Fix Dockerfile continuation around WASM sort limits #24
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build complete Flye WebAssembly | |
| on: | |
| push: | |
| branches: | |
| - agent/flye-wasm-complete | |
| paths: | |
| - .github/workflows/build-flye-wasm.yml | |
| - wasm/** | |
| - scripts/flye-patch/flye-src-886b8c1.tar.gz | |
| workflow_dispatch: | |
| permissions: | |
| actions: read | |
| contents: read | |
| env: | |
| FLYE_VERSION: "2.9.6" | |
| FLYE_NATIVE_IMAGE: flye-wasm-native:2.9.6 | |
| FLYE_WASM_MODULE: wasm/dist/flye-2.9.6-complete.wasm | |
| FLYE_WASM_VM_MEMORY_MB: "2048" | |
| FLYE_WASM_VM_HOST_MEMORY_MB: "1024" | |
| C2W_OPTIMIZATION_MODE: native | |
| C2W_VERSION: v0.8.4 | |
| C2W_LINUX_AMD64_SHA256: 1142ab95212578c0c7f666de830de6945f2abbea1713d1e07a7cb04072e00f31 | |
| WASMTIME_VERSION: v33.0.2 | |
| jobs: | |
| build-and-smoke: | |
| name: Build module and verify CLI parity | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 240 | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@v4 | |
| - name: Build the pinned native Flye image | |
| shell: bash | |
| run: | | |
| set -euxo pipefail | |
| docker build \ | |
| --platform linux/amd64 \ | |
| --progress plain \ | |
| --tag "$FLYE_NATIVE_IMAGE" \ | |
| --file wasm/Dockerfile \ | |
| . | |
| docker run --rm "$FLYE_NATIVE_IMAGE" /opt/flye/bin/flye --version | |
| - name: Reclaim runner disk space | |
| shell: bash | |
| run: | | |
| set -euxo pipefail | |
| sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/share/boost || true | |
| docker builder prune --all --force || true | |
| docker image prune --force || true | |
| docker image inspect "$FLYE_NATIVE_IMAGE" >/dev/null | |
| df -h | |
| - name: Install container2wasm | |
| shell: bash | |
| run: | | |
| set -euxo pipefail | |
| archive="container2wasm-${C2W_VERSION}-linux-amd64.tar.gz" | |
| url="https://github.com/container2wasm/container2wasm/releases/download/${C2W_VERSION}/${archive}" | |
| curl --fail --location --retry 5 --output "/tmp/${archive}" "$url" | |
| echo "${C2W_LINUX_AMD64_SHA256} /tmp/${archive}" | sha256sum --check --strict | |
| tar -xzf "/tmp/${archive}" -C /tmp | |
| sudo install -m 0755 /tmp/c2w /usr/local/bin/c2w | |
| sudo install -m 0755 /tmp/c2w-net /usr/local/bin/c2w-net | |
| c2w --version | |
| - name: Prepare the Flye high-memory container2wasm builder | |
| shell: bash | |
| run: | | |
| set -euxo pipefail | |
| (( FLYE_WASM_VM_MEMORY_MB > 0 )) | |
| (( FLYE_WASM_VM_HOST_MEMORY_MB > 0 )) | |
| (( FLYE_WASM_VM_HOST_MEMORY_MB < FLYE_WASM_VM_MEMORY_MB )) | |
| mkdir -p wasm/dist | |
| upstream=/tmp/container2wasm-upstream.Dockerfile | |
| patched=wasm/dist/container2wasm-flye.Dockerfile | |
| c2w --show-dockerfile > "$upstream" | |
| python3 wasm/tools/patch_c2w_large_ram.py "$upstream" "$patched" | |
| grep -F -- '--enable-large-ramfile' "$patched" | |
| grep -F -- 'memory: guest=${MEMORY_SIZE}, host=${HOST_MEMORY_SIZE}, block_size=1024' "$patched" | |
| test "$(grep -c -- '--enable-large-ramfile' "$patched")" = 1 | |
| test "$(grep -c -- 'ARG VM_HOST_MEMORY_SIZE_MB' "$patched")" -ge 2 | |
| sha256sum "$patched" | tee wasm/dist/container2wasm-flye.Dockerfile.sha256 | |
| - name: Convert the complete image to WASI WebAssembly | |
| shell: bash | |
