ci/release: Use LLVM from Rust CI, support macOS and Linux ARM

.github/actions/report-disk-usage/action.yml

@@ -0,0 +1,30 @@
+name: Report disk usage
+description: Print disk usage for key directories on the runner
+runs:
+  using: composite
+  steps:
+    - name: Report disk usage
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        printf "\n== Filesystems ==\n"
+        df -h
+
+        report_dir() {
+          local dir="$1"
+          local depth="$2"
+
+          [[ -d "$dir" ]] || return
+
+          printf "\n== %s ==\n" "$dir"
+          sudo -n du -x -h -d "$depth" "$dir" 2>/dev/null | sort -h -r | head -n 20
+        }
+
+        report_dir "${{ github.workspace }}" 2
+        report_dir "$HOME/.cargo" 2
+        report_dir "$HOME/.rustup" 1
+        report_dir /tmp 1
+        if [[ "${RUNNER_OS:-}" == "Linux" ]]; then
+          report_dir /var/cache/apt/archives 1
+        fi

.github/workflows/ci.yml

@@ -29,7 +29,7 @@ jobs:
           components: clippy, rust-src
 
       - name: Run clippy
-        run: cargo clippy --features llvm-21,llvm-sys-21/no-llvm-linking --all-targets --workspace -- --deny warnings
+        run: cargo clippy --features llvm-21,no-llvm-linking --all-targets --workspace -- --deny warnings
 
   lint-nightly:
     runs-on: ubuntu-latest
@@ -47,45 +47,71 @@ jobs:
 
   build:
     # We don't use ubuntu-latest because we care about the apt packages available.
-    runs-on: ubuntu-22.04
+    runs-on: ${{ matrix.platform.os }}
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - rust: 1.86.0
-            llvm-version: 19
-            llvm-from: apt
-            exclude-features: default,llvm-20,llvm-21,rust-llvm-20,rust-llvm-21
-          - rust: 1.89.0
-            llvm-version: 20
-            llvm-from: apt
+        toolchain:
+          - rust: 1.90.0
+            llvm: 20
             exclude-features: default,llvm-19,llvm-21,rust-llvm-19,rust-llvm-21
-          - rust: beta
-            llvm-version: 21
-            llvm-from: apt
+          - rust: stable
+            llvm: 21
             exclude-features: default,llvm-19,llvm-20,rust-llvm-19,rust-llvm-20
+          - rust: beta
+            llvm: 21
+            exclude-features: default,llvm-20,rust-llvm-20
           - rust: nightly
-            llvm-version: 21
-            llvm-from: apt
-            exclude-features: llvm-19,llvm-20,rust-llvm-19,rust-llvm-20
-          - rust: nightly
-            llvm-version: 21
+            llvm: 21
+            exclude-features: llvm-20,rust-llvm-20
+        platform:
+          # Rust CI ships only one flavor of libLLVM, dynamic or static, per
+          # target. Linux GNU targets come with dynamic ones. Apple and Linux
+          # musl targets come with static ones.
+          - os: macos-latest
+            static-target: aarch64-apple-darwin
+          - os: macos-15-intel
+            static-target: x86_64-apple-darwin
+          - os: ubuntu-22.04
+            dynamic-target: x86_64-unknown-linux-gnu
+            static-target: x86_64-unknown-linux-musl
+          - os: ubuntu-22.04-arm
+            dynamic-target: aarch64-unknown-linux-gnu
+            static-target: aarch64-unknown-linux-musl
+        llvm-from:
+          - packages
+          - rust-ci
+        include:
+          # Currently we build LLVM from source only for Linux x86_64.
+          - toolchain:
+              rust: nightly
+              llvm: 21
+              exclude-features: llvm-20,rust-llvm-20
+            platform:
+              os: ubuntu-22.04
             llvm-from: source
-            exclude-features: llvm-19,llvm-20,rust-llvm-19,rust-llvm-20
-    name: rustc=${{ matrix.rust }} llvm-version=${{ matrix.llvm-version }} llvm-from=${{ matrix.llvm-from }}
+    name: os=${{ matrix.platform.os }} rustc=${{ matrix.toolchain.rust }} llvm-version=${{ matrix.toolchain.llvm }} llvm-from=${{ matrix.llvm-from }}
     needs: llvm
 
