feat: Docker build linux-x64 + release script platform package support

NathanFlurry · NathanFlurry · commit 10712520407a · 2026-03-20T00:37:05.000-07:00
- Add Dockerfile.linux-x64-gnu for building secure-exec-v8 binary
- Stub unsupported platform packages with postinstall error
- Release script: include platform packages, sync optionalDeps versions
- Release workflow: Docker build + platform package publishing
- Add --no-git-checks flag for RC releases from non-main branches
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -52,17 +52,23 @@ jobs:
       - name: Build
         run: pnpm turbo build
 
+      - name: Build linux-x64 binary via Docker
+        run: |
+          cd crates/v8-runtime
+          docker build -f docker/Dockerfile.linux-x64-gnu -o type=local,dest=npm/linux-x64-gnu .
+
       - name: Publish to npm
         run: |
           FAILURES=""
+
+          # Publish workspace packages
           for dir in $(pnpm -r ls --json --depth -1 | jq -r '.[] | select(.private != true) | .path'); do
             # Skip the root package
             if [ "$dir" = "$(pwd)" ]; then
               continue
             fi
             NAME=$(jq -r .name "$dir/package.json")
             VERSION="${{ inputs.version }}"
-            # Skip if already published
             if npm view "${NAME}@${VERSION}" version >/dev/null 2>&1; then
               echo "⏭ ${NAME}@${VERSION} already published, skipping."
               continue
@@ -72,6 +78,24 @@ jobs:
               FAILURES="${FAILURES} ${NAME}"
             fi
           done
+
+          # Publish v8 platform packages (not in pnpm workspace)
+          for dir in crates/v8-runtime/npm/*/; do
+            if [ ! -f "$dir/package.json" ]; then
+              continue
+            fi
+            NAME=$(jq -r .name "$dir/package.json")
+            VERSION="${{ inputs.version }}"
+            if npm view "${NAME}@${VERSION}" version >/dev/null 2>&1; then
+              echo "⏭ ${NAME}@${VERSION} already published, skipping."
+              continue
+            fi
+            echo "Publishing ${NAME}@${VERSION}..."
+            if ! (cd "$dir" && npm publish --access public --tag ${{ inputs.npm-tag }}); then
+              FAILURES="${FAILURES} ${NAME}"
+            fi
+          done
+
           if [ -n "$FAILURES" ]; then
             echo "::error::Failed to publish:${FAILURES}"
             exit 1
diff --git a/crates/v8-runtime/docker/Dockerfile.linux-x64-gnu b/crates/v8-runtime/docker/Dockerfile.linux-x64-gnu
@@ -0,0 +1,17 @@
+FROM rust:1.85.0-bookworm AS builder
+WORKDIR /build
+COPY Cargo.toml Cargo.lock rust-toolchain.toml ./
+RUN mkdir src && echo 'fn main() {}' > src/main.rs
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git \
+    --mount=type=cache,target=/build/target \
+    cargo build --release --target x86_64-unknown-linux-gnu
+COPY src/ src/
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git \
+    --mount=type=cache,target=/build/target \
+    touch src/main.rs && \
+    cargo build --release --target x86_64-unknown-linux-gnu && \
+    cp target/x86_64-unknown-linux-gnu/release/secure-exec-v8 /secure-exec-v8
+FROM scratch
+COPY --from=builder /secure-exec-v8 /secure-exec-v8
diff --git a/crates/v8-runtime/npm/darwin-arm64/install.js b/crates/v8-runtime/npm/darwin-arm64/install.js
@@ -0,0 +1,2 @@
+console.error("@secure-exec/v8-darwin-arm64 is not yet supported. Only linux-x64 is available.");
+process.exit(1);
diff --git a/crates/v8-runtime/npm/darwin-arm64/package.json b/crates/v8-runtime/npm/darwin-arm64/package.json
@@ -4,8 +4,11 @@
   "license": "Apache-2.0",
   "os": ["darwin"],
   "cpu": ["arm64"],
-  "main": "secure-exec-v8",
-  "files": ["secure-exec-v8"],
+  "main": "install.js",
+  "files": ["install.js"],
+  "scripts": {
+    "postinstall": "node install.js"
+  },
   "repository": {
     "type": "git",
     "url": "https://github.com/rivet-dev/secure-exec.git",
diff --git a/crates/v8-runtime/npm/darwin-x64/install.js b/crates/v8-runtime/npm/darwin-x64/install.js
@@ -0,0 +1,2 @@
+console.error("@secure-exec/v8-darwin-x64 is not yet supported. Only linux-x64 is available.");
+process.exit(1);
diff --git a/crates/v8-runtime/npm/darwin-x64/package.json b/crates/v8-runtime/npm/darwin-x64/package.json
@@ -4,8 +4,11 @@
   "license": "Apache-2.0",
   "os": ["darwin"],
   "cpu": ["x64"],
-  "main": "secure-exec-v8",
-  "files": ["secure-exec-v8"],
+  "main": "install.js",
+  "files": ["install.js"],
+  "scripts": {
+    "postinstall": "node install.js"
+  },
   "repository": {
     "type": "git",
     "url": "https://github.com/rivet-dev/secure-exec.git",
diff --git a/crates/v8-runtime/npm/linux-arm64-gnu/install.js b/crates/v8-runtime/npm/linux-arm64-gnu/install.js
@@ -0,0 +1,2 @@
+console.error("@secure-exec/v8-linux-arm64-gnu is not yet supported. Only linux-x64 is available.");
+process.exit(1);
diff --git a/crates/v8-runtime/npm/linux-arm64-gnu/package.json b/crates/v8-runtime/npm/linux-arm64-gnu/package.json
@@ -4,8 +4,11 @@
   "license": "Apache-2.0",
   "os": ["linux"],
   "cpu": ["arm64"],
-  "main": "secure-exec-v8",
-  "files": ["secure-exec-v8"],
+  "main": "install.js",
+  "files": ["install.js"],
+  "scripts": {
+    "postinstall": "node install.js"
+  },
   "repository": {
     "type": "git",
     "url": "https://github.com/rivet-dev/secure-exec.git",
diff --git a/crates/v8-runtime/npm/win32-x64/install.js b/crates/v8-runtime/npm/win32-x64/install.js
@@ -0,0 +1,2 @@
+console.error("@secure-exec/v8-win32-x64 is not yet supported. Only linux-x64 is available.");
+process.exit(1);
diff --git a/crates/v8-runtime/npm/win32-x64/package.json b/crates/v8-runtime/npm/win32-x64/package.json
@@ -4,8 +4,11 @@
   "license": "Apache-2.0",
   "os": ["win32"],
   "cpu": ["x64"],
-  "main": "secure-exec-v8.exe",
-  "files": ["secure-exec-v8.exe"],
+  "main": "install.js",
+  "files": ["install.js"],
+  "scripts": {
+    "postinstall": "node install.js"
+  },
   "repository": {
     "type": "git",
     "url": "https://github.com/rivet-dev/secure-exec.git",
diff --git a/scripts/release.ts b/scripts/release.ts
@@ -1,7 +1,7 @@
 #!/usr/bin/env npx tsx
 
