Skip to content

feat(codegen): make the in-process LLVM backend the default, statically linked #7353

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
proggeramlug merged 1 commit into from
Aug 4, 2026
Merged

feat(codegen): make the in-process LLVM backend the default, statically linked #7353

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
72 changes: 72 additions & 0 deletions .github/actions/setup-llvm22/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,72 @@
name: Setup LLVM 22
description: >
Provision the LLVM 22 development libraries that `llvm-inprocess` links
against, and export LLVM_SYS_221_PREFIX. Every job that compiles Rust needs
this now that the feature is on by default.

# One definition, not 44 inline recipes. The three platforms need three
# different sources and only one of them is obvious:
#
# macOS brew's llvm formula.
# Linux apt.llvm.org. The distro's `llvm-dev` is whatever the release
# froze on (Ubuntu 24.04 ships 18), so the LLVM project's own
# repository is the only way to get a pinned 22.
# Windows the official `clang+llvm-*-pc-windows-msvc` tarball. NOT
# chocolatey: its `llvm` package is the clang *toolchain* — no
# llvm-config.exe and none of the static libraries llvm-sys links
# against — and it has no 22.x pin at all.
#
# Every arm asserts the major version. llvm-sys 221 requires LLVM 22
# specifically, and a runner image moving its formula on must fail loudly
# here rather than build something subtly different several steps later.
inputs:
version:
description: LLVM major.minor.patch used by the Windows tarball
required: false
default: "22.1.8"

runs:
using: composite
steps:
- name: LLVM 22 (macOS, brew)
if: runner.os == 'macOS'
shell: bash
run: |
set -euo pipefail
brew install llvm@22 2>/dev/null || brew install llvm
PREFIX="$(brew --prefix llvm@22 2>/dev/null || brew --prefix llvm)"
"$PREFIX/bin/llvm-config" --version | grep -q '^22\.' \
|| { echo "::error::brew LLVM is not 22.x ($("$PREFIX/bin/llvm-config" --version))"; exit 1; }
echo "LLVM_SYS_221_PREFIX=$PREFIX" >> "$GITHUB_ENV"

- name: LLVM 22 (Linux, apt.llvm.org)
if: runner.os == 'Linux'
shell: bash
run: |
set -euo pipefail
wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key \
| sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc >/dev/null
Comment on lines +47 to +48

@coderabbitai coderabbitai Bot Aug 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== action file =="
cat -n .github/actions/setup-llvm22/action.yml | sed -n '1,90p'

echo
echo "== repository references to setup-llvm22 and apt.key trust path =="
rg -n "setup-llvm22|apt\.llvm\.org|trusted\.gpg\.d|keyring:|signed-by:|LLVM_SYS_221_PREFIX|apt-get update|apt-get install" .github crates/perry-codegen/Cargo.toml || true

echo
echo "== local gpg/apt behavior probe (no repos/keyring changes) =="
python3 - <<'PY'
from subprocess import run, PIPE
cmds = [
    ("gpg --version", ["gpg", "--version"]),
    ("apt apt-secure man snippet", ["apt", "show", "-A", "apt", "Security"]),
]
for label, cmd in cmds:
    print(f"\n-- {label} --")
    r = run(cmd, text=True, stdout=PIPE, stderr=PIPE, start_new_session=False)
    print(f"exit={r.returncode}")
    out = r.stdout.splitlines()[:20] + r.stderr.splitlines()[:10]
    print("\n".join(out))
PY

Repository: PerryTS/perry

Length of output: 11702

🌐 Web query:

Debian apt trusted.gpg.d global keyring signed-by apt-key apt-secure official documentation

💡 Result:

In modern Debian systems, the use of apt-key and the global /etc/apt/trusted.gpg and /etc/apt/trusted.gpg.d/ keyrings is deprecated and discouraged [1][2][3]. The recommended practice is to use the signed-by option in your APT repository configuration to explicitly associate a repository with its specific public GPG key [1][4][5]. This approach prevents a key trusted for one repository from being automatically trusted for all repositories on the system, significantly enhancing security [6][5]. Recommended Workflow 1. Obtain the GPG key and ensure it is in the correct format (binary.gpg or ASCII-armored.asc) [4][7][2]. 2. Place the key file in a dedicated, secure directory: - Use /etc/apt/keyrings/ for administrator-managed keys [1][7][5]. - Use /usr/share/keyrings/ for keys managed by packages (e.g., provided by a.deb archive) [4][8][5]. - Ensure the file has appropriate read permissions (e.g., chmod 644) [5]. 3. Configure your repository by adding the signed-by option to your source entry [1][6]: - For a legacy.list file: deb [signed-by=/etc/apt/keyrings/example.gpg] https://example.com/debian stable main - For modern.sources files (deb822 format), you can either reference the file or embed the ASCII-armored key directly within the file [1][4][7]. Key Differences and Deprecation - apt-key: This utility is deprecated and has been removed in recent Debian releases (e.g., Debian 13) [9][2]. It should no longer be used for managing repository keys [1][3]. - Global Keyrings (/etc/apt/trusted.gpg and /etc/apt/trusted.gpg.d/): These locations are deprecated [3]. While some systems may still support them for backward compatibility, they are considered insecure because they grant global trust to any key placed within them [3][6][5]. - Signed-By: This option binds a specific repository to a specific key, providing a granular and secure mechanism for verifying package authenticity [4][6][5]. For more information, consult the apt-secure(8) manual page on your system, which provides the authoritative details on repository security and key configuration [4][3].