     env:
       RUST_BACKTRACE: full
-      LLVM_FEATURES: llvm-${{ matrix.llvm-version }},llvm-sys-${{ matrix.llvm-version }}/force-dynamic
+      # Features that have to be included for dynamic linking.
+      LLVM_FEATURES_DYNAMIC: llvm-${{ matrix.toolchain.llvm }}
+      # Features that have to be included for static linking.
+      LLVM_FEATURES_STATIC: llvm-${{ matrix.toolchain.llvm }},llvm-link-static
+      # Features that have to be excluded when running `cargo hack --feature-powerset`
+      # and intending to link dynamically.
+      LLVM_EXCLUDE_FEATURES_DYNAMIC: llvm-link-static,no-llvm-linking
+      RUSTC_LLVM_INSTALL_DIR_DYNAMIC: /tmp/rustc-llvm-dynamic
+      RUSTC_LLVM_INSTALL_DIR_STATIC: /tmp/rustc-llvm-static
 
     steps:
       - uses: actions/checkout@v6
 
-      - name: Install Rust ${{ matrix.rust }}
+      - name: Install Rust ${{ matrix.toolchain.rust }}
         uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: ${{ matrix.rust }}
+          toolchain: ${{ matrix.toolchain.rust }}
           components: rust-src
 
       - name: Check (default features, no system LLVM)
@@ -97,46 +123,74 @@ jobs:
       - name: Install btfdump
         run: cargo install btfdump
 
-      - name: Install prerequisites
+      - name: Add clang to PATH
+        if: runner.os == 'Linux'
         # ubuntu-22.04 comes with clang 13-15[0]; support for signed and 64bit
         # enum values was added in clang 15[1] which isn't in `$PATH`.
         #
-        # gcc-multilib provides at least <asm/types.h> which is referenced by libbpf.
-        #
         # [0] https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2204-Readme.md
         #
         # [1] https://github.com/llvm/llvm-project/commit/dc1c43d
         run: |
           set -euxo pipefail
-          sudo apt update
-          sudo apt -y install gcc-multilib
           echo /usr/lib/llvm-15/bin >> $GITHUB_PATH
 
-      - name: Install LLVM
-        if: matrix.llvm-from == 'apt'
+      - name: Add LLVM APT repository
+        if: runner.os == 'Linux'
         run: |
           set -euxo pipefail
           wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
-          echo -e deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-${{ matrix.llvm-version }} main | sudo tee /etc/apt/sources.list.d/llvm.list
-
+          echo -e deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-${{ matrix.toolchain.llvm }} main | sudo tee /etc/apt/sources.list.d/llvm.list
           sudo apt update
-          # TODO(vadorovsky): Remove the requirement of libpolly.
-          #
-          # Packages from apt.llvm.org are being built all at once, with one
-          # cmake build with superset of options, then different binaries and
-          # libraries are being included in different packages.
-          #
-          # That results in `llvm-config --libname --link-static` mentioning
-          # libpolly, even if it's not installed. The output of that command is
-          # being used in build.rs of llvm-sys, so building llvm-sys on such
-          # system is complaining about lack of libpolly.
-          #
-          # Hopefully that nightmare goes away once we switch to binstalls and
-          # ditch the system LLVM option.
-          sudo apt -y install llvm-${{ matrix.llvm-version }}-dev libpolly-${{ matrix.llvm-version }}-dev
-          echo /usr/lib/llvm-${{ matrix.llvm-version }}/bin >> $GITHUB_PATH
-
-      - name: Restore LLVM
+
+      - name: Install LLVM (Linux, packages)
+        if: matrix.llvm-from == 'packages' && runner.os == 'Linux'
+        run: |
+          set -euxo pipefail
+          sudo apt -y install llvm-${{ matrix.toolchain.llvm }}-dev
+          echo /usr/lib/llvm-${{ matrix.toolchain.llvm }}/bin >> $GITHUB_PATH
+
+      - name: Install LLVM (macOS, packages)
+        if: matrix.llvm-from == 'packages' && runner.os == 'macOS'
+        run: |
+          set -euxo pipefail
+          brew install llvm@${{ matrix.toolchain.llvm }}
+          echo $(brew --prefix llvm@${{ matrix.toolchain.llvm }})/bin >> $GITHUB_PATH
+          echo "DYLD_LIBRARY_PATH=$(brew --prefix llvm@${{ matrix.toolchain.llvm }})/lib" >> $GITHUB_ENV
+
+      - name: Install LLVM from Rust CI
+        if: matrix.llvm-from == 'rust-ci'
+        run: |
+          set -euxo pipefail
+          mkdir -p $RUSTC_LLVM_INSTALL_DIR_DYNAMIC $RUSTC_LLVM_INSTALL_DIR_STATIC
+          rustc_sha=$(cargo xtask rustc-llvm-commit --github-token "${{ secrets.GITHUB_TOKEN }}")
+          download_llvm() {
+            local target=$1
+            local install_dir=$2
+            wget -q -O - "https://ci-artifacts.rust-lang.org/rustc-builds/$rustc_sha/rust-dev-nightly-$target.tar.xz" | \
+              tar -xJ --strip-components 2 -C $install_dir
+          }
+          if [[ -n "${{ matrix.platform['dynamic-target'] }}" ]]; then
+            download_llvm \
+              "${{ matrix.platform['dynamic-target'] }}" \
+              ${RUSTC_LLVM_INSTALL_DIR_DYNAMIC}
+            echo "LD_LIBRARY_PATH=${RUSTC_LLVM_INSTALL_DIR_DYNAMIC}/lib" >> $GITHUB_ENV
+            # We start with steps that use dynamic linking. Add llvm-config
+            # associated with dynamic target to `PATH`.
+            echo "${RUSTC_LLVM_INSTALL_DIR_DYNAMIC}/bin" >> $GITHUB_PATH
+          fi
+          if [[ -n "${{ matrix.platform['static-target'] }}" ]]; then
+            download_llvm \
+              "${{ matrix.platform['static-target'] }}" \
+              ${RUSTC_LLVM_INSTALL_DIR_STATIC}
+            if [[ "${{ runner.os }}" == "Linux" ]]; then
+              # `FileCheck` binary shipped in musl tarballs is linked dynamically
+              # to musl, we can't execute it on Ubuntu.
+              rm -f "${RUSTC_LLVM_INSTALL_DIR_STATIC}/bin/FileCheck"
+            fi
+          fi
+
+      - name: Restore LLVM from GitHub Actions
         if: matrix.llvm-from == 'source'
         uses: actions/cache/restore@v4
         with:
@@ -163,17 +217,19 @@ jobs:
 
