rhel-compatibility.yml

name: rhel-compatibility

# Proves the workspace builds with Red Hat's system-native Rust toolchain and
# no rustup, which is the enterprise consumption path. GitHub's ubuntu-latest
# runners are x86_64, so this runs native amd64 with no emulation -- that is
# what makes CI, rather than a developer laptop, the authoritative gate for the
# x86_64-specific linker configuration stripped below.
#
# Security note: this workflow interpolates no event data. The only variable is
# PROTOC_VERSION, a static literal passed via env:, plus GitHub's own
# GITHUB_WORKSPACE path. No untrusted input reaches any run: block.

on:
  push:
    branches: [main]
    paths:
      - '**/*.rs'
      - '**/Cargo.toml'
      - 'Cargo.lock'
      - 'rust-toolchain.toml'
      - '.cargo/config.toml'
      - '.github/workflows/rhel-compatibility.yml'
  pull_request:
    paths:
      - '**/*.rs'
      - '**/Cargo.toml'
      - 'Cargo.lock'
      - 'rust-toolchain.toml'
      - '.cargo/config.toml'
      - '.github/workflows/rhel-compatibility.yml'
  workflow_dispatch:

# Serialize per ref: this job builds a container and the whole workspace, so
# successive pushes to a PR would otherwise stack multi-minute runs. Matches
# the pattern used by ci.yml, release.yml, release-please.yml and
# npm-build-publish.yml.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

env:
  # protoc is NOT available from any UBI repository -- see the "Install build
  # prerequisites" step. Pinned to the version this workspace builds against
  # locally (libprotoc 35.1).
  PROTOC_VERSION: '35.1'
  # sha256 of protoc-${PROTOC_VERSION}-linux-x86_64.zip. Upstream publishes no
  # checksum file for its releases, so this is computed from the asset and
  # pinned here. Refresh it alongside PROTOC_VERSION:
  #   curl -fsSLO https://github.com/protocolbuffers/protobuf/releases/download/vX.Y/protoc-X.Y-linux-x86_64.zip
  #   sha256sum protoc-X.Y-linux-x86_64.zip
  PROTOC_SHA256: '6930ebf62bd4ea607b98fff052596c6ee564b9835b4ce172c75a3f53ae9d91b7'

jobs:
  rhel-native:
    name: RHEL rust-toolset (no rustup)
    runs-on: ubuntu-latest
    timeout-minutes: 45
    container:
      image: registry.access.redhat.com/ubi9/ubi:latest

    steps:
      # Probed 2026-09-04 against ubi9/ubi:latest. Findings that shape this
      # step, all verified rather than assumed:
      #
      # This list is the empirically minimal set, verified end-to-end by
      # `make check-rhel` on 2026-09-04. Probe findings against ubi9/ubi:latest:
      #
      #   rust-toolset       AVAILABLE (ubi-9-appstream-rpms), currently 1.92.0
      #                      -- note it is a *rolling* stream, so it is ahead of
      #                      the 1.88.0 that RHEL 9.7's notes document
      #   fontconfig-devel   AVAILABLE -- plotters' font stack in hyperdb-mcp
      #   gcc, gcc-c++       AVAILABLE -- also plotters: freetype-sys compiles C
      #                      and pathfinder_simd compiles C++. Nothing in this
      #                      workspace's own code needs a C or C++ compiler.
      #   git                AVAILABLE -- lets actions/checkout use git rather
      #                      than falling back to a REST tarball
      #   unzip              AVAILABLE (ubi-9-baseos-rpms), not preinstalled
      #   protobuf-compiler  *** NOT AVAILABLE *** -- `dnf search protobuf`
      #                      returns only protobuf-c and python3-protobuf, so
      #                      there is no protoc binary. Fetched below instead.
      #   mold               *** NOT AVAILABLE *** -- hence the RUSTFLAGS
      #                      override in the build step.
      #
      # cmake and make are deliberately absent: they were required only by
      # aws-lc-sys, which is no longer in the dependency graph now that both
      # reqwest declarations use `rustls-no-provider` and let the workspace's
      # ring provider apply.
      #
      # Note ubi-9-codeready-builder-rpms is already enabled by default, so
      # enabling it is not an available fallback for the missing protoc.
      - name: Install build prerequisites
        run: |
          dnf install -y rust-toolset fontconfig-devel git unzip gcc gcc-c++
          dnf clean all

      - name: Install protoc
        # hyperdb-api-core/build.rs runs tonic_prost_build, which needs protoc.
        # This is a standing M-OOBE deviation: a published crate should not
        # require a tool beyond cargo and rustc. The durable fix is to generate
        # the .rs files at publish time and vendor them into the crate; until
        # then CI supplies protoc explicitly.
        #
        # The archive is unpacked into /usr/local as root, so its integrity is
        # verified first. Version-pinning alone does not help here: a retagged
        # or compromised release would still be accepted.
        run: |
          set -euo pipefail
          ZIP="protoc-${PROTOC_VERSION}-linux-x86_64.zip"
          curl -fsSLO "https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VERSION}/${ZIP}"
          echo "${PROTOC_SHA256}  ${ZIP}" | sha256sum -c -
          unzip -q "${ZIP}" -d /usr/local
          rm "${ZIP}"
          protoc --version

      - uses: actions/checkout@v7

      - name: Prove this is the distro toolchain, not rustup
        run: |
          if command -v rustup >/dev/null 2>&1; then
            echo "::error::rustup is present; this job must exercise the system toolchain only"
            exit 1
          fi
          echo "cargo:  $(command -v cargo)"
          echo "rustc:  $(command -v rustc)"
          rustc --version
          cargo --version

      - name: cargo check with the system toolchain
        # The repo's .cargo/config.toml pins linker = "clang" plus
        # -fuse-ld=mold for x86_64-unknown-linux-gnu, and mold is not in any
        # UBI repo. `cargo check` still links build scripts and proc-macro
        # crates for the host, so this genuinely breaks the job.
        #
        # Both overrides are neutralized by environment rather than by editing
        # the checkout. Note that `--config target.<triple>.rustflags=[]` does
        # NOT work: cargo *joins* rustflags across config sources. The env var
        # replaces them, which was verified directly.
        #
        # rust-toolchain.toml needs no handling at all: it is read only by
        # rustup's proxy shims, and the step above asserts rustup is absent.
        env:
          RUSTFLAGS: ''
          CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER: cc
        run: |
          set -euo pipefail
          cargo check --workspace --locked --all-targets
          # hyperdb-compile-check declares its own [workspace], so --workspace
          # skips it -- yet release.yml publishes it, meaning the gate that
          # proves "builds on Red Hat's toolchain with no rustup" would
          # otherwise never cover a crate enterprise consumers can depend on.
          cargo check --locked --all-targets \
            --manifest-path hyperdb-compile-check/Cargo.toml