React Native on Android, build-time bindings and metadata filtering, QuickJS-NG submodule

platforms/android/.github/workflows/bytecode-compilers.yml → .github/workflows/bytecode-compilers.yml

@@ -6,41 +6,38 @@ name: Build bytecode compilers
 #
 # Output: one artifact per (engine, host), named `bytecode-compiler-<engine>-<host>`,
 # each containing `<engine>/<host>/<binary>` so the downloads merge straight into
-# tools/bytecode-compiler/bin/.
+# platforms/android/tools/bytecode-compiler/bin/.
 #
 # The final `bundle` job merges them all into a single `bytecode-compiler-bin`
-# artifact laid out exactly like tools/bytecode-compiler/bin/ — download it, unzip,
-# and drop its contents into tools/bytecode-compiler/bin/ as-is.
+# artifact laid out exactly like platforms/android/tools/bytecode-compiler/bin/ — download it, unzip,
+# and drop its contents into platforms/android/tools/bytecode-compiler/bin/ as-is.
 #
 # NOTE ON COMPATIBILITY: the produced bytecode must be loadable by the engine
-# library the runtime ships. Hermes/PrimJS runtimes link prebuilt .so's and
-# QuickJS/QuickJS-NG compile from vendored source, so the refs below must be kept
-# in step with what the runtime actually bundles. Pin these to exact commits once
+# library the runtime ships. Hermes/PrimJS runtimes link prebuilt binaries and
+# QuickJS-NG compiles from the vendored source, so the refs below must be kept in
+# step with what the runtime actually bundles. Pin these to exact commits once
 # validated instead of moving branches.
 on:
   workflow_dispatch:
     inputs:
       hermes_ref:
-        description: "facebook/hermes ref"
+        # MUST match UPSTREAM_COMMIT in build-hermes, which is what produced the
+        # prebuilt both platforms link. See scripts/download_hermes.sh.
+        description: "facebook/hermes ref (match the prebuilt release)"
         default: "10a40b5f1de81d007cba6afe567c4ba7a0b45f5d"
-      quickjs_ref:
-        # MUST match the quickjs submodule pin (BC_VERSION must agree with the
-        # runtime). See .gitmodules / scripts/vendor-engines-as-submodules.sh.
-        description: "bellard/quickjs ref (match the submodule pin)"
-        default: "04be246001599f5995fa2f2d8c91a0f198d3f34c"
       quickjs_ng_ref:
-        # MUST match the quickjs_ng submodule pin (BC_VERSION must agree with the
-        # runtime, or JS_ReadObject rejects the blob). See .gitmodules /
-        # scripts/vendor-engines-as-submodules.sh.
-        description: "quickjs-ng/quickjs ref (match the submodule pin)"
+        # MUST match the vendored source in vendor/quickjs/source_ng, or
+        # JS_ReadObject rejects the blob: the compiler writes its own BC_VERSION
+        # and the runtime accepts only its own. d950d55e == BC_VERSION 27, which
+        # is what the vendored quickjs.c defines.
+        description: "quickjs-ng/quickjs ref (match vendor/quickjs/source_ng)"
         default: "d950d55e950dd7994a96c669c31efa967b8b79f3"
       primjs_ref:
         description: "lynx-family/primjs ref"
         default: "9c1fe150179b86f0ae5c6fbe670af7d76eca9df6"
 
 env:
   HERMES_REPO: https://github.com/facebook/hermes
-  QUICKJS_REPO: https://github.com/bellard/quickjs
   QUICKJS_NG_REPO: https://github.com/quickjs-ng/quickjs
   PRIMJS_REPO: https://github.com/lynx-family/primjs
 