 import { execSync } from "node:child_process";
-import { readFileSync, writeFileSync } from "node:fs";
+import { readFileSync, writeFileSync, existsSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import { createInterface } from "node:readline";
 
@@ -59,8 +59,9 @@ function npmTag(version: string): "latest" | "rc" {
   return version.includes("-") ? "rc" : "latest";
 }
 
-function parseArgs(): { version: string; tag: "latest" | "rc" } {
+function parseArgs(): { version: string; tag: "latest" | "rc"; noGitChecks: boolean } {
   const args = process.argv.slice(2);
+  const noGitChecks = args.includes("--no-git-checks");
 
   // Exact version: --version 0.1.0 or --version 0.2.0-rc.1
   if (args.includes("--version")) {
@@ -72,7 +73,7 @@ function parseArgs(): { version: string; tag: "latest" | "rc" } {
     if (!/^\d+\.\d+\.\d+(-[\w.]+)?$/.test(ver)) {
       fatal(`Invalid version format: "${ver}"`);
     }
-    return { version: ver, tag: npmTag(ver) };
+    return { version: ver, tag: npmTag(ver), noGitChecks };
   }
 
   // Semver bump
@@ -81,7 +82,7 @@ function parseArgs(): { version: string; tag: "latest" | "rc" } {
 
   for (const type of ["patch", "minor", "major"] as const) {
     if (args.includes(`--${type}`)) {
-      return { version: bumpVersion(current, type), tag: "latest" };
+      return { version: bumpVersion(current, type), tag: "latest", noGitChecks };
     }
   }
 
