ci: stop the LLVM caches from being evicted

The Actions cache of the repository was at 10.24 GB against a quota of
10 GB, so GitHub removed entries by least recent use. The LLVM entries
were among the first to go, and CI then built LLVM again although the
LLVM version did not change.

The Docker buildx layer blobs held 6.0 GB of the quota. All LLVM caches
together held 1.97 GB. Move the Docker layer cache to a registry cache in
GHCR, which does not use the Actions quota. Both jobs have the necessary
permission and login already.

Pin the LLVM commit in llvm-version.txt and fetch that commit, in place
of a clone of the branch tip tinygo_22.x. Add a hash of that file to each
LLVM cache key, so a change of the LLVM version invalidates the caches
and no other change does.

Also rename the LLVM image tags from llvm-20 to llvm-22.

.dockerignore

@@ -1,4 +1,4 @@
 build/
 llvm-*/
+!llvm-version.txt
 .github
-

.github/workflows/build-macos.yml

@@ -46,7 +46,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-source
         with:
-          key: llvm-source-22-${{ matrix.os }}-v1
+          key: llvm-source-22-${{ matrix.os }}-v1-${{ hashFiles('llvm-version.txt') }}
           path: |
             llvm-project/clang/lib/Headers
             llvm-project/clang/include
@@ -71,7 +71,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-build
         with:
-          key: llvm-build-22-${{ matrix.os }}-v1
+          key: llvm-build-22-${{ matrix.os }}-v1-${{ hashFiles('llvm-version.txt') }}
           path: llvm-build
       - name: Build LLVM
         if: steps.cache-llvm-build.outputs.cache-hit != 'true'

.github/workflows/compat.yml

@@ -46,7 +46,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-source
         with:
-          key: llvm-source-22-linux-compat
+          key: llvm-source-22-linux-compat-${{ hashFiles('llvm-version.txt') }}
           path: llvm-project/compiler-rt
       - name: Download LLVM source
         if: steps.cache-llvm-source.outputs.cache-hit != 'true'

.github/workflows/docker.yml

@@ -64,5 +64,5 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=registry,ref=ghcr.io/${{ github.repository_owner }}/tinygo-dev:buildcache
+          cache-to: type=registry,ref=ghcr.io/${{ github.repository_owner }}/tinygo-dev:buildcache,mode=max

.github/workflows/extract-changelog.sh

@@ -1,35 +0,0 @@
-#!/bin/sh
-
-# Print the CHANGELOG.md entry for one version, to use as release notes.
-# The file uses a setext heading: the bare version, then a line of dashes.
-
-set -e
-
-version="$1"
-if [ -z "$version" ]; then
-	echo "usage: $0 <version>" >&2
-	exit 1
-fi
-
-notes=$(awk -v version="$version" '
-	found {
-		if ($0 ~ /^---+$/ && previous != "") { previous = ""; exit }
-		if (previous != "") print previous
-		previous = $0
-		next
-	}
-	$0 ~ /^---+$/ && previous == version {
-		found = 1
-		previous = ""
-		next
-	}
-	{ previous = $0 }
-	END { if (found && previous != "") print previous }
-' CHANGELOG.md)
-
-if [ -z "$notes" ]; then
-	echo "no CHANGELOG.md entry for version $version" >&2
-	exit 1
-fi
-
-echo "$notes"

