Build fully static compiler binary using ghc-musl (purescript#4573)

* Build statically-linked binaries with ghc-musl

* Compliance for LGPL terms

* Add changelog entry

* Update dependencies

* Update LICENSE

* Update weeder

* Fix weeder

* Add more changelog entries

* Argument passthrough

* Update license

* Update license

* Build images for ARM

* Checkout after Node installation

* Only mount volumes for static

* Drop static prefix for now

* Force purge cache

* Remove builds against ubuntu

* Use matrix.os for cache key

* Fix linux only

* Set CI_STATIC to true

* CI_STATIC on Linux only

* Fix more linux only checks

Author: purefunctor

.github/workflows/ci.yml

@@ -54,38 +54,52 @@ jobs:
       fail-fast: false # do not cancel builds for other OSes if one fails
       matrix:
         include:
-          - image: haskell:9.8.4  # Also upgrade version in the lint job below
-            os: ubuntu-latest  # Exact version is not important, as it's only the container host)
+          - image: quay.io/benz0li/ghc-musl:9.8.4
+            os: ubuntu-latest
 
-          - image: haskell:9.8.4
-            os: ubuntu-24.04-arm  # Exact version is not important, as it's only the container host
+          - image: quay.io/benz0li/ghc-musl:9.8.4
+            os: ubuntu-24.04-arm 
 
           - os: macos-13  # x64
           - os: macos-14  # arm64
           - os: windows-2022  # x64
 
     runs-on: "${{ matrix.os }}"
-    container:  "${{ matrix.image }}"
+    container:
+      image: "${{ matrix.image }}"
+      # https://github.com/actions/runner/issues/801#issuecomment-2976165281
+      # This workaround also requires a special installation step for Node.js on arm64
+      volumes:
+        - "${{ contains(matrix.os, 'arm') && '/opt:/opt:rw,rshared' || ' ' }}"
+        - "${{ contains(matrix.os, 'arm') && '/opt:/__e/node20:ro,rshared' || ' ' }}"
+    env:
+      CI_STATIC: "${{ startsWith(matrix.os, 'ubuntu') }}"
 
     outputs:
       do-not-prerelease: "${{ steps.build.outputs.do-not-prerelease }}"
       version: "${{ steps.build.outputs.version }}"
 
     steps:
-      - # We need `gh` installed on the Linux version. Otherwise, release artifacts won't be uploaded.
-        name: "(Linux only) Install gh"
-        if: startsWith(matrix.image, 'haskell')
+      # We need `gh` installed on the Linux version. Otherwise, release artifacts won't be uploaded.
+      - name: "(Linux only) Install gh"
+        if: "${{ startsWith(matrix.os, 'ubuntu') }}"
         run: |
-          curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
-          chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
-          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null
-          apt-get update
-          apt-get install -y gh
+          apk add github-cli
+
+      - name: "(Linux only / x64) Install Node"
+        if: "${{ startsWith(matrix.os, 'ubuntu') && ! contains(matrix.os, 'arm') }}"
+        run: |
+          apk add nodejs npm
+
+      - name: "(Linux only / arm64) Install Node"
+        if: "${{ startsWith(matrix.os, 'ubuntu') && contains(matrix.os, 'arm') }}"
+        run: |
+          sed -i "/^ID=/s/alpine/NotpineForGHA/" /etc/os-release
+          apk add nodejs npm --update-cache
+          mkdir /opt/bin
+          ln -s /usr/bin/node /opt/bin/node
 
       - uses: "actions/checkout@v4"
-      - uses: "actions/setup-node@v4"
-        with:
-          node-version: "22"
 
       - id: "haskell"
         name: "(Non-Linux only) Install Haskell"
@@ -98,7 +112,7 @@ jobs:
           stack-no-global: true
 
       - name: "(Linux only) Fix working directory ownership"
-        if: startsWith(matrix.image, 'haskell')
+        if: "${{ startsWith(matrix.os, 'ubuntu') }}"
         run: |
           chown root:root .
 
