fix(core): build native libs against glibc 2.24 (#1428)

.github/workflows/ci.yml

@@ -31,34 +31,50 @@ jobs:
         include:
           # For Linux targets, use Buildjet's builders to get the oldest supported glibc version
           - platform: linux-x64
-            runner: buildjet-4vcpu-ubuntu-2004
+            runner: buildjet-4vcpu-ubuntu-2204
             target: x86_64-unknown-linux-gnu
+            container: quay.io/pypa/manylinux_2_24_x86_64
+            out-file: libtemporal_sdk_typescript_bridge.so
           - platform: linux-arm
             runner: buildjet-4vcpu-ubuntu-2204-arm
             target: aarch64-unknown-linux-gnu
+            container: quay.io/pypa/manylinux_2_24_aarch64
+            out-file: libtemporal_sdk_typescript_bridge.so
           - platform: macos-x64
             runner: macos-12
             target: x86_64-apple-darwin
+            out-file: libtemporal_sdk_typescript_bridge.dylib
           - platform: macos-arm
             runner: macos-14
             target: aarch64-apple-darwin
+            out-file: libtemporal_sdk_typescript_bridge.dylib
           - platform: windows-x64
             runner: windows-latest
             target: x86_64-pc-windows-msvc
+            out-file: temporal_sdk_typescript_bridge.dll
     name: Compile Native Binaries (${{ matrix.platform }})
     runs-on: ${{ matrix.runner }}
+    container: ${{ matrix.container }}
+    env:
+      # This is required to allow continuing usage of Node 16 for actions,
+      # as Node 20 won't run on the docker image we use for linux builds
+      # (Node 20 require glibc 2.28+, but container image has glibc 2.24).
+      # https://github.blog/changelog/2024-05-17-updated-dates-for-actions-runner-using-node20-instead-of-node16-by-default/
+      ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
     defaults:
       run:
         shell: bash
     steps:
       - name: 'Checkout code'
-        uses: actions/checkout@v4
+        # FIXME: v4+ requires Node 20
+        uses: actions/checkout@v3
         with:
           submodules: recursive
 
       - name: 'Cache index.node'
         id: cached-artifact
-        uses: actions/cache@v4
+        # FIXME: v4+ requires Node 20
+        uses: actions/cache@v3
         with:
           path: ./packages/core-bridge/releases
           key: corebridge-artifactcache-${{ matrix.platform }}-${{ hashFiles('./packages/core-bridge/**/Cargo.lock', './packages/core-bridge/**/*.rs') }}
@@ -71,19 +87,17 @@ jobs:
 
       - name: Install protoc
         if: steps.cached-artifact.outputs.cache-hit != 'true'
-        uses: arduino/setup-protoc@v3
+        # FIXME: v3+ requires Node 20
+        uses: arduino/setup-protoc@v2
         with:
           # TODO: Upgrade proto once https://github.com/arduino/setup-protoc/issues/99 is fixed
           version: '23.x'
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Print libc version
-        if: (steps.cached-artifact.outputs.cache-hit != 'true') && startsWith(matrix.platform, 'linux')
-        run: ldd --version
-
       - name: Rust Cargo and Build cache
         if: steps.cached-artifact.outputs.cache-hit != 'true'
-        uses: Swatinem/rust-cache@v2
+        # FIXME: v2.7.2+ requires Node 20
+        uses: Swatinem/[email protected]
         with:
           workspaces: packages/core-bridge -> target
           prefix-key: corebridge-buildcache
@@ -98,13 +112,17 @@ jobs:
           set -x
           cargo build --release --target ${{ matrix.target }}
           mkdir -p ./releases/${{ matrix.target }}
-          # FIXME: This is aweful. Surely there's a better way, but I'm out of ideas.
-          native_lib_file=$(
-            ls target/${{ matrix.target }}/release/{lib,}temporal_sdk_typescript_bridge.{dylib,so,dll} 2>/dev/null || true
-          )
-          cp $native_lib_file ./releases/${{ matrix.target }}/index.node
+          cp target/${{ matrix.target }}/release/${{ matrix.out-file }} ./releases/${{ matrix.target }}/index.node
 
-      - uses: actions/upload-artifact@v4
+      - name: Print required GLIBC version
+        if: startsWith(matrix.platform, 'linux')
+        working-directory: ./packages/core-bridge
+        run: |
+          objdump -T ./releases/${{ matrix.target }}/index.node |
+              grep GLIBC | sed 's/.*GLIBC_\([.0-9]*\).*/\1/g' | sort -V | tail -1
+
+      # FIXME: v4+ requires Node 20
+      - uses: actions/upload-artifact@v3
         with:
           name: corebridge-native-${{ matrix.platform }}
           # Actual file will be named ${{ matrix.target }}/index.node
@@ -135,7 +153,8 @@ jobs:
           submodules: recursive
 
       - name: Download core-bridge native libraries
-        uses: actions/download-artifact@v4
+        # Need v3 here to stay compatible with the compile-native-binaries job.
+        uses: actions/download-artifact@v3-node20
         with:
           path: ./packages/core-bridge/releases/tmp
 
@@ -222,7 +241,8 @@ jobs:
           submodules: recursive
 
       - name: Download core-bridge native libraries
-        uses: actions/download-artifact@v4
+        # Need v3 here to stay compatible with the compile-native-binaries job.
+        uses: actions/download-artifact@v3-node20
         with:
           name: corebridge-native-${{ matrix.platform }}
           path: ./packages/core-bridge/releases
@@ -544,7 +564,9 @@ jobs:
         if: env.IS_MAIN_OR_RELEASE == 'true'
         run: npx vercel deploy packages/docs/build -t ${{ secrets.VERCEL_TOKEN }} --name typescript --scope temporal --prod --yes
 
-      - name: Deploy draft docs
-        # Don't run on forks, since secrets won't be available, and command will fail
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.ref != 'refs/heads/main'
-        run: npx vercel deploy packages/docs/build -t ${{ secrets.VERCEL_TOKEN }} --name typescript --scope temporal --yes
+      # FIXME: This is not working properly, and should probably be done only from the main branch anyway
+      # (and "Deploy prod docs" should only be done when we publish a new release)
+      # - name: Deploy draft docs
+      #   # Don't run on forks, since secrets won't be available, and command will fail
+      #   if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.ref != 'refs/heads/main'
+      #   run: npx vercel deploy packages/docs/build -t ${{ secrets.VERCEL_TOKEN }} --name typescript --scope temporal --yes

packages/core-bridge/scripts/build.js

@@ -55,6 +55,10 @@ const forceBuild = args['--force'];
 const buildRelease = args['--release'] || process.env.BUILD_CORE_RELEASE !== undefined;
 
 function compile(requestedTarget) {
+  if (!fs.existsSync('sdk-core/Cargo.toml')) {
+    throw new Error('Missing sdk-core/Cargo.toml. Did you forget to run `git submodule update --init --recursive`?');
+  }
+
   const target = requestedTarget ?? getPrebuiltTargetName();
   console.log('Compiling bridge', { target, buildRelease });