No debug symbols found for Linux/Android"
+            }
+          }
+
+          # List collected symbols
+          Write-Host "Collected symbols:"
+          Get-ChildItem -Recurse $SymbolsPath | ForEach-Object { Write-Host $_.FullName }
+
+      - name: Strip release binaries
+        if: matrix.build == 'release'
+        shell: pwsh
+        run: |
+          $DotNetOs = $Env:DOTNET_OS
+          $DotNetRid = $Env:DOTNET_RID
+          $LibPrefix = $Env:LIB_PREFIX
+          $RuntimePath = Join-Path "dependencies" "runtimes" "$DotNetRid" "native"
+          
+          if ($DotNetOs -eq 'win') {
+            # Windows: DLL is already separate from PDB, no stripping needed
+            Write-Host "Windows binaries are already compact (PDB is separate)"
+          } elseif ($DotNetOs -eq 'osx' -or $DotNetOs -eq 'ios') {
+            $DylibFile = Join-Path $RuntimePath "${LibPrefix}DevolutionsSspi.dylib"
+            if (Test-Path $DylibFile) {
+              & strip -Sx $DylibFile
+              Write-Host "Stripped dylib: $DylibFile"
+              $SizeMB = [math]::Round((Get-Item $DylibFile).Length / 1MB, 2)
+              Write-Host "Size after stripping: $SizeMB MB"
+            }
+          } elseif ($DotNetOs -eq 'android' -or $DotNetOs -eq 'linux') {
+            $SoFile = Join-Path $RuntimePath "${LibPrefix}DevolutionsSspi.so"
+            if (Test-Path $SoFile) {
+              if ($DotNetOs -eq 'android') {
+                $StripTool = Join-Path $Env:ANDROID_NDK_HOME "toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-strip"
+              } else {
+                $StripTool = 'llvm-strip'
+              }
+              Write-Host "Using strip tool: $StripTool"
+              & $StripTool --strip-unneeded $SoFile 2>&1 | Write-Host
+              Write-Host "Stripped .so ($DotNetOs): $SoFile"
+              $SizeMB = [math]::Round((Get-Item $SoFile).Length / 1MB, 2)
+              Write-Host "Size after stripping: $SizeMB MB"
+            }
+          }
+
       - name: Upload native components
         uses: actions/upload-artifact@v4
         with:
           name: sspi-${{matrix.os}}-${{matrix.arch}}-${{matrix.build}}
           path: dependencies/runtimes/${{matrix.os}}-${{matrix.arch}}
 
+      - name: Upload debug symbols
+        if: matrix.build == 'release'
+        uses: actions/upload-artifact@v4
+        with:
+          name: sspi-${{matrix.os}}-${{matrix.arch}}-${{matrix.build}}-symbols
+          path: symbols/${{matrix.os}}-${{matrix.arch}}
+
   build-universal:
     name: Universal Build
     runs-on: ubuntu-24.04
@@ -228,6 +352,29 @@ jobs:
       - name: Setup CCTools
         uses: Devolutions/actions-public/setup-cctools@v1
 
+      - name: Install Apple strip (cctools)
+        if: matrix.build == 'release'
+        shell: pwsh
+        run: |
+          $DownloadVersion = "v2025.2.0"
+          $HostPlatform = "ubuntu-$(lsb_release -rs)"
+          $HostArch = @{'X64'='x86_64';'ARM64'='aarch64'}['${{ runner.arch }}']
+          $PackageBaseName = "cctools-$HostArch-$HostPlatform"
+          $DownloadFile = "${PackageBaseName}.tar.xz"
+          $BaseDownloadUrl = "https://github.com/awakecoding/llvm-prebuilt/releases/download/$DownloadVersion"
+
+          curl -L -o $DownloadFile "${BaseDownloadUrl}/${DownloadFile}"
+          tar -xf $DownloadFile -C /tmp
+          sudo mv "/tmp/${PackageBaseName}/bin/strip" /usr/bin/apple-strip
+          sudo chmod +x /usr/bin/apple-strip
+          Remove-Item $DownloadFile -Force | Out-Null
+
+      - name: Setup LLVM
+        uses: Devolutions/actions-public/setup-llvm@v1
+        if: matrix.build == 'release'
+        with:
+          version: "18.1.8"
+
       - name: Download native components
         uses: actions/download-artifact@v4
         with:
@@ -290,8 +437,64 @@ jobs:
           # It's perfectly valid XML, but we're dealing with plists here and dyld will not be able to read the file
           ((Get-Content -Path (Join-Path $FrameworkDir "Info.plist") -Raw) -Replace 'PropertyList-1.0.dtd"\[\]', 'PropertyList-1.0.dtd"') | Set-Content -Path (Join-Path $FrameworkDir "Info.plist")
 
