ci(ffi): publish prebuilt mobile binaries as Release assets (#4)#5
Merged
Conversation
Consumers (e.g. maktub-app) currently must check out warden and cross-compile the native Veil libs themselves — a full Rust + iOS/Android toolchain — because the binary is git-ignored and distributed nowhere. The binary is platform- but not machine-specific, so it should be built once and published. - mobile-release.yml: on a `v*` tag, cross-compile via build-mobile.sh on macos/ubuntu runners and attach WardenFfi.xcframework.zip + warden-ffi-android-jniLibs.zip + SHA256SUMS to the Release. Tag-triggered so the binary version stays in lockstep with the warden_ffi pub.dev version (both cut from one tag); workflow_dispatch builds without releasing. - mobile-ci.yml: path-filtered build-check (PR + main) that cross-compiles both platforms and runs the FFI host round-trip, so a mobile-build break surfaces early without cutting a release. - docs: README, ffi/README, ffi/dart/README now point consumers at the Release assets (no toolchain) and keep build-from-source for warden devs. Phase 1 of #4. The turn-key warden_ffi_flutter plugin (which downloads these assets at build time) is the follow-up; it needs real-device verification. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
cargo-ndk 4.x requires rustc 1.86; the toolchain is pinned at 1.83 (rust-toolchain.toml), so the unpinned install failed. 3.5.4 is the last line that builds on 1.83, and pinning keeps the cross-compile reproducible. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
${{ env.ANDROID_NDK_LATEST_HOME }} resolved to empty — the env expression
context only holds workflow-defined vars, not runner-provided ones. The runner
exposes the NDK path as the shell var $ANDROID_NDK_LATEST_HOME, so set
ANDROID_NDK_HOME inline in the run command instead.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase 1 of #4 — make the native Veil binaries downloadable so a consuming Flutter app (e.g.
maktub-app) no longer needs a Rust + iOS/Android cross toolchain to do a device build.Why
The
warden_ffiDart binding is on pub.dev, but the native libs it wraps are git-ignored and published nowhere. Today every build machine must check out warden and runbuild-mobile.shitself. The binary is platform-specific but not machine-specific → build once, publish, consume.What's in this PR
.github/workflows/mobile-release.yml— on av*tag, cross-compile via the existingbuild-mobile.sh(iOS onmacos-latest, Android onubuntu-latest) and attach to the Release:WardenFfi.xcframework.zipwarden-ffi-android-jniLibs.zipSHA256SUMSTag-triggered, not per-merge — keeps the binary version in lockstep with the
warden_ffipub.dev version (cut both from the same tag).workflow_dispatchruns the builds without releasing (the release job is tag-gated) for smoke-testing..github/workflows/mobile-ci.yml— path-filtered build-check (PR + push tomain, scoped tocore/**,ffi/**, Cargo/toolchain): cross-compiles both platforms + runscargo test -p warden-ffi. Catches a broken mobile build without cutting a release.Docs — top
README.md,ffi/README.md,ffi/dart/README.mdnow point consumers at the Release assets (no toolchain), keeping build-from-source for warden devs.Design notes
build-mobile.shunchanged (the already-verified static-xcframework + 4-ABI jniLibs path). No iOS linking changes here.Reuse note
mobile-ci.ymlandmobile-release.ymlduplicate the build steps. Kept separate for clarity (check vs. publish, different triggers); a composite action could DRY them later if the steps grow.Verification
actionlintclean on both workflows; YAML parses.v0.1.0-dev.1tag (release). The cross-compiles they invoke are the samebuild-mobile.shcommands already used by hand.Follow-up (Phase 2, tracked in #4)
warden_ffi_flutterplugin that downloads these assets at build time so consumers add one pub.dev dependency and nothing else. Separate PR because it needs an iOS static-vs-dynamic-framework decision + real-device verification.🤖 Generated with Claude Code