From e01256b54dfd9282cc4af2394f52d7098522fea1 Mon Sep 17 00:00:00 2001
From: Viktor Vaczi <viktor.vaczi@emergence-engineering.com>
Date: Thu, 2 Jul 2026 14:29:20 +0200
Subject: [PATCH] =?UTF-8?q?fix(ci):=20binaryen=20tools=20cache=20also=20ne?=
 =?UTF-8?q?eds=20lib/=20=E2=80=94=20bin-only=20restore=20broke=20every=20p?=
 =?UTF-8?q?ost-process?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The binopt cache from b4cb10b saved only binaryen-hoist-build/bin, but the
tools dynamically link lib/libbinaryen.so, so the first cache HIT (run
28585074335) failed all 7 tools' finalize with a loader error. Cache bin/ +
lib/, bump the key to binopt-v2 (Ubicloud never re-saves an exact-key hit, so
the poisoned v1 entry can't be repaired in place), and make the
BINARYEN_TRUST_PREBUILT guard exec both tools with --version instead of -x
existence checks so an incomplete restore falls through to a source build.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NTxTrY9on6A8gLvogFbGiy
---
 .github/workflows/wasm-build.yml              | 14 +++++++++-----
 scripts/binaryen-hoist-pass/build-wasm-opt.sh | 14 +++++++++-----
 2 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/wasm-build.yml b/.github/workflows/wasm-build.yml
index 3768c0d..4a49d7d 100644
--- a/.github/workflows/wasm-build.yml
+++ b/.github/workflows/wasm-build.yml
@@ -119,17 +119,21 @@ jobs:
           echo "WASM output-cache restore skip=$SKIP"
 
       # Binaryen post-process tools (submodule fork): otherwise built from source on
-      # every fresh VM (~46s on 30 cores, measured run 28577824366). Cache just bin/
-      # keyed on the exact submodule SHA; on a hit BINARYEN_TRUST_PREBUILT tells
-      # build-wasm-opt.sh to skip cmake+ninja and trust the restored binaries.
+      # every fresh VM (~46s on 30 cores, measured run 28577824366). Cache bin/ AND
+      # lib/ (the tools dynamically link lib/libbinaryen.so — bin/ alone is a loader
+      # error at first exec, run 28585074335), keyed on the exact submodule SHA; on a
+      # hit BINARYEN_TRUST_PREBUILT tells build-wasm-opt.sh to skip cmake+ninja and
+      # trust the restored binaries. v2: v1 entries hold a poisoned bin-only layout.
       # Needed by BOTH the host post-process (final-miss path) and the test-app
       # build, hence not gated on run_tests.
       - name: Cache Binaryen post-process tools
         id: binopt-cache
         uses: actions/cache@v4
         with:
-          path: build-wasm/tools/binaryen-hoist-build/bin
-          key: binopt-${{ runner.os }}-${{ steps.keys.outputs.bin }}
+          path: |
+            build-wasm/tools/binaryen-hoist-build/bin
+            build-wasm/tools/binaryen-hoist-build/lib
+          key: binopt-v2-${{ runner.os }}-${{ steps.keys.outputs.bin }}
 
       - name: Trust prebuilt Binaryen tools (cache hit)
         if: steps.binopt-cache.outputs.cache-hit == 'true'
diff --git a/scripts/binaryen-hoist-pass/build-wasm-opt.sh b/scripts/binaryen-hoist-pass/build-wasm-opt.sh
index ec3043f..97e4bcc 100755
--- a/scripts/binaryen-hoist-pass/build-wasm-opt.sh
+++ b/scripts/binaryen-hoist-pass/build-wasm-opt.sh
@@ -22,12 +22,16 @@ if [ ! -f "${SRC}/src/passes/HoistCppCatches.cpp" ]; then
     exit 1
 fi
 
-# CI fast-path: the workflow cache-restores bin/ keyed on the exact submodule SHA and
-# sets this var on a hit, so the restored binaries are authoritative — skip cmake+ninja.
-# Never set it locally when iterating on the pass: uncommitted source edits would be
-# silently ignored (the SHA key can't see them).
+# CI fast-path: the workflow cache-restores bin/ + lib/ keyed on the exact submodule
+# SHA and sets this var on a hit, so the restored binaries are authoritative — skip
+# cmake+ninja. Trust only if both tools actually RUN: the binaries dynamically link
+# lib/libbinaryen.so, so an existence check alone passes on an incomplete restore
+# (bin/ without lib/ shipped a red main, run 28585074335) while --version proves the
+# loader resolves everything. Never set the var locally when iterating on the pass:
+# uncommitted source edits would be silently ignored (the SHA key can't see them).
 if [ "${BINARYEN_TRUST_PREBUILT:-0}" = "1" ] \
-   && [ -x "${BUILD}/bin/wasm-opt" ] && [ -x "${BUILD}/bin/wasm-emscripten-finalize" ]; then
+   && "${BUILD}/bin/wasm-opt" --version >/dev/null 2>&1 \
+   && "${BUILD}/bin/wasm-emscripten-finalize" --version >/dev/null 2>&1; then
     echo "Using prebuilt Binaryen tools (BINARYEN_TRUST_PREBUILT=1): ${BUILD}/bin" >&2
     echo "${BUILD}/bin/wasm-opt"
     exit 0