Citations:

Security Misconfiguration (CWE-345)

Reachability: External

Pin and scope the apt signing key.

The APT signing key is fetched at runtime and stored under global trusted APT metadata, so a compromised endpoint can make future packages from this source appear verified. Store the key in a repository-scoped keyring, verify a committed fingerprint before apt-get update, and configure deb [signed-by=...] instead of relying on /etc/apt/trusted.gpg.d.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/actions/setup-llvm22/action.yml around lines 47 - 48, Update the
LLVM setup steps around the apt.llvm.org signing-key command to use a
repository-scoped keyring rather than /etc/apt/trusted.gpg.d, validate the
downloaded key against the committed expected fingerprint before apt-get update,
and configure the apt source with deb [signed-by=...] pointing to that keyring.
Remove reliance on globally trusted APT metadata while preserving LLVM package
installation.

. /etc/os-release
echo "deb http://apt.llvm.org/${VERSION_CODENAME}/ llvm-toolchain-${VERSION_CODENAME}-22 main" \
| sudo tee /etc/apt/sources.list.d/llvm22.list >/dev/null
sudo apt-get update -qq
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq \
llvm-22-dev libpolly-22-dev libzstd-dev
llvm-config-22 --version | grep -q '^22\.' \
|| { echo "::error::apt LLVM is not 22.x"; exit 1; }
echo "LLVM_SYS_221_PREFIX=$(llvm-config-22 --prefix)" >> "$GITHUB_ENV"

- name: LLVM 22 (Windows, official MSVC tarball)
if: runner.os == 'Windows'
shell: pwsh
run: |
$ErrorActionPreference = "Stop"
$ver = "${{ inputs.version }}"
$url = "https://github.com/llvm/llvm-project/releases/download/llvmorg-$ver/clang+llvm-$ver-x86_64-pc-windows-msvc.tar.xz"
Write-Host "downloading $url"
curl.exe -sSL --retry 3 -o "$env:RUNNER_TEMP\llvm.tar.xz" $url
New-Item -ItemType Directory -Force -Path C:\llvm | Out-Null
tar -xf "$env:RUNNER_TEMP\llvm.tar.xz" -C C:\llvm --strip-components=1
$v = & "C:\llvm\bin\llvm-config.exe" --version
if (-not $v.StartsWith("22.")) { Write-Error "LLVM is not 22.x ($v)"; exit 1 }
"LLVM_SYS_221_PREFIX=C:\llvm" | Out-File -FilePath $env:GITHUB_ENV -Append
3 changes: 3 additions & 0 deletions .github/workflows/benchmark.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ jobs:

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
- uses: ./.github/actions/setup-llvm22

- name: Cache cargo
uses: actions/cache@v6
Expand Down Expand Up @@ -264,6 +265,7 @@ jobs:

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
- uses: ./.github/actions/setup-llvm22

- name: Cache cargo
uses: actions/cache@v6
Expand Down Expand Up @@ -361,6 +363,7 @@ jobs:

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
- uses: ./.github/actions/setup-llvm22

- name: Measure clean-build time
run: |
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/cache-warm.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,7 @@ jobs:

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
- uses: ./.github/actions/setup-llvm22

- name: Install sccache
uses: mozilla-actions/sccache-action@v0.0.10
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/container-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,7 @@ jobs:

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
- uses: ./.github/actions/setup-llvm22

- name: Cache cargo registry
uses: actions/cache@v6
Expand Down Expand Up @@ -168,6 +169,7 @@ jobs:

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
- uses: ./.github/actions/setup-llvm22

- name: Cache cargo registry
uses: actions/cache@v6
Expand Down Expand Up @@ -209,6 +211,7 @@ jobs:

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
- uses: ./.github/actions/setup-llvm22

- name: Cache cargo registry
uses: actions/cache@v6
Expand Down Expand Up @@ -251,6 +254,7 @@ jobs:

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
- uses: ./.github/actions/setup-llvm22

- name: Cache cargo registry
uses: actions/cache@v6
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/coverage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@ jobs:
uses: dtolnay/rust-toolchain@stable
with:
components: llvm-tools-preview
- uses: ./.github/actions/setup-llvm22

- uses: Swatinem/rust-cache@v2
with:
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/eh-transport.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,7 @@ jobs:

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
- uses: ./.github/actions/setup-llvm22

- name: Setup Node.js
uses: actions/setup-node@v7
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/feature-matrix.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ jobs:

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
- uses: ./.github/actions/setup-llvm22

- uses: Swatinem/rust-cache@v2
with:
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/gc-moving-witnesses.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,6 +197,7 @@ jobs:
- name: Install Rust toolchain
if: steps.relevance.outputs.run == 'true'
uses: dtolnay/rust-toolchain@stable
- uses: ./.github/actions/setup-llvm22

@coderabbitai coderabbitai Bot Aug 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Apply the relevance condition to every LLVM setup step.

