Fix cargo install --locked wasixcc, release 0.4.5

.github/workflows/build-release-bundle.yml

@@ -59,13 +59,13 @@ jobs:
         if: matrix.cross
         run: |
           TARGET=$(echo "${{ matrix.target }}" | sed 's/gnu/musl/g')
-          RUSTFLAGS="-C target-feature=+crt-static" cross build --release --target "$TARGET"
+          RUSTFLAGS="-C target-feature=+crt-static" cross build --release --locked --target "$TARGET"
           mv target/$TARGET tmp
           mv tmp target/${{ matrix.target }}
 
       - name: Build binary (cargo)
         if: "!matrix.cross"
-        run: cargo build --release --target ${{ matrix.target }}
+        run: cargo build --release --locked --target ${{ matrix.target }}
 
       - name: Package binary
         shell: bash

.github/workflows/pr-checks.yml

@@ -22,6 +22,44 @@ jobs:
       - name: Check formatting
         run: cargo fmt --check
 
+  lockfile-hygiene:
+    name: Check Lockfile Hygiene
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: No cargo config is tracked
+        run: |
+          tracked="$(git ls-files -- .cargo)"
+          if [ -n "$tracked" ]; then
+            echo "ERROR: tracked cargo config: $tracked"
+            echo "A .cargo/config.toml is auto-discovered by every cargo invocation, so"
+            echo "the WASIX overlay registry would apply to native builds too and rewrite"
+            echo "Cargo.lock with versions that don't exist on crates.io. The overlay"
+            echo "lives in wasix/registry.toml and is passed explicitly by 'make wasix'."
+            exit 1
+          fi
+
+      - name: Cargo.lock contains only crates.io versions
+        run: |
+          if grep -n '+wasix' Cargo.lock; then
+            echo "ERROR: Cargo.lock pins WASIX overlay forks. Those versions do not exist"
+            echo "on crates.io, so 'cargo install --locked wasixcc' and 'cargo vendor'"
+            echo "break for everyone downstream (issue #72). Regenerate with:"
+            echo "  rm -rf .cargo Cargo.lock && cargo generate-lockfile"
+            echo "The WASIX build has its own lockfile, Cargo.wasix.lock."
+            exit 1
+          fi
+
+      - name: Cargo.lock is in sync with Cargo.toml
+        run: cargo metadata --locked --format-version 1 > /dev/null
+
+      - name: WASIX build config still compiles
+        run: cargo check --locked --no-default-features
+
   rust-tests:
     name: Run Rust Unit Tests
     runs-on: ubuntu-latest
@@ -36,6 +74,52 @@ jobs:
       - name: Run tests
         run: cargo test
 
+  wasix-build:
+    name: Build and Test for WASIX
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Set up cargo-wasix
+        uses: wasix-org/cargo-wasix@main
+        with:
+          version: 0.1.31
+        env:
+          # cargo-wasix is a tool, not part of this project's build, and its
+          # dependency tree tracks a recent rustc. Build it with stable rather
+          # than whatever rust-toolchain.toml pins us to, so the pin drifting
+          # behind stable can't break this job. The WASIX build itself uses
+          # the separate `wasix` toolchain anyway.
+          RUSTUP_TOOLCHAIN: stable
+
+      # `cargo wasix test` runs the test module under a WASIX runtime.
+      - name: Install wasmer
+        uses: wasmerio/setup-wasmer@v3.1
+
+      # The toolchain tarball ships the gcc-ld shims (ld.lld and friends)
+      # without the executable bit. rustc still points gcc at them with
+      # -fuse-ld=lld when it links *host* build scripts, so gcc skips them and
+      # gives up with "collect2: cannot find 'ld'" — unless the machine
+      # happens to have lld installed system-wide, which is why this doesn't
+      # reproduce on most dev boxes. Packaging bug in the wasix-org/rust
+      # release; fixing the mode in place is enough.
+      - name: Make the WASIX toolchain's lld shims executable
+        run: chmod -v +x ~/.local/share/cargo-wasix/toolchains/*/rust/lib/rustlib/*/bin/gcc-ld/*
+
+      - name: Build the WASIX module
+        run: make wasix-package
+
+      - name: Run tests under WASIX
+        run: make wasix-test
+
+      # `make wasix` swaps Cargo.wasix.lock in and must put the crates.io
+      # Cargo.lock back; --locked means neither may drift either.
+      - name: Both lockfiles are unchanged
+        run: git diff --exit-code Cargo.lock Cargo.wasix.lock
+
   check-toolchain-changes:
     name: Check if toolchain tests should run
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -144,12 +144,25 @@ jobs:
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
 
+      # The published .crate embeds Cargo.lock, so a lock pinning WASIX overlay
+      # forks makes 'cargo install --locked wasixcc' fail (issue #72).
+      - name: Refuse to publish a poisoned lockfile
+        run: |
+          if [ -e .cargo/config.toml ] || [ -e .cargo/config ]; then
+            echo "ERROR: a .cargo config is present; the WASIX overlay must not apply here"
+            exit 1
+          fi
+          if grep -n '+wasix' Cargo.lock; then
+            echo "ERROR: Cargo.lock pins WASIX overlay forks; refusing to publish"
+            exit 1
+          fi
+
       - name: Publish to crates.io
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}
         run: |
           echo "Publishing wasixcc version ${{ needs.verify-version.outputs.version }} to crates.io"
-          cargo publish --registry crates-io
+          cargo publish --locked --registry crates-io
 
   release:
     name: Create Release

.gitignore

@@ -1,3 +1,9 @@
 /.vscode
 /bin
-/target
+/target
+
+# The WASIX overlay registry must never be auto-discovered by cargo; it
+# applies to native builds too and poisons Cargo.lock. See wasix/registry.toml.
+/.cargo/
+# Scratch file used by the WASIX targets in the Makefile.
+/.Cargo.lock.native.bak