       - uses: taiki-e/install-action@cargo-hack
 
-      - name: Check
+      - name: Check (dynamic linking, feature powerset)
+        if: matrix.platform.dynamic-target || matrix.llvm-from != 'rust-ci'
         run: |
-          cargo hack check --feature-powerset \
-            --exclude-features ${{ matrix.exclude-features }} \
-            --features ${{ env.LLVM_FEATURES }}
+          cargo hack check --feature-powerset --exclude-features \
+            ${{ env.LLVM_EXCLUDE_FEATURES_DYNAMIC }},${{ matrix.toolchain.exclude-features }} \
+            --features ${{ env.LLVM_FEATURES_DYNAMIC }}
 
-      - name: Build
+      - name: Build (dynamic linking, feature powerset)
+        if: matrix.platform.dynamic-target || matrix.llvm-from != 'rust-ci'
         run: |
-          cargo hack build --feature-powerset \
-            --exclude-features ${{ matrix.exclude-features }} \
-            --features ${{ env.LLVM_FEATURES }}
+          cargo hack build --feature-powerset --exclude-features \
+            ${{ env.LLVM_EXCLUDE_FEATURES_DYNAMIC }},${{ matrix.toolchain.exclude-features }} \
+            --features ${{ env.LLVM_FEATURES_DYNAMIC }}
 
       # Toolchains provided by rustup include standard library artifacts
       # only for Tier 1 targets, which do not include BPF targets.
@@ -183,11 +239,13 @@ jobs:
       # running compiler tests.
       #
       # `RUSTC_BOOTSTRAP` is needed to use `rustc-build-sysroot` on stable Rust.
-      - name: Test (sysroot built on demand)
+      - name: Test (sysroot built on demand, dynamic linking)
+        if: matrix.platform.dynamic-target || matrix.llvm-from != 'rust-ci'
         run: |
           RUSTC_BOOTSTRAP=1 cargo hack test --feature-powerset \
-            --exclude-features ${{ matrix.exclude-features }} \
-            --features ${{ env.LLVM_FEATURES }}
+            --exclude-features \
+            ${{ env.LLVM_EXCLUDE_FEATURES_DYNAMIC }},${{ matrix.toolchain.exclude-features }} \
+            --features ${{ env.LLVM_FEATURES_DYNAMIC }}
 
       # To make things easier for package maintainers, the step of building a
       # custom sysroot can be skipped by setting the `BPFEL_SYSROOT_DIR`
@@ -198,7 +256,7 @@ jobs:
       #
       # `RUSTC_BOOTSTRAP` is needed to make `xtask build-std` work on stable
       # Rust.
-      - name: Test (prebuilt BPF standard library)
+      - name: Build BPF standard library
         run: |
           set -euxo pipefail
 
@@ -209,46 +267,79 @@ jobs:
             --sysroot-dir "$BPFEL_SYSROOT_DIR" \
             --target bpfel-unknown-none
 
