name: Build Rust Sources

on:

workflow_call:

env:

CARGO_FLAGS: "--release --locked --all-targets"

CARGO_FEATURES_BASE: "fips,pubsub-emulator-test,iceberg-tests-fs,iceberg-tests-glue"

FELDERA_PLATFORM_VERSION_SUFFIX: ${{ github.sha }}

FELDERA_BUILD_ORIGIN: ci

RUSTC_WRAPPER: sccache

SCCACHE_CACHE_SIZE: ${{ vars.SCCACHE_CACHE_SIZE }}

SCCACHE_BUCKET: ${{ vars.SCCACHE_BUCKET }}

SCCACHE_ENDPOINT: ${{ vars.SCCACHE_ENDPOINT }}

SCCACHE_REGION: ${{ vars.SCCACHE_REGION }}

AWS_ACCESS_KEY_ID: "${{ secrets.CI_K8S_MINIO_ACCESS_KEY_ID }}"

AWS_SECRET_ACCESS_KEY: "${{ secrets.CI_K8S_MINIO_SECRET_ACCESS_KEY }}"

# sccache cannot cache incremental rustc invocations; release already

# disables incremental, but doc tests run in debug mode.

CARGO_INCREMENTAL: 0

# Cap cargo parallelism at the k8s runner core budget so arm64 pods don't

# OOM from too many parallel linkers. Override via the CI_RUNNER_CORES repo

# variable; the fallback matches the current 20-core pod.

CARGO_BUILD_JOBS: ${{ vars.CI_RUNNER_CORES || 20 }}

jobs:

build-rust:

name: Build Rust Binaries

# We run this on two different architectures (x86_64 and aarch64)

strategy:

matrix:

include:

- runner: [k8s-runners-amd64]

arch: x86_64

target: x86_64-unknown-linux-gnu

- runner: [k8s-runners-arm64]

arch: aarch64

target: aarch64-unknown-linux-gnu

runs-on: ${{ matrix.runner }}

container:

image: ghcr.io/feldera/feldera-dev:sha-a5ab793b8d261068867b9fdfad3f04157b2536fc

steps:

- name: Show Kubernetes node

if: always()

run: |

echo "K8S node: ${K8S_NODE_NAME}"

- name: Checkout repository

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Cache Cargo registry and index

uses: ./.github/actions/feldera-minio-cache

with:

# registry/src excluded — cargo regenerates it from registry/cache.

path: |

~/.cargo/registry/cache

~/.cargo/registry/index

~/.cargo/git/db

key: build-rust-cargo-${{ runner.os }}-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}

restore-keys: |

build-rust-cargo-${{ runner.os }}-${{ matrix.target }}-

# Doc tests invoke the linker per test; cap concurrency at the runner

# core budget so arm64 pods don't OOM. See rust-lang/cargo#10702.

- name: Run Rust doc tests

if: matrix.arch == 'x86_64'

run: |

# Don't build the webconsole again for rust tests

export WEBCONSOLE_BUILD_DIR="$(mktemp -d)"

touch $WEBCONSOLE_BUILD_DIR/index.html

cargo test --locked --doc --workspace -- --test-threads ${{ vars.CI_RUNNER_CORES || 20 }}

- name: Build Rust binaries

run: |

FEATURES="${{ env.CARGO_FEATURES_BASE }}"

cargo build ${{ env.CARGO_FLAGS }} --features "$FEATURES" --target=${{ matrix.target }}

- name: Print sccache stats

run: |

sccache --show-stats

# Get list of executables

- name: Collect executables

id: collect

run: |

FEATURES="${{ env.CARGO_FEATURES_BASE }}"

# Run again with --message-format=json to list out executables

# (No real recompile since nothing has changed).

# Then transform newlines to spaces for the artifact step.

EXES=$(cargo build ${{ env.CARGO_FLAGS }} --features "$FEATURES" --target=${{ matrix.target }} --message-format=json \

| jq -r '.executable | select(. != null)' | tr '\n' ' ')

echo "Found executables: $EXES"

# Save it as an output variable for subsequent steps

echo "executables=$EXES" >> $GITHUB_OUTPUT

# Copy all executables into a single directory because upload-artifact does not support

# multiple paths or `|` in glob patterns

- name: Copy executables

run: |

mkdir -p build-artifacts

for exe in ${{ steps.collect.outputs.executables }}; do

cp "$exe" build-artifacts/

done

rm build-artifacts/tutorial*

rm build-artifacts/galen-*

rm build-artifacts/fraud-*

rm build-artifacts/degrees

rm build-artifacts/coord

rm build-artifacts/ldbc_graphalytics-*

rm build-artifacts/logging_demo-*

rm build-artifacts/nexmark_gen-*

rm build-artifacts/orgchart

rm build-artifacts/path-*

rm build-artifacts/pool

mkdir -p build-release-artifacts

# Move the executables we ship to users to a separate directory

mv build-artifacts/fda build-release-artifacts/

mv build-artifacts/pipeline-manager build-release-artifacts/

# Upload test binaries as one artifact

- name: Upload test artifacts

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

with:

name: feldera-test-binaries-${{ matrix.target }}

path: build-artifacts

retention-days: 7

- name: Upload fda

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

with:

name: fda-${{ matrix.target }}

path: build-release-artifacts/fda

retention-days: 7

- name: Upload pipeline-manager

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

with:

name: pipeline-manager-${{ matrix.target }}

path: build-release-artifacts/pipeline-manager

retention-days: 7

build-fda-native:

name: Build fda (native)

# Builds fda for Windows and macOS using native runners.

# Windows arm64 is skipped for now — the runner lacks Rust and MSVC.

strategy:

matrix:

include:

- runner: macos-latest-arm64

target: aarch64-apple-darwin

fda_artifact: fda

- runner: windows-latest-amd64

target: x86_64-pc-windows-msvc

fda_artifact: fda.exe

runs-on: ${{ matrix.runner }}

# sccache is not available on these runners

env:

RUSTC_WRAPPER: ""

steps:

- name: Checkout repository

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Add Rust target

run: rustup target add ${{ matrix.target }}

- name: Cache Cargo registry and index

uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5

with:

# registry/src excluded — cargo regenerates it from registry/cache.

path: |

~/.cargo/registry/cache

~/.cargo/registry/index

~/.cargo/git/db

key: build-rust-fda-native-cargo-${{ runner.os }}-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}

restore-keys: |

build-rust-fda-native-cargo-${{ runner.os }}-${{ matrix.target }}-

- name: Build fda

run: cargo build --release --locked -p fda --target=${{ matrix.target }}

- name: Upload fda

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

with:

name: fda-${{ matrix.target }}

path: target/${{ matrix.target }}/release/${{ matrix.fda_artifact }}

retention-days: 7

cancel-if-build-rust-failed:

name: Cancel if Rust Build Failed

needs: [build-rust]

if: failure()

runs-on: ubuntu-latest-amd64

permissions:

actions: write

steps:

- name: Cancel workflow

run: |

curl -fsSL -X POST \

-H "Authorization: Bearer ${{ github.token }}" \

-H "Accept: application/vnd.github+json" \

"https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/cancel"