[ci] build on container for reproducible build

Author: kateinoigakukun

.github/workflows/build-toolchain.yml

@@ -101,6 +101,7 @@ jobs:
             "build_os": "ubuntu-18.04",
             "agent_query": "ubuntu-18.04",
             "target": "ubuntu18.04_x86_64",
+            "container": "ghcr.io/swiftwasm/swift-ci:main-ubuntu-18.04",
             "run_stdlib_test": true,
             "run_full_test": false,
             "run_e2e_test": true,
@@ -112,6 +113,7 @@ jobs:
             "build_os": "ubuntu-20.04",
             "agent_query": "ubuntu-20.04",
             "target": "ubuntu20.04_x86_64",
+            "container": "ghcr.io/swiftwasm/swift-ci:main-ubuntu-20.04",
             "run_stdlib_test": true,
             "run_full_test": false,
             "run_e2e_test": true,
@@ -123,6 +125,7 @@ jobs:
             "build_os": "ubuntu-22.04",
             "agent_query": "ubuntu-22.04",
             "target": "ubuntu22.04_x86_64",
+            "container": "ghcr.io/swiftwasm/swift-ci:main-ubuntu-22.04",
             "run_stdlib_test": true,
             "run_full_test": false,
             "run_e2e_test": true,
@@ -260,23 +263,32 @@ jobs:
             ${{ github.workspace }}/host-toolchain-sdk \
             ${{ github.workspace }}/dist-toolchain-sdk
 
+      - name: Build ${{ matrix.target }} installable archive on Docker container
+        if: ${{ matrix.container != null }}
+        run: |
+          chmod 777 -R ${{ github.workspace }}/build-cache
+          docker volume create oss-swift-package
+          docker run --name swiftwasm-ci-buildbot \
+            --security-opt=no-new-privileges \
+            --cap-add=SYS_PTRACE \
+            --security-opt seccomp=unconfined \
+            -dit \
+            -w /home/build-user/ \
+            -v ${{ github.workspace }}:/source \
+            -v oss-swift-package:/home/build-user \
+            ${{ matrix.container }}
+          docker exec swiftwasm-ci-buildbot /bin/bash -lc 'env; cp -r /source/* /home/build-user/; ./swift/utils/webassembly/ci.sh'
+          rm -rf ${{ github.workspace }}/build-cache
+          docker cp swiftwasm-ci-buildbot:/home/build-user/build-cache ${{ github.workspace }}/build-cache
+          docker cp swiftwasm-ci-buildbot:/home/build-user/swift-wasm-${{ env.TOOLCHAIN_CHANNEL }}-SNAPSHOT-${{ matrix.target }}.tar.gz .
+
       - name: Build ${{ matrix.target }} installable archive
+        if: ${{ matrix.container == null }}
         env:
           SKIP_XCODE_VERSION_CHECK: 1
         run: |
+          ./swift/utils/webassembly/ci.sh
 
-          case "${{ matrix.target }}" in
-            "amazonlinux2_x86_64" | "ubuntu22.04_x86_64" | "ubuntu20.04_x86_64" | "ubuntu18.04_x86_64" | "ubuntu20.04_aarch64" | "macos_x86_64" | "macos_arm64")
-              ./swift/utils/webassembly/ci.sh
-            ;;
-            *)
-              echo "Unrecognised target: ${{ matrix.target }}"
-              exit 1
-            ;;
-          esac
-
-      - name: Check cache hit rate
-        run: sccache --show-stats
       - uses: actions/cache/save@v3
         if: ${{ always() }}
         with:
@@ -293,7 +305,11 @@ jobs:
         run: echo "$HOME/.wasmer/bin" >> $GITHUB_PATH
 