@@ -80,7 +77,7 @@ jobs:
         # accepts branch/tag names). GitHub allows fetching arbitrary SHAs.
         run: |
           set -euxo pipefail
-          ref="${{ github.event.inputs.hermes_ref || 'master' }}"
+          ref="${{ github.event.inputs.hermes_ref || '10a40b5f1de81d007cba6afe567c4ba7a0b45f5d' }}"
           git init hermes
           git -C hermes remote add origin "$HERMES_REPO"
           git -C hermes fetch --depth 1 origin "$ref"
@@ -112,6 +109,10 @@ jobs:
           bin="$(find build -type f \( -name hermesc -o -name hermesc.exe \) | head -n1)"
           test -n "$bin"
           cp "$bin" "out/hermes/${{ matrix.host }}/"
+          if [ "${{ runner.os }}" = "macOS" ]; then
+            codesign --sign - --force "out/hermes/${{ matrix.host }}/$(basename "$bin")"
+            codesign --verify --verbose "out/hermes/${{ matrix.host }}/$(basename "$bin")"
+          fi
 
       - uses: actions/upload-artifact@v4
         with:
@@ -121,81 +122,12 @@ jobs:
           path: out
           if-no-files-found: error
 
-  # ---------------------------------------------------------------------------
-  # QuickJS (bellard) — build via its own Makefile (libquickjs.a, which injects
-  # -D_GNU_SOURCE -DCONFIG_VERSION), then link our blob-emitting shim.
-  # win32-x64 is CROSS-compiled on Linux via bellard's CONFIG_WIN32 (mingw-w64);
-  # win32-arm64 is not possible (mingw-w64 targets x86 only).
-  # ---------------------------------------------------------------------------
-  quickjs:
-    name: quickjs (${{ matrix.host }})
-    runs-on: ${{ matrix.runner }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { host: linux-x64,    runner: ubuntu-24.04 }
-          - { host: linux-arm64,  runner: ubuntu-24.04-arm }
-          - { host: darwin-x64,   runner: macos-15-intel }
-          - { host: darwin-arm64, runner: macos-14 }
-          - { host: win32-x64,    runner: ubuntu-24.04 }  # mingw cross-compile
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install toolchain (Linux)
-        if: runner.os == 'Linux'
-        run: |
-          set -euxo pipefail
-          sudo apt-get update
-          sudo apt-get install -y build-essential
-          # mingw-w64 for the win32-x64 cross build.
-          if [ "${{ matrix.host }}" = "win32-x64" ]; then sudo apt-get install -y mingw-w64; fi
-      # macOS: make + clang ship with the Xcode command-line tools.
-
-      - name: Clone QuickJS
-        shell: bash
-        run: |
-          set -euxo pipefail
-          ref="${{ github.event.inputs.quickjs_ref || 'master' }}"
-          git init quickjs
-          git -C quickjs remote add origin "$QUICKJS_REPO"
-          git -C quickjs fetch --depth 1 origin "$ref"
-          git -C quickjs -c advice.detachedHead=false checkout FETCH_HEAD
-
-      - name: Build lib + shim
-        shell: bash
-        env:
-          SHIM: ${{ github.workspace }}/tools/bytecode-compiler/native/qjs-compile.c
-        run: |
-          set -euxo pipefail
-          cd quickjs
-          jobs="$(getconf _NPROCESSORS_ONLN)"
-          out="../out/quickjs/${{ matrix.host }}"; mkdir -p "$out"
-          if [ "${{ matrix.host }}" = "win32-x64" ]; then
-            # CONFIG_WIN32=y selects the x86_64-w64-mingw32- cross toolchain.
-            make -j"$jobs" CONFIG_WIN32=y libquickjs.a
-            # bellard's win32 LIBS are "-lm -lpthread" (winpthreads provides the
-            # pthread_* and clock_gettime symbols quickjs.c uses).
-            x86_64-w64-mingw32-gcc -O2 -DNSBC_MAGIC='"NSBCQJS"' -I. \
-              -o "$out/nsbc-quickjs.exe" "$SHIM" libquickjs.a -lm -lpthread
-            # Cross-built Windows binary — not runnable on the Linux host.
-          else
-            # Use bellard's own Makefile so CONFIG_VERSION / _GNU_SOURCE and the
-            # correct source set come from upstream.
-            make -j"$jobs" libquickjs.a
-            cc -O2 -DNSBC_MAGIC='"NSBCQJS"' -I. -o "$out/nsbc-quickjs" "$SHIM" libquickjs.a -lm
-            "$out/nsbc-quickjs" || true  # usage line (exit 2) proves it links & runs
-          fi
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: bytecode-compiler-quickjs-${{ matrix.host }}
-          # Root the artifact at `out/` so it carries the full
-          # `quickjs/<host>/<binary>` path and merges straight into bin/.
-          path: out
-          if-no-files-found: error
-
   # ---------------------------------------------------------------------------
   # QuickJS-NG — CMake build of libqjs, then our shim (same JS_* API).
+  #
+  # There is no bellard/quickjs job: the runtime dropped that tree, and its
+  # QUICKJS engine is now an alias for QUICKJS_NG (see
+  # platforms/android/test-app/runtime/build.gradle).
   # ---------------------------------------------------------------------------
   quickjs-ng:
     name: quickjs-ng (${{ matrix.host }})
@@ -226,7 +158,7 @@ jobs:
         shell: bash
         run: |
           set -euxo pipefail
-          ref="${{ github.event.inputs.quickjs_ng_ref || 'master' }}"
+          ref="${{ github.event.inputs.quickjs_ng_ref || 'd950d55e950dd7994a96c669c31efa967b8b79f3' }}"
           git init quickjs-ng
           git -C quickjs-ng remote add origin "$QUICKJS_NG_REPO"
           git -C quickjs-ng fetch --depth 1 origin "$ref"
@@ -235,9 +167,11 @@ jobs:
       - name: Build lib + shim
         shell: bash
         env:
-          SHIM: ${{ github.workspace }}/tools/bytecode-compiler/native/qjs-compile.c
+          SHIM: ${{ github.workspace }}/platforms/android/tools/bytecode-compiler/native/qjs-compile.c
         run: |
           set -euxo pipefail
+          # Note: the workflow lives at the repository root, so the shim path is
+          # platforms/android/-prefixed; the tool tree itself is under Android.
           # Build the shim as a CMake target so it uses the SAME toolchain + CRT
           # as the engine lib. Linking a separately-compiled (clang) shim against
           # the MSVC-built qjs.lib fails with __imp_*/CRT-mismatch link errors on
@@ -254,6 +188,10 @@ jobs:
           out="out/quickjs-ng/${{ matrix.host }}"; mkdir -p "$out"
           bin="$(find quickjs-ng/build -type f \( -name 'nsbc-quickjs-ng' -o -name 'nsbc-quickjs-ng.exe' \) | head -n1)"
           test -n "$bin"; cp "$bin" "$out/"
+          if [ "${{ runner.os }}" = "macOS" ]; then
+            codesign --sign - --force "$out/nsbc-quickjs-ng"
+            codesign --verify --verbose "$out/nsbc-quickjs-ng"
+          fi
           [ "${{ runner.os }}" = "Windows" ] || "$out/nsbc-quickjs-ng" || true
 