@@ -93,9 +94,24 @@ function parseArgs(): { version: string; tag: "latest" | "rc" } {
 function getPublishablePackages(): string[] {
   const output = run("pnpm -r ls --json --depth -1");
   const packages = JSON.parse(output) as Array<{ name: string; path: string; private?: boolean }>;
-  return packages
+  const paths = packages
     .filter((p) => !p.private && p.path !== ROOT)
     .map((p) => p.path);
+
+  // Include v8 platform packages (not in pnpm workspace)
+  const platformDir = join(ROOT, "crates/v8-runtime/npm");
+  if (existsSync(platformDir)) {
+    for (const entry of readdirSync(platformDir, { withFileTypes: true })) {
+      if (entry.isDirectory()) {
+        const pkgJsonPath = join(platformDir, entry.name, "package.json");
+        if (existsSync(pkgJsonPath)) {
+          paths.push(join(platformDir, entry.name));
+        }
+      }
+    }
+  }
+
+  return paths;
 }
 
 // ── Update version in a package.json ──
@@ -105,6 +121,16 @@ function setVersion(pkgPath: string, version: string) {
   const content = readFileSync(file, "utf-8");
   const pkg = JSON.parse(content);
   pkg.version = version;
+
+  // Sync optionalDependencies versions for platform packages
+  if (pkg.optionalDependencies) {
+    for (const dep of Object.keys(pkg.optionalDependencies)) {
+      if (dep.startsWith("@secure-exec/v8-")) {
+        pkg.optionalDependencies[dep] = version;
+      }
+    }
+  }
+
   // Preserve original formatting (indent detection)
   const indent = content.match(/^(\s+)"/m)?.[1] ?? "  ";
   writeFileSync(file, JSON.stringify(pkg, null, indent) + "\n");
@@ -113,24 +139,28 @@ function setVersion(pkgPath: string, version: string) {
 // ── Main ──
 
 async function main() {
-  const { version, tag } = parseArgs();
-
-  // Git checks
+  const { version, tag, noGitChecks } = parseArgs();
   const branch = run("git branch --show-current");
-  if (branch !== "main") {
-    fatal(`Must be on main branch (currently on "${branch}")`);
-  }
 
-  run("git fetch origin main");
-  const local = run("git rev-parse HEAD");
-  const remote = run("git rev-parse origin/main");
-  if (local !== remote) {
-    fatal("Local main is not even with origin/main. Pull or push first.");
-  }
+  if (!noGitChecks) {
+    // Git checks
+    if (branch !== "main") {
+      fatal(`Must be on main branch (currently on "${branch}")`);
+    }
+
+    run("git fetch origin main");
+    const local = run("git rev-parse HEAD");
+    const remote = run("git rev-parse origin/main");
+    if (local !== remote) {
+      fatal("Local main is not even with origin/main. Pull or push first.");
+    }
 
-  const status = run("git status --porcelain");
-  if (status) {
-    fatal("Working tree is not clean. Commit or stash changes first.");
+    const status = run("git status --porcelain");
+    if (status) {
+      fatal("Working tree is not clean. Commit or stash changes first.");
+    }
+  } else {
+    console.log("\x1b[33m⚠ Skipping git checks (--no-git-checks)\x1b[0m");
   }
 
   // Find packages
@@ -165,16 +195,13 @@ async function main() {
 
   // Commit & push
   console.log("\n\x1b[1mCommitting version bump...\x1b[0m");
-  run("git add package.json");
-  for (const pkg of packages) {
-    run(`git add ${join(pkg, "package.json")}`);
-  }
+  run("git add -A");
   const staged = run("git diff --cached --name-only");
   if (staged) {
     run(`git commit -m "release: v${version}"`);
-    run("git push origin main");
+    run(`git push origin ${branch}`);
   } else {
-    console.log("  No version changes to commit, skipping.");
+    console.log("  No changes to commit, skipping.");
   }
 
   // Git tag
@@ -191,7 +218,7 @@ async function main() {
   console.log(`\n\x1b[1mTriggering CI release workflow...\x1b[0m`);
   run(`gh workflow run release.yml -f version=${version} -f npm-tag=${tag}`, { stdio: "inherit" });
 
-  console.log(`\n\x1b[32m✓ Tag v${version} pushed — CI will handle publish + GitHub release.\x1b[0m`);
+  console.log(`\n\x1b[32m✓ Tag v${version} pushed — CI will handle Docker build + publish.\x1b[0m`);
   console.log(`  Watch progress: \x1b[36mhttps://github.com/rivet-dev/secure-exec/actions/workflows/release.yml\x1b[0m`);
 }
 

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+console.error("@secure-exec/v8-darwin-arm64 is not yet supported. Only linux-x64 is available.");`
	`2`	`+process.exit(1);`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+console.error("@secure-exec/v8-linux-arm64-gnu is not yet supported. Only linux-x64 is available.");`
	`2`	`+process.exit(1);`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+console.error("@secure-exec/v8-win32-x64 is not yet supported. Only linux-x64 is available.");`
	`2`	`+process.exit(1);`