.github/workflows/linux.yml

@@ -66,7 +66,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-source
         with:
-          key: llvm-source-22-linux-alpine-v1
+          key: llvm-source-22-linux-alpine-v1-${{ hashFiles('llvm-version.txt') }}
           path: |
             llvm-project/clang/lib/Headers
             llvm-project/clang/include
@@ -91,7 +91,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-build
         with:
-          key: llvm-build-22-linux-alpine-v1
+          key: llvm-build-22-linux-alpine-v1-${{ hashFiles('llvm-version.txt') }}
           path: llvm-build
       - name: Build LLVM
         if: steps.cache-llvm-build.outputs.cache-hit != 'true'
@@ -268,7 +268,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-source
         with:
-          key: llvm-source-22-linux-asserts-v1
+          key: llvm-source-22-linux-asserts-v1-${{ hashFiles('llvm-version.txt') }}
           path: |
             llvm-project/clang/lib/Headers
             llvm-project/clang/include
@@ -293,7 +293,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-build
         with:
-          key: llvm-build-22-linux-asserts-v1
+          key: llvm-build-22-linux-asserts-v1-${{ hashFiles('llvm-version.txt') }}
           path: llvm-build
       - name: Build LLVM
         if: steps.cache-llvm-build.outputs.cache-hit != 'true'
@@ -377,7 +377,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-source
         with:
-          key: llvm-source-22-linux-v1
+          key: llvm-source-22-linux-v1-${{ hashFiles('llvm-version.txt') }}
           path: |
             llvm-project/clang/lib/Headers
             llvm-project/clang/include
@@ -402,7 +402,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-build
         with:
-          key: llvm-build-22-linux-${{ matrix.goarch }}-v1
+          key: llvm-build-22-linux-${{ matrix.goarch }}-v1-${{ hashFiles('llvm-version.txt') }}
           path: llvm-build
       - name: Build LLVM
         if: steps.cache-llvm-build.outputs.cache-hit != 'true'

.github/workflows/llvm.yml

@@ -35,8 +35,8 @@ jobs:
         uses: docker/metadata-action@v6
         with:
           images: |
-            tinygo/llvm-20
-            ghcr.io/${{ github.repository_owner }}/llvm-20
+            tinygo/llvm-22
+            ghcr.io/${{ github.repository_owner }}/llvm-22
           tags: |
             type=sha,format=long
             type=raw,value=latest
@@ -59,5 +59,5 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=registry,ref=ghcr.io/${{ github.repository_owner }}/llvm-22:buildcache
+          cache-to: type=registry,ref=ghcr.io/${{ github.repository_owner }}/llvm-22:buildcache,mode=max

.github/workflows/nix.yml

@@ -29,7 +29,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-source
         with:
-          key: llvm-source-22-linux-nix-v1
+          key: llvm-source-22-linux-nix-v1-${{ hashFiles('llvm-version.txt') }}
           path: |
             llvm-project/compiler-rt
       - name: Download LLVM source

