fix(ci): arm64 tests — pass binding selector to container; build node with explicit target

.github/workflows/ci.yml

@@ -1,5 +1,9 @@
 name: CI
 
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   push:
     branches: [ main ]
@@ -111,6 +115,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Restore workspace caches
+        if: matrix.component != 'python'
         uses: actions/cache@v4
         with:
           path: |
@@ -126,6 +131,7 @@ jobs:
             build-${{ runner.os }}-x86_64-${{ matrix.component }}-
             build-${{ runner.os }}-x86_64-
       - name: Restore x86_64 core artifacts
+        if: matrix.component != 'python'
         uses: actions/cache/restore@v4
         with:
           path: |
@@ -141,7 +147,36 @@ jobs:
         if: matrix.component == 'dotnet'
         with:
           dotnet-version: '8.0.x'
+      - name: Restore x86_64 core artifacts for Python
+        if: matrix.component == 'python'
+        uses: actions/cache/restore@v4
+        with:
+          path: |
+            target/x86_64-unknown-linux-gnu
+            target/release
+          key: core-target-${{ runner.os }}-x86_64-${{ github.run_id }}
+          fail-on-cache-miss: true
+      - name: Prepare Python build directory
+        if: matrix.component == 'python'
+        run: |
+          rm -rf artifacts/x86_64/python || true
+          mkdir -p artifacts/x86_64/python
+      - name: Package ${{ matrix.component }} (x86_64) - manylinux
+        if: matrix.component == 'python'
+        run: |
+          docker run --rm \
+            -v "$PWD":/io \
+            -w /io \
+            quay.io/pypa/manylinux_2_28_x86_64:latest \
+            bash -c "
+              curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
+              source \$HOME/.cargo/env
+              /opt/python/cp38-cp38/bin/pip install maturin
+              /opt/python/cp38-cp38/bin/maturin build --release --manifest-path asherah-py/Cargo.toml --compatibility manylinux_2_28 --out artifacts/x86_64/python
+            "
+
       - name: Package ${{ matrix.component }} (x86_64)
+        if: matrix.component != 'python'
         env:
           TARGET_ARCH: x86_64
           BINDING_COMPONENTS: ${{ matrix.component }}
@@ -156,15 +191,38 @@ jobs:
   arm64-test-image:
     runs-on: ubuntu-latest
     needs: lint
+    env:
+      CACHE_MAX_AGE_DAYS: 7
+    outputs:
+      cache-hit: ${{ steps.check-cache.outputs.cache-hit }}
     steps:
       - uses: actions/checkout@v4
+      - name: Calculate cache key
+        id: cache-key
+        run: |
+          DOCKERFILE_HASH=$(sha256sum docker/tests.Dockerfile | cut -d' ' -f1 | head -c 8)
+          # Get week number to force rebuild every N days
+          WEEK_NUM=$(( $(date +%s) / 86400 / ${{ env.CACHE_MAX_AGE_DAYS }} ))
+          CACHE_KEY="arm64-test-image-${DOCKERFILE_HASH}-week-${WEEK_NUM}"
+          echo "cache-key=${CACHE_KEY}" >> $GITHUB_OUTPUT
+          echo "Cache key: ${CACHE_KEY}"
+      - name: Check for cached image
+        id: check-cache
+        uses: actions/cache@v4
+        with:
+          path: /tmp/asherah-tests-arm64.tar
+          key: ${{ steps.cache-key.outputs.cache-key }}
+          lookup-only: true
       - name: Set up QEMU
+        if: steps.check-cache.outputs.cache-hit != 'true'
         uses: docker/setup-qemu-action@v3
         with:
           platforms: linux/arm64
       - name: Set up Docker Buildx
+        if: steps.check-cache.outputs.cache-hit != 'true'
         uses: docker/setup-buildx-action@v3
       - name: Build arm64 test image
+        if: steps.check-cache.outputs.cache-hit != 'true'
         run: |
           docker buildx build \
             --file docker/tests.Dockerfile \
@@ -174,6 +232,18 @@ jobs:
             --cache-to type=gha,mode=max,scope=tests-arm64-image \
             --output type=docker,dest=/tmp/asherah-tests-arm64.tar \
             .
+      - name: Restore cached image
+        if: steps.check-cache.outputs.cache-hit == 'true'
+        uses: actions/cache/restore@v4
+        with:
+          path: /tmp/asherah-tests-arm64.tar
+          key: ${{ steps.cache-key.outputs.cache-key }}
+      - name: Save image to cache
+        if: steps.check-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v4
+        with:
+          path: /tmp/asherah-tests-arm64.tar
+          key: ${{ steps.cache-key.outputs.cache-key }}
       - name: Upload arm64 test image
         uses: actions/upload-artifact@v4
         with:
@@ -186,7 +256,7 @@ jobs:
       - package-arm64
       - arm64-test-image
     strategy:
-      fail-fast: false
+      fail-fast: true
       matrix:
         binding: [ffi, python, node, dotnet, java]
     steps:
@@ -210,6 +280,12 @@ jobs:
         with:
           name: bindings-linux-aarch64-part-${{ matrix.binding }}
           path: artifacts/aarch64
+      - name: Download arm64 core FFI artifact
+        if: matrix.binding != 'python' && matrix.binding != 'ffi'
+        uses: actions/download-artifact@v4
+        with:
+          name: bindings-linux-aarch64-part-ffi
+          path: artifacts/aarch64
       - name: Download arm64 test image
         uses: actions/download-artifact@v4
         with:
@@ -393,6 +469,7 @@ jobs:
   core-arm64:
     runs-on: ubuntu-latest
     needs: lint
+    container: rust:1.86-bullseye  # glibc 2.31, Rust pre-installed
     env:
       CARGO_HOME: ${{ github.workspace }}/.cache/cargo
       RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup
@@ -415,38 +492,53 @@ jobs:
           key: build-${{ runner.os }}-arm64-core-${{ hashFiles('**/Cargo.lock', 'asherah-node/package-lock.json', 'asherah-py/Cargo.toml', 'asherah-py/pyproject.toml', 'asherah-java/java/pom.xml', 'asherah-dotnet/**/*.csproj') }}
           restore-keys: |
             build-${{ runner.os }}-arm64-core-
-      - name: Install cross toolchains
+      - name: Install cross-compile toolchain and Node.js for arm64
         run: |
-          sudo apt-get update
-          sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu libc6-dev-arm64-cross pkg-config
-      - name: Prepare Rust target
-        run: rustup target add aarch64-unknown-linux-gnu
-      - name: Build FFI core (arm64)
+          apt-get update
+          apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
+          curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+          apt-get install -y nodejs
+      - name: Build FFI core (arm64) via cross-compilation
         env:
+          CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
+          CXX_aarch64_unknown_linux_gnu: aarch64-linux-gnu-g++
+          AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar
+          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
+          PKG_CONFIG_ALLOW_CROSS: 1
           TARGET_ARCH: aarch64
           BINDING_COMPONENTS: ffi
-          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
-          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_AR: aarch64-linux-gnu-ar
+        run: |
+          rustup target add aarch64-unknown-linux-gnu
+          ./scripts/build-bindings.sh
+      - name: Build Node.js binding (arm64) in Bullseye container
+        env:
           CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
           CXX_aarch64_unknown_linux_gnu: aarch64-linux-gnu-g++
           AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar
+          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
           PKG_CONFIG_ALLOW_CROSS: 1
+          TARGET_ARCH: aarch64
+          BINDING_COMPONENTS: node
+          SKIP_CORE_BUILD: "1"
         run: ./scripts/build-bindings.sh
-      - name: Cache arm64 core artifacts
-        uses: actions/cache/save@v4
+      - name: Upload arm64 core target artifacts
+        uses: actions/upload-artifact@v4
         with:
-          path: |
-            target/aarch64-unknown-linux-gnu
-            target/release
-          key: core-target-${{ runner.os }}-arm64-${{ github.run_id }}
+          name: arm64-core-artifacts
+          path: target/
+      - name: Upload arm64 node binding artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: bindings-linux-aarch64-part-node
+          path: artifacts/aarch64
 
   package-arm64:
     runs-on: ubuntu-latest
     needs: core-arm64
     strategy:
       fail-fast: false
       matrix:
-        component: [ffi, node, python, dotnet, java]
+        component: [ffi, python, dotnet, java]
     env:
       CARGO_HOME: ${{ github.workspace }}/.cache/cargo
       RUSTUP_HOME: ${{ github.workspace }}/.cache/rustup
@@ -456,6 +548,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Restore workspace caches
+        if: matrix.component != 'python'
         uses: actions/cache@v4
         with:
           path: |
@@ -470,19 +563,19 @@ jobs:
           restore-keys: |
             build-${{ runner.os }}-arm64-${{ matrix.component }}-
             build-${{ runner.os }}-arm64-
-      - name: Restore arm64 core artifacts
-        uses: actions/cache/restore@v4
+      - name: Download arm64 core artifacts
+        if: matrix.component != 'python'
+        uses: actions/download-artifact@v4
         with:
-          path: |
-            target/aarch64-unknown-linux-gnu
-            target/release
-          key: core-target-${{ runner.os }}-arm64-${{ github.run_id }}
-          fail-on-cache-miss: true
+          name: arm64-core-artifacts
+          path: target/
       - name: Install cross toolchains
+        if: matrix.component != 'python'
         run: |
           sudo apt-get update
           sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu libc6-dev-arm64-cross pkg-config
       - name: Prepare Rust target
+        if: matrix.component != 'python'
         run: rustup target add aarch64-unknown-linux-gnu
       - uses: actions/setup-node@v4
         if: matrix.component == 'node'
@@ -492,7 +585,38 @@ jobs:
         if: matrix.component == 'dotnet'
         with:
           dotnet-version: '8.0.x'
+      - name: Download arm64 core artifacts for Python
+        if: matrix.component == 'python'
+        uses: actions/download-artifact@v4
+        with:
+          name: arm64-core-artifacts
+          path: target/
+      - name: Prepare Python build directory
+        if: matrix.component == 'python'
+        run: |
+          rm -rf artifacts/aarch64/python || true
+          mkdir -p artifacts/aarch64/python
+      - name: Install cross-compile toolchain for arm64
+        if: matrix.component == 'python'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
+      - name: Build Python wheel for arm64 (using cached core artifacts)
+        if: matrix.component == 'python'
+        env:
+          CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
+          CXX_aarch64_unknown_linux_gnu: aarch64-linux-gnu-g++
+          AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar
+          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
+        run: |
+          pip install maturin
+          rustup target add aarch64-unknown-linux-gnu
+          # Build with cached arm64 core artifacts - only compiles the Python binding wrapper
+          # Skip auditwheel because GitHub runner has too-new GLIBC but maturin still tags correctly
+          maturin build --release --target aarch64-unknown-linux-gnu --manifest-path asherah-py/Cargo.toml --skip-auditwheel --out artifacts/aarch64/python
+
       - name: Package ${{ matrix.component }} (arm64)
+        if: matrix.component != 'python'
         env:
           TARGET_ARCH: aarch64
           BINDING_COMPONENTS: ${{ matrix.component }}

BUILD_RULES.md

@@ -0,0 +1,42 @@
+# Build Rules
+
+## Rust Compilation
+
+**NEVER compile Rust code under QEMU emulation or any other emulation.**
+
+All Rust builds must be either:
+1. Native compilation on the target architecture
+2. Cross-compilation from a native host
+
+Emulated builds are unacceptably slow (60-90 minutes vs 5-10 minutes) and are forbidden.
+
+### Examples
+
+❌ **WRONG**: `docker run --platform linux/arm64` on x86_64 (runs under QEMU)
+❌ **WRONG**: Building in ARM64 container on x86_64 host
+❌ **WRONG**: `cargo build` inside emulated environment
+
+✅ **CORRECT**: Cross-compile from x86_64 to aarch64 with proper toolchain
+✅ **CORRECT**: Native build on actual ARM64 hardware
+✅ **CORRECT**: Using manylinux_2_28_x86_64 container with aarch64 cross-compiler
+
+### CI Implementation
+
+- Use manylinux_2_28 containers for glibc 2.28 compatibility
+- Install cross-compile toolchains (gcc-aarch64-linux-gnu, etc.)
+- Set proper environment variables for cross-compilation
+- Trust pre-built artifacts from earlier pipeline stages
+
+### Current Hardcoded Assumptions
+
+The CI workflow currently assumes x86_64 as the native architecture and cross-compiles to aarch64:
+- Job names: `core-x86_64`, `package-x86_64`, `core-arm64`, `package-arm64`
+- Artifact paths: `artifacts/x86_64`, `artifacts/aarch64`
+- Cache keys: `-x86_64-`, `-arm64-`
+- Manylinux containers: `manylinux_2_28_x86_64` for native, cross-compilers for aarch64
+
+**Future Work**: The workflow could be made bidirectional by:
+1. Detecting host architecture (`uname -m`)
+2. Setting native=x86_64 cross=aarch64 (or vice versa)
+3. Using variables throughout instead of hardcoded values
+4. This would allow the same workflow to run on ARM64 laptops/runners

asherah-node/npm/index.js

@@ -5,12 +5,14 @@ const attempts = [
   path.join(__dirname, '..', 'index.node'),
 ];
 
+let lastErr = null;
 for (const candidate of attempts) {
   try {
     module.exports = require(candidate);
     module.exports.__binary = candidate;
     return;
   } catch (err) {
+    lastErr = err;
     if (
       err.code !== 'MODULE_NOT_FOUND' &&
       err.code !== 'ERR_MODULE_NOT_FOUND' &&
@@ -21,4 +23,5 @@ for (const candidate of attempts) {
   }
 }
 
-throw new Error('Failed to load Asherah native addon.');
+const detail = lastErr ? `: ${lastErr.message || String(lastErr)}` : '';
+throw new Error('Failed to load Asherah native addon' + detail);

asherah-node/package.json

@@ -1,7 +1,7 @@
 {
   "name": "asherah-node",
-  "version": "0.1.0",
-  "private": true,
+  "version": "4.0.0",
+  "private": false,
   "description": "Node.js addon for Asherah (napi-rs)",
   "main": "npm/index.js",
   "types": "index.d.ts",
@@ -24,8 +24,9 @@
     "node": ">= 18"
   },
   "optionalDependencies": {
-    "asherah-win32-x64-msvc": "0.1.0",
-    "asherah-darwin-x64": "0.1.0",
-    "asherah-linux-x64-gnu": "0.1.0"
+    "asherah-win32-x64-msvc": "4.0.0",
+    "asherah-darwin-x64": "4.0.0",
+    "asherah-linux-x64-gnu": "4.0.0",
+    "asherah-linux-arm64-gnu": "4.0.0"
   }
 }