       - uses: actions/upload-artifact@v4
@@ -295,7 +233,7 @@ jobs:
         shell: bash
         run: |
           set -euxo pipefail
-          ref="${{ github.event.inputs.primjs_ref || 'develop' }}"
+          ref="${{ github.event.inputs.primjs_ref || '9c1fe150179b86f0ae5c6fbe670af7d76eca9df6' }}"
           git init primjs
           git -C primjs remote add origin "$PRIMJS_REPO"
           git -C primjs fetch --depth 1 origin "$ref"
@@ -304,7 +242,7 @@ jobs:
       - name: Add shim as a GN target
         shell: bash
         env:
-          SHIM: ${{ github.workspace }}/tools/bytecode-compiler/native/primjs-compile.c
+          SHIM: ${{ github.workspace }}/platforms/android/tools/bytecode-compiler/native/primjs-compile.c
         run: |
           set -euxo pipefail
           # Build as C++ (.cc); the LEPUS_* API is extern "C" so linkage is fine.
@@ -335,6 +273,10 @@ jobs:
           ninja -C out/Default nsbc-primjs
           out="../out/primjs/${{ matrix.host }}"; mkdir -p "$out"
           cp out/Default/nsbc-primjs "$out/nsbc-primjs"
+          if [ "${{ runner.os }}" = "macOS" ]; then
+            codesign --sign - --force "$out/nsbc-primjs"
+            codesign --verify --verbose "$out/nsbc-primjs"
+          fi
           "$out/nsbc-primjs" || true  # usage line (exit 2) proves it links & runs
 