       - name: Run stdlib tests for wasi-wasm32
-        if: ${{ matrix.run_stdlib_test }}
+        if: ${{ matrix.run_stdlib_test && matrix.container != null }}
+        run: |
+          docker exec swiftwasm-ci-buildbot /bin/bash -lc "cd target-build/swift-stdlib-wasi-wasm32 && ninja check-swift-wasi-wasm32-custom"
+      - name: Run stdlib tests for wasi-wasm32
+        if: ${{ matrix.run_stdlib_test && matrix.container == null }}
         run: |
           TARGET_STDLIB_BUILD_DIR=${{ github.workspace }}/target-build/swift-stdlib-wasi-wasm32
           ninja check-swift-wasi-wasm32-custom -C "$TARGET_STDLIB_BUILD_DIR"

utils/webassembly/build-toolchain.sh

@@ -217,14 +217,35 @@ create_darwin_info_plist() {
   chmod a+r "${DARWIN_TOOLCHAIN_INFO_PLIST}"
 }
 
+show_sccache_stats() {
+  # If sccache is installed in PATH
+  if command -v sccache &> /dev/null; then
+    sccache --show-stats
+  else
+    echo "sccache is not installed in PATH"
+  fi
+}
+
 if [ ${BUILD_HOST_TOOLCHAIN} -eq 1 ]; then
   build_host_toolchain
+  echo "=================================="
+  echo "Host toolchain built successfully!"
+  echo "=================================="
+  echo ""
+  echo "sccache stats:"
+  show_sccache_stats
   rm -rf "$DIST_TOOLCHAIN_DESTDIR"
   mkdir -p "$DIST_TOOLCHAIN_SDK"
   rsync -a "$HOST_TOOLCHAIN_DESTDIR/" "$DIST_TOOLCHAIN_SDK"
 fi
 
 build_target_toolchain
+echo "===================================="
+echo "Target toolchain built successfully!"
+echo "===================================="
+echo ""
+echo "sccache stats:"
+show_sccache_stats
 
 embed_wasi_sysroot
 

utils/webassembly/ci.sh

@@ -24,10 +24,14 @@ esac
 BUILD_SCRIPT=$UTILS_PATH/build-toolchain.sh
 RUN_TEST_BIN=$SWIFT_PATH/utils/run-test
 TARGET_STDLIB_BUILD_DIR=$SOURCE_PATH/target-build/swift-stdlib-wasi-wasm32
+BUILD_SDK_PATH="$SOURCE_PATH/build-sdk"
 
-$DEPENDENCIES_SCRIPT
+export WASMER_DIR="$BUILD_SDK_PATH/wasmer"
+
+$DEPENDENCIES_SCRIPT "$BUILD_SDK_PATH"
 $UTILS_PATH/install-build-sdk.sh
 
+export PATH="$BUILD_SDK_PATH/bin:$PATH"
 export SCCACHE_CACHE_SIZE="50G"
 export SCCACHE_DIR="$SOURCE_PATH/build-cache"
 

utils/webassembly/linux/install-dependencies.sh

@@ -2,6 +2,9 @@
 
 set -ex
 
+DESTDIR="$1"
+mkdir -p "$DESTDIR"
+
 if [[ "$(cat /etc/system-release)" == *"Amazon Linux release 2"* ]]; then
   sudo yum -y install   \
     clang               \
@@ -37,73 +40,46 @@ if [[ "$(cat /etc/system-release)" == *"Amazon Linux release 2"* ]]; then
     sudo ln -s /usr/bin/ninja-build /usr/local/bin/ninja
   fi
 else
-  sudo apt update
-
-  if [ $(grep RELEASE /etc/lsb-release) == "DISTRIB_RELEASE=18.04" ]; then
-    sudo apt install -y \
-      git ninja-build clang-10 python python-six \
-      uuid-dev libicu-dev icu-devtools libbsd-dev \
-      libedit-dev libxml2-dev libsqlite3-dev swig \
-      libpython-dev libncurses5 libncurses5-dev pkg-config \
-      libblocksruntime-dev libcurl4-openssl-dev \
-      make systemtap-sdt-dev tzdata rsync wget llvm-10 zip unzip
-    sudo ln -s -f /usr/bin/clang-10 /usr/bin/clang
-    sudo ln -s -f /usr/bin/clang++-10 /usr/bin/clang++
-  elif [ $(grep RELEASE /etc/lsb-release) == "DISTRIB_RELEASE=20.04" ]; then
-    sudo apt install -y \
-      git ninja-build clang python python-six \
-      uuid-dev libicu-dev icu-devtools libbsd-dev \
-      libedit-dev libxml2-dev libsqlite3-dev swig \
-      libpython2-dev libncurses5 libncurses5-dev pkg-config \
-      libblocksruntime-dev libcurl4-openssl-dev \
-      make systemtap-sdt-dev tzdata rsync wget llvm zip unzip
-  elif [ $(grep RELEASE /etc/lsb-release) == "DISTRIB_RELEASE=22.04" ]; then
-    sudo apt install -y \
-      git ninja-build clang python3 python-six \
-      uuid-dev libicu-dev icu-devtools libbsd-dev \
-      libedit-dev libxml2-dev libsqlite3-dev swig \
-      libpython2-dev libncurses5 libncurses5-dev pkg-config \
-      libblocksruntime-dev libcurl4-openssl-dev \
-      make systemtap-sdt-dev tzdata rsync wget llvm zip unzip
-  else
-    echo "Unknown Ubuntu version"
-    exit 1
-  fi
-  sudo apt clean
+  echo "skip"
 fi
 
