CI/build: fix release matrix for macOS, Linux x86_64, and Lambda/Bref

First release run surfaced three platform-specific build breaks:

- macOS (all): linking a cdylib that references Zend symbols fails because
  macOS ld rejects undefined symbols. Add .cargo/config.toml pinning
  `-undefined dynamic_lookup` for the macOS target (also fixes local macOS
  builds), so Zend/PHP symbols resolve at extension load time.

- Linux x86_64 (8.4/8.5): bindgen hit a clang-14 emmintrin.h SSE2 bug on
  ubuntu-22.04. Install clang-15/libclang-15-dev and point bindgen at it via
  LIBCLANG_PATH; keep ubuntu-22.04 so the generic build stays glibc-2.35
  portable. aarch64 was unaffected (no x86 SSE header) and already passed.

- Lambda/Bref (all 4): dnf segfaulted inside the AL2023 Bref image under
  Docker's default seccomp profile. Run the build container with
  `--security-opt seccomp=unconfined`, install clang-devel for the libclang
  symlink, and set LIBCLANG_PATH=/usr/lib64.

Mirror the Bref docker fixes in docs/install.md's build-from-source snippet.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R3vgA3Q6PR9VQn8X5pLcMR

Author: claude

.cargo/config.toml

@@ -0,0 +1,7 @@
+# PHP extensions are loaded into the running PHP process, which already provides
+# the Zend/PHP symbols (zend_*, php_*). On macOS the linker rejects undefined
+# symbols by default, so a cdylib that references them fails to link. Tell the
+# linker to resolve those symbols dynamically at load time instead. (On Linux
+# this is the default behaviour, so no flag is needed there.)
+[target.'cfg(target_os = "macos")']
+rustflags = ["-C", "link-arg=-undefined", "-C", "link-arg=dynamic_lookup"]

.github/workflows/release.yml

@@ -42,8 +42,13 @@ jobs:
         env:
           phpts: nts
       - uses: dtolnay/rust-toolchain@1.96
-      - run: sudo apt-get update && sudo apt-get install -y clang libclang-dev
+      # ubuntu-22.04 (kept for glibc 2.35 portability) defaults to clang 14,
+      # whose emmintrin.h trips a bindgen SSE2 intrinsics bug when parsing the
+      # PHP headers on x86_64. clang 15+ fixes it; aarch64 never hits it.
+      - run: sudo apt-get update && sudo apt-get install -y clang-15 libclang-15-dev
       - run: cargo build --release
+        env:
+          LIBCLANG_PATH: /usr/lib/llvm-15/lib
       - name: Stage artifact
         run: |
           mkdir -p dist
@@ -79,15 +84,19 @@ jobs:
       # `container:`) so checkout/runner tooling stays on the host. The arm64
       # runner pulls the arm64 Bref image and builds an arm64 binary natively.
       - name: Build in Bref image (${{ matrix.image }})
+        # --security-opt seccomp=unconfined: AL2023's rpm/dnf segfaults under
+        # Docker's default seccomp profile, so relax it for the build container.
         run: |
-          docker run --rm -v "$PWD":/src --entrypoint /bin/bash \
+          docker run --rm --security-opt seccomp=unconfined \
+            -v "$PWD":/src --entrypoint /bin/bash \
             "${{ matrix.image }}" -lc '
               set -euo pipefail
-              dnf install -y clang
+              dnf install -y clang clang-devel
               curl --proto "=https" --tlsv1.2 -sSf https://sh.rustup.rs \
                 | sh -s -- -y --default-toolchain none
               export PATH="$HOME/.cargo/bin:/opt/bin:$PATH"
               export CARGO_TARGET_DIR=/tmp/target
+              export LIBCLANG_PATH=/usr/lib64
               cd /src
               cargo build --release          # rust-toolchain.toml pins the version
               mkdir -p dist

docs/install.md

@@ -96,10 +96,14 @@ links against Amazon Linux's glibc. Use `bref/build-php-8x` for x86_64 and
 `bref/arm-build-php-8x` for arm64 (and the matching PHP version):
 
 ```sh
-docker run --rm -v "$PWD":/src --entrypoint /bin/bash bref/build-php-84 -lc '
-  dnf install -y clang
+# --security-opt seccomp=unconfined: AL2023's dnf segfaults under Docker's
+# default seccomp profile.
+docker run --rm --security-opt seccomp=unconfined \
+  -v "$PWD":/src --entrypoint /bin/bash bref/build-php-84 -lc '
+  dnf install -y clang clang-devel
   curl --proto "=https" -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain none
   export PATH="$HOME/.cargo/bin:/opt/bin:$PATH" CARGO_TARGET_DIR=/tmp/target
+  export LIBCLANG_PATH=/usr/lib64
   cd /src && cargo build --release
   cp /tmp/target/release/libphp_quickjs.so /src/quickjs.so
 '