       - uses: actions/upload-artifact@v4
@@ -347,12 +289,12 @@ jobs:
 
   # ---------------------------------------------------------------------------
   # Bundle — merge every per-(engine, host) artifact into a single artifact laid
-  # out exactly like tools/bytecode-compiler/bin/, ready to download-and-paste.
+  # out exactly like platforms/android/tools/bytecode-compiler/bin/, ready to download-and-paste.
   # ---------------------------------------------------------------------------
   bundle:
     name: bundle bin/
     runs-on: ubuntu-24.04
-    needs: [hermes, quickjs, quickjs-ng, primjs]
+    needs: [hermes, quickjs-ng, primjs]
     # Run even if some engine/host builds failed, so a partial bin/ is still
     # published rather than nothing.
     if: always()
@@ -369,6 +311,10 @@ jobs:
       - name: Show merged layout
         run: find bin -type f | sort
 
+      - name: Restore executable permissions
+        shell: bash
+        run: find bin -type f -path '*/darwin-*/*' -exec chmod +x {} \;
+
       - uses: actions/upload-artifact@v4
         with:
           name: bytecode-compiler-bin

.github/workflows/ci.yml

@@ -41,6 +41,13 @@ jobs:
       - name: Generate macOS metadata
         run: npm run metagen macos
 
+      - name: Apply QuickJS patches
+        # vendor/quickjs/source_ng is a pristine submodule checkout at its pinned
+        # commit; the NativeScript engine changes the Apple build needs (e.g.
+        # JS_EVAL_FLAG_COMPILE_ONLY_NO_RESOLVE for node:vm) live in
+        # vendor/quickjs/patches and are applied into the work tree here.
+        run: npm run patch-quickjs
+
       - name: Build NativeScript
         run: npm run build
 
@@ -92,6 +99,9 @@ jobs:
       - name: Generate macOS metadata
         run: npm run metagen macos
 
+      - name: Apply QuickJS patches
+        run: npm run patch-quickjs
+
       - name: Run macOS test suite
         env:
           MACOS_COMMAND_TIMEOUT_MS: "1200000"
@@ -148,6 +158,7 @@ jobs:
           npm run build-libffi
           METADATA_GENERATOR_ARCHS="$(uname -m)" npm run build-metagen
           npm run metagen macos
+          npm run patch-quickjs
 
       - name: Build candidate CLI
         run: |
@@ -169,8 +180,12 @@ jobs:
               rm -rf ./Frameworks/hermes.xcframework ./Frameworks/hermes-headers
               ;;
           esac
+          # A base that still vendors QuickJS-NG as plain files can't be
+          # checked out over the candidate's submodule work tree.
+          git submodule deinit --force vendor/quickjs/source_ng
           git checkout --detach "${BASE_SHA}"
           git submodule update --init --recursive
+          if [ -d vendor/quickjs/patches ]; then npm run patch-quickjs; fi
           npm install
           npm run build-libffi
           METADATA_GENERATOR_ARCHS="$(uname -m)" npm run build-metagen

.github/workflows/npm_release.yml

@@ -111,6 +111,12 @@ jobs:
           echo NPM_VERSION=$NPM_VERSION >> $GITHUB_OUTPUT
           echo NPM_TAG=$NPM_TAG >> $GITHUB_OUTPUT
           echo BUILD_ENGINE=$BUILD_ENGINE >> $GITHUB_OUTPUT
+      - name: Apply QuickJS patches
+        # vendor/quickjs/source_ng is a pristine submodule checkout at its pinned
+        # commit; the NativeScript engine changes the Apple build needs (e.g.
+        # JS_EVAL_FLAG_COMPILE_ONLY_NO_RESOLVE for node:vm) live in
+        # vendor/quickjs/patches and are applied into the work tree here.
+        run: npm run patch-quickjs
       - name: Build
         run: ./scripts/build_all_ios.sh --${{ steps.npm_version_output.outputs.BUILD_ENGINE }}
       - name: Upload npm package artifact