From 0d44947cc4a6f7eb021dc9c598d5ac40c0d74eef Mon Sep 17 00:00:00 2001 From: Philip Niedertscheider Date: Thu, 10 Sep 2026 22:55:46 +0200 Subject: [PATCH 1/4] ci: Strip Linux release binaries Upload symbol-bearing ELF files to Sentry before relinking stripped release artifacts. Enforce an 80 MB size ceiling and matching build IDs so server-side symbolication remains valid. --- .github/workflows/build-binaries.yml | 61 +++++++++++++++++++++++++++- 1 file changed, 60 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-binaries.yml b/.github/workflows/build-binaries.yml index d922603..038353d 100644 --- a/.github/workflows/build-binaries.yml +++ b/.github/workflows/build-binaries.yml @@ -140,13 +140,72 @@ jobs: commit-sha: ${{ inputs.commit_sha }} build-date: ${{ inputs.build_date }} - - name: Build CLI + - name: Build CLI with debug information + id: build-linux run: | swift build -c release --swift-sdk "${{ matrix.swift_sdk }}" BIN_DIR=$(swift build -c release --swift-sdk "${{ matrix.swift_sdk }}" --show-bin-path) + BUILD_ID=$(readelf --notes "$BIN_DIR/apple-docs" | awk '/Build ID/ { print $3 }') + test -n "$BUILD_ID" + echo "bin_dir=$BIN_DIR" >> "$GITHUB_OUTPUT" + echo "build_id=$BUILD_ID" >> "$GITHUB_OUTPUT" + + - name: Install sentry-cli + if: github.event_name != 'pull_request' + env: + SENTRY_CLI_VERSION: "3.7.0" + SENTRY_CLI_SHA256: "cec71d46a7cc394c94b6e75f1601985c710d457376c546ef3975567b3671563b" + run: | + curl --fail --silent --show-error --location \ + "https://github.com/getsentry/sentry-cli/releases/download/${SENTRY_CLI_VERSION}/sentry-cli-Linux-x86_64" \ + --output "$RUNNER_TEMP/sentry-cli" + echo "$SENTRY_CLI_SHA256 $RUNNER_TEMP/sentry-cli" | sha256sum --check + chmod +x "$RUNNER_TEMP/sentry-cli" + + - name: Upload Linux debug information to Sentry + if: github.event_name != 'pull_request' + env: + SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} + SENTRY_ORG: techprimate + SENTRY_PROJECT: apple-docs-cli + run: | + if [ -z "$SENTRY_AUTH_TOKEN" ]; then + echo "::error::SENTRY_AUTH_TOKEN is not configured." + exit 1 + fi + + BINARY_PATH="${{ steps.build-linux.outputs.bin_dir }}/apple-docs" + "$RUNNER_TEMP/sentry-cli" debug-files check "$BINARY_PATH" + "$RUNNER_TEMP/sentry-cli" debug-files upload \ + --include-sources \ + --wait \ + "$BINARY_PATH" + + - name: Build stripped CLI + run: | + swift build -c release \ + --swift-sdk "${{ matrix.swift_sdk }}" \ + -Xlinker --strip-all + BIN_DIR=$(swift build \ + -c release \ + --swift-sdk "${{ matrix.swift_sdk }}" \ + --show-bin-path) mkdir -p dist cp "$BIN_DIR/apple-docs" "dist/apple-docs-${{ matrix.platform }}" + - name: Verify Linux artifact size + run: | + BINARY_PATH="dist/apple-docs-${{ matrix.platform }}" + BINARY_SIZE=$(stat --format=%s "$BINARY_PATH") + BUILD_ID=$(readelf --notes "$BINARY_PATH" | awk '/Build ID/ { print $3 }') + echo "Linux artifact size: $BINARY_SIZE bytes" + test "$BINARY_SIZE" -lt 80000000 + test "$BUILD_ID" = "${{ steps.build-linux.outputs.build_id }}" + if readelf --sections "$BINARY_PATH" | grep --quiet '\.debug_'; then + echo "::error::Linux artifact contains debug sections." + exit 1 + fi + - name: Exercise Linux CLI if: matrix.platform == 'linux-amd64' run: | From 09801eae34d34b6c2c1a3af759f807e58b921e3d Mon Sep 17 00:00:00 2001 From: Philip Niedertscheider Date: Fri, 11 Sep 2026 11:19:10 +0200 Subject: [PATCH 2/4] ci: Trace Linux release build and verification --- .github/workflows/build-binaries.