.github/workflows/release.yml

@@ -1,158 +0,0 @@
-# Publish a GitHub release from the artifacts that CI already built.
-#
-# The Linux, macOS and Windows workflows build every file that a release needs
-# when the release branch is pushed. This workflow collects the artifacts of
-# those runs for the tagged commit, so what ships is what was tested.
-#
-# The release is a draft, so the notes can be reviewed before publication.
-name: Release
-
-on:
-  push:
-    tags:
-      - 'v*'
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Tag to release, for example v0.42.0'
-        required: true
-
-concurrency:
-  group: release-${{ inputs.tag || github.ref_name }}
-  cancel-in-progress: false
-
-permissions:
-  contents: write
-  actions: read
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    env:
-      GH_TOKEN: ${{ github.token }}
-      GH_REPO: ${{ github.repository }}
-      TAG: ${{ inputs.tag || github.ref_name }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          ref: ${{ inputs.tag || github.ref_name }}
-          fetch-depth: 0
-      - name: Read the version
-        id: version
-        # The release file names come from goenv/version.go, not from the tag,
-        # so the two must agree.
-        run: |
-          version=$(./.github/workflows/tinygo-extract-version.sh | cut -d= -f2-)
-          case "$version" in
-            *-dev)
-              echo "::error::goenv/version.go has development version $version"
-              exit 1
-              ;;
-          esac
-          if [ "v$version" != "$TAG" ]; then
-            echo "::error::tag $TAG does not match version $version in goenv/version.go"
-            exit 1
-          fi
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-      - name: Wait for the CI runs of this commit
-        id: runs
-        # A pull request run has the merge commit as its head, so look at push
-        # runs only.
-        run: |
-          sha=$(git rev-parse HEAD)
-          for workflow in linux.yml build-macos.yml windows.yml; do
-            id=
-            for _ in $(seq 20); do
-              id=$(gh run list --workflow "$workflow" --commit "$sha" --event push --limit 1 --json databaseId --jq '.[0].databaseId')
-              if [ -n "$id" ]; then
-                break
-              fi
-              echo "waiting for $workflow to start on $sha"
-              sleep 30
-            done
-            if [ -z "$id" ]; then
-              echo "::error::no $workflow run for commit $sha"
-              exit 1
-            fi
-            echo "$workflow: run $id"
-            gh run watch "$id" --exit-status > /dev/null || true
-            conclusion=$(gh run view "$id" --json conclusion --jq .conclusion)
-            if [ "$conclusion" != "success" ]; then
-              echo "::error::$workflow run $id concluded with $conclusion"
-              exit 1
-            fi
-            case "$workflow" in
-              linux.yml)       echo "linux=$id"   >> "$GITHUB_OUTPUT" ;;
-              build-macos.yml) echo "macos=$id"   >> "$GITHUB_OUTPUT" ;;
-              windows.yml)     echo "windows=$id" >> "$GITHUB_OUTPUT" ;;
-            esac
-          done
-      # The build jobs upload with `archive: false`, so the artifact is the
-      # release file itself. skip-decompress keeps it that way. The Windows
-      # release is a .zip, which a download would otherwise unpack.
-      - name: Download the Linux artifacts
-        uses: actions/download-artifact@v8
-        with:
-          run-id: ${{ steps.runs.outputs.linux }}
-          github-token: ${{ github.token }}
-          path: artifacts
-          skip-decompress: true
-      - name: Download the macOS artifacts
-        uses: actions/download-artifact@v8
-        with:
-          run-id: ${{ steps.runs.outputs.macos }}
-          github-token: ${{ github.token }}
-          path: artifacts
-          skip-decompress: true
-      - name: Download the Windows artifacts
-        uses: actions/download-artifact@v8
-        with:
-          run-id: ${{ steps.runs.outputs.windows }}
-          github-token: ${{ github.token }}
-          path: artifacts
-          skip-decompress: true
-      - name: Collect the release files
-        # A build that stopped uploading must not give a half complete release,
-        # so list the files that are expected. The search is by file name, not
-        # by artifact name, because the artifact names are not uniform.
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          version=$VERSION
-          mkdir -p dist
-          missing=0
-          for file in \
-              "tinygo$version.linux-amd64.tar.gz"  "tinygo_${version}_amd64.deb" \
-              "tinygo$version.linux-arm.tar.gz"    "tinygo_${version}_armhf.deb" \
-              "tinygo$version.linux-arm64.tar.gz"  "tinygo_${version}_arm64.deb" \
-              "tinygo$version.darwin-amd64.tar.gz" \
-              "tinygo$version.darwin-arm64.tar.gz" \
-              "tinygo$version.windows-amd64.zip"; do
-            found=$(find artifacts -type f -name "$file" | head -1)
-            if [ -z "$found" ]; then
-              echo "::error::missing release file $file"
-              missing=1
-            else
-              mv "$found" "dist/$file"
-            fi
-          done
-          ls -l dist
-          exit $missing
-      - name: Extract the release notes
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-        run: ./.github/workflows/extract-changelog.sh "$VERSION" > notes.md
-      - name: Create the draft release
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          version=$VERSION
-          set --
-          case "$version" in
-            *-*) set -- --prerelease ;;
-          esac
-          gh release create "$TAG" --draft --verify-tag "$@" \
-            --title "$version" \
-            --notes-file notes.md \
-            dist/*

.github/workflows/sizediff.yml

@@ -34,7 +34,7 @@ jobs:
         uses: actions/cache@v5
         id: cache-llvm-source
         with:
-          key: llvm-source-22-sizediff-v1
+          key: llvm-source-22-sizediff-v1-${{ hashFiles('llvm-version.txt') }}
           path: |
             llvm-project/compiler-rt
       - name: Download LLVM source

.github/workflows/windows.yml

@@ -40,7 +40,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-source
         with:
-          key: llvm-source-22-windows-v3
+          key: llvm-source-22-windows-v3-${{ hashFiles('llvm-version.txt') }}
           path: |
             llvm-project/clang/lib/Headers
             llvm-project/clang/include
@@ -65,7 +65,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-build
         with:
-          key: llvm-build-22-windows-v1
+          key: llvm-build-22-windows-v1-${{ hashFiles('llvm-version.txt') }}
           path: llvm-build
       - name: Build LLVM
         if: steps.cache-llvm-build.outputs.cache-hit != 'true'