| run: | | |
| set -euxo pipefail | |
| mkdir -p "$(dirname "$FLYE_WASM_MODULE")" | |
| c2w \ | |
| --dockerfile wasm/dist/container2wasm-flye.Dockerfile \ | |
| --target-arch=amd64 \ | |
| --build-arg SOURCE_REPO=https://github.com/container2wasm/container2wasm \ | |
| --build-arg "VM_MEMORY_SIZE_MB=${FLYE_WASM_VM_MEMORY_MB}" \ | |
| --build-arg "VM_HOST_MEMORY_SIZE_MB=${FLYE_WASM_VM_HOST_MEMORY_MB}" \ | |
| --build-arg "OPTIMIZATION_MODE=${C2W_OPTIMIZATION_MODE}" \ | |
| "$FLYE_NATIVE_IMAGE" \ | |
| "$FLYE_WASM_MODULE" | |
| test -s "$FLYE_WASM_MODULE" | |
| test "$(head -c 4 "$FLYE_WASM_MODULE" | od -An -tx1 | tr -d ' \n')" = "0061736d" | |
| sha256sum "$FLYE_WASM_MODULE" | tee wasm/dist/SHA256SUMS | |
| ls -lh "$FLYE_WASM_MODULE" | |
| - name: Install Wasmtime | |
| shell: bash | |
| run: | | |
| set -euxo pipefail | |
| archive="wasmtime-${WASMTIME_VERSION}-x86_64-linux.tar.xz" | |
| url="https://github.com/bytecodealliance/wasmtime/releases/download/${WASMTIME_VERSION}/${archive}" | |
| curl --fail --location --retry 5 --output "/tmp/${archive}" "$url" | |
| tar -xJf "/tmp/${archive}" -C /tmp | |
| sudo install -m 0755 "/tmp/wasmtime-${WASMTIME_VERSION}-x86_64-linux/wasmtime" /usr/local/bin/wasmtime | |
| wasmtime --version | |
| - name: Verify CLI and bundled executable parity | |
| shell: bash | |
| run: | | |
| set -euxo pipefail | |
| bash wasm/verify/cli-smoke.sh | |
| - name: Write build provenance | |
| if: always() | |
| shell: bash | |
| run: | | |
| set -u | |
| mkdir -p wasm/dist | |
| { | |
| echo "Flye version: ${FLYE_VERSION}" | |
| echo "Flye upstream commit: 886b8c17412cdf3a2868a28237bca6c5ad1da156" | |
| echo "Repository commit: ${GITHUB_SHA}" | |
| echo "container2wasm: $(c2w --version 2>&1 || true)" | |
| echo "container2wasm optimization mode: ${C2W_OPTIMIZATION_MODE}" | |
| echo "container2wasm guest memory: ${FLYE_WASM_VM_MEMORY_MB} MiB" | |
| echo "container2wasm in-memory guest backing: ${FLYE_WASM_VM_HOST_MEMORY_MB} MiB" | |
| echo "container2wasm overflow backing: Bochs large-RAM-file" | |
| echo "Wasmtime: $(wasmtime --version 2>&1 || true)" | |
| echo "Built: $(date --utc --iso-8601=seconds)" | |
| } | tee wasm/dist/PROVENANCE.txt | |
| docker inspect "$FLYE_NATIVE_IMAGE" > wasm/dist/native-image-inspect.json 2>/dev/null || true | |
| - name: Publish the complete WebAssembly package before the long assembly test | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: flye-2.9.6-complete-wasm | |
| if-no-files-found: warn | |
| compression-level: 0 | |
| retention-days: 30 | |
| path: | | |
| wasm/dist/flye-2.9.6-complete.wasm | |
| wasm/dist/SHA256SUMS | |
| wasm/dist/PROVENANCE.txt | |
| wasm/dist/native-image-inspect.json | |
| wasm/dist/container2wasm-flye.Dockerfile | |
| wasm/dist/container2wasm-flye.Dockerfile.sha256 | |
| wasm/dist/verification/** | |
| wasm/run-flye-wasi.sh | |
| wasm/README.md | |
| LICENSE | |
| assembly-parity: | |
| name: Verify native versus WebAssembly assembly | |
| needs: build-and-smoke | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 300 | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@v4 | |
| - name: Download the verified WebAssembly package | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: flye-2.9.6-complete-wasm | |
| path: . | |