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/build-binaries.yml b/.github/workflows/build-binaries.yml index 038353d..f92a95c 100644 --- a/.github/workflows/build-binaries.yml +++ b/.github/workflows/build-binaries.yml @@ -143,6 +143,7 @@ jobs: - name: Build CLI with debug information id: build-linux run: | + set -x swift build -c release --swift-sdk "${{ matrix.swift_sdk }}" BIN_DIR=$(swift build -c release --swift-sdk "${{ matrix.swift_sdk }}" --show-bin-path) BUILD_ID=$(readelf --notes "$BIN_DIR/apple-docs" | awk '/Build ID/ { print $3 }') @@ -183,6 +184,7 @@ jobs: - name: Build stripped CLI run: | + set -x swift build -c release \ --swift-sdk "${{ matrix.swift_sdk }}" \ -Xlinker --strip-all @@ -195,6 +197,7 @@ jobs: - name: Verify Linux artifact size run: | + set -x BINARY_PATH="dist/apple-docs-${{ matrix.platform }}" BINARY_SIZE=$(stat --format=%s "$BINARY_PATH") BUILD_ID=$(readelf --notes "$BINARY_PATH" | awk '/Build ID/ { print $3 }') From 02391dfbdb7f6a7076d8546ee50436a2e3e5dc96 Mon Sep 17 00:00:00 2001 From: Philip Niedertscheider Date: Fri, 11 Sep 2026 11:32:48 +0200 Subject: [PATCH 3/4] ci: Preserve Linux build IDs when stripping binaries --- .github/workflows/build-binaries.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/build-binaries.yml b/.github/workflows/build-binaries.yml index f92a95c..291dd03 100644 --- a/.github/workflows/build-binaries.yml +++ b/.github/workflows/build-binaries.yml @@ -182,18 +182,18 @@ jobs: --wait \ "$BINARY_PATH" - - name: Build stripped CLI + - name: Install LLVM tools + run: | + sudo apt-get update + sudo apt-get install --yes --no-install-recommends llvm + + - name: Strip CLI run: | set -x - swift build -c release \ - --swift-sdk "${{ matrix.swift_sdk }}" \ - -Xlinker --strip-all - BIN_DIR=$(swift build \ - -c release \ - --swift-sdk "${{ matrix.swift_sdk }}" \ - --show-bin-path) mkdir -p dist - cp "$BIN_DIR/apple-docs" "dist/apple-docs-${{ matrix.platform }}" + llvm-strip --strip-all \ + --output "dist/apple-docs-${{ matrix.platform }}" \ + "${{ steps.build-linux.outputs.bin_dir }}/apple-docs" - name: Verify Linux artifact size run: | From 279ebf15dacac0254a879b716171800871be7df4 Mon Sep 17 00:00:00 2001 From: Philip Niedertscheider Date: Fri, 11 Sep 2026 11:38:38 +0200 Subject: [PATCH 4/4] ci: Use supported llvm-strip output option --- .github/workflows/build-binaries.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-binaries.yml b/.github/workflows/build-binaries.yml index 291dd03..975d001 100644 --- a/.github/workflows/build-binaries.yml +++ b/.github/workflows/build-binaries.yml @@ -192,7 +192,7 @@ jobs: set -x mkdir -p dist llvm-strip --strip-all \ - --output "dist/apple-docs-${{ matrix.platform }}" \ + -o "dist/apple-docs-${{ matrix.platform }}" \ "${{ steps.build-linux.outputs.bin_dir }}/apple-docs" - name: Verify Linux artifact size