+          # Strip the framework executable (debug symbols will be in dSYM)
+          if ('${{ matrix.build }}' -eq 'release') {
+            if (-not (Test-Path "/usr/bin/apple-strip")) {
+              throw "apple-strip not found at /usr/bin/apple-strip"
+            }
+            & /usr/bin/apple-strip -Sx $FrameworkExecutable
+            Write-Host "Stripped framework executable with: /usr/bin/apple-strip -Sx"
+            $SizeMB = [math]::Round((Get-Item $FrameworkExecutable).Length / 1MB, 2)
+            Write-Host "Size after stripping: $SizeMB MB"
+          }
+
+      - name: Generate universal dSYM
+        if: matrix.build == 'release'
+        shell: pwsh
+        run: |
+          Set-PSDebug -Trace 1
+
+          $SymbolsPath = Join-Path "symbols" "${{ matrix.os }}-universal"
+          New-Item -ItemType Directory -Path $SymbolsPath -Force | Out-Null
+
+          $DylibFile = Join-Path "dependencies" "runtimes" "${{ matrix.os }}-universal" "native" "libDevolutionsSspi.dylib"
+          $DsymOutput = Join-Path $SymbolsPath "libDevolutionsSspi.dylib.dSYM"
+
+          if (Test-Path $DylibFile) {
+            & dsymutil $DylibFile -o $DsymOutput
+            Write-Host "Generated universal dSYM: $DsymOutput"
+          } else {
+            Write-Warning "Universal dylib not found: $DylibFile"
+          }
+
+          # List collected symbols
+          Write-Host "Collected symbols:"
+          Get-ChildItem -Recurse $SymbolsPath | ForEach-Object { Write-Host $_.FullName }
+
+      - name: Strip universal binary
+        if: matrix.build == 'release'
+        shell: pwsh
+        run: |
+          $DylibFile = Join-Path "dependencies" "runtimes" "${{ matrix.os }}-universal" "native" "libDevolutionsSspi.dylib"
+          if (Test-Path $DylibFile) {
+            if (-not (Test-Path "/usr/bin/apple-strip")) {
+              throw "apple-strip not found at /usr/bin/apple-strip"
+            }
+            & /usr/bin/apple-strip -Sx $DylibFile
+            Write-Host "Stripped universal dylib with: /usr/bin/apple-strip -Sx"
+            $SizeMB = [math]::Round((Get-Item $DylibFile).Length / 1MB, 2)
+            Write-Host "Size after stripping: $SizeMB MB"
+          }
+
       - name: Upload native components
         uses: actions/upload-artifact@v4
         with:
           name: sspi-${{ matrix.os }}-universal-${{ matrix.build }}
           path: dependencies/runtimes/${{ matrix.os }}-universal
+
+      - name: Upload universal debug symbols
+        if: matrix.build == 'release'
+        uses: actions/upload-artifact@v4
+        with:
+          name: sspi-${{ matrix.os }}-universal-${{ matrix.build }}-symbols
+          path: symbols/${{ matrix.os }}-universal