Both jobs gate their expensive work on steps.relevance.outputs.run, but the new LLVM setup step bypasses that gate. An irrelevant pull request can still perform external package installation and fail the CI job.

  • .github/workflows/gc-moving-witnesses.yml#L200-L200: add if: steps.relevance.outputs.run == 'true'.
  • .github/workflows/gc-ratchet.yml#L118-L118: add if: steps.relevance.outputs.run == 'true'.
Proposed fix 
       - uses: ./.github/actions/setup-llvm22
+        if: steps.relevance.outputs.run == 'true'
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- uses: ./.github/actions/setup-llvm22
- uses: ./.github/actions/setup-llvm22
if: steps.relevance.outputs.run == 'true'
📍 Affects 2 files
  • .github/workflows/gc-moving-witnesses.yml#L200-L200 (this comment)
  • .github/workflows/gc-ratchet.yml#L118-L118
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/gc-moving-witnesses.yml at line 200, Apply the relevance
condition to both LLVM setup steps: add the existing steps.relevance.outputs.run
== 'true' job condition to .github/workflows/gc-moving-witnesses.yml at lines
200-200 and .github/workflows/gc-ratchet.yml at lines 118-118, so each setup
runs only for relevant pull requests.


- uses: Swatinem/rust-cache@v2
if: steps.relevance.outputs.run == 'true'
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/gc-native-roots.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,7 @@ jobs:
with:
node-version-file: .node-version
- uses: dtolnay/rust-toolchain@stable
- uses: ./.github/actions/setup-llvm22

@coderabbitai coderabbitai Bot Aug 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Preserve the validated LLVM 22 prefix.

Line 127 exports the prefix validated by setup-llvm22, but the later macOS build replaces it with brew --prefix llvm. That formula is unversioned and is not checked for major version. The in-process build can therefore use a different LLVM major. Remove the later override and use the action-provided LLVM_SYS_221_PREFIX.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/gc-native-roots.yml at line 127, Remove the later macOS
override that assigns the LLVM prefix from brew, and retain the validated prefix
exported by setup-llvm22. Ensure the in-process build uses LLVM_SYS_221_PREFIX
consistently.

- uses: Swatinem/rust-cache@v2
with:
shared-key: gc-native-roots
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/gc-ratchet.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,6 +115,7 @@ jobs:
- name: Install Rust toolchain
if: steps.relevance.outputs.run == 'true'
uses: dtolnay/rust-toolchain@stable
- uses: ./.github/actions/setup-llvm22

- name: Cache cargo
if: steps.relevance.outputs.run == 'true'
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/gc-root-dominance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,6 +156,7 @@ jobs:

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
- uses: ./.github/actions/setup-llvm22

# ★ The dependency-scale corpus needs the dependency.
#
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/node-compat-matrix.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,7 @@ jobs:

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
- uses: ./.github/actions/setup-llvm22

- name: Start sccache
uses: mozilla-actions/sccache-action@v0.0.10
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/node-core-subset.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,7 @@ jobs:

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
- uses: ./.github/actions/setup-llvm22

- uses: Swatinem/rust-cache@v2
with:
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/node-suite-guard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@ jobs:

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
- uses: ./.github/actions/setup-llvm22

- name: Start sccache
uses: mozilla-actions/sccache-action@v0.0.10
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/npm-package-sweep.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@ jobs:

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
- uses: ./.github/actions/setup-llvm22

- uses: Swatinem/rust-cache@v2
with:
Expand Down
2 changes: 2 additions & 0 deletions .github/workflows/release-packages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -315,6 +315,7 @@ jobs:
uses: dtolnay/rust-toolchain@stable
with:
targets: ${{ matrix.target }}
- uses: ./.github/actions/setup-llvm22

# Cache cargo registry + target/ per (matrix.target, Cargo.lock).
# First run on a target is still a cold build, but every subsequent
Expand Down Expand Up @@ -1030,6 +1031,7 @@ jobs:
uses: dtolnay/rust-toolchain@stable
with:
targets: ${{ matrix.target }}
- uses: ./.github/actions/setup-llvm22

- name: Install Rust nightly + rust-src (Tier-3 only)
if: matrix.tier3
Expand Down
2 changes: 2 additions & 0 deletions .github/workflows/security-audit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ jobs:
with:
persist-credentials: false
- uses: dtolnay/rust-toolchain@stable
- uses: ./.github/actions/setup-llvm22
- uses: Swatinem/rust-cache@v2
with:
shared-key: security-audit
Expand Down Expand Up @@ -155,6 +156,7 @@ jobs:
with:
persist-credentials: false
- uses: dtolnay/rust-toolchain@stable
- uses: ./.github/actions/setup-llvm22
- uses: Swatinem/rust-cache@v2
with:
shared-key: security-audit
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/simctl-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@ jobs:

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
- uses: ./.github/actions/setup-llvm22

- name: Install iOS simulator Rust target
run: rustup target add aarch64-apple-ios-sim aarch64-apple-ios
Expand Down
Loading
Loading