 SOURCE_PATH="$( cd "$(dirname $0)/../../../.." && pwd )" 
 SWIFT_PATH=$SOURCE_PATH/swift
-cd $SWIFT_PATH
 
-./utils/update-checkout --clone --scheme wasm --skip-repository swift
+mkdir -p "$DESTDIR/bin"
 
 # Install wasmer
 # FIXME: Wasmer doesn't support linux-aarch64, consider using a different WASI-compatible runtime.
 if [ "$(uname -m)" != "aarch64" ]; then
-  if [ ! -e ~/.wasmer/bin/wasmer ]; then
+  export WASMER_DIR="${WASMER_DIR:-$HOME/.wasmer}"
+  if [ ! -e "$WASMER_DIR" ]; then
     curl https://get.wasmer.io -sSfL | sh -s "2.1.1"
+    ln -sf "$WASMER_DIR/bin/wasmer" "$DESTDIR/bin/wasmer"
   fi
 fi
 
-cd $SOURCE_PATH
+install_cmake() {
+  local workdir="$(mktemp -d)"
+  curl -L -o "$workdir/install_cmake.sh" "https://github.com/Kitware/CMake/releases/download/v3.22.1/cmake-3.22.1-linux-$(uname -m).sh"
+  chmod +x "$workdir/install_cmake.sh"
+  mkdir -p "$DESTDIR/cmake"
+  "$workdir/install_cmake.sh" --skip-license --prefix="$DESTDIR/cmake"
+  ln -sf "$DESTDIR/cmake/bin"/* "$DESTDIR/bin"
+}
 
-if [ -z $(which cmake) ]; then
-  wget -O install_cmake.sh "https://github.com/Kitware/CMake/releases/download/v3.22.1/cmake-3.22.1-linux-$(uname -m).sh"
-  chmod +x install_cmake.sh
-  sudo mkdir -p /opt/cmake
-  sudo ./install_cmake.sh --skip-license --prefix=/opt/cmake
-  sudo ln -sf /opt/cmake/bin/* /usr/local/bin
+if [ ! -e "$DESTDIR/cmake/bin/cmake" ]; then
+  install_cmake
 fi
 
-cmake --version
-
 # Install sccache
 
 if [ -z $(which sccache) ]; then
-  sudo mkdir /opt/sccache && cd /opt/sccache
-  wget -O - "https://github.com/mozilla/sccache/releases/download/v0.3.0/sccache-v0.3.0-$(uname -m)-unknown-linux-musl.tar.gz" | \
-    sudo tar xz --strip-components 1
-  sudo chmod +x /opt/sccache/sccache
-  sudo ln -sf /opt/sccache/sccache /usr/local/bin
+  mkdir "$DESTDIR/sccache" && cd "$DESTDIR/sccache"
+  curl -L "https://github.com/mozilla/sccache/releases/download/v0.3.0/sccache-v0.3.0-$(uname -m)-unknown-linux-musl.tar.gz" | \
+    tar xz --strip-components 1
+  chmod +x "$DESTDIR/sccache/sccache"
+  ln -sf "$DESTDIR/sccache/sccache" "$DESTDIR/bin/sccache"
 fi
+
+cd $SWIFT_PATH
+./utils/update-checkout --clone --scheme wasm --skip-repository swift