@@ -107,7 +121,7 @@ jobs:
           path: |
             /root/.stack
             ${{ steps.haskell.outputs.stack-root }}
-          key: "${{ matrix.image || runner.os }}--MdyPsf-${{ hashFiles('stack.yaml.lock', 'purescript.cabal') }}"
+          key: "${{ matrix.image || matrix.os }}-v3-${{ hashFiles('stack.yaml.lock', 'purescript.cabal') }}"
 
       - name: "(Windows only) Configure Stack to store its programs in STACK_ROOT"
         # This ensures that the local GHC and MSYS binaries that Stack installs
@@ -118,20 +132,26 @@ jobs:
           mkdir -p "$STACK_ROOT"
           echo "local-programs-path: $STACK_ROOT/programs" > $STACK_ROOT/config.yaml
 
+      - name: "(Linux only) Configure Stack"
+        if: "${{ startsWith(matrix.os, 'ubuntu') }}"
+        run: |
+          ci/fix-home stack config set system-ghc --global true
+          ci/fix-home stack config set install-ghc --global false
+
       - id: "build"
         run: "ci/fix-home ci/build.sh"
 
       - name: "(Linux only) Glob tests"
-        if: startsWith(matrix.image, 'haskell')
+        if: "${{ startsWith(matrix.os, 'ubuntu') }}"
         working-directory: "sdist-test"
         # We build in this directory in build.sh, so this is where we need to
         # launch `stack exec`. The actual glob checks happen in a temporary directory.
         run: |
-          apt-get install -y tree
+          apk add tree
           ../ci/fix-home stack exec bash ../glob-test.sh
 
       - name: "(Linux only) Build the entire package set"
-        if: startsWith(matrix.image, 'haskell')
+        if: "${{ startsWith(matrix.os, 'ubuntu') }}"
         # We build in this directory in build.sh, so this is where we need to
         # launch `stack exec`. The actual package-set building happens in a
         # temporary directory.
@@ -144,11 +164,11 @@ jobs:
         # Moreover, npm has a hook issue that will cause spago to fail to install
         # We upgrade npm to fix this
         run: |
-          apt-get install -y jq
+          apk add jq
           ../ci/fix-home stack --haddock exec ../ci/build-package-set.sh
 
       - name: Verify that 'libtinfo' isn't in binary
-        if: runner.os == 'Linux'
+        if: ${{ runner.os == 'Linux' }}
         working-directory: "sdist-test"
         run: |
           if [ $(ldd $(../ci/fix-home stack path --local-doc-root)/../bin/purs | grep 'libtinfo' | wc -l) -ge 1 ]; then
@@ -157,6 +177,11 @@ jobs:
             exit 1
           fi
 
+      - name: "(Linux only) Install perl-utils"
+        if: "${{ startsWith(matrix.os, 'ubuntu') }}"
+        run: |
+          apk add perl-utils
+        
       - name: "(Release/prerelease only) Create bundle"
         if: "${{ env.CI_RELEASE == 'true' || env.CI_PRERELEASE == 'true' && steps.build.outputs.do-not-prerelease != 'true' }}"
         run: |
@@ -225,13 +250,13 @@ jobs:
       - name: Install weeder
         run: |
           ci/fix-home stack --no-terminal --jobs=2 \
-            build --copy-compiler-tool weeder-2.8.0
+            build --copy-compiler-tool weeder-2.9.0
 
       - run: |
           ci/fix-home stack --no-terminal --jobs=2 \
             build --fast --ghc-options -fwrite-ide-info
 
-      - run: "ci/fix-home stack exec weeder"
+      - run: "ci/fix-home stack exec weeder -- --hie-directory .stack-work"
 
       # Now do it again, with the test suite included. We don't want a
       # reference from our test suite to count in the above check; the fact
@@ -241,7 +266,7 @@ jobs:
           ci/fix-home stack --no-terminal --jobs=2 \
             build --fast --test --no-run-tests --ghc-options -fwrite-ide-info
 
-      - run: "ci/fix-home stack exec weeder"
+      - run: "ci/fix-home stack exec weeder -- --hie-directory .stack-work"
 
   make-prerelease:
     runs-on: ubuntu-latest

CHANGELOG.d/internal_tool_updates.md

@@ -0,0 +1,2 @@
+* Update weeder version in CI to 2.9.0
+* Add happy ==2.0.2 as build-tool-depends 

CHANGELOG.d/misc_static_linking.md

@@ -0,0 +1,4 @@
+* Enable statically-linked binaries using [ghc-musl](https://github.com/benz0li/ghc-musl)
+* Update haskeline version bounds to >=0.8.2.1 && <0.9
+  
+  Consequently, this fixes Cabal-based builds on GHC 9.8.4