BUILDING.md

@@ -53,6 +53,10 @@ the git repository). Then, inside the directory, download the LLVM source:
 
     make llvm-source
 
+The LLVM commit to use is pinned in `llvm-version.txt`. A change to that file
+makes CI build LLVM again, because the file is part of the LLVM cache key. All
+other changes reuse the cached LLVM build.
+
 You can also store LLVM outside of the TinyGo root directory by setting the
 `LLVM_BUILDDIR`, `CLANG_SRC` and `LLD_SRC` make variables, but that is not
 covered by this guide.
@@ -119,35 +123,3 @@ the following command (for example in ~/lib):
 TinyGo will get extracted to a `tinygo` directory. You can then call it with:
 
     ./tinygo/bin/tinygo
-
-## Publish a release
-
-The `Release` workflow (`.github/workflows/release.yml`) publishes releases. It
-does not build anything. The Linux, macOS and Windows workflows already build
-every file that a release needs when the `release` branch is pushed, so the
-release workflow collects the artifacts of those runs for the tagged commit.
-What ships is what was tested.
-
- 1. On the `dev` branch, set `const version` in `goenv/version.go` to the new
-    version (without a `v` prefix), and add the entry to `CHANGELOG.md`.
- 2. Merge `dev` into the `release` branch.
- 3. Tag that commit and push the tag:
-
-        git tag v0.42.0
-        git push origin v0.42.0
-
-    The tag must be `v` plus the version in `goenv/version.go`, because the
-    release file names come from that constant.
- 4. The workflow waits for the Linux, macOS and Windows runs of the tagged
-    commit, collects their nine files, and creates a **draft** release. The
-    release notes come from the `CHANGELOG.md` entry for that version.
- 5. Review the draft release and publish it.
- 6. On the `dev` branch, set `goenv/version.go` to the next `-dev` version.
-
-To release again after a failure, delete the draft release and start the
-workflow from the Actions tab with the tag as its input.
-
-GitHub keeps a SHA-256 digest of every published file. The digest is not shown
-on the release page, but it can be printed with:
-
-    gh release view v0.42.0 --json assets --jq '.assets[] | "\(.digest)  \(.name)"'

Dockerfile

@@ -11,6 +11,7 @@ RUN apt-get update && \
 
 COPY ./GNUmakefile /tinygo/GNUmakefile
 COPY ./make /tinygo/make
+COPY ./llvm-version.txt /tinygo/llvm-version.txt
 
 RUN cd /tinygo/ && \
     make llvm-source

llvm-version.txt

@@ -0,0 +1 @@
+2be7242b6a4d59fe89fb43f7d1e7333dc9b307a2

make/llvm.mk

@@ -75,8 +75,15 @@ endif
     CGO_LDFLAGS+=-L$(abspath $(LLVM_BUILDDIR)/lib) -lclang $(CLANG_LIBS) $(LLD_LIBS) $(shell $(LLVM_CONFIG_PREFIX) $(LLVM_BUILDDIR)/bin/llvm-config --ldflags --libs --system-libs $(LLVM_COMPONENTS)) -lstdc++ $(CGO_LDFLAGS_EXTRA)
 endif
 
+# Pinned in llvm-version.txt. Branch tinygo_22.x of tinygo-org/llvm-project.
+LLVM_REVISION = $(shell cat llvm-version.txt)
+
 $(LLVM_PROJECTDIR)/llvm:
-	git clone -b tinygo_22.x --depth=1 https://github.com/tinygo-org/llvm-project $(LLVM_PROJECTDIR)
+	git init $(LLVM_PROJECTDIR)
+	cd $(LLVM_PROJECTDIR) && \
+	  git remote add origin https://github.com/tinygo-org/llvm-project && \
+	  git fetch --depth=1 origin $(LLVM_REVISION) && \
+	  git checkout FETCH_HEAD
 llvm-source: $(LLVM_PROJECTDIR)/llvm ## Get LLVM sources
 
 # Configure LLVM.