-          BPFEL_SYSROOT_DIR="$BPFEL_SYSROOT_DIR" cargo hack test --feature-powerset \
-            --exclude-features ${{ matrix.exclude-features }} \
-            --features ${{ env.LLVM_FEATURES }}
+      - name: Test (prebuilt BPF standard libary, dynamic linking)
+        if: matrix.platform.dynamic-target || matrix.llvm-from != 'rust-ci'
+        run: |
+          BPFEL_SYSROOT_DIR="${{ github.workspace }}/bpf-sysroot" \
+            cargo hack test --feature-powerset --exclude-features \
+            ${{ env.LLVM_EXCLUDE_FEATURES_DYNAMIC }},${{ matrix.toolchain.exclude-features }} \
+            --features ${{ env.LLVM_FEATURES_DYNAMIC }}
 
       - uses: actions/checkout@v6
-        if: matrix.rust == 'nightly'
+        if: runner.os == 'Linux' && matrix.toolchain.rust == 'nightly'
         with:
           repository: aya-rs/aya
           path: aya
           submodules: recursive
 
       - name: Install
-        if: matrix.rust == 'nightly'
-        run: cargo install --path . --no-default-features --features ${{ env.LLVM_FEATURES }}
+        if: runner.os == 'Linux' && matrix.toolchain.rust == 'nightly'
+        run: |
+          cargo install --path . --no-default-features --features \
+            ${{ env.LLVM_FEATURES_DYNAMIC }}
 
       - name: Run aya integration tests
-        if: matrix.rust == 'nightly'
+        if: runner.os == 'Linux' && matrix.toolchain.rust == 'nightly'
         working-directory: aya
         run: cargo xtask integration-test local
 
-      - name: Report disk usage
-        if: ${{ always() }}
+      - name: Prepare for static linking (LLVM from Rust CI)
+        if: matrix.llvm-from == 'rust-ci'
         run: |
-          set -euo pipefail
+          echo "${RUSTC_LLVM_INSTALL_DIR_STATIC}/bin" >> $GITHUB_PATH
 
-          printf "\n== Filesystems ==\n"
-          df -h
+      - name: Install static libraries (macOS)
+        if: runner.os == 'macOS'
+        # macOS does not provide any static libraries. Homebrew does provide
+        # them, but in custom paths that the system-wide clang is not aware of.
+        # Point build.rs to them by setting environment variables.
+        #
+        # We install llvm package only for libc++.
+        #
+        # libLLVM from homebrew requires zstd.
+        run: |
+          brew install llvm zlib
+          echo "CXXSTDLIB_PATH=$(brew --prefix llvm)/lib/c++" >> $GITHUB_ENV
+          echo "ZLIB_PATH=$(brew --prefix zlib)/lib" >> $GITHUB_ENV
+          if [[ "${{ matrix.llvm-from }}" == "packages" ]]; then
+            brew install zstd
+            echo "LIBZSTD_PATH=$(brew --prefix zstd)/lib" >> $GITHUB_ENV
+          fi
+
+      - name: Check (static linking, single feature set)
+        # Static linking in combination with `cargo hack --feature-powerset`
+        # (multiple builds) increases the disk usage massively. Therefore we
+        # perform all static builds with only one fixed feature set.
+        run: |
+          cargo check --no-default-features --features \
+            ${{ env.LLVM_FEATURES_STATIC }}
 
-          report_dir() {
-            local dir="$1"
-            local depth="$2"
+      - name: Build (static linking, single feature set)
+        run: |
+          cargo build --no-default-features --features \
+            ${{ env.LLVM_FEATURES_STATIC }}
 
-            [[ -d "$dir" ]] || return
+      - name: Test (sysroot built on demand, static linking)
+        run: |
+          RUSTC_BOOTSTRAP=1 cargo test --no-default-features --features \
+            ${{ env.LLVM_FEATURES_STATIC }}
 
-            printf "\n== %s ==\n" "$dir"
-            sudo -n du -x -h --max-depth="$depth" "$dir" 2>/dev/null | sort -h -r | head -n 20
-          }
+      - name: Test (prebuilt BPF standard library, static linking)
+        run: |
+          BPFEL_SYSROOT_DIR="${{ github.workspace }}/bpf-sysroot" \
+            cargo test --no-default-features --features \
+            ${{ env.LLVM_FEATURES_STATIC }}
 
-          report_dir "${{ github.workspace }}" 2
-          report_dir "$HOME/.cargo" 2
-          report_dir "$HOME/.rustup" 1
-          report_dir /tmp 1
-          report_dir /var/cache/apt/archives 1
+      - name: Report disk usage
+        if: ${{ always() }}
+        uses: ./.github/actions/report-disk-usage