fix(ci): host checkout + docker manylinux2014 for glibc217

Job container cannot run Node-based actions on glibc 2.17. Run checkout/cache on ubuntu-latest and build inside manylinux2014 via docker run; use preinstalled devtoolset-10 in the image.

Author: hongzhi-gao

.github/scripts/package-client-cpp-centos7.sh

@@ -14,9 +14,19 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-# Build client-cpp on manylinux2014 (CentOS 7, glibc 2.17 baseline) with devtoolset-8.
+# Build client-cpp for glibc 2.17 baseline (manylinux2014 or CentOS 7 + devtoolset-8).
 set -euxo pipefail
 
+run_maven_build() {
+  gcc --version
+  cmake --version
+  java -version
+  cd "${GITHUB_WORKSPACE:?GITHUB_WORKSPACE is not set}"
+  ./mvnw clean package -P with-cpp -pl iotdb-client/client-cpp -am -DskipTests \
+    -Dspotless.skip=true \
+    -Dclient.cpp.package.classifier=linux-x86_64-glibc217
+}
+
 # CentOS 7 EOL: redirect yum repos to vault.centos.org (see CentOS wiki / SIG SCLo).
 fix_yum_vault_repos() {
   local repo
@@ -59,16 +69,24 @@ gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-SCLo
 EOF
 }
 
-fix_yum_vault_repos
-yum install -y ca-certificates centos-release-scl epel-release
-write_sclo_vault_repos
-fix_yum_vault_repos
-yum clean all
-yum makecache -y
+install_centos7_devtoolset8() {
+  fix_yum_vault_repos
+  yum install -y ca-certificates centos-release-scl epel-release
+  write_sclo_vault_repos
+  fix_yum_vault_repos
+  yum clean all
+  yum makecache -y
+  yum install -y devtoolset-8-gcc devtoolset-8-gcc-c++ devtoolset-8-binutils \
+    devtoolset-8-libstdc++-devel scl-utils \
+    make wget tar which git patch unzip bzip2
+}
 
-yum install -y devtoolset-8-gcc devtoolset-8-gcc-c++ devtoolset-8-binutils \
-  devtoolset-8-libstdc++-devel scl-utils \
-  make wget tar which git patch unzip bzip2
+if [[ -x /opt/rh/devtoolset-10/root/usr/bin/gcc ]]; then
+  # manylinux2014_x86_64 ships devtoolset-10 on PATH for glibc 2.17-compatible builds.
+  yum install -y wget tar which git patch unzip bzip2 || true
+else
+  install_centos7_devtoolset8
+fi
 
 CMAKE_VERSION=3.28.4
 CMAKE_DIR=/opt/cmake-${CMAKE_VERSION}
@@ -96,16 +114,20 @@ fi
 export PATH="${CMAKE_DIR}/bin:${JAVA_HOME}/bin:${PATH}"
 export JAVA_HOME
 
-scl enable devtoolset-8 -- bash -c '
-  set -euxo pipefail
-  gcc --version
-  cmake --version
-  java -version
-  cd "${GITHUB_WORKSPACE:?GITHUB_WORKSPACE is not set}"
-  ./mvnw clean package -P with-cpp -pl iotdb-client/client-cpp -am -DskipTests \
-    -Dspotless.skip=true \
-    -Dclient.cpp.package.classifier=linux-x86_64-glibc217
-'
+if [[ -x /opt/rh/devtoolset-10/root/usr/bin/gcc ]]; then
+  run_maven_build
+else
+  scl enable devtoolset-8 -- bash -c '
+    set -euxo pipefail
+    gcc --version
+    cmake --version
+    java -version
+    cd "${GITHUB_WORKSPACE:?GITHUB_WORKSPACE is not set}"
+    ./mvnw clean package -P with-cpp -pl iotdb-client/client-cpp -am -DskipTests \
+      -Dspotless.skip=true \
+      -Dclient.cpp.package.classifier=linux-x86_64-glibc217
+  '
+fi
 
 SO="iotdb-client/client-cpp/target/install/lib/libiotdb_session.so"
 test -f "${SO}"

.github/workflows/client-cpp-package.yml

@@ -159,13 +159,12 @@ jobs:
     name: Package (linux-x86_64-glibc217)
     needs: [should-package, resolve-matrix]
     if: needs.should-package.outputs.run == 'true' && needs.resolve-matrix.outputs.run_linux == 'true'
+    # Checkout/cache on host (Node actions need modern glibc); build in manylinux2014 via docker run.
     runs-on: ubuntu-latest
-    container:
-      image: quay.io/pypa/manylinux2014_x86_64
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Cache Maven packages
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.m2
           key: linux-glibc217-m2-${{ hashFiles('**/pom.xml') }}
@@ -176,7 +175,16 @@ jobs:
         run: |
           set -euxo pipefail
           chmod +x .github/scripts/package-client-cpp-centos7.sh
-          bash .github/scripts/package-client-cpp-centos7.sh
+          docker run --rm \
+            -v "${{ github.workspace }}:/workspace" \
+            -v "${HOME}/.m2:/root/.m2" \
+            -w /workspace \
+            -e GITHUB_WORKSPACE=/workspace \
+            quay.io/pypa/manylinux2014_x86_64 \
+            bash .github/scripts/package-client-cpp-centos7.sh
+      - name: Restore workspace ownership after container build
+        if: always()
+        run: sudo chown -R "$(id -u):$(id -g)" "${{ github.workspace }}"
       - name: Resolve package zip
         id: pkg
         shell: bash
@@ -191,7 +199,7 @@ jobs:
           echo "path=${zips[0]}" >> "$GITHUB_OUTPUT"
           echo "name=$(basename "${zips[0]}" .zip)" >> "$GITHUB_OUTPUT"
       - name: Upload zip artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: ${{ steps.pkg.outputs.name }}
           path: ${{ steps.pkg.outputs.path }}