| - name: Validate the downloaded module | |
| shell: bash | |
| run: | | |
| set -euxo pipefail | |
| test -s "$FLYE_WASM_MODULE" | |
| test "$(head -c 4 "$FLYE_WASM_MODULE" | od -An -tx1 | tr -d ' \n')" = "0061736d" | |
| sha256sum --check wasm/dist/SHA256SUMS | |
| - name: Build the pinned native Flye baseline image | |
| shell: bash | |
| run: | | |
| set -euxo pipefail | |
| docker build \ | |
| --platform linux/amd64 \ | |
| --progress plain \ | |
| --tag "$FLYE_NATIVE_IMAGE" \ | |
| --file wasm/Dockerfile \ | |
| . | |
| docker run --rm "$FLYE_NATIVE_IMAGE" /opt/flye/bin/flye --version | |
| - name: Reclaim disk and add emergency swap | |
| shell: bash | |
| run: | | |
| set -euxo pipefail | |
| sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/share/boost || true | |
| docker builder prune --all --force || true | |
| docker image prune --force || true | |
| docker image inspect "$FLYE_NATIVE_IMAGE" >/dev/null | |
| if ! sudo swapon --show=NAME --noheadings | grep -q .; then | |
| sudo fallocate -l 8G /swapfile | |
| sudo chmod 600 /swapfile | |
| sudo mkswap /swapfile | |
| if ! sudo swapon /swapfile; then | |
| echo "warning: this runner does not permit enabling swap" >&2 | |
| fi | |
| fi | |
| free -h | |
| sudo swapon --show || true | |
| df -h | |
| - name: Install Wasmtime | |
| shell: bash | |
| run: | | |
| set -euxo pipefail | |
| archive="wasmtime-${WASMTIME_VERSION}-x86_64-linux.tar.xz" | |
| url="https://github.com/bytecodealliance/wasmtime/releases/download/${WASMTIME_VERSION}/${archive}" | |
| curl --fail --location --retry 5 --output "/tmp/${archive}" "$url" | |
| tar -xJf "/tmp/${archive}" -C /tmp | |
| sudo install -m 0755 "/tmp/wasmtime-${WASMTIME_VERSION}-x86_64-linux/wasmtime" /usr/local/bin/wasmtime | |
| wasmtime --version | |
| - name: Verify an end-to-end assembly against the native image | |
| shell: bash | |
| env: | |
| WASMTIME_BACKTRACE_DETAILS: "1" | |
| run: | | |
| set -euo pipefail | |
| diagnostics=wasm/dist/parity/runner-diagnostics.log | |
| mkdir -p "$(dirname "$diagnostics")" | |
| heartbeat() { | |
| while :; do | |
| printf '\n===== runner heartbeat %s =====\n' "$(date --utc --iso-8601=seconds)" | |
| free -m || true | |
| df -h / "$PWD/wasm/dist" || true | |
| cat /proc/pressure/memory 2>/dev/null || true | |
| cat /proc/pressure/io 2>/dev/null || true | |
| ps -eo pid,ppid,ni,stat,%cpu,%mem,rss,vsz,comm,args --sort=-rss | sed -n '1,12p' || true | |
| sleep 30 | |
| done | |
| } | |
| heartbeat > >(tee -a "$diagnostics") 2>&1 & | |
| heartbeat_pid=$! | |
| cleanup() { | |
| kill "$heartbeat_pid" 2>/dev/null || true | |
| wait "$heartbeat_pid" 2>/dev/null || true | |
| } | |
| trap cleanup EXIT INT TERM | |
| if command -v ionice >/dev/null 2>&1; then | |
| ionice -c 3 nice -n 10 \ | |
| timeout --signal=TERM --kill-after=5m 240m \ | |
| bash wasm/verify/end-to-end.sh | |
| else | |
| nice -n 10 \ | |
| timeout --signal=TERM --kill-after=5m 240m \ | |
| bash wasm/verify/end-to-end.sh | |
| fi | |
| - name: Publish assembly parity results and runner diagnostics | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: flye-2.9.6-assembly-parity | |
| if-no-files-found: warn | |
| compression-level: 0 | |
| retention-days: 30 | |
| path: | | |
| wasm/dist/parity/** |