Phase out hardening flags hurting startup; add three perf wins #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| probe: | |
| name: probe (${{ matrix.target.os }}-${{ matrix.target.arch }}) | |
| runs-on: ${{ matrix.target.runner }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| target: | |
| - { os: linux, arch: amd64, runner: ubuntu-24.04 } | |
| - { os: linux, arch: arm64, runner: ubuntu-24.04-arm } | |
| - { os: darwin, arch: arm64, runner: macos-14 } | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # ── toolchain ─────────────────────────────────────────────────── | |
| # The flag set assumes mainline clang-22 / lld-22 (zstd debug | |
| # compression in lld, recent CET / PAC / BTI codegen, modern | |
| # libc++ hardening macros, …). We install via apt.llvm.org's | |
| # llvm.sh on Linux and Homebrew on macOS, then pin a stable name | |
| # for the rest of the job via $CC and a /usr/local/bin symlink | |
| # for ld.lld / ld64.lld. | |
| - name: Install clang 22 (Linux) | |
| if: matrix.target.os == 'linux' | |
| run: | | |
| set -eux | |
| wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh | |
| chmod +x /tmp/llvm.sh | |
| # `all` pulls clang + lld + libc++ + lldb + tools. | |
| sudo /tmp/llvm.sh 22 all | |
| sudo apt-get install -y --no-install-recommends libzstd-dev | |
| # clang -fuse-ld=lld searches PATH for `ld.lld` (unversioned). | |
| # Without the symlink it would fall back to the default ld and | |
| # silently bypass our linker pinning. | |
| sudo ln -sf /usr/bin/clang-22 /usr/local/bin/clang | |
| sudo ln -sf /usr/bin/clang-22 /usr/local/bin/clang++ | |
| sudo ln -sf /usr/bin/ld.lld-22 /usr/local/bin/ld.lld | |
| echo "CC=/usr/local/bin/clang" >> "$GITHUB_ENV" | |
| echo "CXX=/usr/local/bin/clang++" >> "$GITHUB_ENV" | |
| - name: Install clang via Homebrew (macOS) | |
| if: matrix.target.os == 'darwin' | |
| run: | | |
| set -eux | |
| brew update | |
| brew install llvm zstd | |
| prefix="$(brew --prefix llvm)" | |
| # Prepend brew's llvm bin to PATH so the rest of the job | |
| # picks up `clang` and `ld64.lld` (-fuse-ld=lld) from it | |
| # instead of Apple's clang from Xcode. | |
| echo "$prefix/bin" >> "$GITHUB_PATH" | |
| echo "CC=$prefix/bin/clang" >> "$GITHUB_ENV" | |
| echo "CXX=$prefix/bin/clang++" >> "$GITHUB_ENV" | |
| - name: Toolchain sanity | |
| run: | | |
| set -eux | |
| which clang | |
| clang --version | |
| # ld.lld is the linux name; ld64.lld is the mach-o name. | |
| (which ld.lld && ld.lld --version) || true | |
| (which ld64.lld && ld64.lld --version) || true | |
| - uses: oven-sh/setup-bun@v2 | |
| # ── tests ─────────────────────────────────────────────────────── | |
| - name: Verify cflags.sh / cflags.ts emit identical output | |
| run: | | |
| set -eux | |
| os=${{ matrix.target.os }} | |
| arch=${{ matrix.target.arch }} | |
| for mode in "" "--bin"; do | |
| sh=$(bash ./cli/cflags.sh "$os" "$arch" $mode) | |
| ts=$(bun run ./cli/cflags.ts "$os" "$arch" $mode) | |
| if [ "$sh" != "$ts" ]; then | |
| echo "parity mismatch (mode='${mode:-compile}')" | |
| diff <(printf '%s\n' "$sh") <(printf '%s\n' "$ts") | |
| exit 1 | |
| fi | |
| done | |
| - name: Compile probe with the compile profile | |
| run: | | |
| set -eux | |
| CFLAGS=$(bash ./cli/cflags.sh ${{ matrix.target.os }} ${{ matrix.target.arch }}) | |
| echo "CC=$CC" | |
| echo "CFLAGS:" $CFLAGS | |
| "$CC" $CFLAGS -c tests/probe.c -o /tmp/probe.o | |
| - name: Compile + link + run probe with the binary profile | |
| run: | | |
| set -eux | |
| BFLAGS=$(bash ./cli/cflags.sh ${{ matrix.target.os }} ${{ matrix.target.arch }} --bin) | |
| echo "CC=$CC" | |
| echo "BFLAGS:" $BFLAGS | |
| "$CC" $BFLAGS tests/probe.c -o /tmp/probe | |
| /tmp/probe |