fix(ci): isolate the WASI plugin build from musl compiler settings

Author: Michiel de Jong

.dagger/src/index.ts

@@ -1265,12 +1265,9 @@ export class AtomicServer {
     // `rustTest()` already installs this target for the same reason —
     // same fix, applied where the e2e server binary is actually built.
     const containerReadyToBuild = wasmPluginsEnabled
-      ? containerWithAssets.withExec([
-          'rustup',
-          'target',
-          'add',
-          'wasm32-wasip2',
-        ])
+      ? containerWithAssets
+          .withExec(['rustup', 'target', 'add', 'wasm32-wasip2'])
+          .withEnvVariable('ATOMICSERVER_REQUIRE_PLUGIN_RUNTIME', 'true')
       : containerWithAssets;
 
     return (
@@ -1388,6 +1385,7 @@ export class AtomicServer {
     return (
       this.rustChecksContainer()
         .withExec(['rustup', 'target', 'add', 'wasm32-wasip2'])
+        .withEnvVariable('ATOMICSERVER_REQUIRE_PLUGIN_RUNTIME', 'true')
         // Persist nextest in the shared cargo-bin volume. Previously the
         // curl install sat *after* the source mount, so every Rust source
         // change re-downloaded it. The `linux-musl` URL is required: the

browser/e2e/tests/plugins.spec.ts

@@ -36,9 +36,18 @@ test.describe('plugins', () => {
     await expect(
       setup.getByRole('button', { name: 'Install demo pets', exact: true }),
     ).toBeVisible();
-    await setup
-      .getByRole('button', { name: 'Install demo pets', exact: true })
-      .click();
+    const [preview] = await Promise.all([
+      page.waitForResponse(
+        response =>
+          response.url().endsWith('/plugin-run') &&
+          response.request().method() === 'POST',
+        { timeout: 45_000 },
+      ),
+      setup
+        .getByRole('button', { name: 'Install demo pets', exact: true })
+        .click(),
+    ]);
+    expect(preview.ok(), await preview.text()).toBe(true);
 
     const review = page.locator('dialog[open]');
     // Installing walks pluginClassesFor, two ensureSchema calls, three

server/build.rs

@@ -595,18 +595,27 @@ fn is_newer_than_dist(dir_entry: &walkdir::DirEntry, dist_time: Duration) -> boo
 /// server-side plugins is a degraded server, not a broken build, and failing
 /// here would block anyone who never touches plugins. The absence is reported
 /// at the point someone tries to use it, not swallowed.
+/// CI sets ATOMICSERVER_REQUIRE_PLUGIN_RUNTIME=true to fail the build instead
+/// of allowing this degradation in jobs that exercise server-side plugins.
 fn build_plugin_runtime() {
     const TARGET: &str = "wasm32-wasip2";
     const CRATE: &str = "atomic-plugin-runtime";
 
     println!("cargo:rerun-if-changed=../plugin-runtime/src");
     println!("cargo:rerun-if-changed=../plugin-runtime/wit");
+    println!("cargo:rerun-if-changed=../plugin-runtime/Cargo.toml");
     println!("cargo:rerun-if-env-changed=ATOMICSERVER_SKIP_PLUGIN_RUNTIME");
+    println!("cargo:rerun-if-env-changed=ATOMICSERVER_REQUIRE_PLUGIN_RUNTIME");
+    let required = std::env::var("ATOMICSERVER_REQUIRE_PLUGIN_RUNTIME").is_ok_and(|v| v == "true");
 
     let out_dir = std::env::var("OUT_DIR").expect("OUT_DIR is set by cargo");
     let embedded = PathBuf::from(&out_dir).join("plugin_runtime.wasm");
 
     if std::env::var("ATOMICSERVER_SKIP_PLUGIN_RUNTIME").is_ok_and(|v| v == "true") {
+        assert!(
+            !required,
+            "the plugin runtime cannot be both required and skipped"
+        );
         p!("ATOMICSERVER_SKIP_PLUGIN_RUNTIME is set, skipping the plugin runtime.");
         let _ = std::fs::write(&embedded, []);
 
@@ -624,6 +633,10 @@ fn build_plugin_runtime() {
         .unwrap_or(false);
 
     if !has_target {
+        assert!(
+            !required,
+            "the required {TARGET} plugin runtime target is unavailable"
+        );
         p!("{TARGET} is unknown to this toolchain; plugins will not run server-side.");
         let _ = std::fs::write(&embedded, []);
 
@@ -640,6 +653,16 @@ fn build_plugin_runtime() {
             .env_remove("CARGO_ENCODED_RUSTFLAGS")
             .env_remove("RUSTFLAGS")
             .env_remove("CARGO_BUILD_TARGET")
+            // rust-musl-cross exports TARGET_CC/AR for the native server.
+            // cc-rs prefers these over the CC/AR selected by rquickjs's
+            // WASI SDK, so leaking them compiles QuickJS with the Linux
+            // toolchain instead of clang for WebAssembly.
+            .env_remove("TARGET_CC")
+            .env_remove("TARGET_CXX")
+            .env_remove("TARGET_AR")
+            .env_remove("TARGET_RANLIB")
+            .env_remove("TARGET_CFLAGS")
+            .env_remove("TARGET_CXXFLAGS")
             .current_dir("..")
             .status();
 
@@ -658,6 +681,10 @@ fn build_plugin_runtime() {
             );
         }
         _ => {
+            assert!(
+                !required,
+                "could not build the required {CRATE} for {TARGET}; see the nested cargo build error above"
+            );
             p!(
                 "could not build {CRATE} for {TARGET}; plugins will not run server-side. \
                  Install the target with `rustup target add {TARGET}`.",