.github/workflows/nuget.yml

@@ -156,6 +156,140 @@ jobs:
             Invoke-Expression $PushCmd
           }
 
+  package-symbols:
+    name: Package debug symbols
+    runs-on: ubuntu-latest
+    needs: [ preflight, build-native ]
+
+    steps:
+      - name: Download all symbol artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+          pattern: sspi-*-release-symbols
+
+      - name: Package symbols into zip
+        shell: pwsh
+        run: |
+          Set-PSDebug -Trace 1
+
+          $PackageVersion = '${{ needs.preflight.outputs.package-version }}'
+          $SymbolsDir = "symbols"
+          New-Item -ItemType Directory -Path $SymbolsDir -Force | Out-Null
+
+          # Organize symbols by RID
+          $SymbolArtifacts = Get-ChildItem -Directory "artifacts" -Filter "sspi-*-release-symbols"
+          foreach ($Artifact in $SymbolArtifacts) {
+            # Extract RID from artifact name (e.g., sspi-win-x64-release-symbols -> win-x64)
+            $Rid = $Artifact.Name -Replace '^sspi-(.+)-release-symbols$', '$1'
+            $DestDir = Join-Path $SymbolsDir $Rid
+            New-Item -ItemType Directory -Path $DestDir -Force | Out-Null
+
+            # Copy all contents from the artifact
+            Get-ChildItem -Path $Artifact.FullName -Recurse | ForEach-Object {
+              if (-not $_.PSIsContainer) {
+                $RelativePath = $_.FullName.Substring($Artifact.FullName.Length + 1)
+                $DestPath = Join-Path $DestDir $RelativePath
+                $DestParent = Split-Path $DestPath -Parent
+                if (-not (Test-Path $DestParent)) {
+                  New-Item -ItemType Directory -Path $DestParent -Force | Out-Null
+                }
+                Copy-Item $_.FullName $DestPath
+              }
+            }
+          }
+
+          Write-Host "Symbol directory structure:"
+          Get-ChildItem -Recurse $SymbolsDir | ForEach-Object { Write-Host $_.FullName }
+
+          # Create the zip file
+          $ZipName = "Devolutions.Sspi.$PackageVersion.symbols.zip"
+          Compress-Archive -Path "$SymbolsDir/*" -DestinationPath $ZipName -Force
+          Write-Host "Created symbols archive: $ZipName"
+
+      - name: Upload symbols zip
+        uses: actions/upload-artifact@v4
+        with:
+          name: sspi-symbols-zip
+          path: Devolutions.Sspi.*.symbols.zip
+
+  create-release:
+    name: Create GitHub Release
+    runs-on: ubuntu-latest
+    if: needs.preflight.outputs.dry-run == 'false'
+    needs:
+      - preflight
+      - build-managed
+      - package-symbols
+      - publish
+    permissions:
+      contents: write
+
+    steps:
+      - name: Download NuGet package
+        uses: actions/download-artifact@v4
+        with:
+          name: sspi-nupkg
+          path: release-assets
+
+      - name: Download symbols zip
+        uses: actions/download-artifact@v4
+        with:
+          name: sspi-symbols-zip
+          path: release-assets
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        shell: pwsh
+        run: |
+          Set-PSDebug -Trace 1
+
+          $PackageVersion = '${{ needs.preflight.outputs.package-version }}'
+          $TagName = "v$PackageVersion"
+          $ReleaseName = "Devolutions.Sspi $PackageVersion"
+
+          # Get the list of assets to upload
+          $Assets = Get-ChildItem -Path "release-assets" -File
+          Write-Host "Release assets:"
+          $Assets | ForEach-Object { Write-Host "  - $($_.Name)" }
+
+          # Build the release notes
+          $ReleaseNotes = @"
+          ## Devolutions.Sspi $PackageVersion
+
+          ### NuGet Package
+          - [Devolutions.Sspi on NuGet.org](https://www.nuget.org/packages/Devolutions.Sspi/$PackageVersion)
+
+          ### Included Platforms
+          - Windows (x64, arm64)
+          - macOS (x64, arm64, universal)
+          - Linux (x64, arm64)
+          - iOS (x64, arm64, universal)
+          - Android (x86, x64, arm, arm64)
+
+          ### Debug Symbols
+          The `Devolutions.Sspi.$PackageVersion.symbols.zip` archive contains debug symbols for all platforms:
+          - Windows: `.pdb` files
+          - macOS/iOS: `.dSYM` bundles
+          - Linux/Android: `.debug` or `.dwp` files
+          "@
+
+          # Create the release with assets
+          $AssetArgs = @()
+          foreach ($Asset in $Assets) {
+            $AssetArgs += $Asset.FullName
+          }
+
+          gh release create $TagName `
+            --title $ReleaseName `
+            --notes $ReleaseNotes `
+            --target ${{ github.sha }} `
+            @AssetArgs
+
+          Write-Host "Created release: $ReleaseName with tag $TagName"
+
   notify:
     name: Notify failure
     runs-on: ubuntu-latest
@@ -164,6 +298,7 @@ jobs:
       - preflight
       - build-native
       - build-managed
+      - package-symbols
     env:
       SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_ARCHITECTURE }}
       SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK