Publish bindgen prebuilts for LLVM 22 and 23

.github/workflows/build_release.sh

@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+llvm_version="${1:?usage: build_release.sh LLVM_VERSION}"
+grep -Fq "llvm.version(llvm_version = \"$llvm_version\")" MODULE.bazel
+
 bazel_flags=(--config=remote --lockfile_mode=error)
 if [[ -n "${BUILDBUDDY_API_KEY:-}" ]]; then
   bazel_flags+=(
@@ -20,19 +23,19 @@ copy_out() {
   cp -f "$source" "$2"
 }
 
-copy_out //:bindgen_darwin_amd64 bindgen_darwin_amd64.tar.zst
-copy_out //:bindgen_darwin_arm64 bindgen_darwin_arm64.tar.zst
-copy_out //:bindgen_linux_amd64 bindgen_linux_amd64.tar.zst
-copy_out //:bindgen_linux_arm64 bindgen_linux_arm64.tar.zst
-copy_out //:bindgen_windows_amd64 bindgen_windows_amd64.tar.zst
-copy_out //:bindgen_windows_arm64 bindgen_windows_arm64.tar.zst
+copy_out //:bindgen_darwin_amd64 "bindgen_llvm${llvm_version}_darwin_amd64.tar.zst"
+copy_out //:bindgen_darwin_arm64 "bindgen_llvm${llvm_version}_darwin_arm64.tar.zst"
+copy_out //:bindgen_linux_amd64 "bindgen_llvm${llvm_version}_linux_amd64.tar.zst"
+copy_out //:bindgen_linux_arm64 "bindgen_llvm${llvm_version}_linux_arm64.tar.zst"
+copy_out //:bindgen_windows_amd64 "bindgen_llvm${llvm_version}_windows_amd64.tar.zst"
+copy_out //:bindgen_windows_arm64 "bindgen_llvm${llvm_version}_windows_arm64.tar.zst"
 
 artifacts=(
-  bindgen_darwin_amd64.tar.zst
-  bindgen_darwin_arm64.tar.zst
-  bindgen_linux_amd64.tar.zst
-  bindgen_linux_arm64.tar.zst
-  bindgen_windows_amd64.tar.zst
-  bindgen_windows_arm64.tar.zst
+  "bindgen_llvm${llvm_version}_darwin_amd64.tar.zst"
+  "bindgen_llvm${llvm_version}_darwin_arm64.tar.zst"
+  "bindgen_llvm${llvm_version}_linux_amd64.tar.zst"
+  "bindgen_llvm${llvm_version}_linux_arm64.tar.zst"
+  "bindgen_llvm${llvm_version}_windows_amd64.tar.zst"
+  "bindgen_llvm${llvm_version}_windows_arm64.tar.zst"
 )
-LC_ALL=C shasum -a 256 "${artifacts[@]}" > SHA256.txt
+LC_ALL=C shasum -a 256 "${artifacts[@]}" > "SHA256_llvm${llvm_version}.txt"

.github/workflows/ci.yml

@@ -1,9 +1,11 @@
-name: Build
+name: Build and release
 
 on:
   push:
     branches:
       - master
+    tags:
+      - "v*.*.*"
   pull_request:
     branches:
       - master
@@ -12,13 +14,69 @@ permissions:
   contents: read
 
 jobs:
-  build:
+  plan:
     runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.matrix.outputs.matrix }}
     steps:
-      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - id: matrix
+        run: echo "matrix=$(jq -c '{include:.variants}' releases/manifest.json)" >> "$GITHUB_OUTPUT"
 
-      - name: Build
+  build:
+    needs: plan
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.plan.outputs.matrix) }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - name: Build LLVM ${{ matrix.llvm_version }} archives
+        working-directory: ${{ matrix.workspace }}
         env:
           BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
-        run: .github/workflows/build_release.sh
+          LLVM_VERSION: ${{ matrix.llvm_version }}
+        run: '"$GITHUB_WORKSPACE/.github/workflows/build_release.sh" "$LLVM_VERSION"'
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: bindgen-llvm${{ matrix.llvm_version }}
+          path: |
+            ${{ matrix.workspace }}/bindgen_llvm*.tar.zst
+            ${{ matrix.workspace }}/SHA256_llvm*.txt
+          if-no-files-found: error
+          compression-level: 0
+
+  release:
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+      GH_REPO: ${{ github.repository }}
+      RELEASE_TAG: ${{ github.ref_name }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: bindgen-llvm*
+          merge-multiple: true
+          path: dist
+      - name: Combine manifest and checksums
+        run: |
+          jq --arg source_commit "$GITHUB_SHA" '. + {source_commit:$source_commit}' releases/manifest.json > dist/manifest.json
+          cat dist/SHA256_llvm*.txt > dist/SHA256.txt
+          (cd dist && shasum -a 256 -c SHA256.txt && shasum -a 256 manifest.json >> SHA256.txt)
+      - name: Create draft
+        run: gh release create "$RELEASE_TAG" --verify-tag --draft --title "$RELEASE_TAG" --generate-notes
+      - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65
+        with:
+          draft: true
+          fail_on_unmatched_files: true
+          files: |
+            dist/bindgen_llvm*.tar.zst
+            dist/manifest.json
+            dist/SHA256.txt
+      - name: Publish
+        run: gh release edit "$RELEASE_TAG" --draft=false --latest

.gitignore

@@ -1,4 +1,7 @@
-/bazel-*
+bazel-*
+/dist/
+bindgen_llvm*.tar.zst
+SHA256_llvm*.txt
 /target
 /bindgen_darwin_amd64.tar.zst
 /bindgen_darwin_arm64.tar.zst

MODULE.bazel

@@ -1,19 +1,19 @@
 module(name = "bindgen")
 
-bazel_dep(name = "bazel_lib", version = "3.2.2")
-bazel_dep(name = "llvm", version = "0.8.11")
+bazel_dep(name = "bazel_lib", version = "3.7.2")
+bazel_dep(name = "llvm", version = "0.8.26")
 bazel_dep(name = "platforms", version = "1.1.0")
-bazel_dep(name = "rules_cc", version = "0.2.20")
+bazel_dep(name = "rules_cc", version = "0.2.27")
 bazel_dep(name = "rules_rs", version = "0.2.1")
-bazel_dep(name = "tar.bzl", version = "0.10.4")
+bazel_dep(name = "tar.bzl", version = "0.10.9")
 
-# LLVM 23.1.2, matching the resource headers consumed by these prebuilts.
+# Current hermetic-llvm rules; the extension below selects the LLVM distribution.
 archive_override(
     module_name = "llvm",
-    integrity = "sha256-d1vS7IfVA4zYrWCynJPSOOGECtP5UYmChWi7aiC2k6c=",
-    strip_prefix = "hermetic-llvm-413655560cc6269a1bf4eaac5100fd96830948bd",
+    integrity = "sha256-5pIByuSlCgB/kMKYsb1qH6IPFrt75kDn4m56czrYWGU=",
+    strip_prefix = "hermetic-llvm-c04d527ee4cc2247c82232c1927984714ddb2146",
     urls = [
-        "https://github.com/hermeticbuild/hermetic-llvm/archive/413655560cc6269a1bf4eaac5100fd96830948bd.tar.gz",
+        "https://github.com/hermeticbuild/hermetic-llvm/archive/c04d527ee4cc2247c82232c1927984714ddb2146.tar.gz",
     ],
 )
 
@@ -25,7 +25,7 @@ single_version_override(
     module_name = "windows_support",
     patch_strip = 1,
     patches = ["//patches:windows-support-remote-case-aliases.patch"],
-    version = "0.2.0",
+    version = "0.4.1",
 )
 
 # Latest rules_rs, retaining the Rust 1.96 musl PIE and SDK casing fixes.
@@ -58,6 +58,7 @@ use_repo(toolchains, "default_rust_toolchains")
 register_toolchains("@default_rust_toolchains//:all")
 
 llvm = use_extension("@llvm//extensions:llvm.bzl", "llvm")
+llvm.version(llvm_version = "23.1.2")
 use_repo(llvm, "llvm-project")
 
 crate = use_extension("@rules_rs//rs:extensions.bzl", "crate")

README.md

@@ -2,17 +2,34 @@
 
 Hermetic `bindgen` 0.72.1 executables for Linux, macOS, and Windows on x86-64
 and ARM64. Linux uses musl, Windows uses MSVC with the static CRT, and
-LLVM 23.1.2 `libclang` is linked into every executable.
+LLVM 22.1.8 and 23.1.2 `libclang` variants are linked into separate executables.
 
 ## Build
 
 ```sh
-bazel build //:for_all_platforms
+bazel build --config=remote //:release_archives
+# LLVM 22 uses its own module graph and lockfile:
+(cd releases/llvm22 && bazel build --config=remote //:release_archives)
 ```
 
-`.github/workflows/build_release.sh` builds with remote execution and writes six
-maximum-compression `.tar.zst` archives plus `SHA256.txt`. Each archive contains
-one executable named `bindgen` or `bindgen.exe`.
+The root is the current LLVM workspace. `releases/llvm22` has independent
+`MODULE.bazel` and `MODULE.bazel.lock` files; symlinks share the BUILD files,
+Cargo inputs, flags, and patches. Keep the two module manifests aligned except
+for `llvm.version(...)`. Update each lock from its workspace; CI uses
+`--lockfile_mode=error`. Windows checkouts need Git symlink support.
+
+To collect the six archives and their checksums in each workspace:
+
+```sh
+.github/workflows/build_release.sh 23.1.2
+(cd releases/llvm22 && ../../.github/workflows/build_release.sh 22.1.8)
+```
+
+`releases/manifest.json` lists the supported variants and supplies the CI matrix.
+Keep its versions aligned with the corresponding module manifests.
+For example, `bindgen_llvm23.1.2_linux_arm64.tar.zst` runs on Linux ARM64 and
+parses headers using Clang 23.1.2. Each archive contains one executable named
+`bindgen` or `bindgen.exe`.
 
 ## Use
 
@@ -23,5 +40,21 @@ available, `--no-include-path-detection`.
 ## Release
 
 ```sh
-./release.sh v0.72.1-1
+./release.sh v0.0.4
 ```
+
+The release tag identifies the packaging revision. Bindgen's version and each
+exact LLVM version are independent dimensions recorded in `manifest.json`.
+Tag a reviewed commit on `master` after both CI variants pass.
+
+The same workflow builds both variants before its tag-only release job runs.
+It checks the combined checksums, creates a draft, uploads all twelve archives,
+`manifest.json`, and `SHA256.txt`, then publishes. The manifest records bindgen
+and LLVM versions plus the source commit; checksums cover the archives and manifest.
+
+Creating a release fails if that tag already has one. If an upload fails, inspect
+and remove the incomplete draft before rerunning. Releases before this matrix,
+including v0.0.3, retain their original names and contents.
+
+Consumers select a release, LLVM variant, and execution platform. Updating
+rules_rs's prebuilt selection is a separate consumer change.

releases/llvm22/.bazelrc

@@ -0,0 +1 @@
+../../.bazelrc

releases/llvm22/.bazelversion

@@ -0,0 +1 @@
+../../.bazelversion

releases/llvm22/BUILD.bazel

@@ -0,0 +1 @@
+../../BUILD.bazel

releases/llvm22/Cargo.toml

@@ -0,0 +1 @@
+../../Cargo.toml